provident-storeroom 1.3.0 → 1.4.0

package/src/entry/kernel-commit.mjs

@@ -188,3 +188,168 @@ export function commit(store, address, tier, value) {
   return record;
 }
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ ADDED 2026-10-29 — `commitRemoval`: THE DELETE-SHAPED COMMIT ACT. `D-55` ITEM 3, `DEF-X`.**
+//
+// **THE RULING, THE ARCHITECT, VERBATIM: *"A delete is an editing verb and must pass constraints. This includes
+// all of the relevant commit and message logic."*** (`strata/decisions.md` · `D-55` item `3`). **THE MEASURED
+// OBSTACLE IT ANSWERS WAS PRINTED, NOT ASSUMED**: a `delete` opens its own commit window and reaches the
+// addon's `delete` directly — **no `K-2`, no `K-3`, no log and no terminal entry** — and **the only pass shape
+// the artefact had (`K-2` then `K-3`) LANDS A WRITE FIRST** (`storeAfter = {"c":2}`), so any pass driven
+// through it judges a state the delete is not in. **SO THE DELETE GETS AN ATTEMPT OF ITS OWN KIND, AND THIS IS
+// IT** — the commit act's remove-shaped sibling, and NOT a re-used `K-2`.
+//
+// **IT OPENS LIKE ANY OTHER, AND THE TWO THINGS IT SHARES WITH `K-2` ARE THE TWO THAT MATTER:**
+//   * **`D-44` IS KEPT BY THE CALLER AND RE-CHECKED HERE**: the attempt is opened inside the delete's own
+//     commit window (the member opens it before this act is reached, `index.mjs`'s `delete`), so no check this
+//     pass runs stands outside one — and a store this package did not build carries no commit scope at all, so
+//     `runAttempt` fails closed exactly as it does for a write.
+//   * **`D-53` IS KEPT BY THE SAME READ `K-2` TAKES**: `commitLogInFlight` answers the enclosing invocation's
+//     list where this delete was called from caller code that BELONGS TO an attempt (a constraint body's
+//     `delete`, a repair's), and `null` at a consumer's own call. **ONE LIST PER COMMIT, AND A DELETE'S ENTRIES
+//     JOIN IT** — there is no second list and no merge.
+//
+// **WHAT IT DOES NOT DO IS LAND A WRITE.** `K-2` calls the store's `write`. **This act mints an `AttemptRecord`
+// of kind `delete` and calls THE STORE'S OWN LEG THE CALLER HANDS IT** — the addon's `delete`, already crossed
+// by the entry — so **the state the attempt is judged at is the state the delete LEFT and never a state a probe
+// wrote.** The act's own answer (`removal`) is the delete's declared receipt: its `op` is the DELETE's journal
+// op and so THE ATTEMPT'S ONE LANDING (`attempt.ops`), which is what the pass's context carries and what the
+// failing arm's composition rolls back; its `triggered` set is the store's own returned set, kept on
+// `attempt.write` for the terminal act's discard rule exactly as a failed write's is.
+//
+// **⟶ AND IT MINTS THE `CommitRecord` TOO, 2026-10-29 — THE FOUR MEMBERS, THE SYMBOL-KEYED LOG, AND THE ONE
+// IDENTITY THE WHOLE COMMIT'S MACHINERY IS KEYED BY.** The `DEF-X` build measured the four residuals this
+// closes and printed them; each is a `K-2` behaviour that follows from the record and from nothing else:
+//   * **ADOPTION** — the record is what `K-2` hands the store's own verb at its fourth position, and what the
+//     entry holds so that the TERMINAL ARM performs the delivery and the save. A delete has no fourth position
+//     (its declared arity is `delete(address, tier)`), so the entry adopts the record it holds the same way it
+//     adopts a write's: it stands the delete's own returned receipt in the leg slot the terminal arm reads
+//     (`index.mjs`'s `delete`), and the RECORD is what `settleArm` hands that arm.
+//   * **THE `pending` RESIDUE** — written exactly as `K-2` writes it: the returned set WHOLE at this instant,
+//     and a handle leaves it only by its own pair's check-off (`releasePending`) or by the failing arm's
+//     discard (`terminal`). **NO SIFT**: the delete's own returned set is carried, member for member.
+//   * **THE `file`-TIER SAVE** — the terminal arm's save is gated on the record this act mints
+//     (`SETTLED_ON_THE_PASSING_ARM`, placed by the passing arm) and on the leg the entry adopted, so a
+//     `file`-tier delete SAVES its own op exactly as a `file`-tier write saves its own.
