provident-storeroom 1.5.0 → 1.6.1

package/README.guide.md

@@ -30,7 +30,7 @@ preflight REFUSES when these two lines do not read what it computed** (`scripts/
 one check, read-only). **THE TWO LINES ARE THIS GUIDE'S OPERATIVE FIGURES; every dated paragraph below is the
 reading of its own date and is read through them.**
 
-PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.5.0`.
+PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.6.1`.
 PUBLISH-GUIDE-CUT-STATE: NOT STATED -- this document describes the behaviour at the version line above, and the cut-state is the release's to state, not a shipped document's (`D-57`).
 
 **⟶ AND THE CUT-STATE SENTENCE ABOVE IS WITHDRAWN, 2026-10-28 — THE CUT-STATE IS NOT A DOCUMENT'S TO STATE.** `RCA-8(g)` ANNOTATE-BESIDE, and the architect's ruling verbatim (`strata/decisions.md` · `D-57`): *"Drop the cut-state."* **The two marked lines above stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause — not one byte of either is deleted — and the sentence this clause withdraws is the SECOND of them, the one that claims to say whether the release this guide travels in is cut.** **THE REASON IS MEASURED, THREE TIMES OVER, AND IT IS STRUCTURAL RATHER THAN A MISTAKE: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and the change list's head was stale within minutes of the tag that falsified it. **SO THE CUT-STATE SENTENCE IS DROPPED AS A CLAIM AND THE VERSION LINE STAYS**, because the version line is the ONE figure a tarball can be right about: the manifest knows it and travels beside it. **`scripts/publish.sh --figures` GENERATES AND ASSERTS THE VERSION LINE AND NOTHING ELSE** — the cut-state generation and its assertion are removed in the same act, so a tag set that moves can no longer redden this guide — **and the same one line is asserted in THREE shipped documents: this guide, `README.md` beside it, and the change list** (`DEF-AC`'s remaining demand, *"guard the release notes too"* and *"`README.md` still declares no version at all"*). **THE TAG SET IS NOT DELETED AND NOT DENIED: it is a RECORD OF RELEASES held in the change list, PAST TENSE — a list of what has been cut — and never a claim about the current one.** **AND WHAT THIS CLAUSE DOES NOT SAY, SAID PLAINLY BECAUSE A READER WILL LOOK FOR IT: it does not say whether the version this guide prints is cut.** That is not a document's to state; the record of what has been cut is in `RELEASE-NOTES.md`, and the registry is the registry.
@@ -71,7 +71,10 @@ measurements on a locally packed, installed artefact, and is still not witnessed
 
 **⟶ AND THE FIGURES MOVE TO THE PREPARED RELEASE, 2026-10-28 — THE ELEVEN SITES READ `1.3.0`, AND `1.3.0` IS PREPARED, NOT CUT.** `RCA-8(g)` ANNOTATE-BESIDE: **the eight dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0` and `1.2.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.3.0"` and all five `optionalDependencies` pins are `1.3.0` with it** — the six figures move together and never singly (§0 item 1; `PUB-DD-10`) — **and the five platform manifests' own `version` fields read `1.3.0` with them, which is eleven sites and one rebuild; the rebuilt artefact is stamped from that manifest, so `version()` answers `1.3.0`.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* and §11's manifest table all read `1.3.0`; **every `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0` and `1.2.0` this guide prints is the figure of its writing date and reads `1.3.0` from here on.** **AND WHAT THIS CLAUSE DOES NOT CLAIM, SAID FIRST BECAUSE IT IS THE EASIER THING TO GET WRONG: `1.3.0` IS PREPARED AT THOSE ELEVEN FIGURES AND THE TAG IS NOT CUT — `git tag --list` carries `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` and no `v1.3.0`, and the registry carries no `1.3.0`; so nothing here says the release is cut, and the tag is not cut until the architect cuts it.** **AND THE TREE THIS GUIDE DESCRIBES IS TEN COMMITS PAST `v1.2.0`** — `git describe` reads `v1.2.0-10-g14787b5` and `git rev-list --count v1.2.0..HEAD` reads `10`, one commit past the nine the paragraph above reads — **so the two behaviour changes and the four smaller items `§1.3.0` of the change list declares are the CONTENT of `1.3.0`, and `1.3.0` is the version that carries them once it is cut; the `1.2.0` tarball carries neither, and `1.3.0` is the version this guide describes from here on.** **THE ONE THING THAT IS STILL UNMOVED IS THE ONE THING NO PASS WITNESSED, AND IT IS NOT A FIGURE:** no `npm install` was run against the registry, so a registry-installed `1.3.0` is described here from the manifest and from measurements on a locally packed, installed artefact, and is still not witnessed as a registry download. **NO OTHER CLAIM OF THIS GUIDE MOVES: the `files` allowlist's seven rows (§11's `2026-10-28` clause (i)), the packed set's `20` bare / `21` assembled (§11's clause (ii)), the twenty-status set (§11's clause (iv)), the fourteen own members and every API clause stand exactly as they stood.** (`D-41` item `1`; the change list's `§1.3.0`; `docs/specs/storeroom-publish/contract.md §2.3` item `3` — the byte-for-byte guide stage this correction travels by; `scripts/publish.sh`'s eleven cells and its two generated figures.)
 
-**⟶ AND THE ELEVEN VERSION SITES READ `1.5.0`, 2026-10-29 — THE PREPARED FIGURE, AND EVERY `1.3.0` THIS GUIDE PRINTS READS `1.5.0` FROM HERE ON.** `RCA-8(g)` ANNOTATE-BESIDE: **the nine dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.5.0"`, all five `optionalDependencies` pins are `1.5.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.5.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.5.0` at the built artefact and at a package installed from it.** **AND THE RELEASE THIS CHAIN SKIPPED IS NAMED RATHER THAN SILENTLY ABSORBED: `1.4.0` read `1.4.0` at those same eleven cells and was cut from them — the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0` — and §11's manifest table all read `1.5.0`. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`, and `git describe` reads `v1.4.0-27-ga3312b7` — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above).
+**⟶ AND THE ELEVEN VERSION SITES READ `1.5.0`, 2026-10-29 — THE PREPARED FIGURE, AND EVERY `1.3.0` THIS GUIDE PRINTS READS `1.5.0` FROM HERE ON.** `RCA-8(g)` ANNOTATE-BESIDE: **the nine dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.5.0"`, all five `optionalDependencies` pins are `1.5.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.5.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.5.0` at the built artefact and at a package installed from it.** **AND THE RELEASE THIS CHAIN SKIPPED IS NAMED RATHER THAN SILENTLY ABSORBED: `1.4.0` read `1.4.0` at those same eleven cells and was cut from them — the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0` — and §11's manifest table all read `1.5.0`.
+
+**⟶ AND THE ELEVEN SITES READ `1.6.0` FROM THIS PREPARATION, 2026-10-29 — THE BUMP IS MADE HERE AND EVERY `1.5.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause — including its `1.5.0` — because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.0"`, all five `optionalDependencies` pins are `1.6.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`)** — and **`npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.0` at the built artefact and at a package installed from it** (measured this date at `bindings/js/build/Release/storeroom_js_binding.node`, and again at a package installed into a `/tmp` consumer with no repository in its ancestry). **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.0`, **and the one figure this guide can be right about is generated from that manifest and asserted in three shipped documents by `scripts/publish.sh --figures`.** **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0`, `git describe` reads `v1.5.0-11-g8f5454f`, and **no `v1.6.0` is among them** — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above). **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`, and `git describe` reads `v1.4.0-27-ga3312b7` — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above).
+**⟶ AND THE ELEVEN SITES READ `1.6.1` FROM THE DOCUMENTATION RELEASE, 2026-10-30 — EVERY `1.6.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause, because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.1"`, all five `optionalDependencies` pins are `1.6.1` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.1` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.1` at the built artefact and at a package installed from it.** **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.1`. **AND WHAT THIS RELEASE CHANGES FOR YOU IS NO ARM OF THE PACKAGE: the failure form stays four members, a log entry stays five, the status set stays twenty and the kernel's token set stays nine** — the change list's `§1.6.1` states it with its arithmetic. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0` · `v1.6.0`, and `git describe` reads `v1.6.0-4-g674b79e`. (`D-57`; the change list's `§1.6.1`; `scripts/publish.sh --figures`, which asserts the one figure in three shipped documents.)
 
 **AND ONE THING A READER OF THE INSTALLED PACKAGE SHOULD KNOW BEFORE THE CITATIONS: WHEN THIS DOCUMENT IS AT
 `node_modules/provident-storeroom/README.guide.md`, IT IS THIS GUIDE.** **Its ONE authored home is
@@ -674,16 +677,27 @@ the listeners."* **AND THE CONSEQUENCES, STATED BECAUSE EACH IS SOMETHING YOU WI
 
 1. **A LISTENER RUNS IN ITS OWN COMMIT** (`D-45`), **AND ITS OUTCOME — PASSED OR REFUSED — IS THAT COMMIT'S**, not
    yours.
-2. **THE TRIGGERING CALLER RECEIVES ITS OWN OUTCOME AND NOTHING ABOUT THE LISTENER'S.** **Your record is your
-   write's** — `op`, `watched`, `triggered` (`§6.4`) — **and it carries no member for what a listener's own
-   commit did.**
+2. **YOUR RECORD IS YOUR WRITE'S — `op`, `watched`, `triggered` (`§6.4`) — AND IT CARRIES NO MEMBER FOR WHAT A
+   LISTENER'S OWN COMMIT DID.** **⟶ AND THE SENTENCE THAT STOOD HERE — *"THE TRIGGERING CALLER RECEIVES ITS OWN
+   OUTCOME AND NOTHING ABOUT THE LISTENER'S"* — IS WITHDRAWN AS A PROHIBITION, 2026-10-29, BY `D-76` ITEM 1
+   (`DEF-AU`), BECAUSE IT HARDENED A PERMISSION INTO A CLAIM.** **THE ARCHITECT'S OWN SENTENCE ABOVE IS A
+   PERMISSION** — *"the caller does not NEED to know about the outcome of the listeners"* — **and a caller that
+   does not NEED to know is not a caller that CANNOT: `D-73` kept the throw in the very next ruling precisely so
+   the client can log errors cleanly, which is the caller learning the outcome** (`§6.5a`). **THE TRUE PAIR, AND IT
+   IS THE PAIR TO CARRY AWAY:** **a listener's REFUSAL is CONTAINED** — its own commit's, invisible upward;
+   **a listener's THROW is the CHANNEL** — **and the caller is the only party positioned to log the violation,
+   because the listener's act is in the listener's own commit.** **NOTHING ABOVE IS NARROWED BY THE CORRECTION: the
+   record still carries no member for a listener's commit, and neither `triggered` nor the `log` gains one.**
 3. **A LISTENER'S REFUSAL DOES NOT FAIL THE WRITE THAT FIRED IT.** **A listener is a SIDE EFFECT for external
    code, and a side effect's failure is the side effect's** — your write already passed every constraint and
    already answered before the delivery ran.
-4. **AND BECAUSE OF THAT, THE ONLY THING A CHAIN OF LISTENER WRITES EXPOSES UPWARD IS ITS COST** — depth, and
-   whatever the listener itself does with what its own call returns. **Which is why the missing loop guard is the
-   asymmetry that matters** (`§7.9` item 2): **nothing else about the chain is observable, so nothing else can be
-   bounded.**
+4. **AND BECAUSE OF THAT, THE ONLY THINGS A CHAIN OF LISTENER WRITES EXPOSES UPWARD ARE ITS COST AND ITS THROW** —
+   depth, and whatever the listener itself does with what its own call returns; **and, where a listener body
+   throws, that error crossing every hop of the stack to you** (`§6.5a`). **Which is why the missing loop guard is
+   the asymmetry that matters** (`§7.9` item 2): **nothing else about the chain is observable, so nothing else can
+   be bounded.** **⟶ AND *"THE ONLY THING … IS ITS COST"* IS CORRECTED AT THIS LINE BY `D-76` ITEM 1 (`DEF-AU`),
+   2026-10-29, WITH ONLY THAT NOUN MOVING: the throw is not a window into the chain — it is where the chain STOPS,
+   and it crosses whether or not you wanted it.**
 
