provident-storeroom 1.6.1 → 1.6.2

package/README.guide.md

@@ -30,7 +30,7 @@ preflight REFUSES when these two lines do not read what it computed** (`scripts/
 one check, read-only). **THE TWO LINES ARE THIS GUIDE'S OPERATIVE FIGURES; every dated paragraph below is the
 reading of its own date and is read through them.**
 
-PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.6.1`.
+PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.6.2`.
 PUBLISH-GUIDE-CUT-STATE: NOT STATED -- this document describes the behaviour at the version line above, and the cut-state is the release's to state, not a shipped document's (`D-57`).
 
 **⟶ AND THE CUT-STATE SENTENCE ABOVE IS WITHDRAWN, 2026-10-28 — THE CUT-STATE IS NOT A DOCUMENT'S TO STATE.** `RCA-8(g)` ANNOTATE-BESIDE, and the architect's ruling verbatim (`strata/decisions.md` · `D-57`): *"Drop the cut-state."* **The two marked lines above stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause — not one byte of either is deleted — and the sentence this clause withdraws is the SECOND of them, the one that claims to say whether the release this guide travels in is cut.** **THE REASON IS MEASURED, THREE TIMES OVER, AND IT IS STRUCTURAL RATHER THAN A MISTAKE: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and the change list's head was stale within minutes of the tag that falsified it. **SO THE CUT-STATE SENTENCE IS DROPPED AS A CLAIM AND THE VERSION LINE STAYS**, because the version line is the ONE figure a tarball can be right about: the manifest knows it and travels beside it. **`scripts/publish.sh --figures` GENERATES AND ASSERTS THE VERSION LINE AND NOTHING ELSE** — the cut-state generation and its assertion are removed in the same act, so a tag set that moves can no longer redden this guide — **and the same one line is asserted in THREE shipped documents: this guide, `README.md` beside it, and the change list** (`DEF-AC`'s remaining demand, *"guard the release notes too"* and *"`README.md` still declares no version at all"*). **THE TAG SET IS NOT DELETED AND NOT DENIED: it is a RECORD OF RELEASES held in the change list, PAST TENSE — a list of what has been cut — and never a claim about the current one.** **AND WHAT THIS CLAUSE DOES NOT SAY, SAID PLAINLY BECAUSE A READER WILL LOOK FOR IT: it does not say whether the version this guide prints is cut.** That is not a document's to state; the record of what has been cut is in `RELEASE-NOTES.md`, and the registry is the registry.
@@ -74,7 +74,7 @@ measurements on a locally packed, installed artefact, and is still not witnessed
 **⟶ AND THE ELEVEN VERSION SITES READ `1.5.0`, 2026-10-29 — THE PREPARED FIGURE, AND EVERY `1.3.0` THIS GUIDE PRINTS READS `1.5.0` FROM HERE ON.** `RCA-8(g)` ANNOTATE-BESIDE: **the nine dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.5.0"`, all five `optionalDependencies` pins are `1.5.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.5.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.5.0` at the built artefact and at a package installed from it.** **AND THE RELEASE THIS CHAIN SKIPPED IS NAMED RATHER THAN SILENTLY ABSORBED: `1.4.0` read `1.4.0` at those same eleven cells and was cut from them — the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0` — and §11's manifest table all read `1.5.0`.
 