+//   * **`K-4`/`K-5` BY REF** — the record carries `attempt`, the `AttemptRef` those two items accept, so the
+//     delete's log and report are answerable after a PASSING delete and not only from a refusal's log.
+// **THE RECORD'S FOUR MEMBERS AND ITS SYMBOL-KEYED LOG ARE `K-2`'S OWN, SPELLED THE SAME WAY**: the log is
+// defined with `Object.defineProperty` under `COMMIT_LOG` and is not a fifth member (`A117` (D6)), so a census
+// of any record moves by nothing.
+//
+// **THE `D-3` ARM IS KEPT AND A HELD ADDRESS IS JOINED RATHER THAN REFUSED** (the ground is printed at the act
+// itself and it is a measurement, not a preference: a repair has no fourth position to name its commit at, so
+// a `KC-7` here would make a lawful repair's `delete` unlawful):
+//   * **A REFUSED STORE VERB LEAVES NO ATTEMPT** (`D-3`'s neighbour): the addon's own refusal crosses back
+//     unchanged, and because the attempt is placed in `kernel.live` only AFTER the act answered an op, a
+//     refused delete holds nothing and closes nothing — `K-2`'s own rule, reached by the same structure.
+//   * **AND AN ACT THAT REMOVED NOTHING IS `D-3`'S SUCCESS WITH `tiers: []`**: no journal entry was appended,
+//     so there is no op, no landing to judge and no edit to undo — **this act answers `null`, the entry mints
+//     no pass, and nothing is added to any log.** A delete that changed nothing cannot be refused by a
+//     constraint, because it is not an edit. **NO `KC` TOKEN IS MINTED FOR IT AND NO TENTH TOKEN EXISTS.**
+//
+// **WHAT IT ANSWERS.** The attempt record, open and live — **carrying `attempt.record`, the `CommitRecord` this
+// act minted** — for the pass the caller runs next (`entry`'s `constraintDelete`), or `null` on the `D-3` arm.
+// **NO KERNEL ITEM IS MINTED**: `kernel-surface.md §1` item
+// `2` closes the kernel's EXPORT SET at the five `K-1`–`K-5` items and that barrel
+// (`src/constraint-kernel.mjs`) is untouched — this function is a part module's own act, reached by the entry
+// the way every other kernel part is, and it is named by no `K-` number.
+export function commitRemoval(store, address, tier, remove) {
+  const kernel = kernelFor(store);
+  // **NO `KC-7` REFUSAL IS TAKEN AT THIS OPENING, AND THE ASYMMETRY WITH `K-2` IS NAMED BECAUSE IT IS
+  // MEASURED.** `K-2` refuses a second attempt at a HELD address, and a REPAIR at that address is admitted only
+  // because it NAMES the enclosing commit at `write`'s fourth position (`D-46`). **A delete has no such
+  // position** — the member's arity is the declared `delete(address, tier)` and this pass changes no
+  // declaration — so a repair that edits by `delete` at the attempt's own address (the shape
+  // `tests/integration/js-constraints/constraint-kernel-negatives.test.mjs`'s `P-NEG-22` drives, and
+  // `parameter-semantics.md §2.7` blesses) would be refused by a hold it had no way to name its way out of,
+  // and a lawful repair would stop being lawful. **SO THIS ACT REFUSES NOTHING ON THAT GROUND**: it joins the
+  // address as a second attempt record and places itself in `kernel.live` below, which keeps the hold the
+  // enclosing attempt already has (`attemptHeldAt` stays true there for every nested `K-2`, unchanged) and
+  // takes the hold itself where the address was free. **THE COUNT `reversalAtRest` READS IS UNMOVED IN
+  // MEANING**: an open delete attempt IS an open attempt, so a reversal raised inside its pass is a step.
+  kernel.attempts += 1;
+  // THE ATTEMPT'S ADDRESS IS A LOCAL INDEX COPY of the caller's array, never `address.slice()` (`D-35`'s read
+  // half; the same form `commit` above takes and for the same measured reason).
+  const addressCopy = [];
+  for (let i = 0; i < address.length; i += 1) appendOwn(addressCopy, address[i]);
+  // THE COMMIT'S ONE LIST, BY REFERENCE, OR A FRESH ONE WHERE THIS DELETE OPENED THE COMMIT (`D-53`).
