provident-storeroom 1.4.0 → 1.5.0

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.4.0`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.5.0`.
 
 ## The one entry
 
@@ -70,6 +70,17 @@ reached INTERNALLY by the package's own resolution step and is not an entry poin
 | `removeConstraint(pair)` | `undefined` — **the one act that deletes an identity** |
 | `constraints()` | the registered pairs, `{address, id}` only — **no function, no order, no `enabled`** |
 
+**⟶ AND THE `delete` ROW'S ANSWER HAS A SECOND NON-ENUMERABLE MEMBER, 2026-10-29 — ITS COMMIT RECORD.** The row above
+names the `discarded` witness and stops there; **a `delete` is an editing verb with its own attempt, its own pass and
+its own commit, so the receipt ALSO carries `commit`, a NON-ENUMERABLE own member holding the same four-member
+`CommitRecord` a `K-2` returns — `attempt` · `op` · `triggered` · `pending` — and `null` on the arm that removed
+nothing.** **Measured on this checkout: `Object.keys(receipt)` reads `["address","tiers","triggered","op"]` — four —
+while `Object.getOwnPropertyNames(receipt)` reads six, `commit` and `discarded` being the two it does not list** — so
+a spread or `Object.assign` copy of a receipt loses BOTH, and nothing throws when it does. **Read either off the
+receipt itself.** **No member is added to the FOURTEEN and no enumerable shape moves.** (`D-57`; `D-55` item `3`;
+`index.d.ts`'s `DeleteRecord.commit`; the long-form reading — the adoption, the `pending` residue, the `file`-tier
+save and `K-4`/`K-5` by reference — is the shipped guide's `§7.8`, which is where those four follow-ons are stated.)
+
 **THE RECEIVER IS THE STORE, SO NO CALL CARRIES AN `instance` POSITION** (`surface.md §2.1` (e) item 3):
 `store.write(address, tier, value)` is the shape every method takes, and a leading `instance` is a SUPERSEDED
 SPELLING — wrong, not redundant. **AND NO OWN MEMBER IS A DATA MEMBER:** there is no `store.data`, no `state`
@@ -114,8 +125,10 @@ try {
 with an object literal, not `defineProperty`, not a getter, not on a prototype and not behind a `Symbol` — and
 **`Object.keys(caught)` reads exactly its three members in the form's own order, `["status","message","log"]`,
 length `3`, on EVERY arm.** **`[]` is its declared value where the failure's cause has no attempt at all, and
-every failure whose attempt exists carries that attempt's own entries — the kernel's six-member `LogEntry`
-records, with the `outcome` entry's `state` carrying the `KC` token where the constraint pass produced one**
+every failure whose attempt exists carries that attempt's own entries — the kernel's FIVE-member `LogEntry`
+records, with the `outcome` entry's `state` carrying the `KC` token where the constraint pass produced one** **⟶ AND IT IS
+FIVE SINCE `D-65`: `kind` · `id` · `opId` · `message` · `state` — the `seq` member is GONE, because a log entry's position
+IS its array index and a member restating the index was a second copy of a fact the array already carried.**
 (`index.d.ts`, `LogEntry`; `surface.md §2.5` items 3–4). **The `message` is generated from the code and the
 failing trigger's arguments**, never hand-authored at a call site.
 
@@ -130,6 +143,19 @@ JOURNAL ORDINAL.** `JournalOp.seq` orders the store's own record; this `seq` ord
 the two differ by design (a refusal's entry can carry `seq` `1` while the store's journal counter reads `41`). **The
 kernel's `state` token set is `KC-1`…`KC-9`, `KC-9` being the save arm's own; the store's status set has not moved.**
 
+**⟶ AND THE SECOND OF THOSE TWO THINGS IS WITHDRAWN AT THE MEMBER, 2026-10-28 — `D-65`: `LogEntry` CARRIES NO `seq`,
+AND AN ENTRY'S POSITION IS ITS ARRAY INDEX.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte above stands BYTE-FOR-BYTE as
+the reading of its own date and is read THROUGH this clause — the withdrawn sentence is *"AN ENTRY'S `seq` IS THE
+POSITION OF THE ENTRY IN THAT LIST … the two differ by design"*, and it described a member that no longer exists.**
+**THE RULING, THE ARCHITECT, ONE WORD: *"Drop it"*** — `seq: log.length + 1` WAS the index of the entry being
+appended, a second copy of a fact the array already carries. **WHAT YOU READ NOW: FIVE members, `kind` · `id` ·
+`opId` · `message` · `state`** (declared at the same place the clause above declares them, and stated there beside
+its `seq` retirement), **and the position of an entry is `log.indexOf(entry)` or the index of the loop you are
+already in.** **`JournalOp.seq` IS STILL THE STORE'S OWN APPEND ORDINAL, so the distinction the sentence above drew
+has not disappeared — only the member that could be confused with it has**, and the two are now impossible to
+confuse for that reason. **So do not read `entry.seq` for an ordering, and do not read its absence as an entry that
+lost its place: the list's order is the commit's append order and the index is the place.**
+
 ## The status set is TWENTY, and open by design
 
 **`StoreStatus` carries TWENTY members, ranked `1`…`20`, plus the open escape arm `(string & {})`** — the union

package/RELEASE-NOTES.md

@@ -16,7 +16,7 @@ claims to be installable.**
 
 **⟶ AND THE CUT-STATE IS DROPPED FROM THIS FILE, 2026-10-28 — `D-57`, THE ARCHITECT VERBATIM: *"Drop the cut-state."*** `RCA-8(g)` ANNOTATE-BESIDE: **the title line and every dated paragraph of this file stand BYTE-FOR-BYTE as the reading of their own date, THIS clause is the one that reads them, and not one byte is deleted.** **THE REASON IS STRUCTURAL AND IT WAS MEASURED THREE TIMES: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and this file's own head was stale within minutes of the tag that falsified it. **SO EVERY SENTENCE BELOW THAT CLAIMS WHETHER SOME VERSION IS OR IS NOT CUT — *"PREPARED — NOT CUT"*, *"no `v1.3.0`"*, *"nothing in this section is cut"*, *"the release is not cut"*, *"what is installed today is still `1.1.0`"*, and each reading printed beside them — IS READ THROUGH THIS CLAUSE: the cut-state is not a document's to state.** **WHAT SURVIVES IS THE ONE FIGURE A SHIPPED DOCUMENT CAN BE RIGHT ABOUT, AND IT IS GENERATED FROM THE MANIFEST AND ASSERTED BY THE PREFLIGHT:**
 
-PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.4.0`.
+PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.5.0`.
 
 **AND THE TAG SET SURVIVES AS A RECORD OF RELEASES — PAST TENSE, A LIST OF WHAT HAS BEEN CUT, NEVER A CLAIM ABOUT THE CURRENT ONE** (the record stands in `§1.4.0` below — the section this file's head called `§main` until it was re-cut to name the version it prepares, 2026-10-28 — beside the section for the tree this file describes). (`D-57`; `DEF-AC` (b) — `scripts/publish.sh --figures` generates that line from `bindings/js/package.json`'s `version` and refuses on any disagreement, in this file, in `bindings/js/README.md` and in the shipped guide: three documents, three version lines, one generator, one assertion.)
 
@@ -53,7 +53,9 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
-## §1.4.0 · **PREPARED** — what `1.4.0` carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states
+## §1.4.0 · **CUT AND PUBLISHED — tag `v1.4.0`** — what that release carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states
+
+**⟶ THE HEADING THAT STOOD HERE WAS *"`## §1.4.0 · **PREPARED** — what `1.4.0` carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states`"*, AND IT IS CORRECTED AT ITS OWN LINE, 2026-10-28.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted above, every paragraph of this section below stands BYTE-FOR-BYTE as the reading of its own date, and nothing is deleted.** **THE DEFECT IS THE `DEF-AC` CLASS AT ITS THIRD ITERATION AND AT ITS SHARPEST: A HEADING THAT DENIED THE RELEASE ITS OWN TAG NAMES.** The tag set at this date reads `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`; **the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes**, its five `optionalDependencies` pins read `1.4.0` with it, and the five platform manifests' `version` fields read `1.4.0` with them; and **a reader opening this file met *"PREPARED"* over a version the registry carries.** **SO THE HEADING NOW READS `CUT AND PUBLISHED — tag `v1.4.0``, which is a PAST-TENSE RECORD OF A RELEASE AND NOT A CLAIM ABOUT THE TREE YOU ARE READING** — the tag set is the record of what has been cut, and the state of the current tree's version is not a document's to state (`D-57`, and the head clause of this file, which stands). **AND WHAT THE SECTION BELOW DECLARES IS UNMOVED BY THE CORRECTION: the ancestor set (`D-56`), the `delete`'s own attempt and its `CommitRecord` (`D-57`), the five smaller items of `D-55`, and the one shipped sentence that all of it falsified — those are `1.4.0`'s content, they travelled in its tarball, and a consumer who installed `1.4.0` has them.** (`D-57`; the head clause of 2026-10-28 above; `git tag --list` and `bindings/js/package.json` read at their own bytes this date.)
 