 **MEASURED 2026-10-29 ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY — AND THE MEASUREMENT IS THE POINT, BECAUSE
 THIS IS A CLAIM ABOUT WHAT CROSSES AND IT MUST BE PRINTED RATHER THAN ASSUMED.** One store: a listener at `['a']`
@@ -747,7 +761,7 @@ see the listener's error instead of your own record, and that is your signal to
   takes away is the ANSWER, not the write.**
 - **THE REFUSAL, as the control.** One listener at `['a']` whose body writes `['b'] = 'bad'`, against a constraint
   at `['b']` refusing `'bad'`. **The listener's own write was refused INSIDE the listener** — `{status:
-  'ConstraintPassRefused', message: 'b may not be bad', log: […] }`, own members `["status","message","log"]` —
+  'ConstraintPassRefused', message: 'b may not be bad', log: […] }`, own members `["status","message","log","address"]` —
   **`store.write(['a'], 'mem', 1)` RETURNED ITS OWN RECORD** with **no status and no `log`**, and `['b']` read
   **ABSENT**. **The same caller writing `['b'] = 'bad'` directly WAS refused with the same status — so the
   constraint was armed throughout, and the difference is only WHAT CROSSES.**
@@ -761,7 +775,15 @@ of the same date; `§6.6`'s item 5, where a DEPTH-TWO throw's destination is mea
 
 **★ AND THE PRACTICAL HAZARD THIS ASYMMETRY MAKES REAL, WRITTEN HERE SO YOU MEET IT IN A TEST RATHER THAN IN PRODUCTION: THE WRITE'S DATA LANDED AND ITS ANSWER DID NOT — SO A BLIND RETRY RE-APPLIES A WRITE THAT ALREADY SUCCEEDED.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause of §6.5a above stands BYTE-FOR-BYTE and is read THROUGH this one; no ruling, no measurement and no member moves — what this clause adds is the one consequence of the measured arm that a caller's ERROR HANDLER will otherwise get wrong.** **IT FOLLOWS FROM THE MEASUREMENT ABOVE AND NEEDS NO NEW ONE:** *"the data had already landed (`read(['a'])` answered `1`), because the commit resolved before its delivery ran; what the throw takes away is the ANSWER, not the write"* — **so `try { store.write(...) } catch { retry() }` runs that write a SECOND time, and the store has no way to tell the two apart: there is no commit identity on your side, no idempotency key and no record, because after a throw there is no record** (`§6.5a`'s closing sentence). **AND THE ERROR IS YOURS AND NOT THE PACKAGE'S SHAPE:** it carries **no depth, no handle, no address** (`§6.6` item 5) — a throw at depth two arrives as the same `Error` object a depth-one throw would — **so a retry policy cannot key on where the chain broke, and a listener body's own `catch` is the only containment arm there is.** **WHAT TO WRITE INSTEAD: catch in the body, decide whether to rethrow, and make the write your retry re-issues one whose landing you can recognise** — an `op` you kept from an earlier answer, a value you wrote, or a read before you write. (`D-73`; `D-71`; the `§6.5a` measurement; `§6.6` item 5; `docs/specs/storeroom-js/contract.md §2.7` item 4.)
 
-### §6.6 ★ DELIVERY NESTS — every window is a synchronous call on one thread, and the stack is the only place its order exists
+**★★ AND ONE THING THE ANSWER DOES NOT TELL YOU, MEASURED IN BOTH ARMS ON THIS CHECKOUT 2026-10-29 AND DECLARED HERE RATHER THAN LEFT FOR YOU TO DISCOVER — `D-76` ITEM 2 (`DEF-AU`, ITS SECOND HALF): A `ConstraintPassRefused` DOES NOT SAY WHOSE ACT IT REFUSED.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; no status is minted, no member is added and the throw's BEHAVIOUR IS UNMOVED — the behaviour is correct, and what was owed is this sentence and the rule at its end.** **THE HAZARD: your listener's own act is refused, the listener body does not catch it, and the refusal crosses to you — you catch `ConstraintPassRefused`, `message` and `log` exactly as you would if YOUR write had been refused, WHILE YOUR WRITE'S DATA IS IN THE STORE.** **THAT IS `D-73`'s RETRY HAZARD IN ITS SHARPEST FORM, BECAUSE THE ANSWER DOES NOT EVEN LOOK DIFFERENT.** **MEASURED, BOTH ARMS, ONE PAIR, ONE MESSAGE:**
+
+- **ARM ONE — YOUR OWN ACT REFUSED.** `write(['x','y'], 'mem', {bad: true})` against a pair at `['x']` whose body answers `{message: 'x must hold one'}`: what crosses is `{status: 'ConstraintPassRefused', message: 'x must hold one', log: [{kind: 'constraint-check', id: 'x-must-hold-one', opId: 'op-2', message: 'x must hold one', state: null}, {kind: 'outcome', id: null, opId: 'op-2', message: 'x must hold one', state: 'KC-3'}]}`, **own members `['status','message','log']`** — **and `['x','y']` still reads the value that stood before.**
+- **ARM TWO — YOUR ACT PASSED AND YOUR LISTENER'S WAS REFUSED.** the same pair, the same refusal built inside a listener body that does not catch it: **the same `status` string, the same `message` string, the same three own members, the same entry count, and entries whose `kind`, `id`, `message` and `state` are equal item for item — the ONLY differing byte anywhere in the answer is the log's `opId` (`op-5` here, `op-2` above).** **AND YOU CAN NEVER COMPARE THAT BYTE: a refused act answers no `op`, so you never learn your own act's op id** (`§6.5a`'s closing sentence: after a throw there is no record). **AND YOUR DATA LANDED: `['x','y']` reads `{ok: true}`.**
+- **THE VERDICT, MEASURED AND NOT ASSUMED: THE TWO ANSWERS ARE INDISTINGUISHABLE FROM ANY MEMBER YOU CAN READ.** `Object.keys` reads the same three; a refusal carries **no `triggered`** and **no `op`**; the pair's `id` and the pair's own `message`, the entry count and the terminal `state` are the same on both arms whenever the pair that refuses your listener's act is one that could equally have refused yours — **and the `opId` is a datum with nothing on your side to key it against.** **A LISTENER's raw THROW is distinguishable and this is not:** an `Error` crosses as itself with `status` `undefined` (`§6.5a`) — **but a listener body's uncatched REFUSAL crosses as a refusal and carries nothing that says whose.** **A NEW STATUS OR A NEW MEMBER WOULD TELL YOU, AND NONE WAS MINTED: the closed set is `D-38`'s business and the distinction is the architect's call, not this guide's** (`D-76` item 2).
+- **★★ SO THE RULE, AND IT IS THE ONE THING TO DO WHEN A `ConstraintPassRefused` ARRIVES: DO NOT RETRY ON THE ANSWER — READ THE ADDRESS YOU WROTE.** **A refusal of YOUR act did not land** — the store stands where the act opened at, or at the last state a pass validated (`D-63`; `§5.4`) — **while a listener's refused act left YOUR value standing.** **So: catch the refusal, `read` the address your act wrote, and let that decide.** **Your value stands ⇒ the refusal was a listener's, your write LANDED, and re-issuing it re-applies it** (`§6.5a`'s hazard, unmoved). **Your value does not stand ⇒ the refusal was your own act's, and the write did not happen.** **AND THE TWO LIMITS OF THAT READ, SAID PLAINLY RATHER THAN LEFT TO A GREEN TEST:** it answers *"did my value land"* and never *"whose act was refused"*, so **it is a check of the outcome and not of the identity**; and **a write whose value equalled what already stood cannot be told apart by it**, so the read is evidence and not proof. **THE REMAINING ARM IS THE ONE `D-73` GAVE YOU: make the throw impossible to mistake by making it yours** — catch in the listener body and decide there whether to let it out (`§6.5a`'s shape to write), **because a body that catches leaves your write ANSWERING ITS OWN RECORD.** (`D-76`; `D-73`; `D-71`; `D-63`; `D-38`; the `§6.5a` measurement driven a second time in this clause's two arms.)
+
+**⟶ AND THE MEMBER THAT CLAUSE SAID WAS NOT MINTED WAS MINTED THE NEXT DAY, 2026-10-29 — `D-77`: THE TWO ARMS `D-76` MEASURED ARE NOW SEPARATED BY THE FORM ITSELF.** `RCA-8(g)` ANNOTATE-BESIDE: **the whole of `§6.5a`'s `D-76` clause above stands BYTE-FOR-BYTE as the reading of its own date and is read THROUGH this clause; not one byte of it is deleted, and its RULE — *"do not retry on the answer, read the address you wrote"* — STANDS.** **THE TWO SENTENCES THIS CLAUSE SUPERSEDES, NAMED RATHER THAN OVERWRITTEN: *"the same three own members"* in arm two, and *"A NEW STATUS OR A NEW MEMBER WOULD TELL YOU, AND NONE WAS MINTED"*** — **the first is now FOUR own members on both arms, and the second is discharged: the architect's ruling on the OWED was one word, *"New member"*.**
+**WHAT THE FOURTH MEMBER IS: `address`, the ADDRESS the refusal is about** — a segment array in the caller's own domain, or `null` where nothing is nameable — **and THE TWO ARMS ABOVE NOW DIFFER IN IT: arm one's own refused act answers the address YOU WROTE (`['x','y']` there), and arm two's listener-refused act answers THE LISTENER'S (`['inner']`, or whichever address its body acted at).** **SO THE COMPARISON REPLACES THE READ-BACK AS THE FIRST ANSWER: `address` equal to the address you wrote ⇒ your own act was refused and your write did not happen; different ⇒ a listener's act was and YOUR WRITE STANDS.** **AND THE READ-BACK `D-76` TAUGHT IS NOT WITHDRAWN — it is what you fall back on where `address` is `null` and the cross-check where it is not**, **and its two limits stand: the member names the ACT and never the party, so it is an address and not a verdict; and a write whose value equalled what already stood is still not told apart by reading back.** **NOR IS A FIFTH STATUS MINTED: the closed set stays twenty, and the member carries an address, never a code.** (`D-77`; `D-76`; `bfe844a`; `§7.7`'s clause of the same date; `§8`'s form, corrected above at its own line.) — every window is a synchronous call on one thread, and the stack is the only place its order exists
 
 **★ THE SHAPE, IN ONE STACK** (`strata/decisions.md` · `D-72`). **A commit resolves and its delivery begins; a
 listener that writes opens a commit of its own (`D-45`), which runs its own pass and then ITS delivery — so
@@ -891,7 +913,7 @@ overwrite a listener with a constraint or vice versa is rejected"*; `D-29`: *"Li
 only other listeners"*).
 