+  const joined = commitLogInFlight(kernel);
+  const ref = { id: `attempt-${kernel.attempts}` };
+  const attempt = {
+    // **THE KIND — the discriminator the write's attempt never needed**: an attempt that landed no write is
+    // judged against the DELETE's op, and it now owes the SAME `CommitRecord` a write's attempt does.
+    kind: 'delete',
+    ref,
+    // **THE NAME THE BODIES THIS PASS INVOKES JOIN** (`D-46`/`D-53`). The record below is that name from now
+    // on — `kernel-attempt.mjs`'s `evaluate` hands `attempt.record` to the invocation channel where one exists —
+    // and this one-member object STANDS AS THE RECORD'S ABSENT ARM, so a body's write joins the delete's commit
+    // instead of opening a second one on either arm.
+    name: { attempt: ref },
+    store,
+    address: addressCopy,
+    tier,
+    // THE SUBJECT IS WHAT THE DELETE REMOVES, NOT A VALUE: the after-state is absence, and the op carries what
+    // stood before it (its `before`) per tier (`D-55` item `3`'s *"the addresses and the tiers"*).
+    value: undefined,
+    commit: undefined,
+    // The store's own returned set, kept whole for the terminal act's discard rule (`terminal`).
+    write: null,
+    // THE DELETE'S JOURNAL OP IS THE ATTEMPT'S ONE LANDING — empty until the act answers one.
+    ops: [],
+    log: joined === null ? [] : joined,
+    ran: [],
+    appliedRepairs: [],
+    rollback: [],
+    checkpoint: null,
+    checkedOff: [],
+    status: 'open',
+    report: null,
+  };
+  // **THE RECORD, BUILT BEFORE THE STORE'S LEG IS CALLED — `K-2`'s OWN INSTANT AND `K-2`'s OWN FOUR MEMBERS**
+  // (`kernel-surface.md §2.1` item 2; `A112` re-spells the fourth: *"`pending` IS THE WHOLE RETURNED SET"*).
+  // Its members are FILLED from the receipt below; it is built here so the commit's identity exists before the
+  // act lands anything, exactly as it does for a write.
+  const record = {
+    attempt: attempt.ref,
+    op: null,
+    triggered: [],
+    pending: [],
+  };
+  attempt.record = record;
+  // AND THE COMMIT'S LIST TRAVELS ON IT UNDER THE SYMBOL KEY, VERBATIM AS `K-2` DEFINES IT (`D-53`): ONE LIST
+  // PER COMMIT, and the record is the identity it hangs from. **NO MEMBER IS ADDED** (`A117` (D6)).
+  Object.defineProperty(record, COMMIT_LOG, {
+    value: attempt.log,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
+  // **THE STORE'S OWN LEG, AND IT IS THE CALLER'S** (`kernel-surface.md §1` item 1's empty import footprint:
+  // this module reaches no entry and no addon of its own; the thunk is the entry's own addon call).
+  const removal = remove();
+  // `D-3`: nothing was removed — no entry was appended, so there is no op to name and no state to judge. **NO
+  // ATTEMPT IS OPENED AND NO RECORD CROSSES**: the receipt is the whole answer, its `tiers` and `triggered`
+  // empty, and the record built above dies with this attempt.
+  if (removal === null || typeof removal !== 'object' || removal.op === null || removal.op === undefined) {
+    attempt.status = 'closed';
+    return null;
+  }
+  attempt.write = removal;
+  attempt.ops = [removal.op];
+  // **THE RECEIPT'S OWN MEMBERS, READ OFF IT VERBATIM — `K-2`'s three assignments at its own record's name.**
+  // `triggered` is the store's returned set and `pending` is that set WHOLE (no sift; `A112`), so the residue
+  // the terminal arm delivers and the failing arm's discard reads are the delete's own, unfiltered.
+  record.op = removal.op;
+  record.triggered = removal.triggered;
+  record.pending = removal.triggered.slice();
+  // THE ATTEMPT IS PLACED LIVE HERE, BEFORE THE FIRST BODY OF THE PASS RUNS: the store's own `delete` invokes
+  // nothing, so there is no window between the act and this line in which a caller's code could interleave —
+  // and the address is held from this instant through the pass and its terminal act, exactly as `K-2` holds
+  // it. **THE MAP IS ALSO THE COUNT OF OPEN ATTEMPTS** the restart's at-rest discriminator reads
+  // (`constraints.mjs`'s `reversalAtRest`), so a reversal raised inside this pass is a step and not a
+  // judgement.