 **⟶ THIS SECTION IS RE-CUT FROM THE HEADING IT STOOD UNDER, 2026-10-28, AND ITS FIGURES MOVED WITH THE ELEVEN CELLS.** `RCA-8(g)` ANNOTATE-BESIDE: **the heading that stood here was *"`## §main · **PREPARED** — the seven commits on `main` past `v1.3.0`, and the one figure this section states`"*, the withdrawn bytes are quoted there, and the four numbered items below stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause.** **THE HEADING NOW NAMES THE VERSION THIS SECTION PREPARES — `1.4.0` — because the section below it, `§1.3.0`, is the change list of a release that IS cut, and a prepared section must say which version it prepares.** **AND IT STILL STATES THE VERSION AND NOT THE CUT-STATE, BECAUSE THE SECOND IS NOT A DOCUMENT'S TO STATE (`D-57`).**
 
@@ -71,6 +73,40 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 **4 · AND A SHIPPED SENTENCE WAS FALSIFIED BY ALL OF IT, AND IS CORRECTED AT ITS OWN HOME.** **The package's `README.md` said a `delete` and a `rollback` both perform no file I/O at any tier scope.** **A `delete` SAVES NOW** — a `file`-tier delete left the bytes standing and a fresh boot read the old value; the terminal arm saves the delete's own op, and a failed save is the write's arm with `KC-9`. **A `rollback` still performs no file I/O, because it has no op of its own to save at** — and that half of the sentence was never in doubt. (`1090e1e`; `bindings/js/README.md`'s own 2026-10-28 clause.)
 