 **Measured 2026-10-26, from the constraint-then-listener direction:** with `c1` armed at `['a']`,
-`store.listen('h1', [['a']])` threw the **one plain form** — `Object.keys` `["status","message","log"]`, `status`
+`store.listen('h1', [['a']])` threw the **one plain form** — `Object.keys` `["status","message","log","address"]`, `status`
 `'AddressMalformed'`, `log` `[]` — whose message names BOTH sides and carries the shared rule sentence **"a
 listener and a constraint do not share one"**. **The form is the surface's one thrown form and NOT a `TypeError`**
 (`index.d.ts`, `addConstraint`'s and `register`'s cross-kind clauses). **No state moves: the rejection is taken
@@ -990,12 +1012,14 @@ body.**
 
 ### §7.7 ★ The check is BOUNDED — THREE restarts per terminal act, and past the budget it fails closed
 
-**★ THE LIMIT, DECLARED HERE BECAUSE NO CLAUSE OF THIS GUIDE SAID IT: A CONSTRAINT CHECK RESTARTS AT MOST THREE TIMES PER TERMINAL ACT.** The bound is **`RESTART_LIMIT` = `3`**, one exported constant at **`bindings/js/src/entry/constraints.mjs:1366`**. **THE BUDGET IS SPENT AND NOT RESET by an action raised inside a restart** — a body that reverses again inside a restart's own ask spends the SAME budget and not a fresh one — **AND PAST IT THE CHECK FAILS CLOSED IN THE ONE FORM:** the write throws the same plain `{status, message, log}` it throws for a refused pass (§8), with `status` **`'ConstraintPassRefused'`** and **ONE log entry** whose message says the budget was spent rather than that a pair refused a state it never judged. **The store is restored** — the request's own watch records what is owed — so the terminal act leaves no unjudged effect standing (`D-42` item `3`; `D-41` item `4`).
+**★ THE LIMIT, DECLARED HERE BECAUSE NO CLAUSE OF THIS GUIDE SAID IT: A CONSTRAINT CHECK RESTARTS AT MOST THREE TIMES PER TERMINAL ACT.** The bound is **`RESTART_LIMIT` = `3`**, one exported constant at **`bindings/js/src/entry/constraints.mjs:1366`**. **THE BUDGET IS SPENT AND NOT RESET by an action raised inside a restart** — a body that reverses again inside a restart's own ask spends the SAME budget and not a fresh one — **AND PAST IT THE CHECK FAILS CLOSED IN THE ONE FORM:** the write throws the same plain `{status, message, log, address}` it throws for a refused pass (§8), with `status` **`'ConstraintPassRefused'`** and **ONE log entry** whose message says the budget was spent rather than that a pair refused a state it never judged. **The store is restored** — the request's own watch records what is owed — so the terminal act leaves no unjudged effect standing (`D-42` item `3`; `D-41` item `4`).
+
+**⟶ AND THE CROSSED FORM IS FOUR MEMBERS FROM 2026-10-29 — `D-77`, THE ARCHITECT'S RULING, ONE WORD: *"New member"*.** Every figure above and below that prints that form as THREE is read THROUGH this clause and stands as the reading of its own date. **THE FOURTH MEMBER IS *WHICH ACT WAS REFUSED* — `address`, the ADDRESS the refusal is about**: a segment array in the caller's own domain, or the declared `null` where there is nothing to name. The measurement it answers: **a caller's OWN act refused and a caller's act that PASSED while a LISTENER's was refused cross with the same `status`, the same `message`, the same keys and the same two log entries** — only the `opId` differs, and a refused act answers no `op` to key against — so the caller read `ConstraintPassRefused` and concluded its own write did not happen while the store says it did. **Compare the member with the address you wrote: `equal` means your own act, `different` means a listener's, and a retry is then a decision rather than a guess.** **IT IS PRESENT ON EVERY REFUSAL, `null` WHERE NOTHING IS NAMEABLE** (*"a member absent on some arm is the `DEF-AH` defect wearing a new name"*), so `Object.keys(caught)` reads exactly `["status","message","log","address"]`, length `4`, on EVERY arm. **THE CLOSED STATUS SET IS NOT REACHED — twenty stays twenty — and the member is no heuristic a consumer has to reproduce.** The form's one home is `docs/specs/storeroom-js/surface.md §2.5` item `4-ter`.
 
 **⟶ AND THE ARM PAST THE BUDGET NAMES THE PAIR THAT WAS BEING ASKED, AND SAYS WHAT IT IS, 2026-10-28 — `DEF-AL`, MEASURED AND CLOSED HERE.** `RCA-8(g)` ANNOTATE-BESIDE: **the two clauses above stand BYTE-FOR-BYTE and are read THROUGH this one; this clause re-reads what the refusal NAMES and what its `message` SAYS, and moves no status, no form and no bound.** **WHAT WAS MEASURED:** the arm named the FIRST WATCHED ADDRESS rather than the one the budget was spent at, **so registration order decided the accusation — the pair it named had answered `true` on every ask it received**, and the crossed `message` was **byte-identical to a genuine refusal's**, so a consumer reading only the message could not tell a pair refusing from a budget running out. **WHAT IT DOES NOW:**
 - **the one `log` entry names the pair that was BEING ASKED when the budget ran out, and the address it was being asked at** — not the first watched address — **and its sentence says that pair refused nothing and that the check could not settle**;
 - **the crossed `message` keeps the store's generated sentence for `ConstraintPassRefused` and then says, in its own words, that this is a RESTART BUDGET EXHAUSTION and NOT a constraint pair refusing a state** — no pair refused the state the check was asking it for, a pair body acted inside the check at every restart, and the budget is spent. **A GENUINE refusal never carries that clause**, so the two are distinguishable by the message alone.
-**`status` stays `ConstraintPassRefused`, the form stays `{status, message, log}`, ONE log entry stands, and the store is still restored by the refusal's own compensating act.** (`D-42`; `D-41` item `4`; §7.7's bound above.) **MEASURED 2026-10-28, on this checkout, with a passing pair registered FIRST: the entry named the passing pair and the passing pair's address before this clause, and names the pair the check was asking and its own address after it; the crossed message said `'t5' was refused by a constraint pass, the state this act would leave is not one the registered constraints admit` before and carries the budget's own clause after — beside a control in which a genuine refusal still reads as its refusing pair's own sentence.**
+**`status` stays `ConstraintPassRefused`, the form stays `{status, message, log, address}`, ONE log entry stands, and the store is still restored by the refusal's own compensating act.** (`D-42`; `D-41` item `4`; §7.7's bound above.) **MEASURED 2026-10-28, on this checkout, with a passing pair registered FIRST: the entry named the passing pair and the passing pair's address before this clause, and names the pair the check was asking and its own address after it; the crossed message said `'t5' was refused by a constraint pass, the state this act would leave is not one the registered constraints admit` before and carries the budget's own clause after — beside a control in which a genuine refusal still reads as its refusing pair's own sentence.**
 
 **MEASURED 2026-10-28, ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY — AND THE MEASUREMENT IS THE POINT: THE RESIDUAL IS THE BUDGET, NOT THE STATE AND NOT THE JOURNAL.** A pair whose body raises ONE FRESH REVERSAL on every ask the restart makes, **with every ask passing**, was driven twice: **with `60` fresh reversals available it rests at exactly `3` restart asks** (the listener's own action plus one per ask — `4` actions in all), **and with `40` available it answers identically, `3`.** **The body had `57` and `37` reversals it never got to spend, and nothing structural stopped it: every ask it made passed.** The terminal write then refused `ConstraintPassRefused` with its log entry saying the budget was spent.
 
@@ -1019,7 +1043,7 @@ three editing verbs — `write`, `delete`, `rollback` — all ask the pairs, and
    absence, with the delete's own journal op handed to the pair as `context.op`, so a constraint can tell a
    delete from a write and refuse one;
 3. **every one of them passes ⇒ you get the record** — `{ address, tiers, triggered, op }` (`§3.3`), unchanged;
-   **one refuses ⇒ you get the ordinary refusal**: the same `{status, message, log}` every constraint refusal
+   **one refuses ⇒ you get the ordinary refusal**: the same `{status, message, log, address}` every constraint refusal
    throws (§8), `status: 'ConstraintPassRefused'`, its `log` naming the pair and carrying the kernel's token in
    the terminal entry's `state`, **and the delete is UNDONE together with every edit the delete's own attempt made** (a repair's write included)
    — the store stands at the state the commit opened at;
@@ -1041,9 +1065,7 @@ store.read(['window','tabs','landingPage']);   // { active: true } — the delet
 ```
 
 **The pair is asked with `context.value` = the AFTER-state (absence), `context.tier` = the delete's tier or `null`,
-and `context.attempt` = the attempt's own identity.** **A pair at an ANCESTOR address is not asked by the delete's
-pass** — the pass keeps the write's exact-address rule and not the trigger set's prefix widening — even though
-such a listener DOES fire for the delete (`§6.4`). **And a delete that removes nothing is not an edit**: `tiers: []`,
+and `context.attempt` = the attempt's own identity.** **⟶ `RCA-8(g)` MOVE-OUT, AUTHORED 2026-10-29 BY `D-76` ITEM 3 (`DEF-AT`): THE SENTENCE THAT STOOD HERE — *"A pair at an ANCESTOR address is not asked by the delete's pass — the pass keeps the write's exact-address rule and not the trigger set's prefix widening — even though such a listener DOES fire for the delete"* — IS NO LONGER AT THIS LINE.** **It is contradicted by the clause two paragraphs below in this same section, by `D-56` and by measurement, and its byte-exact text stands at `docs/guides/backup/D76-2026-10-29-guide-move-out.md §1`, whose head names this source path and its pre-move line range; NO BYTE OF IT IS RE-EMITTED HERE, and the operative rule is `D-56`'s, printed below.** **And a delete that removes nothing is not an edit**: `tiers: []`,
 no pass, no refusal, no delivery (`§5.3`).
 
 **⟶ AND THE SECOND OF THOSE THREE SENTENCES IS CORRECTED, 2026-10-29 — `D-56`: THE PAIR AT AN ANCESTOR IS ASKED, AND
@@ -1223,25 +1245,29 @@ try {
   const v = store.read(['users', 0, 'name']);
 } catch (e) {
   // e is a PLAIN OBJECT — never an Error subclass, never a rejected promise, never a tagged union
-  const { status, message, log } = e;
+  const { status, message, log, address } = e;   // FOUR members since D-77, in the form's own order
 }
 ```
 
-**A refusal is a thrown object literal carrying exactly `{status, message, log}`** — **never an `Error` subclass,
+**A refusal is a thrown object literal carrying exactly `{status, message, log, address}`** — **never an `Error` subclass,
 never a returned tagged union, never a `Promise` rejection**, so `try/catch` is the whole error model
 (`bindings/js/index.d.ts`, `StoreRefusal`; `surface.md §2.5`'s clause of 2026-10-16, the crossing form's one home;
 `js/contract.md §1.4`).
 
 **★ AND THE `log` MEMBER IS ALWAYS PRESENT, and it is a plain own enumerable data member of that same object** —
 written with an object literal, not `defineProperty`, not a getter, not on a prototype and not behind a `Symbol`.
-**So `Object.keys(caught)` reads exactly `["log","message","status"]` and its length is `3` on EVERY arm. It is
+**So `Object.keys(caught)` reads exactly `["status","message","log","address"]` and its length is `4` on EVERY arm.** It is
 never absent, never `null` and never a non-array; `[]` is its declared value where the failure's cause has no
 attempt at all, and every failure whose attempt exists carries that attempt's own entries**
 (`index.d.ts`, `StoreRefusal` items 4, 9 and 10; `surface.md §2.5`).
 
