provident-storeroom 1.3.0 → 1.4.0

package/src/entry/constraints.mjs

@@ -19,7 +19,15 @@ import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver,
 // function the pass appends with — rather than pushed here with a member set of its own; the REFUSAL's own
 // list keeps its five members and no `seq`, because no attempt stands at the judgement that built it
 // (`D-41` item 4). Two records, two honest forms, one append.
-import { append, externalCall, kernelFor } from './kernel-foundations.mjs';
+import { append, externalCall, kernelFor, throwableForm } from './kernel-foundations.mjs';
+// **⟶ AND THE TWO KERNEL ACTS THE DELETE'S PATH OWES — `D-55` ITEM 3, 2026-10-29.** The kernel's public
+// barrel (`src/constraint-kernel.mjs`) is untouched and keeps its five names; **these are two PART modules' own
+// acts, reached here the way `append` and `kernelFor` above are** (`kernel-surface.md §1` item 1's empty import
+// footprint is the kernel's side of this edge and it is unmoved: neither module imports this file or any entry
+// module). `commitRemoval` is the commit part's remove-shaped act — a delete-shaped attempt that lands no write
+// — and `runAttempt` is the ONE pass, taken verbatim so no second pass loop is minted for a delete.
+import { commitRemoval } from './kernel-commit.mjs';
+import { runAttempt } from './kernel-attempt.mjs';
 // **⟶ AND THE CARRIERS, ADDED 2026-10-26 FOR THE REFUSAL'S OWN UNDOING (`DEF-W`'s `(a)`).** The
 // compensating act below reaches the store's own verb at its entry, with the SAME carrier forms every member
 // hands it (`carrier.mjs` is the boundary's one encoder for the three positions and imports nothing of this
@@ -489,7 +497,11 @@ export function registrationCrossing(refusal) {
   // is the caller's own value and is answered as it was thrown.
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried, refusal);
+    // **`false` — THE REGISTRATION INSTANT RECORDS NOTHING, AND THE CLAUSE SAYS SO.** No attempt stands at
+    // this evaluation, so the crossing's `log` is `surface.md §2.5` item 4's declared `[]` (`DEF-S`'s own cell
+    // reads it) and no terminal entry exists to carry the throwable's form: the crossed sentence must not
+    // point at a log that does not hold it (`DEF-AK`, 2026-10-28).
+    const converted = bodyThrowRefusal(carried, refusal, false);
     if (converted !== null) throw converted;
   }
   if (isKernelBuiltRefusal(refusal) === false) throw refusal;
@@ -829,6 +841,140 @@ export function constraintWrite(state, instance, address, tier, value) {
   };
 }
 
+/**
+ * **⟶ ADDED 2026-10-29 — THE DELETE'S OWN KERNEL-DRIVEN PATH: A DELETE-SHAPED ATTEMPT, A PASS, AND THE
+ * TERMINAL ENTRY. `D-55` ITEM 3, `DEF-X`, THE ARCHITECT, VERBATIM: *"A delete is an editing verb and must pass
+ * constraints. This includes all of the relevant commit and message logic."***
+ *
+ * **WHAT WAS MEASURED AT `1.3.0`, AND IT IS WHY THIS FUNCTION EXISTS.** `delete` opened its own commit window
+ * and called the addon's `delete` directly: **no `K-2`, no `K-3`, no log, no terminal entry** — so a delete
+ * consulted no constraint at all, and **the only pass shape the artefact had LANDS A WRITE FIRST** (`K-2`'s
+ * store leg called `write`, so the pass it ran judged a state the delete was not in; measured `storeAfter =
+ * {"c":2}`). **A delete therefore needed an attempt of its OWN KIND rather than a re-used `K-2`.**
+ *
+ * **THE THREE STAGES, IN THE ONE ORDER `constraintWrite` TAKES ITS OWN** (`surface.md §2.12` item 1):
+ * ```
+ *   1. the delete-shaped attempt   `kernel.commitRemoval` — the hold, the commit's log, the delete's op
+ *                                  named as the attempt's landing; NO WRITE IS LANDED
+ *   2. the store's own leg        the thunk the entry hands: the addon's `delete`, crossed by `index.mjs`
+ *   3. the pass                   `kernel.runAttempt` — every pair standing at THE DELETE'S OWN ADDRESS is
+ *                                  asked against THE STATE THE DELETE LEFT (its after-state is absence)
+ *   4. the terminal act           the attempt's ONE `outcome` entry on the refusing arm, its `commit` entry
+ *                                  on the passing arm, and on a refusal the composition that undoes the
+ *                                  delete (`D-55` item 5's safe state)
+ * ```
+ * **THE PASS IS THE WRITE'S PASS, MEMBER FOR MEMBER** — `runAttempt`, the same evaluated set, the same `D-39`
+ * registration order, the same repair and re-run arms, the same restart drain — and **the ONLY difference is the
+ * landing it judges**: a delete's journal op, whose `after` is absence, instead of a write's op whose `after` is
+ * the value it landed. **NO SECOND PASS LOOP IS MINTED**, and a repair landed under a delete's pass re-runs the
+ * same evaluation against ITS op (`D-53`: repairs use the same commit).