+## §1.5.0 · **PREPARED** — what `1.5.0` carries: the twenty-seven commits on `main` past `v1.4.0`, derived from the tree
+
+**⟶ THE HEADING THAT STOOD HERE WAS *"`## §1.5.0 · **PREPARED** — what `1.5.0` carries: the eleven commits on `main` past `v1.4.0`, derived from the tree`"*, AND ITS COUNT IS CORRECTED AT ITS OWN LINE, 2026-10-29.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted above, every paragraph of this section below stands BYTE-FOR-BYTE as the reading of its own date, and nothing is deleted.** **THE COUNT MOVED BECAUSE THE TREE DID**: the section was written when `git describe` read `v1.4.0-11-g90f810c`, and **the sixteen commits after that reading — `c3c61ab` through `a3312b7` — carry the rulings and the code changes this section's items `5` through `8` declare.** **A HEADING THAT UNDERCOUNTS THE COMMITS IT PREPARES IS THE `DEF-AC` CLASS AT ITS MILDLEST AND IS CORRECTED RATHER THAN ANNOTATED AROUND, because the count is the one figure this section's own arithmetic prints.** (`D-57`; `git describe` at `v1.4.0-27-ga3312b7`.)
+
+**⟶ THIS SECTION IS NEW, 2026-10-28, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte above moves and no byte of the sections below moves; this section is added beside them and is read through the same head clause as the rest of this file.** **THE FIGURE THIS SECTION MAY BE RIGHT ABOUT, AND ITS GENERATOR:** the version line at this file's head is generated from `bindings/js/package.json`'s `version` and asserted by `scripts/publish.sh --figures` in three shipped documents — **`1.4.0`, at eleven cells that move together and never singly**: the main manifest's `version`, its five exact `optionalDependencies` pins, and the five `bindings/js/platforms/*/package.json` `version` fields; and `bindings/js/build.rs` stamps the artefact from that manifest, so the built artefact's `version()` answers `1.4.0`. **AND THE TREE IS ELEVEN COMMITS PAST THE TAG THAT NAMES THOSE CELLS:** `git describe` reads `v1.4.0-11-g90f810c`, `git rev-list --count v1.4.0..HEAD` reads `11`, and **no version bump is in any of the eleven** — the manifest still reads `1.4.0` after all of them. **THE TAG SET IS A RECORD OF RELEASES, PAST TENSE, AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`. **AND NOTHING IN THIS SECTION CLAIMS WHETHER `1.5.0` IS CUT: the cut-state is not a document's to state** (`D-57`; the head clause of this file; the `§1.4.0` correction above, which is the same defect met one section higher).
+
+**⟶ AND THAT PARAGRAPH'S TWO FIGURES ARE RE-READ AT THE TREE THIS SECTION PREPARES, 2026-10-29 — THE TREE IS TWENTY-SEVEN COMMITS PAST `v1.4.0`, AND THE ELEVEN CELLS READ `1.5.0`.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE as the reading of its own date (`v1.4.0-11-g90f810c`) and is read THROUGH this clause; not one byte of it is deleted.** **THE COUNT:** `git rev-list --count v1.4.0..HEAD` reads `27` and `git describe` reads `v1.4.0-27-ga3312b7`, so its *"ELEVEN COMMITS"* is read as TWENTY-SEVEN. **THE VERSION: `bindings/js/package.json`'s `version` now reads `"1.5.0"`, its five exact `optionalDependencies` pins read `1.5.0` five times, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.5.0` — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.5.0` at the built artefact AND at a package installed from it.** **SO ITS SENTENCE *"no version bump is in any of the eleven — the manifest still reads `1.4.0` after all of them"* IS THE READING OF ITS OWN DATE, and the bump is THIS preparation's.** **AND THE TAG SET IS UNMOVED BY THE BUMP AND STILL A RECORD OF RELEASES, PAST TENSE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` — **no `v1.5.0` among them** — **and nothing in this section claims whether `1.5.0` is cut** (`D-57`; the head clause of this file).
+
+**THE ELEVEN, DERIVED FROM THE TREE THEY LANDED ON, EACH STATED FOR A CONSUMER — AND THE HONEST SHAPE OF THE ELEVEN IS `3 + 8`.** **THREE OF THEM MOVE THE PACKAGE**: `d862448` carries `D-58` (*"No insight into a running commit, and nothing retained after the handoff"*), `85b0174` carries `D-63` (*"Bump the mark when a sweep ends valid: the restore target is the last validated state"*), and `90f810c` carries `D-65` (*"Drop seq from the log entry: the array index is the position"*). **THE OTHER EIGHT RECORD RULINGS AND MOVE NO BEHAVIOUR** — `e5acd49` (`D-58`), `9b58c4a` (`D-59`), `0f113bf` (`D-60`), `e152c0b` (`D-61`), `15444fd` (`D-62`), `8dd2593` (`D-63`), `47ec840` (`D-64`), `b9936ac` (`D-65`) — each of which is a ruling written down beside the code that implements it, and none of which a consumer can observe except by reading them.
+
+**⟶ AND THE SAME ARITHMETIC IS DONE AGAIN FOR THE WHOLE TWENTY-SEVEN, 2026-10-29 — THE HONEST SHAPE IS `6 + 16 + 5`.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE as the reading of its own date and is read THROUGH this clause; its `3 + 8` is kept and its METHOD is reused rather than replaced — each of the twenty-seven is read at the paths it touched and sorted by what those paths are.** **SIX OF THE TWENTY-SEVEN MOVE THE PACKAGE** — a line under `bindings/js/src/` or `src/store.rs` changes, so a consumer can observe it: `d862448` (`D-58`: the log reader's live arm refuses, and the closed record is dropped to its four members), `85b0174` (`D-63`: the restore mark bumps when a sweep ends valid), `90f810c` (`D-65`: `seq` leaves `LogEntry`), `c3c61ab` (`D-66`: the pass asks a descendant the act touched), `3384d2e` (the touched set made symmetric: a path that disappears changed as surely as one that appears), and `6fd15a7` (`D-69`: the registration is restored, so the store's `triggered` names both kinds and the pass FILTERS it instead of walking its own registry). **SIXTEEN ARE RECORD RULINGS AND MOVE NO BEHAVIOUR** — each writes `strata/decisions.md` and no other path: `e5acd49` (`D-58`), `9b58c4a` (`D-59`), `0f113bf` (`D-60`), `e152c0b` (`D-61`), `15444fd` (`D-62`), `8dd2593` (`D-63`), `47ec840` (`D-64`), `b9936ac` (`D-65`), `535b56a` (`D-66`), `948dcde` (`D-67`), `5fa84e6` (`D-68`), `c37adae` (`D-69`), `2ba405e` (`D-70`), `aaedc73` (`D-71`), `5331993` (`D-72`) and `92d2ec6` (`D-73`). **AND FIVE CARRY DOCUMENTS AND MOVE NO CODE** — the guide, this change list and the `docs/L1` records: `7e81e7f` (this change list, the guide and the L1 declarations regenerated to the tree), `a1c65d9` (`D-70`'s rule of use declared), `80c2ca7` (the reach's two readings reconciled and the three asymmetries declared), `fc81fd3` (`D-71`'s independence and `D-72`'s nesting declared) and `a3312b7` (`D-73`'s throw and its consequence declared). **`6 + 16 + 5 = 27` ✓ — the count is the whole of the twenty-seven past `v1.4.0`, and no commit is counted twice.**
+
+**1 · ★ THE RESTORE MARK BUMPS WHEN A SWEEP ENDS VALID — THE RESTORE TARGET IS THE LAST VALIDATED STATE, NOT THE STATE THE COMMIT OPENED AT (`D-63`).** **THE ARCHITECT, VERBATIM: *"After the constraint sweep ends in a valid state, bump the restore mark. The passing constraint state marks the new next valid state."*** **`AT `1.4.0`:** a refused edit rolled the commit back to the state it OPENED at — every edit the commit made was undone, a successful write's included. **NOW:** the restore is told a POSITION and the position MOVES FORWARD — it starts where the commit opened and it moves to the store's own journal position at every constraint sweep that ends valid, **before the listeners are delivered.** **WHAT A CONSUMER SEES, IN THE THREE ARMS THE RULING'S TERM OF ART MAKES DIFFERENT: a VALIDATED EDIT STANDS against a later refusal; a REPAIR'S WRITE does not stand**, because a repair's write is atomic with the write that asked for it and the sweep that follows judges the pair together — **and a LISTENER'S WRITE SURVIVES**, because the delivery runs after the bump and the sweep that validated it is the sweep the mark now names. **So *"the state it opened at"* is now the answer to exactly one case — a commit whose constraint sweep never passed — and it is `1.4.0`'s behaviour there and stays.** (`D-63`; `D-38`'s restore; the `DEF-AN` measurement, whose pair refuses on the FIRST check so nothing moves the mark and its reading is unchanged; `tests/e2e/discard-witness.mjs`'s `W12` arms `DW-12.1`–`DW-12.4`, with the re-derived readings in `tests/e2e/in-commit-restart.test.mjs`, `tests/e2e/direct-pass-restart.test.mjs`, `tests/e2e/downstream-claims.test.mjs` and `tests/e2e/def-ae-restore-mark.test.mjs`.)
+
+**2 · ★ `seq` IS DROPPED FROM `LogEntry` — SIX MEMBERS TO FIVE, `kind` · `id` · `opId` · `message` · `state`, AND THAT IS A BREAKING SHAPE CHANGE FOR A TYPED CONSUMER.** **THE RULING, THE ARCHITECT, ONE WORD: *"Drop it"*** (`D-65`) — and `DEF-AI`'s own demand had offered the route: *"mint `seq` from the attempt's counter, **or omit the member**."* **THE REASON IS THE ONE THIS FILE KEEPS MEETING AT A SMALLER SCALE: `seq: log.length + 1` IS THE INDEX OF THE ENTRY BEING APPENDED, a second copy of a fact the array already carries** — the same class as a hand-maintained allowlist, a hand-named runner chain or a hand-transcribed census. **WHAT A CONSUMER SEES:** a log entry carries **five** own members and **`entry.seq` is `undefined`**; **the position survives as the index and is asserted rather than assumed** — `log[0]` is the entry, `log.indexOf(entry)` answers its position, and a commit's entries run `0..n-1` continuously across its attempts. **A TYPED CONSUMER READING `entry.seq` MEETS A COMPILE ERROR, WHICH IS THE HONEST FORM OF THIS CHANGE**; a JavaScript consumer reading it meets `undefined`, and **`JournalOp.seq` IS UNMOVED** — the store's own append ordinal is a different subject and is now impossible to confuse with the commit's, because the commit's no longer has a member to be confused with. (`D-65`; `index.d.ts`'s `LogEntry`; `bindings/js/README.md` and the shipped guide each carry the retirement at their own home.)
+
+**3 · NO INSIGHT INTO A RUNNING COMMIT, AND NOTHING RETAINED AFTER THE HANDOFF (`D-58`).** **THE ARCHITECT, VERBATIM: *"The client does not need any insight into the current state of a commit/attempt before it completes. Don't expose any of it. After a commit/attempt resolves/rejects, the store does not need to retain the message log or other client-returned data. Don't retain it."*** **WHAT A CONSUMER SEES, IN TWO PARTS. (i) `K-4` REFUSES A LIVE ATTEMPT WITH `KC-7`**, the same member `K-5` already used, in the same shape and the same message family — so an in-flight list is no longer a thing you can read at all. **(ii) THE CLOSED RECORD IS `{attempt, ops, outcome, rollback}` AND THE LOG IS LET GO**: the record a commit resolves or rejects with carries those four and no message list, and the entries on the refusal you caught (or on `report`'s return) are **the only copy** — sealed at the handoff. **WHAT THAT COSTS, SAID PLAINLY:** on an arm whose handoff carries no list at all — a repair body that throws, and a PASSING `write`, whose answer is `{op, watched, triggered}` and has never carried one — the entries are no longer readable after the call. **That is the ruling's price and not a defect.** (`D-58`; `d862448`; `tests/e2e/discard-witness.mjs`'s `DW-11.1`–`DW-11.4`, each RED under its own revert.)
+