+**⟶ AND TWO CELLS OF THIS SECTION WERE STALE AND ARE CORRECTED AT THEIR OWN LINES, 2026-10-29 — `D-77`'s MEMBER APPLIED HERE AND NOT ONLY AT `§7.7`'s CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted in this clause, the prose around them stands BYTE-FOR-BYTE, and the defect is the one this branch keeps meeting: A CORRECTION APPLIED AT ONE SITE AND NOT AT THE OTHERS.** **`§7.7` printed `D-77`'s four-member form on 2026-10-29 while this section — the form's own home in the guide of USE — still printed THREE in its sample and contradicted itself in its census.** **CELL ONE, THE SAMPLE:** it read *"`const { status, message, log } = e;`"* **and it now reads `const { status, message, log, address } = e;`** — **because a consumer who copies the sample would meet three of four members and never learn the one member that separates its own refusal from a listener's.** **CELL TWO, THE CENSUS:** it read *"`Object.keys(caught)` reads exactly `["status","message","log","address"]` and its length is `3` on EVERY arm"* — **four names beside a length of three, in one sentence** — **and it now reads `4`.** **NEITHER MOVED A BYTE OF THE REFUSAL: both are readings of `D-77`'s form, which `bfe844a` shipped, and both were wrong at this file's own line.** (`D-77`; `bfe844a`; `§7.7`'s clause of the same date; `index.d.ts`'s `StoreRefusal`; `scripts/publish.sh --figures` does not assert these — a reader does.)
+
+**⟶ AND THE REST OF THE AUDIT, PRINTED SO IT IS A CHECK AND NOT A CLAIM: FOUR PLACES IN THIS GUIDE STILL PRINT THAT FORM AS THREE, AND EVERY ONE OF THEM IS A DATED READING WITH ITS OWN CORRECTING CLAUSE BESIDE IT — WHICH IS WHY THEY STAND AND THE TWO ABOVE DID NOT.** **`§5.4`'s rank-`20` sentence (`{status: 'ConstraintPassRefused', message, log}`), `§6.2`'s `cfg`-side measurement (`{status: 'AddressMalformed', message, log}`), `§6.5a`'s arm two (*"the same three own members"*) and `§8.1`'s `ConstraintBodyThrew` paragraph (`{status: 'ConstraintPassRefused', message, log}`)** — **each is the reading of a tree that carried three members, each is read THROUGH a correcting clause (`§7.7`'s `D-77` clause of this date, `§6.5a`'s `D-77` clause of this date, and the `D-55`/`DEF-AK` clauses of 2026-10-28 around `§8.1`), and none of them is a place where a consumer copies the form.** **WHAT DISTINGUISHES THE TWO CORRECTED ABOVE IS NOT STYLE: `§8` IS THE FORM'S OWN HOME IN THIS GUIDE, AND ITS SAMPLE AND ITS CENSUS ARE WHAT A CONSUMER READS AND RE-SPELLS — a dated measurement is a record, and a sample is an instruction.** (`D-77`; `RCA-8(g)`; `§7.7`; `§6.5a`; `§8.1`.)
+
 **Measured 2026-10-26, on refusals from `read`, `readLiteral`, `write`, `delete`, `rollback`, `listen`,
 `unlisten`, `register` and `removeListener`: every one was an `Object` whose `Object.keys` was
-`["status","message","log"]`, whose `log` was `[]`, and which was not an `Error` instance.**
+`["status","message","log","address"]`, whose `log` was `[]`, and which was not an `Error` instance.**
 
 ### §8.0a What the `log` IS: one list per COMMIT — and what that buys you
 
@@ -1319,6 +1345,13 @@ refusal (`js/contract.md §2.6`'s `D-53` clause, item `6`).
 - **and the crossed `message` stops claiming the value crosses**: after the store's generated sentence it says, in its own words, that the value the body threw does **NOT** cross as this refusal — and it names where the form it threw stands, which is that `log` entry. **THE CALLER'S OWN TEXT IS QUOTED IN THE LOG AND NEVER IN THE SENTENCE**, so a forged `{status, message}` cannot make the package speak a refusal it did not find (`DEF-A`'s protection, unmoved);
 - **where no attempt stands there is no commit log to carry it** — a registration-time body's throw crosses with `log: []`, which is `surface.md §2.5` item 4's declared arm — **and the crossed sentence says exactly that instead of pointing at a list that would not hold the form**. (`tests/e2e/discard-witness.mjs`'s `DW-10.3`/`DW-10.4` print the readings for an `Error`, a string and an object with no `message`; both cells are RED under a revert of the terminal sentence.)
 
+**⟶ ★ AND THAT ENTRY IS BOUNDED, 2026-10-28 — `D-74` · `DEF-AR`, MEASURED, AND IT IS THE SENTENCE TO CARRY AWAY FROM THIS SECTION.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; the entry's five members, its `outcome` kind, its position as the array index and every form the clause above prints are UNMOVED.** **THE FINDING, AS THE DOWNSTREAM FILED IT: *"bound the log entry as the message is bounded — compose it from a summary of the inner refusal rather than re-serialising it."*** **WHAT WAS MEASURED ON THIS CHECKOUT BEFORE THIS CLAUSE: a chain of inner refusals — each level's constraint body making the write the next level's body throws on, which is a LAWFUL chain that stops at the caller's own depth limit and loops not at all — wrote the previous level's whole form into the next level's `outcome` entry, so THE ENTRY DOUBLED AT EVERY LEVEL: `134,228,754` characters at depth `26` (`268,446,544` as its JSON text, the figure the downstream's `longestLogEntryChars` prints as `268,446,682` on its own spelling), and at depth `28` the composition passed V8's maximum string length and died with `RangeError: Invalid string length` — the very class `1.4.0` answered with, arriving one level deeper. THE ENTRY IS A LOG LINE, AND A LINE THAT CAN BE 268 MB IS NOT A LINE.**
+- **WHAT YOU READ NOW IS A SUMMARY, WHEN THE VALUE THE BODY THREW IS ITSELF A REFUSAL** — with its own `status`, `message` and `log` — **and NEVER the serialised refusal**: *"a refusal, "ConstraintBodyThrew", carrying 27 log entries — its first message is "…""*. **Three facts and nothing else**: the inner refusal's own **status**, its **entry count**, and its **first entry's message**. **Nothing of its log is copied**, so a refusal whose `log` carries fifty thousand entries costs your caller one number;
+- **THE BOUND IS ONE NUMBER AND IT IS THE MESSAGE'S OWN: `307` characters**, one exported constant at **`bindings/js/src/entry/kernel-foundations.mjs`** (`MESSAGE_CEILING`), and it is what a message has when it has nothing inner to quote (`errorMessage('ConstraintBodyThrew', <subject>)` plus the one clause this package appends — measured `306` on this checkout's spelling and printed by the downstream at `307`). **THE CLIP IS APPLIED TO THE ENTRY'S TOTAL — head, form and tail together — and not to a level**, which is the bug this clause replaces: **the same figure at depth `26`, at depth `28` and at the first refusal alike** (`tests/e2e/discard-witness.mjs`'s `DW-17.1`/`DW-17.3`, printed before → after);
+- **AND NO ENTRY IS UNBOUNDED FOR ANY THROWN VALUE**, measured on all six shapes (`DW-17.2`): an `Error` (`152` characters), a string (`117`), a number (`102`), an object with no `message` (`126`), a refusal (`174`), a refusal whose `log` is itself huge, a thrown string of four mebibytes and a thrown `message` of four mebibytes — **the last two at exactly `307`, each CLIPPED AND SAYING SO with a trailing `…`**;
+- **THE LAWFUL ARMS ARE UNCHANGED WHERE THEY FIT THE BOUND** (`DW-17.4`): a plain `Error`, a string and an object with no `message` answer the very words the clause above prints, byte for byte — **the bound cuts a value that does not fit and touches no value that does**;
+- **and `LogEntry` DID NOT GAIN A MEMBER** (`DW-17.5`): the bound is on the FORM'S CONTENT and not a new column, so every entry still carries exactly `id` · `kind` · `message` · `opId` · `state` (`D-65`'s five, `D-74`'s own terms). **THE MESSAGE BESIDE IT IS BOUNDED THE SAME WAY**, at the one place it quotes an inner refusal's `message` — because a sentence quoting the whole of an inner sentence is the same class of compounding: **measured `134,229,071` characters at depth `26` and `268,447,241` at `27` before, and `753` at every depth after**, which is why a depth-`28` chain crosses as `ConstraintBodyThrew` at all rather than dying in the caller's own frame. **SO THE FINDING'S OWN `307` IS READ AS THE BOUND AND NOT AS A MEASURED LENGTH: on this checkout the *sentence* the package generates is `306` characters, and the figure the downstream measured at depth `28` was the saturation of a chain that had already died.**
+
 **⟶ AND THE RECORD YOU ARE HANDED IS FINAL, 2026-10-28 — `D-55` ITEM 6 · `DEF-AO`, MEASURED.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; the log's home on the commit, its entries and its identity are unmoved.** **THE RULING, THE ARCHITECT, VERBATIM: *"Attempts don't log. This is what the commits are for. The commits have their log handed off to the client and are dropped after closing out."*** **SO: a closed attempt's report and its log DO NOT MUTATE AFTER THE HANDOFF — a consumer holding a refusal is holding the record, and a record that changes after it is given out is not a record.** **WHAT THE PACKAGE DOES: at the end of the commit's own processing — the restarted check's amendment included, which is part of closing out — the report and the log it carries are `Object.freeze`d**, so a later act can neither append an entry nor re-member the report. **THE LIST IS THE SAME LIST** (`D-53`: *"the crossed report IS that list"*) — the refusal you caught and `report(store, ref)`'s `log` are ONE array, now sealed. **AND THE LIST IS SEALED WITH ITS COMMIT**, never at a nested attempt's own handoff: a constraint body's nested write is part of your commit (`D-53`), so freezing the list from inside it would stop the enclosing attempt's own `append`. (`tests/e2e/discard-witness.mjs`'s `DW-10.6` holds the crossed refusal and the closed report, drives four further acts, and prints the bytes before → after beside `Object.isFrozen` on both; RED under a revert of the seal.)
 **⟶ AND ITS SECOND HALF IS NOW DELIVERED, 2026-10-28 — `D-58` · THE DROP, AND NOTHING OF A RUNNING COMMIT.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; the seal, the list's identity and the log's home on the commit are unmoved.** **THE RULING, THE ARCHITECT, VERBATIM: *"The client does not need any insight into the current state of a commit/attempt before it completes. Don't expose any of it. After a commit/attempt resolves/rejects, the store does not need to retain the message log or other client-returned data. Don't retain it."*** **WHAT THAT MEANS FOR YOU, IN TWO SENTENCES. (1) A RUNNING COMMIT HANDS YOU NOTHING**: the log reader refuses a live attempt with `KC-7` — the same refusal the report reader already answered — so an in-flight `seq` list is no longer a thing you can read; **and (2) ONCE THE COMMIT RESOLVES OR REJECTS, THE STORE KEEPS NO MESSAGE LOG**: what it goes on holding is the outcome, the ops and the reversal's record, and the list it handed you — the entries on the refusal you caught, or on `report`'s return — is the ONLY copy, sealed at the handoff. **WHAT THIS COSTS, SAID PLAINLY**: on an arm whose handoff carries no list at all — a repair body that throws, and a PASSING `write` (whose answer is `{op, watched, triggered}` and has never carried one) — the entries are no longer readable after the call. **THAT IS THE RULING'S PRICE AND NOT A DEFECT**, and it is why the seal mattered: a record you hold is the record. (`tests/e2e/discard-witness.mjs`'s `DW-11.1`–`DW-11.4` print both readers, the pass's own instant, the retained shape before → after and the single-copy proof; each RED under its own `/tmp` revert.)
 