 **⟶ AND THE ELEVEN SITES READ `1.6.0` FROM THIS PREPARATION, 2026-10-29 — THE BUMP IS MADE HERE AND EVERY `1.5.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause — including its `1.5.0` — because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.0"`, all five `optionalDependencies` pins are `1.6.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`)** — and **`npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.0` at the built artefact and at a package installed from it** (measured this date at `bindings/js/build/Release/storeroom_js_binding.node`, and again at a package installed into a `/tmp` consumer with no repository in its ancestry). **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.0`, **and the one figure this guide can be right about is generated from that manifest and asserted in three shipped documents by `scripts/publish.sh --figures`.** **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0`, `git describe` reads `v1.5.0-11-g8f5454f`, and **no `v1.6.0` is among them** — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above). **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`, and `git describe` reads `v1.4.0-27-ga3312b7` — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above).
-**⟶ AND THE ELEVEN SITES READ `1.6.1` FROM THE DOCUMENTATION RELEASE, 2026-10-30 — EVERY `1.6.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause, because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.1"`, all five `optionalDependencies` pins are `1.6.1` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.1` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.1` at the built artefact and at a package installed from it.** **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.1`. **AND WHAT THIS RELEASE CHANGES FOR YOU IS NO ARM OF THE PACKAGE: the failure form stays four members, a log entry stays five, the status set stays twenty and the kernel's token set stays nine** — the change list's `§1.6.1` states it with its arithmetic. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0` · `v1.6.0`, and `git describe` reads `v1.6.0-4-g674b79e`. (`D-57`; the change list's `§1.6.1`; `scripts/publish.sh --figures`, which asserts the one figure in three shipped documents.)
+**⟶ AND THE ELEVEN SITES READ `1.6.2` FROM THIS PREPARATION, 2026-11-02, AS THEY READ `1.6.1` FROM THE DOCUMENTATION RELEASE BEFORE IT — EVERY `1.6.1` AND `1.6.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause, because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.1"`, all five `optionalDependencies` pins are `1.6.1` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.1` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.1` at the built artefact and at a package installed from it.** **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.1`. **AND WHAT THIS RELEASE CHANGES FOR YOU IS NO ARM OF THE PACKAGE: the failure form stays four members, a log entry stays five, the status set stays twenty and the kernel's token set stays nine** — the change list's `§1.6.1` states it with its arithmetic. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0` · `v1.6.0`, and `git describe` reads `v1.6.0-4-g674b79e`. (`D-57`; the change list's `§1.6.1`; `scripts/publish.sh --figures`, which asserts the one figure in three shipped documents.)
 
 **AND ONE THING A READER OF THE INSTALLED PACKAGE SHOULD KNOW BEFORE THE CITATIONS: WHEN THIS DOCUMENT IS AT
 `node_modules/provident-storeroom/README.guide.md`, IT IS THIS GUIDE.** **Its ONE authored home is
@@ -891,6 +891,18 @@ instance: at CONSTRUCTION, and at a boot over an existing `filePath`, where the
 the list you supplied** (`native/contract.md §8.1` #16's amended trigger clause). **So a constraint list is code
 your application carries, not state your store stores.**
 