+ *
+ * **⟶ AND "THE SAME EVALUATED SET" IS NOW A PREFIX SET, 2026-10-29 — `D-56`, WHICH SUPERSEDES THE CLAUSE THIS
+ * PARAGRAPH PRINTED.** `RCA-8(g)` ANNOTATE-BESIDE: **the bytes that stood here read** *"the same evaluated set
+ * (the pairs whose own address IS the attempt's, `pairsAtAddress`'s exact-address rule and never the trigger set's
+ * prefix widening)"*, **and they are read THROUGH the architect's sentence**: *"A listener/constraint should fire
+ * when the descendants of its targeted address node change, because the descendants become part of the object
+ * that is read from that address"*. **SO THE DELETE'S PASS ASKS THE PAIRS AT OR ABOVE THE DELETE'S ADDRESS** —
+ * the pairs whose own address is a PREFIX of it — **and a pair at `['tabs']` is asked for a delete at
+ * `['tabs','landingPage']`** (`strata/decisions.md` · `D-56`). **THE SET IS STILL `pairsAtAddress`'s ONE
+ * FUNCTION AND STILL ONE SNAPSHOT** (`CX-12`): `D-56` moves WHICH rows are members and nothing about WHEN the
+ * list is materialised, HOW it is ordered (`HL-8` item 6: first-registration order, ancestors interleaved into
+ * that one order) or how many times a row is asked.
+ *
+ * **A REFUSAL IS THE ORDINARY REFUSAL** (`constraintCrossing` below): the surface's one plain form
+ * `{status, message, log}`, its `status` the set's rank-`20` member `ConstraintPassRefused`, and its `log` the
+ * COMMIT'S OWN LIST — `constraint-check` for the pair that refused, then the terminal `outcome` entry whose
+ * `state` is the kernel's token — each with its `seq`. **AND THE SAFE STATE IS `D-55` ITEM 5's**: the
+ * composition the terminal act runs (`composeRollback`, one floor call per address at that address's first owed
+ * op) undoes **the delete and every edit the commit made under it**, so the caller meets a store back at the
+ * state the commit opened at. Where the refusal is a RESTARTED check's (`D-42`, a reversal raised by a body
+ * inside this pass), the compensation is the reversal's own and it restores the journal mark the commit cached
+ * at ITS OPENING (`state.mjs`'s `windowMark`) — the same safe state by the other route.
+ *
+ * **`D-3`'S NO-OP ARM IS NOT AN EDIT**: where the delete removed nothing there is no journal op, so
+ * `commitRemoval` answers `null`, **no attempt is opened, no pass runs and no entry is appended** — there is no
+ * state for a pair to refuse and nothing for the safe-state rule to undo. The record crosses as it always did.
+ *
+ * **THE DELIVERY IS THE TERMINAL ARM'S FROM 2026-10-29, AND IT IS WHY THE PASS IS HANDED THE `CommitRecord`
+ * (`D-55` item 3's third demand: a listener fired by a delete sees the JUDGED state, and a refused delete
+ * delivers nothing, its commit having been undone).** `commitRemoval` now mints the record the pass's terminal
+ * arm is keyed by, and `runAttempt` reaches that arm with it (`settleArm` → the entry's `TERMINAL_ARM`), so the
+ * residue `record.pending` — the delete's returned set MINUS the handles its own pass checked off — is
+ * delivered at the arm, after the judgement, exactly as a write's is. **A REFUSED DELETE STILL DELIVERS
+ * NOTHING**: the failing arm reaches the same seam with the residue the discard emptied (`terminal`).
+ *
+ * **AND THE RECORD IS HANDED TO THE CONSUMER ON THE RECEIPT, UNDER THE `D-49` DEVICE.** `DeleteRecord` keeps
+ * its enumerable members; `commit` is a NON-ENUMERABLE own `data` property, visible by its name and declared in
+ * `index.d.ts`, exactly as `discarded` is — so the record a delete minted can be held (`receipt.commit`) and
+ * handed back (`K-4`/`K-5` take its `attempt`; a nested `write` takes the record itself at its fourth
+ * position). **`null` IS THE `D-3` ARM'S VALUE**: no attempt was opened there, so there is no record to carry.