@@ -1395,10 +1428,12 @@ whose union stopped at `17` would mistype both.** **So: do
 not `switch` on these without a `default`, and NEVER treat an unknown `status` as success.** The set is the
 store's to close; **the package mints no member, widens no set and renames none.**
 
+**★ AND ONE ARM OF ROW `20` IS NOT WHOSE IT LOOKS LIKE, DECLARED HERE SO YOU MEET IT BEFORE A TEST DOES — `D-76` ITEM 2 (`DEF-AU`), 2026-10-29.** **`ConstraintPassRefused` ALSO CROSSES WHEN THE REFUSED ACT WAS A LISTENER'S AND NOT YOURS**: **your own write's data then STANDS IN THE STORE**, and the answer carries **no member that says so** — *"so the status alone is not a statement that your write did not happen."* **WHAT TO DO IS `§6.5a`'s rule of use, where both arms are measured and printed side by side: DO NOT RETRY ON THE ANSWER — READ THE ADDRESS YOU WROTE.** **NO RANK MOVES, NO MEMBER IS MINTED AND NO BEHAVIOUR MOVES: the distinction is a closed set's business (`D-38`) and the architect's call, not this guide's** (`D-76`; `D-73`; `§6.5a`).
+
 **⟶ AND AN INNER REFUSAL A CONSTRAINT BODY THREW NOW CROSSES BESIDE THE CROSSED ONE, 2026-10-28 — `DEF-AK`, MEASURED AND DECLARED.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE and is read THROUGH this one; no rank moves and no member is minted.** **WHAT WAS MEASURED: a LISTENER body propagates an inner refusal VERBATIM — same `status`, same `message`, same two-entry `log` — while a CONSTRAINT body making the IDENTICAL write had it REPLACED by a generated `ConstraintBodyThrew` whose single log entry was the OUTER attempt's, with the inner refusal's own literal occurring ZERO TIMES anywhere. WHICH HOST YOU WERE INSIDE DECIDED WHAT YOU WERE TOLD.**
-- **`ConstraintBodyThrew` is still the `status` that crosses** — the body did throw, and rank `18` says so — **but the inner refusal is now REACHABLE from what you catch, under `Symbol.for('provident-storeroom.inner-refusal')`:** a non-enumerable own member carrying the value the body threw, so **its own `status`, its own `message` and its own `log` are all there to read.** `Object.keys(caught)` still reads `["status","message","log"]` — three members in the form's own order — and the form is unmoved.
+- **`ConstraintBodyThrew` is still the `status` that crosses** — the body did throw, and rank `18` says so — **but the inner refusal is now REACHABLE from what you catch, under `Symbol.for('provident-storeroom.inner-refusal')`:** a non-enumerable own member carrying the value the body threw, so **its own `status`, its own `message` and its own `log` are all there to read.** `Object.keys(caught)` still reads `["status","message","log","address"]` — FOUR members in the form's own order (`D-77`) — and the form is unmoved.
 - **AND THE CROSSED SENTENCE STOPS CLAIMING MORE THAN IT DELIVERS.** Its own bytes — *"a constraint body's throwable crosses as this refusal"* — now stand followed by **the package's own clause saying the value the body threw does NOT cross as this refusal, naming the inner `status` and quoting the inner `message`, and saying where the inner refusal crosses instead.** A body that threw something that is **not** a refusal (**a `TypeError`, a string**) has **nothing carried beside the crossed form**; there is no inner refusal to name, and the generated sentence names the CODE rather than promising a value.
-- **A FORGED THREE-MEMBER OBJECT IS STILL NOT QUOTED.** The inner refusal is recognised by **a mark this package sets on the forms IT builds** — never by the shape a caller can spell — so a body throwing `{status, message, log}` of its own gets the generated sentence and nothing of its text is repeated back as though the package had found a refusal there (`DEF-A`'s protection, extended one layer in).
+- **A FORGED THREE-MEMBER OBJECT IS STILL NOT QUOTED.** The inner refusal is recognised by **a mark this package sets on the forms IT builds** — never by the shape a caller can spell — so a body throwing `{status, message, log, address}` of its own gets the generated sentence and nothing of its text is repeated back as though the package had found a refusal there (`DEF-A`'s protection, extended one layer in).
 - **THE LISTENER ARM IS UNCHANGED, AND THAT IS THE CONTROL:** nothing marks a listener's throw, so it still crosses **as itself**, by identity — `caught === thrown`, its own `status`, `message` and `log`. **A `rollback` whose judgement a pair's body threw** crosses `ConstraintBodyThrew` at rank `18` and carries any inner refusal the same way (`§5.4`).
 - **⟶ AND THE CONSTRAINT HOST'S LIST IS NOW THE COMMIT'S, WHICH IS THE DEEPER HALF OF THE SAME RULING (2026-10-28, `D-53`).** The inner refusal's own two entries are **IN the crossed report** — the `constraint-check` entry naming the inner pair and the `outcome` entry carrying `KC-3` — on the same array the enclosing attempt appends to, at a continuous `seq`; **`carriedInner.log` and `caught.log` are ONE array, not two.** **READ §8.0a ABOVE BEFORE COUNTING ENTRIES**: the listener's list is still its own, because the listener's write opens its own commit, and that difference between the two hosts is now the difference the ruling draws rather than an asymmetry nobody declared.
 
@@ -1440,7 +1475,7 @@ directory; a path that is a directory; an existing file that is not writable; a
 SYMLINK; a parent on a read-only mount (`EROFS`); and a create the process is denied (`EACCES`)
 (`docs/specs/storeroom-native/contract.md §8.1` #13's amended trigger clause; `§10.4` part 5).
 
-### §8.3 The refusal that is not `{status, message, log}` — declared, and narrow
+### §8.3 The refusal that is not `{status, message, log, address}` — declared, and narrow
 
 **Two positions throw a `TypeError` instead of the one form, and both are DECLARED rather than accidental:**
 
@@ -1728,7 +1763,7 @@ each is the figure its own clause already prints.** **THE FIVE, EACH WITH ITS ME
 **NO FIGURE MOVES BY THIS CLAUSE, AND THE ONE THING IT ADDS IS THE DATE ON WHICH ALL FIVE WERE READ AT THE SAME TREE.**
 
 **⟶ AND THE SIX FIGURES THIS GUIDE STATES ABOUT THE SHIPPED TREE ARE RE-MEASURED AGAIN AT THE `1.5.0` PREPARATION, 2026-10-29 — EVERY ONE OF THEM UNMOVED, AND THE PACKED SET MEASURED RATHER THAN CARRIED.** `RCA-8(g)` ANNOTATE-BESIDE: **every row, every ★ paragraph and every dated clause above stands BYTE-FOR-BYTE and is read THROUGH this one; this clause adds no rule, moves no figure and re-reads all six at one tree.** **THE SIX, EACH WITH THE READING ITS OWN BYTES GIVE THIS DATE:** **(1) THE STATUS SET IS TWENTY** — `src/error.rs`'s `CODES` is `[&str; 20]`, ranks `1`…`20` (`§8.1`'s heading, its table's `20` row). **(2) THE KERNEL'S TOKEN SET IS NINE** — `bindings/js/src/entry/kernel-foundations.mjs`'s `KC` carries `KC-1`…`KC-9` and no tenth (§8.0a's `KC-9` clause). **(3) THE INSTANCE CARRIES FOURTEEN OWN MEMBERS** (§3.1's table; `index.d.ts`'s `StoreInstance`). **(4) THE DEPTH CEILING IS `126`** — `bindings/js/src/entry/carrier.mjs`'s `ENCODER_CEILING = 126` and `bindings/js/src/crossing.rs`'s `depth > 126` are ONE figure, with `127` and beyond refused at the walk and the node ceiling at `1,000,000` beside it (`§10.3`). **(5) THE ALLOWLIST IS SEVEN ROWS** — `index.mjs` · `README.md` · `README.guide.md` · `RELEASE-NOTES.md` · `index.d.ts` · `src/entry/` · `src/constraint-kernel.mjs`, `7 = 5 + 2` ✓ (the clause of 2026-10-28 above). **(6) THE PACKED MEMBER SET IS `20` BARE AND `21` ASSEMBLED** — measured with `npm pack --dry-run --json` at `bindings/js` this date: `1` `package.json` + `5` root files + `13` entry modules + `1` kernel `= 20` ✓, and the assembled artefact adds the release's `LICENSE` for `21` (the clause above). **AND THE VERSION IS `1.5.0` AT ELEVEN CELLS** (§0's clause of this date). **NO FIGURE MOVED BETWEEN THE `1.4.0` PREPARATION AND THIS ONE**, and the reason is named rather than left to inference: **the twenty-seven commits past `v1.4.0` add no member, no status, no token, no ceiling, no packed byte and no allowlist row** — they declare the reach, the two kinds, the derived address, the listener's independence, the delivery's nesting and the throw (`D-66` … `D-73`), and those are clauses of use rather than rows of this section. (`D-66`–`D-73`; §0's clause of this date; `scripts/publish.sh --figures`.)
-
+**⟶ AND THE SIX FIGURES ARE RE-MEASURED AGAIN AT THE `1.6.0` PREPARATION, 2026-10-29 — FIVE OF THEM UNMOVED AND ONE MOVED, WHICH IS THE POINT OF MEASURING.** `RCA-8(g)` ANNOTATE-BESIDE: **every row, every ★ paragraph and every dated clause above stands BYTE-FOR-BYTE and is read THROUGH this one; this clause adds no rule and re-reads all six at one tree — the eleven commits past `v1.5.0` (`git describe` `v1.5.0-11-g8f5454f`).** **THE SIX, EACH WITH THE READING ITS OWN BYTES GIVE THIS DATE:** **(1) THE STATUS SET IS TWENTY** — `src/error.rs`'s `CODES` is `[&str; 20]`, ranks `1`…`20` (`§8.1`'s heading, its table's `20` row), **UNMOVED by `D-77`: the member is an address and never a code.** **(2) THE KERNEL'S TOKEN SET IS NINE** — `bindings/js/src/entry/kernel-foundations.mjs`'s `KC` carries `KC-1`…`KC-9` and no tenth, **UNMOVED** (§8.0a's `KC-9` clause). **(3) THE INSTANCE CARRIES FOURTEEN OWN MEMBERS** — measured at a live instance this date by `Object.getOwnPropertyNames`: `read` · `readLiteral` · `write` · `delete` · `rollback` · `listen` · `unlisten` · `addConstraint` · `constraintOn` · `constraintOff` · `constraints` · `removeListener` · `removeConstraint` · `register`, `14` ✓ — **UNMOVED** (§3.1's table; `index.d.ts`'s `StoreInstance`). **(4) THE DEPTH CEILING IS `126`** — `bindings/js/src/entry/carrier.mjs`'s `ENCODER_CEILING = 126` and `bindings/js/src/crossing.rs`'s `depth > 126` are ONE figure, with `127` and beyond refused at the walk and the node ceiling at `1,000,000` beside it, **UNMOVED** (`§10.3`). **(5) THE ALLOWLIST IS SEVEN ROWS** — `index.mjs` · `README.md` · `README.guide.md` · `RELEASE-NOTES.md` · `index.d.ts` · `src/entry/` · `src/constraint-kernel.mjs`, `7 = 5 + 2` ✓, **UNMOVED** (the clause of 2026-10-28 above; no document this release ships was added to `files` and none was removed). **(6) ★ THE PACKED MEMBER SET IS `20` BARE AND `21` ASSEMBLED, AND THE COUNT IS UNMOVED WHILE THE SET'S `README.md` AND `README.guide.md` GREW** — measured with `npm pack --dry-run --json` at `bindings/js` this date: `1` `package.json` + `5` root files + `13` entry modules + `1` kernel `= 20` ✓, and the assembled artefact adds the release's `LICENSE` for `21` (the clause above). **AND THE ONE FIGURE THAT MOVED IS NOT OF THE SIX: `LogEntry` KEEPS ITS FIVE MEMBERS (`kind` · `id` · `opId` · `message` · `state`, `D-65`), AND THE FOURTH MEMBER `D-77` ADDED IS ON THE *FAILURE FORM* AND NOT ON A LOG ENTRY** — so **the entry is five, the refusal is four, and neither is the other.** **AND THE VERSION IS `1.6.0` AT ELEVEN CELLS** (§0's clause of this date). **THE REASON THE FIVE ARE UNMOVED IS NAMED RATHER THAN LEFT TO INFERENCE: the eleven commits past `v1.5.0` add no status, no token, no ceiling and no allowlist row, and their one shape change is the refusal's fourth member (`D-77`)** — `D-74` bounds an entry's content and adds no column, `D-75` puts a witness on paths that already existed, and `D-76`/`D-78` declare what the machinery already did. (`D-74`; `D-75`; `D-77`; `D-78`; §0's clause of this date; `scripts/publish.sh --figures`.)
 **★ THE `exports` MAP HAS ONE ARM, AND THAT IS A PROMISE ABOUT WHAT IS REACHABLE:** **the addon is NOT reachable
 as a subpath and neither is the constraint kernel.** **There is no wildcard export, no deep import to the addon
 and no CJS arm** (`bindings/js/README.md`; `docs/specs/storeroom-publish/contract.md §1.3`;
@@ -1934,6 +1969,26 @@ tree sharing no mutable member with the store or with another crossing**, which
 