+**⟶ AND THREE CONSEQUENCES THE TWO ROUTES OWE THEIR READER, PLUS THE ONE ROUTE A REPAIR MAY TAKE THERE, PLUS THE ONE SCOPE CLAUSE THE LIST-PERSISTENCE PARAGRAPH OWES — 2026-11-02.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte of `§7.2` above stands BYTE-FOR-BYTE and is read THROUGH this clause; nothing above is deleted, no other section of this guide moves, and this clause is one dated correction and not a second site.** Its ground is two rulings of this date — `strata/decisions.md` · `D-90` and `D-91` (`docs/guides/package-use.md §7.2`'s own subject, read at the positions it names).
+
+**(1) ★ THE BATCH AND THE ADD ROUTE TAKE THE SAME ACT, AND THE BATCH'S ACT IS TAKEN WHILE YOU HOLD NO HANDLE.** `cfg.constraints` is armed INSIDE `storeCreate`, before that call has answered you an instance — so **a function the batch arms cannot reach the store by your own binding: there is not yet a binding to close over.** **What a repair invoked at that instant has is THE RECORD IT IS HANDED, and at a registration instant that record carries the route below.** The add route performs the same act with your binding in hand, and the two answer the same evaluation.
+
+**(2) ★ AND THE SKIP'S THRESHOLD IS ABSENCE ALONE — A PAIR IS CARRIED AND SKIPPED EXACTLY WHEN ITS PARENT DOES NOT RESOLVE, AND IT IS APPLIED WHERE THAT PARENT RESOLVES, WHETHER AS A CONTAINER, AS A LEAF, OR AS THE REGISTER.** The discriminator is the pair's own ADDRESS MINUS ITS LAST SEGMENT, and the parent's ABSENCE is the only skip. **⟶ AND THE LEAF ARM THIS ITEM FIRST PRINTED IS REPLACED HERE, 2026-11-02, AND NOT SCOPED — `D-96` (1)–(2); the architect, verbatim: *"Reject this, the constraint being there implicitly expects `'x'` to be a container"*.** **A LEAF STANDING AT A PAIR'S PARENT DOES NOT SKIP ITS PAIR: the pair's own presence declares that parent a container, so the pair is ASKED (`D-96` (2)) — and a body that REFUSES the state it meets at a resolving parent REFUSES THE REGISTRATION AT RANK `19`, `ConstraintRefusedAtRegistration`, on the arm where the refusing pair is the repaired one.** **A skip is not a refusal:** the function is not asked, nothing is refused for it, no entry is written for it, and **the registration does not fail for it** — the pair is registered, `constraints()` names it, and **it applies at the first later instant its parent resolves and an act of yours reaches its address.** **And the rule is GLOBAL, not batch-only:** it is read at every instant that would apply a pair — the batch at construction, the list at a boot over an existing `filePath`, `addConstraint`, a re-enable, and the pass over a write, a `delete` or a `rollback` (`D-90` (1)–(4); `D-96`). **The line is drawn by the NODE and not by how the value looks:** an object written at the parent makes it a container and a primitive written there makes a leaf — **and a pair under EITHER of them is APPLIED**, because neither of them is an absence.
+
+**(3) ★ AND A PAIR WHOSE OWN KEY IS ABSENT IS APPLIED, AND MAY REPAIR ITSELF.** `['window']` on a store holding no `window` has the REGISTER for a parent, and the register is always a container — so **the absence of its own key is the state that pair judges**, which is the arm a repair can rescue. **It is the only arm a repair can rescue: a pair under an absent parent is never asked, so nothing runs to create that parent and a repair it carries cannot reach the arm** (`D-91` (iv)). **To have a repair create `window`, register the pair at `['window']`** — whose own absence is what is judged — and not at an address beneath it.
+
+**(4) ★ AND THE ROUTE A REPAIR MAY TAKE AT A REGISTRATION INSTANT — `D-91`, THE ARCHITECT, VERBATIM: *"Give the registration instant a lawful write route."*** **A repair invoked at a registration instant — from `cfg.constraints`, from a boot over an existing `filePath`, from `addConstraint`, or from a re-enable — CAN WRITE, THROUGH A `write` FUNCTION ON THE RECORD IT IS HANDED.** **THE CONSTRAINT BODY'S OWN CONTEXT IS UNMOVED AND CARRIES NO SUCH MEMBER** (`D-92`: the route is the repair's alone), **so a body that needs a change returns a repair.** **THE ROUTE'S POSITIONS ARE THE STORE'S OWN THREE — `write(address, tier, value)` — AND THERE IS NO FOURTH: the commit is the registration's own and cannot be named**, and a call supplying one is refused before any store act. **ITS ANSWER IS THE STORE'S OWN WRITE RECORD — the very record the store's `write` answers — and the repair becomes creditable by `§7.6`'s repairable arm returning that record's own `op`**, which is the same rule a write's own repair is judged by, pointed at and not re-spelled here. **THE WRITE RUNS NO PASS OF ITS OWN:** the pair is judged by **THE REGISTRATION'S OWN RE-RUN over the op the repair returned**, so a repair that lands the state its own body admits makes the registration stand — **and a write the route lands before a refusal STANDS, because a registration composes no rollback.** **AND THE ROUTE EXISTS AT A REGISTRATION INSTANT AND NOWHERE ELSE**: at a write's own evaluation you already hold the instance, the repair there is handed the record it always was, and nothing about that instant moves.
+
+**(5) ★ AND THE LIST-PERSISTENCE PARAGRAPH ABOVE — the one that opens *"★ AND THE LIST IS NEVER PERSISTED — not in the file, not as a register key and not in any journal entry"* — IS READ THROUGH THIS ITEM FROM HERE, 2026-11-02, AND THIS ITEM IS THE SCOPE CLAUSE THAT PARAGRAPH OWES.** **THE LOADED STATE IS NOT VALIDATED FOR RESOLVABILITY:** a pair whose parent does not resolve is not refused at CONSTRUCTION and not refused at a boot over an existing `filePath`, **and no list is refused for it — the pair is CARRIED and SKIPPED, which is item (2)'s rule, and a skip is not a refusal of the pair or of the list.** **So at both of those instants `ConstraintListInvalid` — the one status that paragraph declares — answers THE MALFORMED LIST ALONE:** an element whose `address` is not a segment array, an `id` that is not a string, the list's own outside forms, **and the package's own construction-time rejections, which `§7.2` states at its own paragraphs and which this item points at rather than re-spells.** **AND A WELL-FORMED PAIR IS NEVER ANSWERED BY THE SHAPE ARM** — `native/contract.md §8.1` item 3's own sentence, which the withdrawal above makes TRUE of this tree rather than needing an amendment.
+
 **★ AND A REPEATED HANDLE ANSWERS DIFFERENTLY AT THE TWO ROUTES, WHICH IS A DIFFERENCE OF ACT AND NOT AN
 INCONSISTENCY** (`D-27`'s own table):
 