+ */
+export function constraintDelete(instance, address, tier, remove) {
+  // THE DELETE-SHAPED ATTEMPT, OPENED AROUND THE STORE'S OWN LEG: `remove` is the addon's `delete`, already
+  // crossed by the entry, and it is invoked with the hold taken and the commit's list in hand. `null` is the
+  // `D-3` arm (nothing removed) — the receipt the thunk answered stands and nothing is judged.
+  let receipt = null;
+  let attempt;
+  try {
+    attempt = commitRemoval(instance, address, tier, () => {
+      receipt = remove();
+      return receipt;
+    });
+  } catch (refusal) {
+    // THE KERNEL'S OWN `KC-7` (a held address, before the store is reached) or the store's own refusal: the
+    // ONE crossing every kernel-driven path takes, so a nested delete at a live attempt's address answers the
+    // same rank-`20` form a write does and a store refusal crosses verbatim (`§2.5` item 10 (ii)).
+    constraintCrossing(refusal);
+  }
+  // **THE `D-3` ARM CARRIES ITS `null`** — no attempt, so no record, and the member is present rather than
+  // absent (`D-21`: a member whose act did not run says so).
+  if (attempt === null) {
+    exposeCommit(receipt, null);
+    return receipt;
+  }
+  // THE PASS, INSIDE THE COMMIT THE MEMBER OPENED (`D-44`): `runAttempt` names THE RECORD `commitRemoval`
+  // minted (`attempt.record` — the same object `K-2` hands `K-3`), so its scope JOINS — the delete's window is
+  // the pass's window, and the pairs standing at THIS address are asked against the delete's own op. **THE
+  // TERMINAL ARM IS REACHED WITH THAT RECORD AND NOTHING ELSE** (`settleArm`), so the delivery and the
+  // `file`-tier save are the record's own facts. A failing pass throws the kernel's own refusal with its log
+  // and its compensating act already taken.
+  let report;
+  try {
+    report = runAttempt(instance, attempt.record);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  // **AND THE RESTART'S REFUSAL, WHERE THE PASS ITSELF PASSED** (`D-42`; `D-54` (b)): a reversal raised by a
+  // body inside this pass is drained at the pass's terminal state, and where the restarted check refused, the
+  // refusal the report carries is the one that crosses — the delete is refused with the store already restored
+  // to the mark the commit cached at its opening. THE PASSING DELETE FINDS NO CARRIED REFUSAL AND RETURNS ITS
+  // RECEIPT UNCHANGED.
+  const restarted = report !== null && typeof report === 'object' ? report[RESTART_REFUSAL] : undefined;
+  if (restarted !== undefined) {
+    constraintCrossing(restarted);
+  }
+  exposeCommit(receipt, attempt.record);
+  return receipt;
+}
+
+/// **THE RECORD ON THE RECEIPT — A NON-ENUMERABLE OWN `data` PROPERTY, THE DEVICE `D-49` DECLARED.**
+///
+/// `Object.keys(receipt)`, every deep-equality over a receipt and every census of its ENUMERABLE members read
+/// exactly what they read before, while a caller reads the commit **by its name** (`receipt.commit`) and
+/// `index.d.ts` declares it. **IT IS A `data` PROPERTY AND NOT AN ACCESSOR**: a getter would run caller-side
+/// code on a read, which is the read half `D-35` closes everywhere else. **A RECEIPT THAT ALREADY CARRIES ONE**
+/// — the thunk answers the store's own object and this entry owns it — takes the value it was handed, and the
+/// member is defined on every arm so its presence never depends on the arm.
+function exposeCommit(receipt, record) {
+  if (receipt === null || typeof receipt !== 'object') return;
+  Object.defineProperty(receipt, 'commit', {
+    value: record === undefined ? null : record,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
+}
+
 /// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
 /// STORE'S — AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16** (`surface.md §2.5`'s clause of that
 /// date, items 3–4 and 10 (i)–(iii); `docs/specs/storeroom-js/surface.md §2.12` item 1's mark of the same date).
@@ -1111,7 +1257,7 @@ function innerRefusalCarried(value) {
 /// **A TREE THAT CARRIES NO USABLE GENERATOR ANSWERS `null`**, and both crossings then re-throw the marked
 /// value AS ITSELF — the same safe direction `registrationCrossing` takes for a kernel refusal, and no
 /// sentence is authored here.