+  kernel.live.set(ref.id, attempt);
+  return attempt;
+}
+

package/src/entry/kernel-foundations.mjs

@@ -229,6 +229,61 @@ export function markBodyThrow(thrown, address, log) {
   }
 }
 
+/// **⟶ ADDED 2026-10-28 — `D-55` ITEM 1, THE ARCHITECT, VERBATIM: *"Include a thrown message in the message
+/// log. Obviously."*** **THE MEASURED DEFECT (`DEF-AK`):** a constraint body that threw its own `Error`
+/// crossed as the rank-`18` `ConstraintBodyThrew` whose `log` carried **only the attempt's `outcome` entry** —
+/// the thrown value's own literal occurred **zero times** in it — while the crossed sentence said *"a
+/// constraint body's throwable crosses as this refusal"*. **The commit's log now carries the throwable's own
+/// form, written into the ONE `outcome` entry the terminal act appends at the frame that caught the body —
+/// before the attempt is disposed of and before the record is handed off** (`kernel-attempt.mjs`'s `evaluate`;
+/// no second entry and no fifth `kind` is minted).
+///
+/// **WHAT THE FORM IS, AND WHY IT NAMES WHAT IT READ RATHER THAN A CLASS.** The value is the CALLER'S OWN —
+/// it may be an `Error`, a string, a number, an object with no `message`, a `Proxy` — so the spelling is
+/// built from **own data members only** (`ownMember`, `[[GetOwnProperty]]`, `D-35`'s read half) and from the
+/// language's own `typeof`. **NO PROTOTYPE IS CONSULTED**: `instanceof`, `constructor.name` and
+/// `Object.prototype.toString` all walk a chain a caller owns, and a `Proxy`'s trap would RUN here, on a
+/// refusal path. **AND A CLASS IS NEVER CLAIMED**: *"an object whose own `message` member is the string …"*
+/// is true of an `Error` and of a plain object alike, which is what the reading supports.
+///
+/// **THE FORM IS NAMED AND NOT SILENTLY STRINGIFIED**: a thrown string is *"a string whose text is …"*, a
+/// number *"a number whose value is …"*, a thrown `void 0` *"no value at all"*, an object without a `message`
+/// *"an object carrying no own string `message` member"*. A consumer therefore reads WHAT KIND of value the
+/// body threw beside whatever text it carried.
+///
+/// **IT IS TOTAL, AND THE ONLY READ THAT COULD RUN CALLER CODE IS THE GUARDED ONE**: this frame invokes
+/// nothing of the caller's — `ownMember` is `[[GetOwnProperty]]` and consults no chain — and the one trap it
+/// can trip (a `Proxy`'s `getOwnPropertyDescriptor`) is inside a `try`, whose arm past it answers a sentence of
+/// this frame's own. **NO `undefined` IS EVER PRINTED** (`native/contract.md §8.2` property (c); the `DEF-Q`
+/// sweep reads every entry's message for it): a thrown `void 0` says *"no value at all"* and a missing member
+/// is named as absent rather than spelled.
+export function throwableForm(thrown) {
+  if (thrown === null) return '`null`';
+  const kind = typeof thrown;
+  if (kind === 'undefined') return 'no value at all (the body threw `void 0`)';
+  if (kind === 'string') return `a string whose text is ${JSON.stringify(thrown)}`;
+  if (kind === 'number') return `a number whose value is ${String(thrown)}`;
+  if (kind === 'boolean') return `a boolean whose value is ${String(thrown)}`;
+  if (kind === 'bigint') return `a bigint whose value is ${String(thrown)}`;
+  if (kind === 'symbol') return 'a symbol, which carries no text a log can print';
+  if (kind === 'function') return 'a function, which carries no message';
+  let message;
+  let name;
+  try {
+    message = ownMember(thrown, 'message');
+    name = ownMember(thrown, 'name');
+  } catch {
+    // A `Proxy` whose `getOwnPropertyDescriptor` trap throws cannot be read at all: this frame says so and
+    // runs nothing further (`D-35`: the refusal path invokes no caller code it was not already handed).
+    return 'an object this frame could not read, so its form is not printed';
+  }
+  const named = typeof name === 'string' && name.length > 0 ? ` named ${JSON.stringify(name)}` : '';
+  if (typeof message === 'string') {
+    return `an object${named} whose own \`message\` member is the string ${JSON.stringify(message)}`;
+  }
+  return `an object${named} carrying no own string \`message\` member`;
+}
+
 /// **WHETHER A VALUE IS A REFUSAL THIS KERNEL BUILT** — the entry's crossing and this kernel's own repair
 /// arm both ask this and nothing else.