+**4 · AND THE TWO HEADLINES A CONSUMER MEETS THAT ARE NOT THE ELEVEN'S, NAMED SO NOBODY ATTRIBUTES THEM TO `1.5.0`.** **`D-56`'s ancestor set and the `delete`'s own attempt with its `CommitRecord` are `§1.4.0`'s content and travelled in the `1.4.0` tarball** — `4449a93`, `1d23abc` and `1090e1e` are all ancestors of the tag `v1.4.0`, and the section above declares them in full. **THEY ARE RESTATED HERE ONLY AS THE FACTS A `1.5.0` READER STILL MEETS, WITH THEIR TWO CONSEQUENCES NAMED BECAUSE THEY ARE THE ONES A CONSUMER TRIPS OVER:** **① a pair is asked for acts at or below its own address — so a pair at `['window','tabs']` IS asked for a `delete` at `['window','tabs','landingPage']`**, because the value read at a prefix contains its subtree; **and because the pass's set now EQUALS the store's `triggered` set, a passing write now EMPTIES `pending`** (measured `1` → `0`) — the handles the pass checked off are exactly the handles the record carried. **② a `delete` is an editing verb with its own attempt, its own pass and its own `CommitRecord`**, whose four follow-ons are the record's ADOPTION by the entry, the `pending` residue, the `file`-tier SAVE, and `K-4`/`K-5` answering a delete's record BY REFERENCE where they refused `NO-REF` before. **AND NO KERNEL ITEM IS OWED FOR IT: `K-7` `commitRemoval` is owed only if a consumer must drive a delete's attempt directly, and none can — the verb is the surface** (`D-57`'s second half; the kernel's surface stays `K-1`…`K-6`). (`D-56`; `D-57`; `D-3`; `D-44`; `D-53`; `§1.4.0`'s items 1 and 2, which declare both in full.)
+
+**5 · ★ ONE REGISTRATION, ONE REACH — A CONSTRAINT AND A LISTENER ARE THE SAME MECHANICAL THING TO THE STORE, `triggered` NAMES BOTH KINDS IN ONE LIST, AND THE PASS FILTERS IT RATHER THAN WALKING A REGISTRY OF ITS OWN (`D-56` · `D-66` · `D-67` · `D-68` · `D-69`).** **THE ARCHITECT, VERBATIM** (`D-68`): *"a constraint is mechanically the same as a listener from the perspective of the rust store triggers. The distinction is whether it is registered as a constraint (and thus run in the constraint loop and expecting the constraint signature format) or as a listener (and thus running after constraints and not being confined to the constraint signature)"*. **WHAT A CONSUMER SEES, IN FOUR SENTENCES.** **(i) ONE PREDICATE, COMPUTED WHERE THE VERSIONS LIVE:** a registration fires when **its address is a PREFIX of the act's OR the act TOUCHED it** — the touched set being the written value's paths unioned with what it replaced, and, for a `delete`, the whole subtree it removed — so **a listener bound at a strict descendant of a deleted address FIRES** where the prefix-only rule never reached it, and a pair standing there is ASKED. **(ii) ★ A PAIR AT AN ANCESTOR IS ASKED FOR A DESCENDANT'S ACT, AND SO IS A LISTENER:** a pair at `['window','tabs']` is asked for a `delete` at `['window','tabs','landingPage']`, and its refusal crosses and rolls the delete back — because the value read at a prefix contains its subtree (`D-56`, whose `1.4.0` half is `§1.4.0` item 1) — **while a LISTENER bound at that ancestor fires for the same act, which the prefix rule never had to be taught.** **WHAT THIS RELEASE ADDS TO THAT DIRECTION IS THE REVERSE ONE**: `D-67` measured the listener SILENT on a touched descendant while the pass asked the pair standing there, and `D-69`'s restored registration closed it — **so the two kinds now share ONE reach, computed in Rust where the per-tier versions live.** **(iii) A PAIR AT A DESCENDANT IS ASKED ONLY WHEN THE ACT TOUCHED IT:** `write(['a','b'], {c,d})` asks `['a','b','c']` and `['a','b','d']` and **not** `['a','b','e']` — the criterion is TOUCHED and not "descendant" (`D-66`). **(iv) AND THE ELEMENT CARRIES NO KIND**, because **a registration is a HANDLE AND A BODY and a constraint already has both** — its `id` is the handle (`D-29`) and its `constraint` is the body (`D-26`), so the inert listener body the old `store.register(home, noopListener)` fabricated does not return (`D-69`). **WHAT THAT MEANS FOR YOU: `triggered` and `pending` name listener handles AND constraint `id`s in ONE list, and which is which is your own registry's answer.** (`D-56`; `D-66`; `D-67`; `D-68`; `D-69`; `6fd15a7`; `c3c61ab`; `3384d2e`; the guide's `§6.3` item 2, `§6.4` and `§7.6`–`§7.9` clauses of the same date; `tests/e2e/discard-witness.mjs`'s `DW-13`/`DW-14` cells.)
+
+**6 · ★ `pending` EMPTIES ON A PASSING WRITE — BECAUSE THE PASS'S SET NOW EQUALS THE STORE'S FIRED SET.** **WHAT MOVES:** `record.pending` is seeded whole from the store's `triggered` set and every handle the pass EVALUATES is checked off by identity, so **the CONSTRAINTS the store named leave `pending` as the pass passes them and the member reads `[]` on an arm whose fired set is constraints only** — *measured `1` → `0`* — **and a LISTENER's handle is the one element that STAYS, because the pass evaluates constraint rows and a listener is the DELIVERY's work (measured at `K-2` `['anc-pair','watch-child']` → after the pass `['watch-child']`).** **WHAT IT MEANS, SAID PLAINLY: `pending` IS NO LONGER A LIST OF "WHAT I STILL OWE A DELIVERY TO" — IT IS THE LIST OF HANDLES THE PASS DID NOT EVALUATE.** A non-empty `pending` therefore means one of two things and only two: **the write FAILED** (the record's `pending` is the whole returned set, because a failing arm checks nothing off), **or a handle stands in `triggered` that the pass holds no row for** — the one reachable state being a registration whose own body refused it at the registration instant (`ConstraintRefusedAtRegistration`, state `2`), which leaves the store-side entry standing, fires nothing, silently. **AND AT `K-2` THE MEMBER NOW CARRIES BOTH KINDS**: a write whose pair stands at a TOUCHED descendant and whose listener stands at an ancestor carries **`2`** elements at `K-2` where the prefix-only composition carried **`1`**, and **`1`** after the pass (the listener's handle, which is the delivery's work and never the pass's). (`D-56`; `D-69`; `6fd15a7`; the guide's `§6.4` clauses of the same date; `tests/e2e/discard-witness.mjs`'s `DW-14.3`/`DW-14.4`.)
+
+**7 · ★ A DERIVED ADDRESS IS NOT AN ADDRESS — AN INDEX INSIDE A COLLECTION IS DERIVED, AND A REGISTRATION THERE IS A REGISTRATION ON A VALUE THE STORE NEVER WROTE (`D-70`).** **THE ARCHITECT, VERBATIM:** *"A constraint/listener that cares about a derived value like the vec index should listen to the vec, not the contained node"*. **WHAT A CONSUMER SEES:** `delete(['v',0])` moves `{b:2}` from `['v',1]` to `['v',0]`, **and a listener at `['v',1]` does not fire** — correctly, because **the store wrote `['v',0]` and replaced nothing at `['v',1]`**, and the `triggered` list is right to be empty. **THE RULE: register at the CONTAINER (`['v']`) and READ what you care about** — a container listener fires once, is handed the ACT's address `['v',0]`, and its body's read at `['v']` answers the renumbered collection. **AND THE TWO KINDS HAVE DIFFERENT JOBS, WHICH IS THE SENTENCE TO CARRY AWAY: IF YOUR CALLBACK CHANGES THE STORE IT IS A CONSTRAINT OR A REPAIR; IF IT TELLS THE WORLD IT IS A LISTENER** — *"Functions that automatically produce changes in the stored data should be written as constraint/repair, not as listeners, because constraint/repair has loop guards while listeners don't"*, and *"The use case for listeners is for updating external code with new data"*. **NO MEMBER, STATUS, KERNEL ITEM OR BOUND MOVES: this is a rule of USE over a surface already measured.** (`D-70`; `a1c65d9`; `80c2ca7`; the guide's `§7.9` of the same date; `tests/e2e/discard-witness.mjs`'s `DW-15.1`–`DW-15.3`.)
+
+**8 · ★ A LISTENER IS INDEPENDENT OF YOUR COMMIT, AND DELIVERY NESTS — its refusal is CONTAINED, its THROW is NOT, and the windows are nested synchronous calls on one thread (`D-71` · `D-72` · `D-73`).** **THE INDEPENDENCE, VERBATIM** (`D-71`): *"A listener is independent of the commit record of the triggering caller. The caller does not need to know about the outcome of the listeners."* **SO: a listener runs in its own commit, its OUTCOME IS THAT COMMIT'S, and a listener's refusal does NOT fail the write that fired it** — your write already passed every constraint and already answered before the delivery ran. **AND THE THROW IS THE EXCEPTION, BY RULING** (`D-73`, verbatim: *"Keep the throw so that the client can log errors cleanly"*): **a listener that throws makes YOUR write throw the listener's own error, identity equal, and ANSWER NOTHING — while its DATA HAS ALREADY LANDED** (the commit resolved before its delivery ran; what the throw takes away is the answer, not the write). **THE PRACTICAL HAZARD, WRITTEN: a client that retries on error RE-APPLIES A WRITE THAT ALREADY SUCCEEDED**, and the error carries no depth, handle or address — *"A contained throw is an error nobody can log"* is the ruling's reason, and **a listener body's own `catch` is the only containment arm there is.** **AND THE NESTING** (`D-72`): `outer write → its commit → its pass → its delivery → listener A → A's write (a NEW commit) → A's pass → A's delivery → listener B → …` — **windows live at once, NESTED, every level a synchronous call**, so *"interleaving"* is **nested suspension**: A's whole chain runs to completion before the window that fired it invokes its next listener. **FOUR PROPERTIES, NONE DECLARED ANYWHERE UP THE STACK:** **depth is UNBOUNDED** (no counter, no cap, no instrument); **the CROSS-WINDOW ORDER is real and undeclared** (a nested chain precedes the window's next listener — the machine provides it and no clause promises it); **RE-ENTRANCY IS UNAVOIDABLY OPEN** (a listener that writes at the address it was delivered for fires itself again); **and NOTHING ABOVE SEES BELOW** — a chain that fails at depth three is indistinguishable, to the original caller, from one that never ran, **except by the throw, which crosses every hop as the same error object.** **MEASURED 2026-10-29 ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY, ALL THREE WAYS:** the throw (`write(['a'])` threw the listener's `Error`, `===` true, and answered `undefined`, with `['a']` reading `1`); the containment beside it (a listener's refused write crossed nothing, the caller's record carried no status and no `log`, and `['b']` read ABSENT, while the same caller writing `['b']` directly WAS refused); and the depth-two throw (surfacing first at the inner write, then reaching the original caller with identity preserved, and the original write unanswered — while a listener body that catches instead leaves the original write ANSWERING ITS OWN RECORD). (`D-71`; `D-72`; `D-73`; `fc81fd3`; `a3312b7`; the guide's `§6.5`, `§6.5a` and `§6.6` of the same date.)
+
+**NO VERSION BUMP IS PROPOSED BY THIS SECTION AND THE ELEVEN VERSION CELLS STAY AT `1.4.0` — AND WHETHER `1.5.0` IS CUT IS NOT WRITTEN HERE, BECAUSE IT IS NOT A DOCUMENT'S TO WRITE.**
+
+**⟶ AND THE FIRST OF THOSE TWO CLAUSES IS SUPERSEDED BY THIS PREPARATION, 2026-10-29 — THE BUMP IS MADE, THE SECOND CLAUSE IS NOT, AND THE THREE ARE NOW SIX.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE as the reading of its own date and is read THROUGH this clause; its second half — *"whether `1.5.0` is cut is not written here, because it is not a document's to write"* — is UNMOVED and governs every clause of this section.** **SUPERSEDED: *"NO VERSION BUMP IS PROPOSED BY THIS SECTION AND THE ELEVEN VERSION CELLS STAY AT `1.4.0`"* — the bump IS this preparation's, and the eleven cells read `1.5.0`** (the clause at this section's head states the manifest, the pins, the five platform manifests and the rebuilt artefact's `version()`; `scripts/publish.sh --figures` asserts the one generated line in three shipped documents). **AND ITS LAST SENTENCE IS RE-READ TOO: *"THE THREE COMMITS THAT MOVE THE PACKAGE"* reads SIX** — `d862448`, `85b0174`, `90f810c`, `c3c61ab`, `3384d2e` and `6fd15a7` — **because the arithmetic above re-sorts all twenty-seven and six of them change a line the package ships.** **The honesty the paragraph declares is unmoved: a consumer can read every commit that moves the package before installing a release that carries them.** **The three commits that move the package are declared here so that a consumer can read them before installing a release that carries them, and so that no reader has to infer them from a tarball's contents** — the `DEF-AC` honesty this whole file has been corrected toward, and the same honesty the corrected heads above owe.
+
+---
+
 ## §1.3.0 · **CUT AND PUBLISHED — tag `v1.3.0`** — what that release carries, ten commits past `v1.2.0`
 