-function bodyThrowRefusal(carried, thrown) {
+function bodyThrowRefusal(carried, thrown, recorded) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') return null;
   const subject = typeof carried.address === 'string' ? carried.address : '';
@@ -1130,6 +1276,22 @@ function bodyThrowRefusal(carried, thrown) {
       + `ITSELF a refusal, ${JSON.stringify(innerStatus)} with the message ${JSON.stringify(innerSaid)}, and it `
       + `crosses BESIDE this one under Symbol.for('provident-storeroom.inner-refusal') with its own log — the `
       + `generated sentence above names the CODE for a body that threw and not the value the body threw`;
+  } else {
+    // **⟶ AND THE PLAIN THROWABLE'S SENTENCE STOPS CLAIMING A CROSSING IT DOES NOT MAKE — `D-55` ITEM 1,
+    // `DEF-AK`, 2026-10-28.** The generated sentence's own bytes are *"a constraint body's throwable crosses
+    // as this refusal"*, and the throwable DOES NOT: it is not carried, its members are not merged and its
+    // identity is not handed on. **WHAT DOES CROSS IS ITS MESSAGE, IN THE COMMIT'S LOG** — the terminal arm of
+    // the attempt that caught it put the form the value took (the string's own text, the object's own
+    // `message` member, or the kind of value it was) in the ONE entry the arm appends. **`recorded` IS THAT
+    // FACT, SAID BY THE CROSSING THAT CALLED THIS FRAME** (`constraintCrossing` reads the arm that records it;
+    // `registrationCrossing` and the judgement do not), **so no arm points at a `log` that does not carry it**:
+    // where the arm records nothing the clause says so and names the declared `[]` (`surface.md §2.5` item 4).
+    const where = recorded === true
+      ? `the form the throwable took stands in the \`outcome\` entry of this refusal's \`log\`, which is where `
+        + `a throwable's own message crosses`
+      : `no entry of this failure's \`log\` records it — \`log\` is the declared empty list where no attempt `
+        + `stands (surface.md §2.5 item 4) — so nothing of the value crosses`;
+    generated = `${generated} — the value the constraint body threw does NOT cross as this refusal: ${where}`;
   }
   const crossed = {
     status: BODY_THREW_STATUS,
@@ -1159,7 +1321,10 @@ function constraintCrossing(refusal) {
   // `{status, message}` AND NO MARK STILL CROSSES AS ITSELF, BELOW.**
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried, refusal);
+    // **`true` — THIS IS THE LANDING'S OWN CROSSING, AND ITS TERMINAL ARM RECORDS THE THROWABLE'S FORM**
+    // (`kernel-attempt.mjs`'s `evaluate`: the attempt closes with ONE `outcome` entry whose sentence carries
+    // `throwableForm(body)`), so the crossed sentence may point at it and `DEF-AK`'s log entry exists.
+    const converted = bodyThrowRefusal(carried, refusal, true);
     if (converted !== null) throw converted;
   }
   const isObject = refusal !== null && typeof refusal === 'object';
@@ -1494,6 +1659,23 @@ const COMPENSATING = Symbol.for('provident-storeroom.compensating-rollback');
 /// first address, which is a fact about registration order and not about the check.
 const ASKING = new WeakMap();
 
+/// **⟶ THE VALUE A BODY THREW, CARRIED FROM THE FRAME THAT CAUGHT IT TO THE ENTRY THAT MUST PRINT IT, ADDED
+/// 2026-10-28 — `D-55` ITEM 1, `DEF-AK`, MEASURED.**
+///
+/// **THE WINDOW IT CLOSES.** A pair body that throws at a reversal's judgement is caught by `reversalOutcome`,
+/// which converts it to the surface's rank-`18` form; `judgeReversal` then catches that and builds the refusal
+/// whose ONE log entry names the throwing pair. **NOTHING OF THE THROWABLE REACHED ANY RECORD**: the crossed
+/// sentence said *"a constraint body's throwable crosses as this refusal"* and the log carried only the pair's
+/// name. **D-55's clarification (the architect, verbatim: *"Include a thrown message in the message log.
+/// Obviously."*) makes the message a log entry's own business**, and no attempt log stands at this judgement —
+/// so the form travels here, from the catch frame to `reversalRefusal`'s entry sentence.
+///
+/// **A `WeakMap` KEYED BY THE CONVERTED FORM AND NOTHING ELSE** (`D-30`'s device, `D-46`): the form's three
+/// declared members are unmoved, no symbol is spelled on a value a caller holds, and the record dies with the
+/// value. **A TREE WITH NO USABLE GENERATOR IS NOT CONVERTED**, so its raw value reaches `reversalRefusal` and
+/// that frame spells the form itself (`throwableForm`) — the map answers nothing and nothing is invented.
+const THROWN_FORM = new WeakMap();
+
 /// **HOW MANY RESTARTS ONE PASS'S COMMIT SCOPE MAY TAKE** — the bound `drainRestartRequests` spends. Three is
 /// the declared figure: two fewer than any arm of this package's own batteries drives, and enough that a lawful
 /// in-commit action's single restart never meets it.
@@ -1690,6 +1872,17 @@ export function witnessDiscardedReversal(instance, window) {
   }
   // THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED — `null` where the reversal's call answered no id (the
   // request stands and the act's answer did not reach the echo, which is a real arm a caller can see).