 ///
@@ -397,6 +452,37 @@ export function sameAddress(left, right) {
   return true;
 }
 
+/**
+ * **⟶ ADDED 2026-10-29 — `isAddressPrefix`: THE PASS'S OWN MEMBERSHIP TEST, AND IT IS `D-56`'S SENTENCE IN
+ * ONE FUNCTION.** The architect, verbatim: *"A listener/constraint should fire when the descendants of its
+ * targeted address node change, because the descendants become part of the object that is read from that
+ * address"* (`strata/decisions.md` · `D-56`). **THE GROUND IS SEMANTIC AND NOT A PREFERENCE: the value read at
+ * a prefix CONTAINS its subtree, so a change at a descendant CHANGES what a read at the ancestor returns** —
+ * and a pair standing at the ancestor therefore **judges an object that moved.**
+ *
+ * **THE SET, STATED ONCE: a pair is asked when THE ACT'S ADDRESS IS AT OR BELOW THE PAIR'S ADDRESS** — *"the
+ * pair's address is a prefix of the act's address (equality included)"* (`D-56`). **So `isAddressPrefix(standing,
+ * act)` is `true` exactly where the pair stands AT the act's address OR AT ONE OF ITS ANCESTORS**, and `false`
+ * for a pair standing at a DESCENDANT — the unruled direction, which `D-56` requires to be MEASURED rather than
+ * implemented, and which this predicate therefore does not reach.
+ *
+ * **IT IS STRUCTURAL AND SEGMENT-WISE, WITH `string` AND `number` DISTINGUISHED, EXACTLY AS `sameAddress` IS**
+ * (`P: docs/pending.md · (M-3)` item (iv)): a pair at `['a', 0]` is NOT asked by an act at `['a', '0']`, so the
+ * widening changes WHICH DEPTHS are members and NOT how a segment is compared. **A SEGMENT COUNT OF ZERO IS A
+ * PREFIX OF EVERY ADDRESS** — the root pair's own reading, and the same one the trigger set's prefix rule gives.
+ */
+export function isAddressPrefix(prefix, address) {
+  if (!Array.isArray(prefix) || !Array.isArray(address)) return false;
+  if (prefix.length > address.length) return false;
+  for (let i = 0; i < prefix.length; i += 1) {
+    const a = prefix[i];
+    const b = address[i];
+    if (typeof a !== typeof b) return false;
+    if (a !== b) return false;
+  }
+  return true;
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE KERNEL'S OWN CALLER-SIDE STATE — **THE INSTANCE OWNS IT, IN A SLOT ON THE INSTANCE ITSELF**, so
 // two stores never share a registry, this module retains no store of its own, and NOTHING STANDS AT
@@ -654,6 +740,44 @@ export function ownMember(value, name) {
 // `Object.getOwnPropertyNames` read past, and the record keeps its FOUR declared members.
 export const COMMIT_LOG = Symbol.for('provident-storeroom.commit-log');
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ THE HANDOFF'S OWN SEAL — `D-55` ITEM 6, `DEF-AO`, ADDED 2026-10-28.** The architect, verbatim:
+// *"Attempts don't log. This is what the commits are for. The commits have their log handed off to the client
+// and are dropped after closing out."* **SO THE RECORD IS HANDED OFF ONCE, AT THE END OF THE COMMIT'S OWN
+// PROCESSING, AND A RECORD THAT CHANGES AFTER THE HANDOFF IS NOT A RECORD.**
+//
+// **WHAT WAS MEASURED BEFORE THIS ACT EXISTED.** The drain amends the REPORT a pass already closed — it sets
+// `outcome` and appends the refusal's entry to the report's list — and the list it appends to is THE COMMIT'S
+// OWN, held by reference by every attempt of the commit, the crossed refusals included. A consumer that took
+// the closed report (or a refusal carrying that list) before the drain therefore held a record that moved
+// under it. **FREEZING AT THE SEAL MAKES THE HANDED-OFF RECORD FINAL**: the drain's amendment happens BEFORE
+// this call (it is part of closing out), and nothing after it can append, renumber or re-member the list.