 **⟶ AND ONE CLAUSE OF ITEM 1 ABOVE IS CORRECTED AT ITS OWN SITE, 2026-10-29 — `D-55` ITEM 3 AND `D-57`: A `delete` DOES MINT AN ATTEMPT NOW, AND THE WINDOW'S REAL REASON IS THE DELIVERY'S POSITION.** `RCA-8(g)` ANNOTATE-BESIDE: **item 1's operative claim — a listener invoked by a `delete`'s delivery runs no constraint pass, and a `rollback` raised there is unjudged and its effect stands — is UNMOVED; what is false of this tree is its given reason, *"there is no attempt for a pass to run over."*** **THE TREE AT `1.4.0`: a `delete` opens its own commit, its own attempt and its own pass, and its receipt carries the four-member `CommitRecord`** (`§7.8`'s clause; `D-57`'s second half; `D-55` item 3). **SO THE ATTEMPT EXISTS — IT HAS ALREADY CLOSED** — **and the window stays passless for the ruling's own reason: the delivery runs AFTER the pass, and after a pass nothing re-enters on that work** (`D-64`; `§7.8`'s four steps). **NOTHING ELSE OF ITEM 1, OF ITEM 2, OF THE EXITS OR OF THE WITNESS MOVES.** (`D-55` item 3; `D-57`; `D-64`; §7.8; §12.6's clause above.)
 
+**⟶ AND THE ONE RAISE THIS SECTION'S LIST DOES NOT NAME IS JUDGED, 2026-10-29 — `D-42` · `D-54`, MEASURED, AND THE LIST STAYS TWO.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte of the two items, of the two exits and of the three clauses above stands BYTE-FOR-BYTE and is read THROUGH this clause; this clause adds no window and takes none away.** **THE QUESTION A CONSUMER ASKED, IN THEIR OWN WORDS:** *"host 6 — a raise from a constraint body DURING A DELETE'S CONSTRAINT PASS — does not judge, its effect stands, and it is not among the guide's declared windows."* **IT IS NOT JUDGED — IT IS JUDGED, AND THE LIST OF TWO IS COMPLETE.**
+
+**1. WHAT WAS MEASURED, ON THIS TREE, BEFORE AND AFTER THE MECHANISM WAS FOLLOWED.** The drive is one pair standing at `['a']`: `write(['a'], 'mem', 5)`, `write(['a'], 'mem', 9)` (the reversal's target), then `delete(['a'], 'mem')` with the pair's body issuing `rollback(<the 9 write's op>)` the first time a pass asks it. **THE PAIR'S ASKS, IN ORDER: `[9, undefined, 5]`** — at its REGISTRATION (`9`), by the DELETE'S OWN PASS at the state the delete left (absence), and **by the RESTARTED CHECK AT THE STATE THE REVERSAL LEFT (`5`)**. The delete answers **`ConstraintPassRefused`** with **ONE `constraint-check` entry naming the pair** and `opId` the reversal's own echo, the store is restored by that refusal's compensating act, **and `5` — the state the reversal left — is nowhere in the store afterwards.** The raise is taken with the delete's own window open (`open 1`, `live 1`), the reversal still answers its declared record (`{opId, undoneOps, restoredTo}`), and **the pair is asked at `5` ONCE, never per step** (`D-38`).
+
+**2. WHY THE RESTART REACHES THERE — THE SITE, NAMED, BECAUSE "IT JUST DOES" IS NOT AN ANSWER.** A `delete` runs **the same pass function a write's attempt runs**: its commit act opens the attempt (`kernel-commit.mjs`'s `commitRemoval`, no probe write landed), the entry runs the pass through `kernel-attempt.mjs`'s `runAttempt` **inside the `delete`'s own commit window**, and that scope **JOINS** the window rather than opening a second one — so **the request a body raises is stamped with the window the `delete` opened, and the drain at the pass's terminal is stamped with that same identity.** `constraints.mjs`'s `drainRestartRequests` therefore **consumes it, asks the pairs at the state the reversal left, and carries any refusal into the pass's report** (`D-54` (b) — the drain runs on **both** arms, the passing and the throwing one). **NOT ONE OF THE THREE CAUSES A MISSED JUDGEMENT WOULD NEED IS PRESENT**: the window identity matches, `reversalAtRest` answers "step" for a commit that is still open (`open 1`/`live 1` — which is why no per-step judgement is taken at the raise's own instant), and the delete's attempt does not close on a path that skips the drain. **THE EMPTY WITNESS AGREES RATHER THAN CONTRADICTING**: a delete whose pass raised and judged a request answers **`discarded: []`**, because the pass's drain consumed the request **before** the delivery ran (`§7.8`: the delivery sits after the pass) — **`[]` there is the reading of a JUDGED raise, and the same `[]` on a delivery's raise is the reading of an IGNORED one. The witness is not the judge; the ask is.**
+
+**3. AND THE SEVEN HOSTS THIS MACHINERY HAS, EACH LABELLED ON THIS TREE — THE TABLE TO KEEP THE COUNT IN.** Each row is the same drive: a pair whose body reverses, and the one readable evidence is **the pair being asked again at the state the reversal left**.
+
+| host | where the raise is taken | judged? |
+|---|---|---|
+| `H1` | a constraint body, during a **write's pass** | **JUDGED** — the pairs asked `[9, 7, 5]` |
+| `H2` | a repair body, during a **write's pass** | **JUDGED** — `[9, 7, 5]` |
+| `H3` | a listener body, in a **write's delivery** | **JUDGED** — `[9, 5]` |
+| `H4` | a **registration's own evaluation** | **NOT JUDGED** — `[9]`; the DECLARED window (item 2 above) |
+| `H5` | a **`delete`'s listener delivery** | **NOT JUDGED** — `[9]`, and `discarded` reports it; the DECLARED window (item 1 above) |
+| `H6` | a constraint body, during a **`delete`'s own pass** | **JUDGED** — `[9, undefined, 5]` |
+| `H7` | a **reentrant reversal-then-write** (a listener reverses, then writes) | **JUDGED** — `[9, 5]` |
+
+**SO THE MEASURED SET IS FIVE JUDGED AND TWO NOT, AND THE TWO ARE EXACTLY THE TWO WINDOWS DECLARED IN THE LIST ABOVE.** **A raise taken inside a pass is judged by that pass's own terminal check whichever verb opened the pass; a raise taken where NO PASS RUNS AT ALL — a registration's evaluation, a `delete`'s listener delivery — is not, and its effect stands, with the two exits intact.** (`D-42`; `D-54`'s three hosts, its item (a) and (b); `D-55` item 3; `D-64`; `tests/e2e/discard-witness.mjs` section `W16`, cells `DW-16.1`–`DW-16.4`: `DW-16.1` — `H6` judged, the asks, the refusal and the store printed — is **RED under a `/tmp` revert that removes the `delete`'s pass**, and `DW-16.3` — the seven-row table — is RED with it.)
+
 **⟶ AND THE SENTENCE THAT STOOD HERE IS WITHDRAWN AS FALSE, 2026-10-28 — `D-54`, MEASURED, AND IT IS WITHDRAWN RATHER THAN NARROWED. THE BYTES WERE: *"And every pass that DOES run drains its own restart request — so the fail-state is bounded by the two acts that run none."* THE CONSUMER MEASURED THREE HOSTS WHERE NEITHER HALF HOLDS — a repair body, a delete's pass, and a reentrant reversal-then-write — AND IN EACH ONE A PASS RAN, THE REVERSAL WAS LEFT UNJUDGED, AND ITS EFFECT STOOD (zero judge invocations; the refused `5` still there). What follows replaces them and is true of the code after that fix.**
 
 **THE RULE NOW, IN ONE SENTENCE: NO PASS CONSUMES A RESTART REQUEST IT DID NOT RAISE, AND A REQUEST RAISED INSIDE A PASS IS CARRIED TO THAT PASS'S OWN TERMINAL STATE AND JUDGED THERE — ONCE, AS `D-38` DECLARES, AND NEVER PER STEP.** The budget, its three asks, the failing-closed arm and `D-42` are exactly as they were; what changed is where the request is carried.
@@ -1971,12 +2026,105 @@ window throws away**: if it fails and you raise a `rollback`, **the request dies
   overwrites the first, so the witness reports the **last** request a delivery raised, and earlier ones were
   never recorded. **Neither limit is a defect; both are the declared shape.**
 