+  //
+  // **⟶ AND AN ENTRY IS NEVER SHIPPED WITH AN EMPTY ADDRESS LIST — `D-55` ITEM 2, `DEF-AH`, 2026-10-28.**
+  // The architect, verbatim: *"A witness address of [] corresponds to the register itself. This is not a legal
+  // response for any other watched address."* **SO `[]` IS THE REGISTER (THE ROOT) AND IS AN ADDRESS, NEVER A
+  // LIST**: a request whose reversal moved NOTHING has no discard to report — there is no legal response to
+  // give it — so **the entry is ABSENT (`null`) rather than empty**, and the caller reads `discarded: []`
+  // because nothing was discarded *observably*. **AND THE ROOT STAYS DISTINGUISHABLE**: an address that IS
+  // `[]` is one element of `addresses` — `[[]]` — which is length `1` and therefore survives this test; the
+  // distinction the ruling draws is between an ADDRESS of `[]` and a LIST of `[]`, and this is the one line
+  // where it is measured.
+  if (addresses.length === 0) return null;
   return {
     opId: typeof request.reversalId === 'string' ? request.reversalId : null,
     addresses,
@@ -1823,13 +2016,55 @@ export function reversalWatch(state, instance) {
     // judgement — a listener's own window is the measured arm), and the arm past the budget then says so
     // rather than naming a pair it cannot know.
     const asking = ASKING.get(instance);
-    restartRecord(instance).pending = {
-      watched: watchStanding(state, instance),
+    const window = currentWindow(instance);
+    // **⟶ AND A SECOND RAISE IN THE SAME COMMIT MERGES INTO THE REQUEST RATHER THAN REPLACING IT — `D-55`
+    // ITEM 6's SECOND HALF, `DEF-AP`, 2026-10-28, MEASURED.** **WHAT WAS MEASURED:** two listeners each
+    // reversing inside ONE commit — two raises in one window — left only the LAST raise judged; the earlier
+    // listener's own violation was asked **zero** times, registration order decided which raise was lost, and
+    // when the survivor's judgement passed the write returned normally **with the violation standing**. **THE
+    // ROW'S OWN ESCAPE — declare that an overwritten raise may leave a violation unjudged — IS UNAVAILABLE**,
+    // because `DEF-AN`'s safe-state rule is the promise: a refused edit undoes the WHOLE commit.
+    // **SO THE DRAIN JUDGES THE STATE THE COMMIT STANDS AT, NOT THE REQUEST THAT HAPPENED TO SURVIVE**: the
+    // request's captures are merged to the EARLIEST reading of each address — the state the commit opened at —
+    // so `movedStanding` at the drain sees every address the WHOLE commit moved, whichever raise named it.
+    // **THE WALK'S ORDER AND MEMBERSHIP STAY THE REGISTRY'S** (`watchStanding`'s `D-39` order, re-read now):
+    // an address this raise's walk carries takes the earlier capture where one exists, and an address the
+    // earlier watch carried but the registry no longer does leaves the debt record (it is not the check's
+    // subject now). **THE LATEST RAISE KEEPS ITS OWN ASK AND ITS `moved` IS RE-MEASURED**; the `reversalId`
+    // stays the first echo it recorded (`judgeReversal`'s in-flight arm sets it once), so the entry a refusal
+    // names is never re-spelled.
+    const next = watchStanding(state, instance);
+    const record = restartRecord(instance);
+    const prior = record.pending;
+    if (prior !== null && prior.window === window) {
+      const merged = [];
+      for (let index = 0; index < next.length; index += 1) {
+        const one = next[index];
+        const spelling = homeAddressKey(one.address);
+        let earlier = null;
+        for (let known = 0; known < prior.watched.length; known += 1) {
+          if (homeAddressKey(prior.watched[known].address) === spelling) {
+            earlier = prior.watched[known];
+            break;
+          }
+        }
+        appendOwn(merged, earlier === null ? one : earlier);
+      }
+      prior.watched = merged;
+      // THE MOVED SET IS RE-MEASURED AGAINST THE MERGED CAPTURES (`judgeReversal`'s in-flight arm does it at
+      // the reversal's own instant, one frame below this call) — a set measured against the later watch would
+      // hide the earlier raise's movement, which is the defect this merge closes.
+      prior.moved = null;
+      prior.asked = asking === undefined ? prior.asked : asking;
+      return watched;
+    }
+    record.pending = {
+      watched: next,
       // **AND THE MOVED SET IS MEASURED BY THE JUDGEMENT, NOT BY THE WATCH** (`judgeReversal`'s in-flight arm;
       // `DEF-AM`): the watch is taken BEFORE the reversal runs, so what moved is not knowable here.
       moved: null,
       reversalId: null,
-      window: currentWindow(instance),
+      window,
       asked: asking === undefined ? null : asking,
     };
     return watched;
@@ -2498,7 +2733,18 @@ function reversalOutcome(instance, entry, address, value) {
     // **⟶ AND THE BODY'S OWN VALUE IS HANDED IN, 2026-10-28 (`DEF-AK`)**: `bodyThrowRefusal` carries an inner
     // refusal beside the crossed one and names it in the crossed sentence, and the value the body threw is
     // the only place that refusal stands.