+//
+// **WHAT IT FREEZES, AND WHY THE LOG'S SEAL IS THE COMMIT'S.** `D-53` makes the message log THE COMMIT'S: an
+// attempt's `log` is that one list, carried by reference, and every attempt of the commit appends to it — a
+// constraint body's nested write, a repair's write, the re-run. **SO THE REPORT IS SEALED AT EVERY ATTEMPT'S
+// HANDOFF AND THE LIST IS SEALED AT THE HANDOFF OF THE ATTEMPT WHOSE SCOPE OWNS IT** (the one whose commit is
+// not an enclosing invocation's list, read off `commitLogInFlight`): freezing the list at a NESTED attempt's
+// handoff would stop the enclosing attempt's own `append` and turn a lawful write into a raw host `TypeError`
+// — measured, and the reason the `shared` argument exists. **THE LIST IS SEALED WITH ITS COMMIT**, which is
+// what *"the commits have their log handed off to the client and are dropped after closing out"* says.
+//
+// **IT FREEZES TWO THINGS AND ONLY TWO**: the report's `log` array (where this attempt's scope owns it) and
+// the report itself. **NO MEMBER MOVES, NO MEMBER IS ADDED, AND THE LIST'S IDENTITY IS UNCHANGED** — `D-53`'s
+// *"the crossed report IS that list"* is a statement about WHICH array crosses, and the same array crosses
+// (frozen): `K-5`, `K-4` and every refusal built from it read the same entries at the same `seq` ordinals.
+// **A PASSING ATTEMPT'S REPORT IS SEALED TOO** — its log is handed off exactly once and drops with the commit.
+export function sealHandoff(report, shared) {
+  if (report === null || typeof report !== 'object') return report;
+  // THE REPORT'S OWN `log` MEMBER, READ AS A MEMBER OF THE OBJECT THIS FRAME BUILT (`kernel-terminal.mjs`
+  // places the commit's list there and nothing else): an absent or non-array member is not this act's, and
+  // `refusalLog`'s own rule (`surface.md §2.5` item 4) is that a `log` is a list on every arm.
+  const log = report.log;
+  if (shared !== true && Array.isArray(log) === true) Object.freeze(log);
+  Object.freeze(report);
+  return report;
+}
+
 // **THE COMMIT'S FRAME — THE ONE STRUCTURE THAT MAKES "THE SAME COMMIT" A FACT RATHER THAN A CONVENTION.** It is
 // a per-instance stack on the kernel record (`kernel.frames`, created by `kernelFor`), pushed by the kernel
 // around each invocation IT makes of caller code that belongs to an attempt — a constraint body at a landing,
@@ -851,31 +975,57 @@ function opSpelling(value) {
  * replacement for `byAddress`'s index, declared at `contract.md §2.8` item 6 (`HL-DD-6`) and
  * `kernel-selection.md §3` item 1.
  *
- * **THE SET IS THE PAIRS WHOSE OWN ADDRESS IS THE ATTEMPT'S — selected by an EXACT-ADDRESS match and NEVER
- * widened to `triggered`'s prefix set** (`P: docs/pending.md · (AA-1)`, verbatim: *"the pass selects the rows
+ * **⟶ THE PREDICATE IS WIDENED FROM EXACT ADDRESS TO PREFIX, 2026-10-29 — `D-56`, AND THE CLAUSE BELOW STANDS
+ * BYTE-FOR-BYTE AS THE RULE THIS ONE SUPERSEDES.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph that stood here
+ * read** *"THE SET IS THE PAIRS WHOSE OWN ADDRESS IS THE ATTEMPT'S — selected by an EXACT-ADDRESS match and NEVER
+ * widened to `triggered`'s prefix set"* (`P: docs/pending.md · (AA-1)`, verbatim: *"the pass selects the rows
  * whose address IS the triggering address, which PRESERVES the EXACT-ADDRESS RULE rather than widening it to
- * `triggered`'s prefix set"*; `contract.md §2.8` item 1).
+ * `triggered`'s prefix set"*; `contract.md §2.8` item 1), **and the architect has superseded it**, verbatim:
+ * *"A listener/constraint should fire when the descendants of its targeted address node change, because the
+ * descendants become part of the object that is read from that address"* (`strata/decisions.md` · `D-56`).