 **⟶ THE HEADING THAT STOOD HERE WAS *"`## §1.3.0 · **PREPARED — NOT CUT** — what `1.3.0` carries, ten commits past `v1.2.0``"*, AND IT IS CORRECTED AT ITS OWN LINE RATHER THAN ANNOTATED AROUND, 2026-10-28.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted above, the section's body below stands BYTE-FOR-BYTE as the reading of its own date, and every reading in it that says the release is not cut is read THROUGH the head clause.** **THE DEFECT: the heading denied the release the tag names — `git tag --list` answers `v1.3.0`, the tag names a tree whose `bindings/js/package.json` reads `"version": "1.3.0"` at its own bytes, and the registry carries `1.3.0` — so a reader opening this file met *"PREPARED — NOT CUT"* over a published version.** **That is the `DEF-AC` class one level in, and it is the third iteration of the same class; `D-57` is the ruling that ends the recurrence.** (`D-57`; the head clause above.)

package/index.d.ts

@@ -337,9 +337,10 @@ export type StoreStatus =
   | (string & {});
 
 /**
- * **THE KERNEL'S OWN LOG ENTRY** — *"exactly six members — `seq` · `kind` · `id` · `message` · `opId` ·
- * `state`"* (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1, whose member set is CLOSED:
- * *"a seventh member of `LogEntry` … is not a variation, it is a different shape"*). **DECLARED HERE ONLY
+ * **THE KERNEL'S OWN LOG ENTRY** — *"exactly FIVE members — `kind` · `id` · `message` · `opId` · `state`"*
+ * (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1's shape, read through `D-65` of 2026-10-28;
+ * its member set is CLOSED: *"a seventh member of `LogEntry` … is not a variation, it is a different shape"*).
+ * **DECLARED HERE ONLY
  * AS THE ELEMENT SHAPE OF THE FAILURE'S `log` MEMBER, AND MINTED BY NO CLAUSE OF THIS UNIT**: an attempt's
  * message log entries are the KERNEL'S records, carried VERBATIM, and no flattening is declared — a client
  * that reads one reads the kernel's own entry.
@@ -352,20 +353,21 @@ export type StoreStatus =
  * uses the new commit's message log. Constraints/Repairs should always use the same commit. Listeners should open
  * a new commit, because the triggering commit already passed constraints"*** (`strata/decisions.md` · `D-53`).
  * **SO ONE COMMIT'S WORK IS ONE LIST**: a write, the constraint passes that judged it, a repair's own write and
- * the re-run after it all append to the same array, `seq` is *"the ordinal of the list it stands in"* and it runs
- * `1..n` CONTINUOUSLY across those attempts, and **the `log` a refusal crosses with IS that array** — which is what
+ * the re-run after it all append to the same array, **each entry standing at its own INDEX** and the list running
+ * `0..n-1` CONTINUOUSLY across those attempts, and **the `log` a refusal crosses with IS that array** — which is what
  * `DEF-AK`'s *"one inner refusal, two hosts"* measures and what `D-52`'s merge question dissolved into. **A
  * LISTENER'S WRITE IS THE ONE THAT STARTS A FRESH LIST**, because the commit that triggered it has already passed
  * its constraints and what the listener does is a new question.
  *
- * **⟶ AND WHAT `seq` IS TRUE OF IS SAID PLAINLY HERE, 2026-10-28 — `DEF-AI`, MEASURED.** **`seq` is the position
- * of the entry in the commit's own message log; it is not the store's journal ordinal, and the two differ by
- * design.** The kernel mints it as `log.length + 1` on the one list its commit appends to
- * (`bindings/js/src/entry/kernel-foundations.mjs`), so a refusal's entry can carry `seq` `1` while the store's
- * own journal counter reads `41`. **READ THE TWO AS TWO ORDINALS WITH TWO HOMES**: `JournalOp.seq` is the
- * STORE's append ordinal and orders the store's record; this `seq` orders the COMMIT's message log and nothing
- * else. **A consumer that compares them compares two different subjects, and no reading of this declaration
- * says the first equals the second.**
+ * **⟶ AND THE MEMBER THAT USED TO CARRY THAT POSITION IS GONE, 2026-10-28 — `D-65`: THE ARRAY INDEX IS THE
+ * POSITION.** `RCA-8(g)` ANNOTATE-BESIDE: **the clause below stands BYTE-FOR-BYTE as the reading of its own date
+ * and is read THROUGH this one; what it said of `seq` is RETIRED, not rewritten.** **THE RULING, THE ARCHITECT,
+ * ONE WORD: *"Drop it"*** (`strata/decisions.md` · `D-65`) — and `DEF-AI`'s own demand had offered the route:
+ * *"mint `seq` from the attempt's counter, **or omit the member**."* **THIS DECLARATION OMITS IT.** A log entry
+ * no longer carries `seq`: **the member is gone, the position is the array index, and there is no second copy of
+ * it to disagree with the journal's ordinal.** **`JournalOp.seq` IS UNMOVED AND IS STILL A DIFFERENT SUBJECT** —
+ * the store's own append ordinal, ordered in the store's record — **and the two are now impossible to confuse,
+ * because the one that named the commit's list is no longer there to be read.**
  *
  * **AND `state`'S DOMAIN IS `KC-1`…`KC-9`, NOT `KC-1`…`KC-8`.** **`D-53`'s THIRD RULING — *"Open the token
  * set"* — gives the SAVE ARM a token of its own (`KC-9`)**, so that a `file`-tier save that fails at the terminal
@@ -375,7 +377,6 @@ export type StoreStatus =
  * never `status`, exactly as every `KC` token does, so the closed status set keeps its `20` members and its ranks.
  */
 export interface LogEntry {
-  readonly seq: number;
   readonly kind: 'constraint-check' | 'repair-run' | 'commit' | 'outcome';
   readonly id: string | null;
   readonly message: string;