-    const converted = bodyThrowRefusal(carried, body);
+    //
+    // **⟶ AND ITS FORM IS TAKEN HERE, 2026-10-28 — `D-55` ITEM 1, `DEF-AK`.** No attempt stands at a reversal's
+    // judgement, so there is no terminal entry for the kernel to record it in: **the judgement's own refusal
+    // list is the log this failure crosses with**, and its ONE entry carries the form the body threw
+    // (`reversalRefusal` reads it off this `WeakMap`). **A `WeakMap` AND NOT A MEMBER**: the converted form's
+    // three members are unmoved and nothing is added to any record (`A117` (D6)).
+    const form = throwableForm(body);
+    // **`false` — NO ATTEMPT LOG STANDS AT A JUDGEMENT, AND THIS FRAME'S OWN LIST KEEPS ITS ONE ENTRY**: the
+    // form the body threw is carried through `THROWN_FORM` and printed in that entry's sentence by
+    // `reversalRefusal`, so the crossed sentence points at the `log` it actually carries (`DEF-AK`).
+    const converted = bodyThrowRefusal(carried, body, false);
+    if (converted !== null && typeof converted === 'object') THROWN_FORM.set(converted, form);
     throw converted === null ? body : converted;
   }
 }
@@ -2615,8 +2861,18 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
       + (said === null ? '' : ` — ${said}`)
       + ` — ${undoSpelling(undo)}`;
   } else {
+    // **⟶ AND THE THROWABLE'S OWN FORM IS PRINTED IN THIS ENTRY — `D-55` ITEM 1, `DEF-AK`, 2026-10-28.** No
+    // attempt stands at a reversal's judgement, so no commit log exists for the kernel to append to: **this
+    // refusal's ONE entry is the log the failure crosses with**, so the value the body threw is named HERE —
+    // the form the catch frame took (`THROWN_FORM`) where the value was converted, and the value's own form
+    // where the tree carried no generator to convert it. **THE ENTRY'S SHAPE, KIND, `seq` AND MEMBER COUNT DO
+    // NOT MOVE**: the form is in the sentence, not in a seventh member and not in a second entry (`D-41` item
+    // `4`'s one-entry arm, which the restoration's cell asserts).
+    const took = THROWN_FORM.get(thrown);
+    const form = typeof took === 'string' ? took : throwableForm(thrown);
     spelled = `the constraint ${one.entry.id} THREW at the judgement of the state the reversal left at `
       + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
+      + ` — the value it threw was ${form}`
       + ` — ${undoSpelling(undo)}`;
   }
   const entry = {

package/src/entry/delivery.mjs

@@ -600,9 +600,17 @@ export function terminalArm(state, record) {
   const triggeringAddress = answer === null || answer === undefined || answer.op === null || answer.op === undefined
     ? undefined
     : answer.op.address;
-  // `deliver` is THE SAME loop the post-verb window uses (`docs/specs/storeroom-js/surface.md §2.4` rules 1–3 read once, at both instants): ONE
-  // invocation per DISTINCT handle, and a handle with no registered function fires nothing silently.
-  deliver(state, triggered, triggeringAddress);
+  // **⟶ AND THE ARM PERFORMS THE DELIVERY FOR A KERNEL-DRIVEN WRITE AND FOR NO OTHER ACT — 2026-10-29.** A
+  // `delete`'s delivery is its OWN MEMBER's (`D-49` declares that window the one whose check never ran, and a
+  // request raised there is the witness's and not a pass's); the record is the delete's, so this arm is
+  // reached for it — the `file`-tier save above is the arm's act on BOTH — and the residue's delivery is the
+  // member's. **THE FACT IS THE PACKAGE'S OWN STATE AND NEVER A MEMBER OF ANY RECORD**, and it is `'arm'` on
+  // every path that does not name another, so a write's delivery is exactly where it was.
+  if (state.legDelivery !== 'member') {
+    // `deliver` is THE SAME loop the post-verb window uses (`docs/specs/storeroom-js/surface.md §2.4` rules 1–3 read once, at both instants): ONE
+    // invocation per DISTINCT handle, and a handle with no registered function fires nothing silently.