+ * **THE TWO CLAUSES `D-56` NAMES BY NUMBER ARE `HL-8` ITEM 1'S OWN SENTENCE AND
+ * `attempt-lifecycle.md §2.4` ITEM 5 (iv)'s EXACT-ADDRESS RULE — both superseded, both annotated in place, and
+ * neither rewritten.**
+ *
+ * **THE SET IS NOW THE PAIRS WHOSE OWN ADDRESS IS A PREFIX OF THE ATTEMPT'S — equality included — WHICH IS
+ * `isAddressPrefix(standing, address)` AND IS `D-56`'s ONE SENTENCE**: a pair at `['tabs']` IS asked for a
+ * delete at `['tabs','landingPage']`, a pair at `['tabs','landingPage']` IS asked for that same delete, and a
+ * pair at `['tabs','landingPage','x']` is NOT asked because the act did not change it (**the unruled direction,
+ * measured and not implemented** — `D-56`'s own terms). **THE REASON IS THE READ:** the value read at a prefix
+ * contains its subtree, so a descendant's change changes what the ancestor's read returns, and the ancestor pair
+ * **judges an object that moved.**
  *
- * **IT IS A SCAN, AND THE COST IS PRICED AND ACCEPTED** (`P: docs/pending.md · (AA-1)`, verbatim: *"selecting
- * rows by address is a scan over `kernel.pairs` … THAT GROUND WAS WRONG AND IS WITHDRAWN: the store names the
- * ADDRESS, and the kernel selects"*).
+ * **IT IS STILL A SCAN, AND THE COST IS STILL PRICED AND ACCEPTED** (`P: docs/pending.md · (AA-1)`, verbatim:
+ * *"selecting rows by address is a scan over `kernel.pairs` … THAT GROUND WAS WRONG AND IS WITHDRAWN: the store
+ * names the ADDRESS, and the kernel selects"*) — **and `D-56` re-prices it not at all**: the scan reads one
+ * prefix test per standing address instead of one equality test per standing address, on the same rows.
  *
- * **AND THE RESULT IS MATERIALISED ONCE, WHICH IS WHAT IMPLEMENTS `CX-12`'s *"the pass's evaluated set is
- * FIXED WHEN THE PASS BEGINS"*** (`P: docs/pending.md · R-B3`'s snapshot clause; `contract.md §2.8` item 6):
- * the returned list is a fresh array, so a `K-1` that returns DURING the pass enters the NEXT pass's set and
- * no earlier one, and a pair PURGED mid-pass is still evaluated by the pass that began with it
- * (`kernel-selection.md §3` item 5).
+ * **AND THE RESULT IS STILL MATERIALISED ONCE, WHICH IS WHAT IMPLEMENTS `CX-12`'s *"the pass's evaluated set is
+ * FIXED WHEN THE PASS BEGINS"*** (`P: docs/pending.md · R-B3`'s snapshot clause; `contract.md §2.8` item 6;
+ * `D-56`'s third deferrer, which changes WHAT is materialised and not WHEN): the returned list is a fresh array,
+ * so a `K-1` that returns DURING the pass enters the NEXT pass's set and no earlier one, and a pair PURGED
+ * mid-pass is still evaluated by the pass that began with it (`kernel-selection.md §3` item 5). **THE PASS READS
+ * THIS LIST AND NEVER THE REGISTRY**, and **`D-56` says nothing that moves that**: the ancestors are members of
+ * the SAME one snapshot, taken at the SAME instant.
  *
- * **THE ORDER IS THE PAIR'S FIRST-REGISTRATION ORDER AT THE ADDRESS** — `attempt-lifecycle.md:193`'s *"clause
- * (ii)'s first-registration order"* — **and `kernel.pairs`' own `Map` iteration supplies it**, which is the
- * order the ruling says is preserved *"by the store's own returned order, not by an index's append order"*
- * (`P: docs/pending.md · M-3`, its closing sentence; `contract.md §2.8` item 6's `HL-DD-6`).
+ * **THE ORDER IS STILL THE PAIR'S FIRST-REGISTRATION ORDER — `HL-8` ITEM 6's RULE SURVIVES `D-56` — AND THE
+ * ANCESTORS INTERLEAVE INTO THAT ONE ORDER RATHER THAN FORMING A SECOND.** `attempt-lifecycle.md:193`'s *"clause
+ * (ii)'s first-registration order"* **is supplied by `kernel.pairs`' own `Map` iteration**, which is the order
+ * the ruling says is preserved *"by the store's own returned order, not by an index's append order"*
+ * (`P: docs/pending.md · M-3`, its closing sentence; `contract.md §2.8` item 6's `HL-DD-6`). **THE WIDENING ADDS
+ * NO ITERATION AND NO SORT**: `D-39`'s registration sequence is the `Map`'s insertion order over the pair rows,
+ * the one loop below walks it once, and **a row is admitted or not by its own `addresses` member** — so an
+ * ancestor registered FIRST is asked FIRST, an ancestor registered THIRD is asked THIRD, **interleaved with the
+ * act's own pairs by the one sequence both stand in.** There is no "ancestors first", no "ancestors last", and
+ * no second list: **one order, one list, one snapshot.** **EACH ELEMENT IS EVALUATED AT MOST ONCE** — the `break`
+ * below is that rule, so a pair standing at N addresses of which two are prefixes of the act is reached once
+ * (`contract.md §2.6` item 5).