@@ -989,6 +1001,62 @@ you already hold, and `store.read(address)` is a published verb. **Measured 2026
 restored — **and the same body without the read passed, answering its record with its own value still standing at
 its address.** **The read is the whole difference.**
 
+**⟶ AND THE TWO RETURNS YOUR CONSTRAINT AND ITS REPAIR MAY MAKE ARE DECLARED HERE, 2026-10-30 — AND THE SECOND OF THEM IS THE ONE THIS SECTION IS ABOUT.** **EVERY SENTENCE OF THIS CLAUSE — THE ONE THIS MARK OPENS, DATED 2026-10-30 — HOLDS AT THE WRITE'S OWN EVALUATION, THE INSTANT THE KERNEL EVALUATES THE VALUE YOUR FUNCTION RETURNED, AND AT THAT INSTANT ONLY, EXCEPT WHERE A SENTENCE NAMES ITS OWN INSTANT IN ITS OWN WORDS.** **AND §7.6 CARRIES CLAUSES THIS DATED CLAUSE DID NOT WRITE, EACH AT ITS OWN EARLIER DAY — the clauses that state what a READ reads and what a DELETE asks, and the clauses that fix which pairs an act asks — AND A SENTENCE STANDING IN ONE OF THOSE IS OUTSIDE THIS FRAME AND IS READ AT ITS OWN INSTANT BY ITS OWN WORDS.** `RCA-8(g)` ANNOTATE-BESIDE: **every other clause of §7.6 — those standing above this one and those standing below it alike — stands BYTE-FOR-BYTE and is read THROUGH this one; the read rule, the addresses the pass asks, and the membership rule do not move, and this clause MOVES no byte of theirs. What this clause adds is the SHAPE of the two returns, the four ways the repair arm meets you, and ONE EXAMPLE you can drive as written.**
+
+**★ YOUR CONSTRAINT'S ANSWER IS A CLOSED THREE-ARM SET, READ IN THIS ORDER, AND THERE IS NO FOURTH ARM.** **`true` is the ONLY pass value; `{ message, repair }` is a REPAIRABLE violation; `{ message }` is an UNREPAIRABLE violation, whose `message` is the refusal's own sentence.** **A value outside those three is read as the `{ message }` arm and never as an arm of its own**, so a shape you invent beyond them is not distinguished from a bare refusal — the kernel does not ask it a second question.
+
+**AND `message` IS REQUIRED ON THE REPAIR ARM, BECAUSE THE KERNEL READS IT FIRST.** The arm's gate is the `message` member, read before any `repair` is looked for, and a `repair` is looked for only inside that branch: **a return carrying only `repair` is the arm outside the three, and its repair is NEVER SEEN**; **and AT THE WRITE'S OWN EVALUATION a `message` present but not a non-empty string keeps the repair readable while the refusal answers the kernel's own unrecognized sentence** — so write both members, and write `message` as the sentence you want your caller to read. **AT THE WRITE'S OWN EVALUATION — AT THAT INSTANT AND NO OTHER — THE KERNEL READS `message` AND `repair` AS OWN MEMBERS OF THE OBJECT YOUR FUNCTION RETURNED: a pair carried on a prototype is NOT SEEN there, and such a return answers the unrecognized sentence instead** (`bindings/js/src/entry/kernel-attempt.mjs:686-699`, `:690-696`). **THIS IS THE ONLY SENTENCE IN THIS GUIDE THAT STATES THAT RULE, AND IT IS THE LANDING INSTANT'S: the registration act reads the same closed outcome at `bindings/js/src/entry/kernel-registration.mjs:330-332`, where an inherited `repair` IS seen and invoked, so ONE RETURNED SHAPE ANSWERS TWO DIFFERENT THINGS AT THE TWO INSTANTS — a repair at registration and no repair at a write — and that divergence is OWED to a code-bearing unit and is contradicted by no sentence here** (`strata/decisions.md` · `D-35`). **THE EXAMPLE BELOW ESCAPES THE QUESTION BY CONSTRUCTION: it returns ONE OBJECT LITERAL whose two members are own members, so both instants read it alike.**
+