package/index.mjs

@@ -89,7 +89,7 @@ import { encodeAddress, encodeFilePath, encodeJournalLength, encodeOpId, encodeT
 import { admittedConstraintBatch, constraintAddress, decodeBaseState, decodeJournalOp, decodeSegments, decodeValue, encodeConfig, spellConstraintAddress } from './src/entry/frame.mjs';
 import { addressSpelling } from './src/entry/kernel-foundations.mjs';
 import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, homeAddressKey, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
-import { commitPositionRefusal, constraintOverwrittenByListen, deliver, listenerStandingAt, registerOn, terminalArm } from './src/entry/delivery.mjs';
+import { commitPositionRefusal, constraintOverwrittenByListen, deliver, installRegistrationSeam, listenerStandingAt, registerOn, terminalArm } from './src/entry/delivery.mjs';
 import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintDelete, constraintWrite, constraintsKernel, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, withdrawStanding } from './src/entry/constraints.mjs';
 const require_ = createRequire(import.meta.url);
 const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release', 'storeroom_js_binding.node');
@@ -496,7 +496,11 @@ export function storeCreate(cfg) {
     /// *"A delete is an editing verb and must pass constraints. This includes all of the relevant commit and
     /// message logic."*** **THE BYTES THIS PARAGRAPH REPLACES READ *"`delete` IS THE ONE ACT WHOSE DELIVERY RUNS
     /// NO PASS"*, AND THEY WERE TRUE OF `1.3.0` AND FALSE OF THIS TREE**: a delete opens its own commit, and
-    /// **the delete-shaped attempt `constraints.mjs`'s `constraintDelete` builds asks every pair standing at the
+    /// **⟶ AND THE SET IT ASKS IS NOW THREE-PART, `D-66` (2026-10-28): every ANCESTOR of the delete's address (`D-56`), the
+    /// address itself, and EVERY DESCENDANT THE DELETE TOUCHED — for a delete, the whole subtree, because removing it
+    /// changes what a read there returns (absent where it stood). A pair at an address the act did NOT touch is still
+    /// not asked, which is the criterion: TOUCHED, not descendant.** **the delete-shaped attempt
+    /// `constraints.mjs`'s `constraintDelete` builds asks every pair standing at the
     /// delete's own address **⟶ AND AT EVERY ANCESTOR OF IT, `D-56` (2026-10-28): THE PAIR'S ADDRESS BEING A PREFIX OF
     /// THE ACT'S IS THE MEMBERSHIP TEST NOW, because the value read at a prefix CONTAINS its subtree and a change at a
     /// descendant changes what that read returns** — against THE STATE THE DELETE LEFT**, appends the attempt's terminal entry to the
@@ -1634,6 +1638,12 @@ export function storeCreate(cfg) {
   // `§4.2` item 4). **IT IS INSTALLED AFTER THE BATCH ROUTES ABOVE**, so a `listen` the construction itself
   // performs is not counted as a commit the caller opened and leaves the count at `0` on the return.
   installAttemptSeam(instance);
+  // **⟶ AND `D-69`'S REGISTRATION CHANNEL, ONCE, BY THE SAME RULE — 2026-10-29.** The registration entry admits a
+  // body of EITHER kind, and the kernel's `K-1` hands the pair's own constraint function through this channel after
+  // `listen` has written the home entry. **IT IS INSTALLED HERE BECAUSE THE REGISTRY IT FILLS IS THIS FACTORY'S
+  // `state`** (`delivery.mjs`'s `installRegistrationSeam` states the shape and the two places the kinds part
+  // company), **and it is symbol-keyed, so the product's FOURTEEN own members are unmoved** (`A117` (D6)).
+  installRegistrationSeam(instance, state);
   return instance;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -41,11 +41,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.4.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.4.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.4.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.4.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.4.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.5.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.5.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.5.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.5.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.5.0"
   },
   "publishConfig": {
     "access": "public"