  */
 export function pairsAtAddress(kernel, address) {
   const out = [];
   for (const [key, pair] of kernel.pairs) {
     for (const standing of pair.addresses) {
-      if (sameAddress(standing, address)) {
+      if (isAddressPrefix(standing, address)) {
         appendOwn(out, key);
         break;
       }

package/src/entry/kernel-registration.mjs

@@ -521,11 +521,18 @@ function registrationRerun(kernel, attempt, produced) {
   // **THE ADDRESS IS IN HAND ONE FRAME ABOVE the `byAddress.get` call that stood here**, and the store→kernel
   // channel is `record` alone (`A117` (D6) forbids a fifth member).
   //
-  // **AND THE SELECTION IS AN EXACT-ADDRESS MATCH, NEVER A PREFIX ONE**: the pass's set is the pairs WHOSE OWN
-  // ADDRESS IS THE ATTEMPT'S, which preserves `attempt-lifecycle.md §2.4` item 5 (iv)'s exact-address rule
-  // rather than widening it to the store's prefix-selected `triggered` (`P: docs/pending.md · (AA-1)`;
-  // `contract.md §2.8` item 1). **EACH ELEMENT IS EVALUATED AT MOST ONCE**, so a pair standing at N addresses
-  // whose two addresses both match is reached once (`contract.md §2.6` item 5).
+  // **AND THE SELECTION IS A PREFIX MATCH ON A PAIR'S OWN ADDRESS, AS OF 2026-10-29 (`D-56`).** `RCA-8(g)`
+  // ANNOTATE-BESIDE: **the sentence that stood here read** *"the pass's set is the pairs WHOSE OWN ADDRESS IS THE
+  // ATTEMPT'S, which preserves `attempt-lifecycle.md §2.4` item 5 (iv)'s exact-address rule rather than widening
+  // it to the store's prefix-selected `triggered`"* (`P: docs/pending.md · (AA-1)`; `contract.md §2.8` item 1) —
+  // **and `D-56` supersedes that rule**: *"A listener/constraint should fire when the descendants of its targeted
+  // address node change, because the descendants become part of the object that is read from that address"*.
+  // **SO THE SET HERE IS `pairsAtAddress`'s AND MOVES WITH IT** — the pairs whose own address is a PREFIX of the
+  // attempt's, equality included — because a registration's re-run is not a second kind of pass and mints no
+  // second membership rule. **THE WIDENING IS THE FUNCTION'S AND NOT THIS MODULE'S**: the call below is byte-for-
+  // byte what it was, and the registration instant inherits `D-56` by CALLING the one selection function.
+  // **EACH ELEMENT IS EVALUATED AT MOST ONCE**, so a pair standing at N addresses whose two addresses are both
+  // prefixes of the act is reached once (`contract.md §2.6` item 5).
   const list = pairsAtAddress(kernel, attempt.address);
   for (const key of list) {
     const pair = kernel.pairs.get(key);
@@ -549,6 +556,12 @@ function registrationRerun(kernel, attempt, produced) {
       // **⟶ ADDED 2026-10-26 (`DEF-S`, the same ruling): a body thrown at the synthetic attempt's re-run is
       // marked at this frame too — the mark carries the attempt's own log and address, and the entry's
       // crossing converts a marked value only** (`markBodyThrow`, `kernel-foundations.mjs`).
+      // **⟶ AND NEITHER THIS FRAME NOR THE REGISTRATION-TIME EVALUATION ABOVE APPENDS A THROWABLE ENTRY, 2026-10-28
+      // — `DEF-AK`'s RECORDED ARM IS THE LANDING'S.** The re-run appends no `constraint-check` entry for the
+      // evaluation it threw in (the pair's own function ran at the registration instant), and no `outcome`
+      // entry stands because this throwable propagates before any terminal act — so there is no entry of the
+      // closed four this frame could honestly extend, and no fifth `kind` is minted for it. The registration
+      // instant's `log` is `surface.md §2.5` item 4's declared `[]` and stays it (`DEF-S`'s own cell reads it).
       throw markBodyThrow(body, attempt.address, attempt.log);
     } finally {
       leaveCommitFrame(kernel);