+**⟶ AND THE WITNESS NOW REPORTS EVERY RAISE, AT ANY COUNT, ON EVERY PATH, 2026-10-29 — `D-75`. READ THIS BEFORE YOU
+READ ANY `discarded` LIST, AND READ THE `D-49` BYTES ABOVE THROUGH IT: NOT ONE OF THEM IS DELETED, AND THE TWO
+CLAUSES BELOW ARE WITHDRAWN BY NAME.**
+
+**THE DEMAND, VERBATIM: *"report every discarded raise at any count, on every path."*** **It was filed because
+the witness was ABSENT MORE OFTEN THAN PRESENT, and the sentence it carries is the thing it could not say.**
+
+- **THE THREE THINGS THAT WERE BROKEN, IN YOUR TERMS.** **(1) TWO RAISES ANSWERED `[]`.** If your listener raised
+  a `rollback` and a second listener raised another in the same delete, the record said nothing had been
+  discarded — because **the machinery keeps ONE request and merges the second raise into it, and the merged
+  request's addresses were never re-measured**. **(2) A RAISE INSIDE A CONSTRAINT BODY WAS INVISIBLE ON BOTH
+  ANSWERS.** A `rollback` your constraint body raised while it was being asked carried no witness on the
+  `rollback`'s own record and none on the write's record. **(3) AND `[]` THEREFORE MEANT TWO THINGS.** *"Nothing
+  was discarded"* and *"I wasn't told"* read the same.
+- **WHAT YOU CAN SEE NOW: THE COUNT IS THE RAISES, NOT THE SLOTS.** `discarded` is **one entry per raise the
+  act's delivery threw away, in raise order, at any count** — each entry `{ opId, addresses }`, `opId` the id
+  THAT raise's reversal answered and `addresses` the addresses THAT raise's reversal moved. **An entry whose
+  `addresses` is `[]` is a raise that moved nothing your pairs watch: it is still COUNTED, and no address is
+  invented for it** (a reversal that moves the register itself reports `addresses: [[]]` — one element, the empty
+  address — so the two are told apart by the lengths `0` and `1`).
+- **AND IT IS PRESENT WHEREVER AN ACT CAN DISCARD, `0` INCLUDED.** **`a.delete`'s receipt** carries it (as it did);
+  **`a.write`'s record carries it too** — a write's window is drained by its own pass, so it reads `[]` and MEANS
+  it — **and `a.rollback`'s own record carries it**, answering the entry where the act's window discarded that
+  raise, and `[]` where a pass's drain consumed and JUDGED it (`D-42`: a raise a pass carries to its terminal
+  judgement was judged, not discarded). **`record.discarded.length === 0` now reads, on every one of them:
+  NOTHING WAS DISCARDED — and the member is present to say so.**
+- **READ THE ROLLBACK'S MEMBER AFTER THE ACT RETURNS.** `a.rollback(...)`'s `discarded` is a **LIVE VIEW**, not a
+  snapshot: the pass that judges a body's raise runs *after* the body returned, so read at that instant it says
+  `[]` — nothing has been discarded YET. **Read it once the act whose window the raise stands in has returned and
+  it is the settled answer.** **A WRITE'S AND A DELETE'S are accessors for the same reason** — a write's delivery
+  runs before its drain.
+- **STILL UNCARRIED, SAID PLAINLY BECAUSE `D-49` ASKED FOR IT TO BE SAID.** **A registration's answer
+  (`addConstraint`) is an opaque identity and carries NO witness.** What has changed is where its raise is
+  ANSWERED: **the store's next at-rest act proves that window has ended, the raise settles as discarded, and the
+  `rollback` record you already hold names it then** — on the raise's own answer, never on the unrelated call.
+- **NOTHING ELSE MOVED.** The `delete`'s four enumerable members, the `write`'s three and the `rollback`'s three
+  are the members `Object.keys` prints; `discarded` is a **NON-ENUMERABLE own member** on all three (an accessor
+  on the write's and the rollback's, an own data property on the delete's), so **a spread or `Object.assign` copy
+  does not carry it — read it off the record itself.** No status is minted, no refusal is added, and the
+  fail-state and both exits are unchanged.
+
+**MEASURED 2026-10-29, ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY** (`tests/e2e/discard-witness.mjs`'s `W18`):
+one raise with a pair at the raised address answers **one entry**; **TWO raises with pairs at both answer TWO
+entries — the arm that answered `[]` before** — each naming its own op id and its own moved address; two raises
+with a pair at only the first answer two entries, the second's `addresses` empty; and inside a constraint body, at
+one raise and at two, **the raise's own answer and the triggering write's answer both carry `discarded`**. Every
+one of those five cells is RED under its own `/tmp` revert. (`D-75`; `D-49`; `D-55` item 6 · `DEF-AP`; §8's
+`record.discarded` clause above.)
+
+**⟶ AND THE MEMBER'S PRESENCE IS ITSELF A CLAIM, 2026-10-29 — `D-78`: `undefined` IS NOT `[]`, AND THESE ARE THE
+TWO LINES YOU WILL COMPARE WITHOUT THINKING.** **THE DOWNSTREAM'S DEMAND, VERBATIM: *"say when the member is
+present, and that `undefined` is not `[]`."*** **AN ABSENT MEMBER AND AN EMPTY LIST ARE DIFFERENT CLAIMS:** **one is
+about an act that cannot have this outcome at all, and the other is a statement about an act that can — so a
+consumer reading absence cannot tell *"not reported"* from *"nothing to report."***
+
+- **WHICH ANSWERS CARRY IT — THREE, AND THEY ARE EXACTLY THE THREE THAT CAN DISCARD A RAISE: `a.delete`'s receipt,
+  `a.write`'s record, and `a.rollback`'s own record.** **On all three the member is PRESENT on every return, `0`
+  included** — it is not a member that appears when something went wrong, and nothing in your drive has to happen
+  for it to be there.
+- **`[]` MEANS: THIS ACT'S DELIVERY DISCARDED NOTHING.** **Present, empty, and TRUE.** The act *can* discard a
+  raise, you were told, and this time there was nothing in its window to throw away. **`record.discarded.length ===
+  0` is that sentence and no other.**
+- **`undefined` MEANS: THIS ACT CANNOT DISCARD A RAISE, SO THE QUESTION DOES NOT ARISE.** **A `read` — and
+  `readLiteral`, and every member that hands you a VALUE rather than a record of an act — carries no such member at
+  all** (`store.read(['a'])` answers your tree, and `answer.discarded` is `undefined` — no such member stands on
+  it). **DO NOT READ ABSENCE AS
+  "NOTHING WAS DISCARDED":** it says this act was never in the position to discard, **and a consumer that treats the
+  two alike has answered a question about an act whose outcome cannot be that one.**
+- **THE TRAP, NAMED: THE TWO LINES ASK DIFFERENT QUESTIONS.** **`if (record.discarded === undefined)` asks *"can
+  this act discard at all?"*** — it is a question about the ACT. **`if (record.discarded.length === 0)` asks *"did
+  it, this time?"*** — it is a question about YOUR run. **Neither line is a spelling of the other, and on a `read`
+  the second one throws.**
+- **AND A COPY LOSES THE MEMBER ENTIRELY.** `discarded` is a **NON-ENUMERABLE** own member on all three (an
+  accessor on the `write`'s and the `rollback`'s, an own data property on the `delete`'s), so **`{...receipt}` and
+  `Object.assign({}, receipt)` carry the enumerable members and NOT the witness** — **the copy's `record.discarded`
+  is `undefined` whatever the original said**, which is how a consumer ends up asking the "cannot discard" question
+  about an act that can (`D-49`'s non-enumerability, and `D-55` item 2's root). **Read it off the record itself.**
+- **WHAT TO DO: CHECK PRESENCE FIRST, THEN LENGTH.** `if ('discarded' in record)` distinguishes *"this act cannot
+  discard"* from *"it can"*; only then does `record.discarded.length === 0` mean *"nothing was discarded."* **AND DO
+  NOT WRITE `record.discarded?.length` (OR TEST IT FOR TRUTHINESS) AND CALL IT DONE:** `undefined` and `0` are both
+  falsy and one test then answers both questions — **that collapse is exactly what this clause exists to
+  prevent.** If you need one expression, name which question you are asking: `record.discarded === undefined` for
+  the act, `record.discarded.length === 0` for the run.
+- **MEASURED 2026-10-29, ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY — SIX ARMS AND A SEVENTH.** **`delete`: a
+  listener in its delivery raises a `rollback` → `discarded: [{opId, addresses}]` (`1` entry); the same delete whose
+  delivery raises nothing → `discarded: []`.** **`write`: a raise its own drain never reached → `1` entry; a raise
+  its own pass's drain consumed and JUDGED → `[]`.** **`rollback`: raised in a delete's delivery → `1` entry; an
+  at-rest reversal → `[]`.** **AND ONE ACT THAT CANNOT DISCARD — `read`: the member is ABSENT on its answer
+  (`record.discarded === undefined`, `Array.isArray(record.discarded) === false`), and that is not `[]`.** **So no
+  act that can discard was missing it and no act that cannot discard carried it.** (`D-78`; `D-75`; `D-49`; `D-55`
+  item 2.)
+
+
 **THE EXITS ARE STILL YOURS AND ARE UNCHANGED: reload the file, or regenerate the store.** What changed is that
 **the `delete` now tells you the discard happened** — *"a fail-state is honest only if the consumer learns it
 happened"* (`D-49`).
 **⟶ AND AN ENTRY IS NEVER SHIPPED WITH AN EMPTY ADDRESS LIST, 2026-10-28 — `D-55` ITEM 2 · `DEF-AH`, MEASURED.** `RCA-8(g)` ANNOTATE-BESIDE: **every bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause; the member's name, its non-enumerability, its `{ opId, addresses }` shape and the two limits stay exactly as they were.** **THE RULING, THE ARCHITECT, VERBATIM: *"A witness address of `[]` corresponds to the register itself. This is not a legal response for any other watched address."*** **SO THE TWO EMPTY THINGS ARE NOT THE SAME THING, AND THE SHIPPED `1.3.0` CONFLATED THEM: an ADDRESS of `[]` is THE REGISTER (the root) and is lawful; an entry whose address LIST is `[]` is never lawful.** **WHAT `1.3.0` DID, MEASURED: a delivery whose reversal moved NOTHING — a nested write, then a reversal of an op the watched address never held — reported `addresses: []`**, a list with no address in it. **WHAT YOU GET NOW:** **`record.discarded` is `[]` where nothing moved** — *if nothing moved there is no discard to report, so the entry is ABSENT and not empty* — **and a reversal that moves the ROOT reports `addresses: [[]]`**: one element, whose segment list is empty. **THE TWO READINGS BESIDE EACH OTHER, so a consumer can tell them apart: `[]` is "nothing was discarded"; `[[]]` is "the register itself is what moved".** **NO OTHER MEMBER MOVES:** `opId` is still the id the reversal named, the list is still `0` or `1` long, and nothing is minted into the status set. (`tests/e2e/discard-witness.mjs`'s `DW-10.1`/`DW-10.2` measure both arms; the empty-list arm is RED under a revert of the one line.)
 
-**⟶ AND YOUR `delete`'S OWN PASS IS STILL A MEASUREMENT AND NOT A BEHAVIOUR, 2026-10-28 — `D-55` ITEM 3 · `DEF-X`.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause of this section and of §12.6 above stands BYTE-FOR-BYTE; this clause answers the question a consumer asked about `1.2.0` by measuring `1.3.0`.** **THE RULING, THE ARCHITECT, VERBATIM: *"A delete is an editing verb and must pass constraints. This includes all of the relevant commit and message logic."*** **SO IT MUST — AND NO SHAPE AT THIS VERSION ADMITS ONE, WHICH IS WHAT THE MEASUREMENT SAYS RATHER THAN WHAT AN INTENTION SAYS.** **A `delete`'s path, verb by verb:** the entry's `delete` opens a commit window of its own (`openCommits` is `1` inside its delivery), calls the addon's `delete` entry, builds the record `{address, tiers, triggered, op}`, delivers the triggering set, reads the witness and closes the window. **IT NEVER CALLS THE KERNEL**: no `K-2` opens an attempt, no `K-3` runs a pass, no message log is minted and no terminal entry is appended — so the pair standing at the deleted address is asked exactly as often as its registration asked it, and NOT ONCE FOR THE DELETE. **AND THE ONE PASS SHAPE THE ARTEFACT HAS CANNOT STAND IN**: `K-2` **LANDS A WRITE OF ITS OWN BEFORE `K-3` JUDGES**, so a pass driven at the deleted address judges a state the delete is not in (measured: the store after it holds the value `K-2` wrote). **WHAT WOULD HAVE TO BE BUILT, SAID PLAINLY AND NOT BUILT HERE:** **a delete would have to be GIVEN a commit and an attempt of its own** — a `K-2`-shaped opening that takes the delete's own op instead of a write's, a commit list minted for it, a pass over the pairs standing at the deleted address against the state the delete leaves, a terminal arm that appends that log's `outcome` entry, and the delivery moved AFTER the pass so its listeners see a judged state — **and the current `delete` verb has none of those.** **A delete performed INSIDE a pass IS judged**, and that is the third case §12.6 above declares — but that is the pass's check, not the delete's. (`tests/e2e/discard-witness.mjs`'s `DW-10.8` prints the path, the counts and the pass shape it drove.)
+**⟶ `RCA-8(g)` MOVE-OUT, AUTHORED 2026-10-29 BY `D-76` ITEM 3 (`DEF-AT`): THE CLAUSE THAT STOOD HERE — the `D-55` item-3 `DEF-X` measurement headed *"AND YOUR `delete`'S OWN PASS IS STILL A MEASUREMENT AND NOT A BEHAVIOUR"*, its *"IT NEVER CALLS THE KERNEL"* and the shape it said would have to be built before a delete could have one — IS NO LONGER AT THIS LINE.** **`§7.8` above and the measurement both falsify it: a `delete` reaches the kernel, opens an attempt of its own kind at its own journal op, runs a pass over the pairs standing at the deleted address AND at every ancestor of it, appends that attempt's `outcome` entry, and delivers AFTER that pass** (`D-55` item `3`; `D-56`; `D-57`; the `1.4.0` section of this package's change list). **Its byte-exact text stands at `docs/guides/backup/D76-2026-10-29-guide-move-out.md §2`, whose head names this source path and its pre-move line range; NO BYTE OF IT IS RE-EMITTED HERE, and the ruling it recorded stays legible at that archive.**
 