package/src/entry/constraints.mjs

@@ -884,12 +884,17 @@ export function constraintWrite(state, instance, address, tier, value) {
  * **A REFUSAL IS THE ORDINARY REFUSAL** (`constraintCrossing` below): the surface's one plain form
  * `{status, message, log}`, its `status` the set's rank-`20` member `ConstraintPassRefused`, and its `log` the
  * COMMIT'S OWN LIST — `constraint-check` for the pair that refused, then the terminal `outcome` entry whose
- * `state` is the kernel's token — each with its `seq`. **AND THE SAFE STATE IS `D-55` ITEM 5's**: the
+ * `state` is the kernel's token — each at its own index in that one list, the list's position being the array
+ * index and no member (`D-65`, 2026-10-28). **AND THE SAFE STATE IS `D-55` ITEM 5's**: the
  * composition the terminal act runs (`composeRollback`, one floor call per address at that address's first owed
  * op) undoes **the delete and every edit the commit made under it**, so the caller meets a store back at the
  * state the commit opened at. Where the refusal is a RESTARTED check's (`D-42`, a reversal raised by a body
- * inside this pass), the compensation is the reversal's own and it restores the journal mark the commit cached
- * at ITS OPENING (`state.mjs`'s `windowMark`) — the same safe state by the other route.
+ * inside this pass), the compensation is the reversal's own and it restores the journal mark the commit holds
+ * at its LAST VALIDATED position (`state.mjs`'s `windowMark`; `D-63`, 2026-10-28) — the same safe state by the
+ * other route. **⟶ AND FROM 2026-10-28 THAT MARK MOVES (`D-63`): it is the position the commit's opening cached,
+ * bumped forward at every constraint sweep that ENDS VALID (`kernel-attempt.mjs`'s passing arm, between the
+ * verdict and the delivery), so the restore target is THE LAST VALIDATED STATE and a delete's own validated
+ * landing STANDS against a later refusal in the same commit.**
  *
  * **`D-3`'S NO-OP ARM IS NOT AN EDIT**: where the delete removed nothing there is no journal op, so
  * `commitRemoval` answers `null`, **no attempt is opened, no pass runs and no entry is appended** — there is no
@@ -1446,9 +1451,10 @@ function constraintCrossing(refusal) {
 // MESSAGE IS THE STORE'S OWN GENERATED SENTENCE** (`addon_.errorMessage`, whose `§8.2` clause for this code of
 // 2026-10-26 is *"… was refused by a constraint pass, the state this act would leave is not one the
 // registered constraints admit"*) — `DD-52` forbids a code's message from a second source, so none is
-// authored here — **and the `log` is ONE `constraint-check` entry of the kernel's own six members**
-// (`kernel-surface.md §2.5` item 1: `seq` · `kind` · `id` · `message` · `opId` · `state`) **naming the
-// constraint that refused and the state it refused.** **NO `KC` TOKEN CROSSES** (`A120` (2);
+// authored here — **and the `log` is ONE `constraint-check` entry of the kernel's own FIVE members**
+// (`kernel-surface.md §2.5` item 1: `kind` · `id` · `opId` · `message` · `state`; the shape moved `6 → 5` on
+// `strata/decisions.md` · `D-65`, 2026-10-28, which removed `seq` — the array index is the position) **naming
+// the constraint that refused and the state it refused.** **NO `KC` TOKEN CROSSES** (`A120` (2);
 // `docs/specs/storeroom-js/surface.md §2.12` item 3 item 2): `state` is `null` and the sentence is where the
 // state is named.
 //
@@ -1900,11 +1906,13 @@ export function witnessDiscardedReversal(instance, window) {
 ///     `attempt-lifecycle.md §2.4` item 3's terminal-arm clause): no third value is minted;
 ///   * **THE REFUSAL'S OWN LOG ENTRY IS APPENDED TO THE ATTEMPT'S LOG** — one `constraint-check` entry naming
 ///     the pair that refused the state the action left and saying what the refusal's compensating act did
-///     (`undoSpelling`). **IT ENTERS THROUGH THE KERNEL'S OWN `append`**, so it carries the log's six declared
-///     members and the log's own ordinal: the entry the driver reads in `report.log` is a log entry of the
-///     attempt's log and not a record of another kind. **THE REFUSAL'S OWN LIST KEEPS ITS FIVE MEMBERS AND NO
-///     `seq`** — that list is the judgement's and no attempt log stands at its own instant (`D-41` item `4`) —
-///     so the copy is the report's and the original is the refusal's, each honest in its own record;
+///     (`undoSpelling`). **IT ENTERS THROUGH THE KERNEL'S OWN `append`**, so it carries the log's declared and
+///     its POSITION is the report's own list's index: the entry the driver reads in `report.log` is a log entry
+///     of the attempt's log and not a record of another kind. **AND BOTH LISTS ARE THE FIVE-MEMBER SHAPE FROM
+///     2026-10-28 — `D-65`: THE ARRAY INDEX IS THE POSITION.** The refusal's own list is the judgement's (no
+///     attempt log stands at its own instant, `D-41` item `4`) and the report's copy is appended here; **the two
+///     copies now agree because there is no `seq` member in either of them to disagree** — the disagreement this
+///     clause was re-derived for was a member's, and the member is removed (`strata/decisions.md` · `D-65`);
 ///   * **AND THE REFUSAL ITSELF TRAVELS UNDER `RESTART_REFUSAL`** so that `constraintWrite` re-throws THE VERY
 ///     VALUE the restarted check built — same `status`, same `message`, same `log` — with nothing re-rendered
 ///     and no second spelling of the store's sentence (`DD-52`).
@@ -1920,9 +1928,10 @@ function carryRestartRefusal(report, refusal) {
   const carried = refusal !== null && typeof refusal === 'object' && Array.isArray(refusal.log)
     ? refusal.log
     : [];
-  // THE APPEND IS THE KERNEL'S OWN (`append`): a local holder carrying the report's own list, so the ordinal
-  // is `log.length + 1` exactly as every other entry of this log was minted, and no `Array.prototype.push` is
-  // read on this path (`contract.md §2.1`'s clause of 2026-10-24 on `F8-2`).
+  // THE APPEND IS THE KERNEL'S OWN (`append`): a local holder carrying the report's own list, so the entry lands
+  // at the report's list's next INDEX exactly as every other entry of this log did, and no `Array.prototype.push`
+  // is read on this path (`contract.md §2.1`'s clause of 2026-10-24 on `F8-2`). **THE ORDINAL IS THAT INDEX**
+  // (`D-65`, 2026-10-28): nothing is minted to carry it.
   const log = { log: report.log };
   for (let index = 0; index < carried.length; index += 1) {
     const entry = carried[index];
@@ -1931,8 +1940,9 @@ function carryRestartRefusal(report, refusal) {
     // (`D-52` counted it as rule 1's fourth kind), so the iteration is rebuilt from the two identities the entry
     // itself carries: **the pair stands by its `id`, and the op by the `opId` the judgement's reversal answered —
     // and the pair's own row is not in hand here, which is why the identity alone is spelled.** Nothing is
-    // renumbered and nothing is re-authored: the entry minted here is the report's own, by the report's own
-    // ordinal, and its two identity columns read exactly what the entry it carries read.
+    // renumbered and nothing is re-authored: the entry minted here is the report's own, at the report's own next
+    // index (`D-65`: the index is the position), and its two identity columns read exactly what the entry it
+    // carries read.
     append(log, entry.kind, { pair: { id: entry.id }, op: { opId: entry.opId } }, entry.message, entry.state);
   }
   Object.defineProperty(report, RESTART_REFUSAL, {
@@ -2234,6 +2244,19 @@ export function judgeReversal(instance, watched, reversalId) {
   // own scope, `kernel-attempt.mjs`) and re-caches nothing, so the mark in flight stays the OUTERMOST opening's:
   // the position the attempt found. **THE `finally` RELEASES THE WINDOW ON EVERY ARM, INCLUDING THE THROWING ONE**,
   // because a refusal that leaves a commit standing is the count this package's own cells measure.
+  //
+  // **⟶ AND FROM 2026-10-28 THE MARK IN FLIGHT IS THE LAST VALIDATED POSITION AND NOT THE OPENING — `D-63`.**
+  // `RCA-8(g)` ANNOTATE-BESIDE: **every byte above stands**, and the one sentence it states about the restart arm
+  // — *"the mark in flight stays the OUTERMOST opening's: the position the attempt found"* — is read THROUGH this
+  // clause: **the position the attempt found is where the cache STARTS and it is not where it stays.** **The
+  // architect, verbatim: *"After the constraint sweep ends in a valid state, bump the restore mark. The passing
+  // constraint state marks the new next valid state."*** **So on the restart arm — the drain runs INSIDE the pass's
+  // own scope, hence AFTER the passing arm bumped (`kernel-attempt.mjs`) — `windowMark` answers the state the
+  // passing sweep VALIDATED**, the listener's or a repair's own work being on the side of it `D-60` places it: a
+  // repair's write is during the sweep and goes with the write, a listener's write is in the delivery and stands.
+  // **THE AT-REST ARM IS UNMOVED AND THE REASON IS MEASURED**: that judgement runs in a window whose own cache is
+  // taken at its opening, **no sweep has passed inside it**, and a reversal appends no entry — so the mark still
+  // names the PRE-REVERSAL state and the at-rest control restores exactly what it restored before.
   const opened = openCommit(instance);
   try {
     // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
@@ -2346,6 +2369,25 @@ export function judgeReversal(instance, watched, reversalId) {
 /// there immediately before the reversal; and a REFUSED mark, a CACHELESS window and a store that did not
 /// restore are *"NOT undone"*, naming every address that does not stand again (the arm unchanged).
 ///
+/// **⟶ AND FROM 2026-10-28 THE MARK THIS ACT NAMES MOVES — `D-63`: THE RESTORE TARGET IS THE LAST VALIDATED STATE,
+/// AND THIS IS WHERE THE RESTORE READS IT.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte above stands BYTE-FOR-BYTE
+/// and is read THROUGH this clause; the two phrases *"the journal mark its commit cached at its OPENING"* and
+/// *"the 2026-10-27 ruling above"* are the OPENING'S position and the clause that fixed it, and neither is the
+/// whole of what this act names from this date.** **THE RULING, THE ARCHITECT, VERBATIM:** *"After the constraint
+/// sweep ends in a valid state, bump the restore mark. The passing constraint state marks the new next valid
+/// state."* **SO `windowMark` ANSWERS THE LAST VALIDATED POSITION**: `state.mjs`'s `openCommit` still caches the
+/// store's own `journalMark` where the commit OPENS, and `state.mjs`'s `bumpWindowMark` moves that cache to the
+/// store's own position at every constraint sweep that ends VALID — **called from `kernel-attempt.mjs`'s passing
+/// arm, between the sweep's verdict and the delivery**. **THE TWO HALVES `D-60` SPLITS ARE THEREFORE PLACED BY