+    deliver(state, triggered, triggeringAddress);
+  }
   return undefined;
 }
 

package/src/entry/kernel-attempt.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, enterCommitFrame, leaveCommitFrame } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, throwableForm, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, enterCommitFrame, leaveCommitFrame, commitLogInFlight, sealHandoff } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close } from './kernel-terminal.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-3` `runAttempt(store, commit) -> AttemptReport`
@@ -160,7 +160,12 @@ export function runAttempt(store, commitRecord) {
     } catch (thrown) {
       return drainFailingPass(store, commitRecord, thrown);
     }
-    return drainRestart(store, report);
+    // **⟶ AND THE RECORD IS SEALED AT THE HANDOFF — `D-55` item 6, `DEF-AO`, 2026-10-28.** The drain above is
+    // the LAST act of closing out (it amends the report's own `outcome` and appends the refusal's entry to the
+    // report's list BEFORE this line), so what the seal freezes is the record the driver receives and no record
+    // in flight: `report.log` and the report are `Object.freeze`d, and a later act can neither append to the
+    // commit's list nor re-member the report. **A PASSING ARM IS SEALED TOO** — its list is handed off once.
+    return sealHandoff(drainRestart(store, report), commitLogInFlight(kernelFor(store)) !== null);
   }, commitRecord);
 }
 
@@ -182,6 +187,11 @@ function drainFailingPass(store, commitRecord, thrown) {
   const closed = kernelFor(store).closed.get(commitAttemptIdOf(commitRecord));
   if (closed === undefined) throw thrown;
   const answered = drainRestart(store, closed);
+  // **⟶ THE FAILING ARM'S RECORD IS SEALED AT ITS OWN HANDOFF — `DEF-AO`.** The drain has already amended the
+  // closed report if the restarted check refused, so the seal stands before this arm picks which value crosses:
+  // the restarted refusal and the pass's own throwable both carry the SAME frozen list (`D-53`), and neither
+  // can be appended to after this line.
+  sealHandoff(answered, commitLogInFlight(kernelFor(store)) !== null);
   const restarted = answered !== null && typeof answered === 'object' ? answered[RESTART_REFUSAL] : undefined;
   if (restarted !== undefined && isKernelRefusal(thrown) === true) throw restarted;
   throw thrown;
@@ -445,14 +455,35 @@ function evaluate(kernel, attempt, landing) {
   // alike — and NOT the union of the store's prefix-selected addresses"), WHILE THE OP EVERY EVALUATION
   // CARRIES IS THE LANDING'S OWN — the repair's op where a repair's edit landed, and the attempt's first
   // write where the pass is the commit's own landing.
-  // THE PASS'S OWN EVALUATED SET IS FIXED WHEN THE PASS BEGINS — a SNAPSHOT of the registry's rows for
+  // **⟶ AND THE SET THAT ADDRESS MATERIALISES IS NOW A PREFIX SET, 2026-10-29 (`D-56`).** `RCA-8(g)`
+  // ANNOTATE-BESIDE: **the quotation above stands BYTE-FOR-BYTE as `attempt-lifecycle.md §2.4` item 5 (iv)'s
+  // EXACT-ADDRESS rule — the clause `D-56` names by number and SUPERSEDES**; the architect's own sentence is
+  // *"A listener/constraint should fire when the descendants of its targeted address node change, because the
+  // descendants become part of the object that is read from that address"*, and what it changes here is the
+  // PREDICATE `pairsAtAddress` applies — **the pairs whose own address is a PREFIX of the attempt's, equality
+  // included.** **NO OTHER LINE OF THIS FRAME MOVES**: the address is still the attempt's, the landing's op is
+  // still what every evaluation carries, and the set is still ONE SNAPSHOT taken at this instant.
+  // THE PASS'S OWN EVALUATED SET IS FIXED WHEN THE PASS BEGINS — a SNAPSHOT of the registry's rows AT OR ABOVE
   // the attempt's address AT THAT INSTANT, and never a live view of the registry this pass reads again:
   // "a PASS's evaluated set is FIXED WHEN THE PASS BEGINS — it is every pair registered at the attempt's
   // address AT THAT INSTANT, each evaluated once in clause (ii)'s order", so "A `K-1` THAT RETURNS
   // DURING A PASS APPENDS A PAIR TO THE REGISTRY WITHOUT APPENDING ANY ENTRY TO THAT PASS AND WITHOUT
   // BEING EVALUATED BY IT: the new pair enters the NEXT pass's set" (`attempt-lifecycle.md §2.4` item 5
-  // (iv); `CX-12`). The snapshot is ALSO the set the layer (a) delivery of this run is read over.