 ### §12.7 A skip is not a green, and your own throws are not refusals
 
@@ -1984,7 +2132,7 @@ happened"* (`D-49`).
 log's own words: *"`skipped 1` is a cell that did not run"* (`strata/decisions.md`, the examiner's findings) —
 **and a client's own throw is not the package's form.** **A listener body that throws is NOT CAUGHT, NOT RETRIED
 AND NOT REPORTED:** the package does not wrap your callback, and what escapes is your own throwable, not
-`{status, message, log}` (`docs/specs/storeroom-js/surface.md §2.7` item 4). **WHY IT IS OUT OF SCOPE:** `D-35` —
+`{status, message, log, address}` (`docs/specs/storeroom-js/surface.md §2.7` item 4). **WHY IT IS OUT OF SCOPE:** `D-35` —
 **anything that enters the package from your side and leaves it is your shape, and the one thrown form is the
 package's answer to its OWN refusals.** **WHAT TO DO INSTEAD:** **catch inside your listener if you want a
 listener's failure to be yours**, and **never count a skipped test as a passed one** — and never treat a caught

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.5.0`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.6.1`.
 
 ## The one entry
 
@@ -81,6 +81,21 @@ receipt itself.** **No member is added to the FOURTEEN and no enumerable shape m
 `index.d.ts`'s `DeleteRecord.commit`; the long-form reading — the adoption, the `pending` residue, the `file`-tier
 save and `K-4`/`K-5` by reference — is the shipped guide's `§7.8`, which is where those four follow-ons are stated.)
 
+**★ AND `discarded` IS PRESENT OR ABSENT BY A RULE, NOT BY LUCK — `undefined` IS NOT `[]`** (`D-78`, 2026-10-29).
+**`discarded` is carried by the three acts that can discard a raise — `delete`'s receipt, `write`'s record and
+`rollback`'s own record — and by nothing else.** **On all three it is PRESENT on every return, `0` included:**
+**`[]` means this act's delivery discarded nothing — present, empty and true.** **A member that is `undefined` means
+this act CANNOT discard a raise, so the question does not arise** — a `read` or a `readLiteral` answers a value and
+carries no such member — **and absence must not be read as "nothing was discarded": it is "not reported, because
+this act cannot have that outcome."** **So `if (record.discarded === undefined)` and
+`if (record.discarded.length === 0)` are DIFFERENT QUESTIONS — "can this act discard?" and "did it, this run?" — and
+`record.discarded?.length` tested for truthiness answers both with one falsy reading, which is the collapse this
+rule exists to prevent.** **CHECK PRESENCE FIRST, THEN LENGTH;** and because the member is non-enumerable, **a spread
+or `Object.assign` copy of a receipt does not carry it and reads `undefined` whatever the original said** — read it
+off the record itself. **Measured on this checkout through the published entry: `delete`, `write` and `rollback` each
+answer `1` entry where a raise was discarded and `[]` where none was, and `read`'s answer carries the member
+nowhere.** (`D-78`; `D-75`; `D-49`; the long-form section is the shipped guide's `§12.6b`.)
+
 **THE RECEIVER IS THE STORE, SO NO CALL CARRIES AN `instance` POSITION** (`surface.md §2.1` (e) item 3):
 `store.write(address, tier, value)` is the shape every method takes, and a leading `instance` is a SUPERSEDED
 SPELLING — wrong, not redundant. **AND NO OWN MEMBER IS A DATA MEMBER:** there is no `store.data`, no `state`
@@ -109,22 +124,26 @@ position**. A refused position stops the write: no store call is reached and no
 
 ## The failure form is ONE
 
-**Every refusal is THROWN as a plain object carrying exactly `{status, message, log}`** — never an `Error`
+**Every refusal is THROWN as a plain object carrying exactly `{status, message, log, address}`** — never an `Error`
 subclass, never a returned tagged union and never a `Promise` rejection, so `try`/`catch` is the whole error
 model (`index.d.ts`, `StoreRefusal`; `surface.md §2.5`).
 
+**⟶ AND THE CROSSED FORM IS FOUR MEMBERS FROM 2026-10-29 — `D-77`, THE ARCHITECT'S RULING, ONE WORD: *"New member"*.** Every figure above and below that prints that form as THREE is read THROUGH this clause and stands as the reading of its own date. **THE FOURTH MEMBER IS *WHICH ACT WAS REFUSED* — `address`, the ADDRESS the refusal is about**: a segment array in the caller's own domain, or the declared `null` where there is nothing to name. The measurement it answers: **a caller's OWN act refused and a caller's act that PASSED while a LISTENER's was refused cross with the same `status`, the same `message`, the same keys and the same two log entries** — only the `opId` differs, and a refused act answers no `op` to key against — so the caller read `ConstraintPassRefused` and concluded its own write did not happen while the store says it did. **Compare the member with the address you wrote: `equal` means your own act, `different` means a listener's, and a retry is then a decision rather than a guess.** **IT IS PRESENT ON EVERY REFUSAL, `null` WHERE NOTHING IS NAMEABLE** (*"a member absent on some arm is the `DEF-AH` defect wearing a new name"*), so `Object.keys(caught)` reads exactly `["status","message","log","address"]`, length `4`, on EVERY arm. **THE CLOSED STATUS SET IS NOT REACHED — twenty stays twenty — and the member is no heuristic a consumer has to reproduce.** The form's one home is `docs/specs/storeroom-js/surface.md §2.5` item `4-ter`.
+
 ```js
 try {
   store.write(['users', 0, 'name'], 'mem', 'ada');
 } catch (e) {
-  const { status, message, log } = e;   // Object.keys(e) is ["status","message","log"] on EVERY arm
+  // The FOUR members, in the form's own order (`D-77`: `address` is the act the refusal is about).
+  const { status, message, log, address } = e;   // Object.keys(e) is ["status","message","log","address"] on EVERY arm
+  // equal to the address you wrote ⇒ YOUR OWN act was refused; different ⇒ a LISTENER's was and your write stands.
 }
 ```
 
 **★ AND `log` IS NEVER ABSENT.** It is an ordinary own enumerable data member of that same object — written
 with an object literal, not `defineProperty`, not a getter, not on a prototype and not behind a `Symbol` — and
-**`Object.keys(caught)` reads exactly its three members in the form's own order, `["status","message","log"]`,
-length `3`, on EVERY arm.** **`[]` is its declared value where the failure's cause has no attempt at all, and
+**`Object.keys(caught)` reads exactly its FOUR members in the form's own order, `["status","message","log","address"]`,
+length `4`, on EVERY arm.** **`[]` is its declared value where the failure's cause has no attempt at all, and
 every failure whose attempt exists carries that attempt's own entries — the kernel's FIVE-member `LogEntry`
 records, with the `outcome` entry's `state` carrying the `KC` token where the constraint pass produced one** **⟶ AND IT IS
 FIVE SINCE `D-65`: `kind` · `id` · `opId` · `message` · `state` — the `seq` member is GONE, because a log entry's position
@@ -225,6 +244,21 @@ token on the `outcome` entry's `state`. **The value is not written
 and a failed attempt leaves the store exactly as it found it**, whether the constraint refused outright or its
 repair failed on the re-run (`D-40`).
 
+**⟶ AND ONE ARM OF THAT STATUS IS NOT YOURS, DECLARED HERE 2026-10-29 — `D-76` ITEMS 1 AND 2, ON THE DOWNSTREAM'S
+`DEF-AU`.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE and is the reading of its own
+date; what it cannot say is whose act the status names.** **`ConstraintPassRefused` ALSO CROSSES WHEN THE REFUSED
+ACT WAS A LISTENER'S AND YOUR OWN WRITE HAD ALREADY LANDED** — **a listener's act is in the listener's own commit,
+and its throw is the channel by which your code logs that violation, because you are the only party positioned to**
+— **and the answer does not tell the two apart: `status`, `message`, the three own members, the log's length and
+every entry's `kind` · `id` · `message` · `state` are EQUAL, the log's `opId` the only differing byte, and that byte
+cannot be keyed against anything, because a refused act answers no `op`.** **SO DO NOT RETRY ON THE STATUS ALONE:
+READ THE ADDRESS YOU WROTE.** **Your value stands ⇒ the refusal was a listener's and your data landed, so a retry
+re-applies it; your value does not stand ⇒ it was your own act's and nothing was written.** **NO STATUS, MEMBER OR
+RANK MOVES FOR THIS: the distinction is a closed set's business (`D-38`) and the architect's call** (the guide's
+`§6.5a` and its `§8.1` row `20` carry both arms measured, and `D-73` carries the throw's rule; `D-76`.)
+
+**⟶ AND THE MEMBER THAT PARAGRAPH SAID WOULD NOT MOVE HAS MOVED, 2026-10-29 — `D-77` MINTS `address`, SO THE TWO ARMS IT MEASURED ARE TOLD APART BY THE FORM ITSELF.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE as the reading of its own date and is read THROUGH this clause; its RULE — *"do not retry on the status alone: read the address you wrote"* — STANDS, and the two sentences this clause supersedes are named rather than overwritten: *"the three own members"* and *"NO STATUS, MEMBER OR RANK MOVES FOR THIS"*.** **WHAT A CONSUMER GETS: the fourth member, `address` — the ADDRESS the refusal is about, a segment array in your own domain or `null` where nothing is nameable — present on EVERY arm, `Object.keys` reading `["status","message","log","address"]` at length `4`** (the clause below prints the same form, and it is this page's one shipped sentence about it). **SO THE COMPARISON IS THE ANSWER: `address` equal to the address you wrote ⇒ YOUR OWN act was refused and your write did not happen; different ⇒ a LISTENER's act was and your write STANDS, so a retry would apply it twice.** **THE CLOSED STATUS SET IS NOT REACHED — twenty stays twenty — and no rank moves.** (`D-77`; `bfe844a`; the form's own clause below, and the guide's `§6.5a` and `§8`.)
+
 ## The `file` tier, and what actually persists
 
 **Durability is produced by a successful `file`-TIER WRITE ONLY** (`DD-28`, `D-32`). **So a BARE `file`-tier