+/// POSITION AND NOT BY IDENTITY:** a repair's write is DURING the sweep, so a sweep that refuses it never bumps
+/// and the refusal undoes it with the write; a listener's write is AFTER the sweep, in the delivery, so the mark
+/// the outer refusal names is already carried past it and the outer's restore does not reach it. **A COMMIT WHOSE
+/// SWEEP NEVER PASSES KEEPS ITS OPENING MARK** — nothing bumps, and a refusal restores to the opening, which is
+/// the behaviour the paragraphs above declare and it STANDS for that case. **NO BYTE OF THE VERDICT BELOW MOVES**:
+/// the watch is still what was owed, the two success arms and the failure arm are still read from the addresses'
+/// standings — what changes is which state a successful act is EXPECTED to leave, and `undoSpelling` says which
+/// mark it measured.
+///
 /// **AND WHY IT CANNOT RECURSE INTO THE MEMBER.** `judgeReversal` is reached from `index.mjs`'s `rollback`
 /// member; the restore never calls that member, the addon's `rollback`, or any package member — only the store's
 /// `restoreMark` at its entry — so the judgement's ONE pass over the pairs stays one pass and `D-40`'s floor law
@@ -2367,11 +2409,15 @@ export function judgeReversal(instance, watched, reversalId) {
 /// NO SECOND SAVE IS ATTEMPTED** — the store's answer is the whole report.
 function restoreReversal(instance, moved) {
   const addon_ = withAddon();
-  // **THE ONE ACT: THE STORE RETURNS ITS OWN STATE TO THE MARK ITS COMMIT CACHED AT ITS OPENING** (`windowMark`,
-  // `state.mjs`) — NOT to the journal's head, which is the write's own landing on the restart arm. **THE CARRIER
-  // IS THE STORE'S OWN ANSWER, HANDED BACK VERBATIM**: `{k:'s', v:<op id>}` names an entry and `{k:'F'}` names the
-  // FLOOR (the state the store was born with, where the journal held no entry when the commit opened). **NOTHING
-  // IS COMPOSED HERE**, so the mark has one spelling and it lives at the store's edge.
+  // **THE ONE ACT: THE STORE RETURNS ITS OWN STATE TO THE MARK ITS COMMIT HOLDS — THE LAST VALIDATED POSITION
+  // (`windowMark`, `state.mjs`)**, and NOT to the journal's head, which is the write's own landing on the restart
+  // arm. **THE MARK STARTS AS THE COMMIT'S OPENING POSITION AND MOVES FORWARD AT EVERY PASSING SWEEP — `D-63`,
+  // 2026-10-28** (`state.mjs`'s `bumpWindowMark`, called from `kernel-attempt.mjs`'s passing arm between the verdict
+  // and the delivery), **so what this act restores is THE LAST VALIDATED STATE**: a validated edit STANDS against a
+  // later refusal in the same commit, and a commit whose sweep never passed still restores to its opening.
+  // **THE CARRIER IS THE STORE'S OWN ANSWER, HANDED BACK VERBATIM**: `{k:'s', v:<op id>}` names an entry and
+  // `{k:'F'}` names the FLOOR (the state the store was born with, where the journal held no entry when the commit
+  // opened). **NOTHING IS COMPOSED HERE**, so the mark has one spelling and it lives at the store's edge.
   let refused = null;
   let cacheless = false;
   const mark = windowMark(instance);
@@ -2547,10 +2593,17 @@ function undoSpelling(undo) {
       + `: ${typeof said === 'string' ? said : ''}) and holds the state it held; `;
   }
   if (undo.failed.length === 0 && undo.wholeCommit.length === 0) {
+    // **⟶ AND THE PARENTHETICAL NAMES THE MARK THE RESTORE ACTUALLY NAMED — `D-63`, 2026-10-28.** It read *"…
+    // which is the state the journal mark the commit cached at its opening holds"*, and **that sentence stopped
+    // being true of this arm the moment the mark began to MOVE**: the position the restore names is the LAST
+    // VALIDATED ONE (`state.mjs`'s `bumpWindowMark`), so where no address moved past the pre-reversal standing it
+    // is the state the LAST PASSING SWEEP left — and that is precisely why a reversal's own effect is what this
+    // arm undid and nothing else.
     return `${refusal}the reversal was UNDONE: every address it moved stands again exactly as it stood before `
       + 'the reversal — the same value at the same tier, or absent where it was absent (the baseline this '
-      + 'verdict measured is the pre-reversal standing, which is the state the journal mark the commit cached '
-      + 'at its opening holds)';
+      + 'verdict measured is the pre-reversal standing, which is the state the LAST VALIDATED MARK holds: the '
+      + 'position the commit cached at its opening, moved forward by every constraint sweep that has passed '
+      + 'since)';
   }
   // **⟶ AND A SUCCESSFUL RESTORE WHOSE MARK STANDS BEFORE THE REVERSAL IS NAMED AS WHAT IT IS — `DEF-AJ`.**
   // The store's act succeeded (`failed` is empty), so nothing here is a failure; what differs from the watch's
@@ -2566,10 +2619,16 @@ function undoSpelling(undo) {
     }
     const movedCount = undo.total === 1 ? 'address' : 'addresses';
     const stands = undo.restored === 1 ? 'stands' : 'stand';
-    return `${refusal}the store was restored to the journal mark its commit cached at its opening, so the `
-      + `reversal was UNDONE — as a WHOLE-COMMIT UNDO (the baseline this verdict measured is the pre-reversal `
+    // **⟶ AND THE MARK THIS SENTENCE NAMES IS THE LAST VALIDATED ONE — `D-63`, 2026-10-28.** *"the journal mark
+    // its commit cached at its opening"* is now the OPENING alone: the position moves forward at every passing
+    // sweep (`state.mjs`'s `bumpWindowMark`), so an address standing past the pre-reversal standing is one the
+    // commit's own work after its LAST VALIDATION left — and the sentence says which mark it measured.
+    return `${refusal}the store was restored to the LAST VALIDATED MARK its commit holds (the position its `
+      + `opening cached, moved forward by every constraint sweep that has passed since), so the reversal was `
+      + `UNDONE — as a WHOLE-COMMIT UNDO (the baseline this verdict measured is the pre-reversal `
       + `standing): all ${undo.total} ${movedCount} it moved ${stands} where that mark leaves them, and the `
-      + `difference from the pre-reversal standing is the commit's own earlier work, undone with it — ${named}`;
+      + `difference from the pre-reversal standing is the commit's own work since that validation, undone with `
+      + `it — ${named}`;
   }
   let named = '';
   for (let index = 0; index < undo.failed.length; index += 1) {
@@ -2770,6 +2829,15 @@ function reversalSaid(outcome) {
 /// a reversal's judgement**, so there is no attempt log to carry verbatim (`§2.5` item 3's `log` is *"the
 /// attempt's own message log"*).
 ///
+/// **⟶ AND THIS CLAUSE'S FIVE-MEMBER FORM IS NOW THE KERNEL'S OWN SHAPE, 2026-10-28 — `D-65`: THE ARRAY INDEX
+/// IS THE POSITION.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte above stands BYTE-FOR-BYTE and is read THROUGH
+/// this one**; what moves is the reason, not the entry. **THE 2026-10-28 RE-DERIVATION PUT `seq` `1` BACK** by
+/// reading the ordinal rule as *"the first element of a one-entry list is `1`"*; **`D-65` removes the member the
+/// rule was about** (`strata/decisions.md`, the architect: *"Drop it"*), so **the five-member entry this clause
+/// built is the declared shape and the `1` is gone at every arm, not only here.** **THE POSITION IS THE INDEX**:
+/// this entry is `log[0]` of the one-entry list it stands in, and the ordinal a reader wants is the index it is
+/// already holding. **NO OTHER MEMBER, KIND, STATUS, SENTENCE OR ENTRY COUNT MOVES.**
+///
 /// **⟶ AND THE ENTRY CARRIES FIVE MEMBERS AND NOT SIX, 2026-10-27 — `D-41` ITEM `4`, ANNOTATE-BESIDE.** The
 /// clause above read *"The six members, their `constraint-check` kind and their `seq` ordinal are the kernel's
 /// own shape"* and the entry minted `seq: 1`; **THAT `1` WAS FABRICATED AND HAS NO RECORD BEHIND IT.** The
@@ -2876,22 +2944,17 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
       + ` — ${undoSpelling(undo)}`;
   }
   const entry = {
-    // **⟶ AND THE `seq` STANDS, 2026-10-28 — `DEF-AI`: THE ENTRY'S DECLARED SHAPE IS THE KERNEL'S CLOSED SIX
-    // AND THIS ONE CARRIED FIVE.** The 2026-10-27 clause below withdrew the `1` as FABRICATED, on the reading
-    // that `seq` is *"the ordinal within an ATTEMPT's own log"* and that no attempt stands at a reversal's
-    // judgement. **THE READING IS RIGHT ABOUT THE ATTEMPT AND WRONG ABOUT THE MEMBER.** `seq`'s DECLARED
-    // DOMAIN is *"the append ordinal, strictly increasing from `1` in array order"*
-    // (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1), and the array this entry stands in is
-    // THIS REFUSAL'S OWN ONE-ENTRY LIST: its first element's ordinal is `1` BY THAT RULE, not by invention —
-    // the same arithmetic the kernel's own `append` performs (`log.length + 1`, read off the list the entry
-    // stands in). **AND THE TWO COPIES OF THIS VERY ENTRY ALREADY DISAGREED**: `carryRestartRefusal` re-appends
-    // it into the attempt's log through `append`, where it carries `seq` `1`, while the list that crosses to
-    // the caller carried none — one entry, two shapes, which is this branch's `DEF-AI` class exactly. **`log`
-    // IS DECLARED `LogEntry[]`** (`bindings/js/index.d.ts`), so a consumer typing it read `undefined` where
-    // `number` is declared. **THE DECLARATION IS NOT WEAKENED TO MATCH THE ENTRY: THE ENTRY CARRIES THE
-    // MEMBER.** No other member, no second entry and no sentence moves.
+    // **⟶ AND THE `seq` IS GONE FROM THIS ENTRY TOO, 2026-10-28 — `D-65`: THE ARRAY INDEX IS THE POSITION.**
+    // `RCA-8(g)` ANNOTATE-BESIDE: the 2026-10-28 clause below stands as the reading of its own date and is read
+    // THROUGH this one; **it is RETIRED in its conclusion, not contradicted in its ground.** Its ground was
+    // RIGHT — the two copies of this entry disagreed while the member existed, and the declaration is not
+    // weakened to match an entry — **and the ruling removes the member that could disagree**: `seq`'s declared
+    // domain was *"the append ordinal, strictly increasing from `1` in array order"*, and **that ordinal IS the
+    // index**, so `1` here was the index of the only element of a one-entry list and never a second fact
+    // (`strata/decisions.md` · `D-65`, the architect: *"Drop it"*). **ONE ENTRY, FIVE MEMBERS, NO `seq`**: the
+    // position is this list's index and there is no copy of it to disagree with the journal's ordinal. No other
+    // member, no second entry and no sentence moves.
     kind: 'constraint-check',
-    seq: 1,
     id: one.entry.id,
     // **⟶ AND THE ENTRY SAYS WHAT THE ACT DID, 2026-10-26 (`DEF-W`'s `(a)`) and 2026-10-27 (`D-41` item `2`)** —
     // the refusal's own record, beside the state it refused, so a consumer that catches it knows whether the