+  // (iv); `CX-12`, which `D-56` defers to and does NOT move). **THE SNAPSHOT IS MATERIALISED ONCE PER RUN AND
+  // READ BY THE WHOLE RUN** — the loop below, the repair arm's `list` and `releasePending`'s check-off all read
+  // THIS ONE array — **and it is ALSO the set the layer (a) delivery of this run is read over.**
   const list = pairsAtAddress(kernel, attempt.address);
+  // **⟶ AND THE COMMIT THE INVOCATIONS OF THIS RUN NAME — `D-55` ITEM 3's DELETE-SHAPED ATTEMPT, 2026-10-29.**
+  // **A WRITE'S ATTEMPT NAMES ITS `CommitRecord`** (`attempt.record`, the object `K-2` built and adopted), and
+  // every verb a body calls under it JOINS that commit (`D-46`). **A DELETE'S ATTEMPT HAS NO `CommitRecord`** —
+  // it lands no write, so there is no adoption, no residue and no save — **and it still owes the same
+  // invariant**: `D-53`'s *"Constraints/Repairs should always use the same commit"* is not a rule about records
+  // but about the COMMIT, and a body's write under a delete's pass that named nothing would OPEN a second commit
+  // and start a second list. **SO THE ATTEMPT CARRIES ITS COMMIT'S NAME** (`kernel-commit.mjs`'s
+  // `commitRemoval` sets `attempt.name` to the one member `commitAttemptIdOf` reads) **and this frame hands THE
+  // NAME where a record exists and THE RECORD where it does** — one expression, and on the write path it is the
+  // very object it always was, so no byte of the write's own invocation moves.
+  const commitName = attempt.record === undefined ? attempt.name : attempt.record;
   // THE ATOMIC LANDING EVALUATION'S OWN ARM-TAKING IS `attempt-lifecycle.md §2.4` item 4's arms, read
   // over THE PAIR THAT FAILED AT THAT OP (`kernel-surface.md §2.3` item 1; `§2.4`: `KC-3` where that pair
   // is NOT in `ran` before this run and no repair is registered for it; `KC-6` where it IS in `ran` and
@@ -503,12 +534,22 @@ function evaluate(kernel, attempt, landing) {
         // does.** The name is an INVOCATION's and nothing else's: it is set before the call and restored after it,
         // on the throwing arm too, so an ordinary write still opens ONE commit and a callback's verb is still an
         // act of its own.
-        outcome = constraintInCommit(attempt.store, attempt.record, () => pair.constraint(context));
+        outcome = constraintInCommit(attempt.store, commitName, () => pair.constraint(context));
       } catch (body) {
         // A body that threw returned nothing, so no `constraint-check` entry stands and the attempt is
         // closed (`PAR-C-6`; `NX-2`; `composition-and-states.md §2.7` item 13).
         withdraw(attempt, check);
-        terminalComposed(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed`);
+        // **⟶ AND THE THROWABLE'S OWN FORM ENTERS THE COMMIT'S LOG — `D-55` ITEM 1, `DEF-AK`, 2026-10-28.**
+        // The architect, verbatim: *"Include a thrown message in the message log. Obviously."* **THE ENTRY IS
+        // THE ONE THE TERMINAL ACT ALREADY APPENDS**: this arm closes the attempt with its ONE `outcome` entry
+        // (`composition-and-states.md §2.7` item 13), and NO second entry and NO fifth `kind` is minted —
+        // `constraint-check` was WITHDRAWN above and must not come back (`fail-surface.md §1.1` item 1 (b),
+        // which the kernel-level cells assert as *"NO entry stands for the pair whose body returned nothing"*).
+        // **SO THE TERMINAL ENTRY'S SENTENCE CARRIES THE FORM** (`throwableForm`: the string's own text, the
+        // object's own `message` member, or the kind of value it was, read off own members only), and the
+        // closed report's list — the list the crossing hands the caller — holds it at that entry's `seq`.
+        terminalComposed(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed — the `
+          + `value it threw was ${throwableForm(body)}`);
         // **⟶ AND THE VALUE IS MARKED HERE, BY THE FRAME THAT CAUGHT IT FROM THE BODY — `DEF-S`, 2026-10-26,
         // on the architect's ruling *"Expand the returned error set for both S/N"*.** The mark is what the
         // entry's `constraintCrossing` converts on, and an UNMARKED value still crosses as itself
@@ -644,7 +685,7 @@ function evaluate(kernel, attempt, landing) {
         // **⟶ AND THE FRAME STANDS FOR THIS INVOCATION TOO (`D-53`'s first invariant): the repair's own verbs
         // append to the attempt's list, and the frame is what makes `K-2` join rather than open.**
         enterCommitFrame(kernel, attempt.log);
-        result = repairInCommit(attempt.store, attempt.record, () => repair(repairContext));
+        result = repairInCommit(attempt.store, commitName, () => repair(repairContext));
       } catch (body) {
         // THE REPAIR-RUN ENTRY IS APPENDED BEFORE THE THROW, and the attempt's outcome entry carries
         // `KC-4` (`ck_states_a_repair_body_that_throws_reaches_the_caller_unconverted`).