+**THE REPAIR'S OWN RETURN IS A CLOSED TWO-ARM SET.** **`{ ok: true, op }` is the repairable arm: `op` is REQUIRED and is THE STORE'S OWN OPERATION RECORD — `WriteRecord.op`, or `DeleteRecord.op` where that member is non-`null`, a `delete` that removed nothing answering `null` and crediting nothing — the one the verb your repair called returned.** **`{ ok: false, message }` is the failed arm: `ok` and `message`, and `op` ABSENT and never `null`, because an `op` there is read by nothing.** **At the write's own evaluation a return carrying any other identity fails `KC-4`** (`docs/specs/storeroom-constraints/contract.md:552`; the two arms print at `:558`) — **that one sentence covers every outside form of that return and this guide enumerates none of them.** **AND THE OP MUST BE ONE THE ATTEMPT CAN BE SHOWN TO HAVE LANDED: that ground is the kernel's own credit check, declared at `bindings/js/src/entry/kernel-foundations.mjs:1105-1131`, and it is POINTED AT here rather than re-spelled.** **No ordinal ground is claimed at the registration instant, whose credit check runs with no invoked-for op** (`bindings/js/src/entry/kernel-registration.mjs:510-517`).
+
+**THE REPAIR IS HANDED ONE ARGUMENT — ITS OWN RECORD, WHICH IS NOT YOUR CONSTRAINT'S AND IS NOT INTERCHANGEABLE WITH IT: the two records stand apart at THREE PLACES — by COUNT, SIX against FIVE; by `id`, which the repair's record carries where the constraint's carries `attempt`; and by `pending`, which rides the repair's record ALONE** (`bindings/js/src/entry/kernel-attempt.mjs:607-613`, `:756-782`; the kernel's own words at `bindings/js/src/entry/kernel-registration.mjs:373-374`). **AND THE COMMIT YOUR REPAIR IS PART OF RIDES THAT RECORD — its own `pending` member, the `CommitRecord.pending` this package declares at `bindings/js/index.d.ts:772`, POINTED AT and re-declared nowhere: pass it as `write`'s DECLARED FOURTH POSITION and the write you make JOINS the commit you are inside** (`bindings/js/index.d.ts:862`; `strata/decisions.md` · `D-46`). **No member census of either record is printed here, and that position's own class test is not restated.** A repair that names nothing in the fourth place also joins, by the kernel's own name; the fourth position is how YOU name it.
+
+**AND THE FOUR WAYS THIS ARM MEETS YOU, EACH DECLARED BECAUSE SILENCE HIDES A STATE A CONSUMER MEETS:**
+
+1. **(a) A THROW FROM YOUR REPAIR BODY CROSSES TO YOUR OWN CALL UNCONVERTED ON A WRITE**, where the throwable carries no store code: the write hands you back the very value you threw (`bindings/js/src/entry/kernel-attempt.mjs:833-854`).
+2. **(b) AT THE REGISTRATION INSTANT THAT SAME THROW IS CAUGHT AND CONVERTED INTO THE REGISTRATION'S REFUSAL** — `addConstraint` refuses, and no caller meets your body's value on that route (`bindings/js/src/entry/kernel-registration.mjs:498-508`).
+3. **(c) A PAIR'S REPAIR NEVER RUNS TWICE:** an applied repair may not run again, and a second violation of the same pair FAILS the attempt (`docs/specs/storeroom-constraints/contract.md:736`, `P-SM-6`'s row).
+4. **⟶ (d) AND WHAT A FAILED ATTEMPT DOES TO THE EDITS A REPAIR LANDED IS `docs/guides/package-use.md §5.4`'s OWN RULE — CITED BY PATH AND SECTION, STATED THERE AND NOT RE-SPELLED HERE.** **The plan that rule is read against is live code and is read at its own bytes: `bindings/js/src/entry/kernel-terminal.mjs:184-196`, the call site at `:215`, and `floorCallPlan` at `:288-343`; `strata/decisions.md` · `D-40` is the ruling that CLOSES that scope.** **AND ONE SENTENCE FOLLOWS FROM `§5.4`'s RULE, AS THAT RULE'S CONSEQUENCE AND NOTHING MORE: a repair's own writes are part of the attempt.**
+
+**⟶ AND HERE IS THE EXAMPLE THIS SECTION OWES — a repair that lands SOMEWHERE ELSE, which is this section's own subject, self-contained and driveable as written through the package's one export.** It is the shape the package's own e2e drive takes (`tests/e2e/repair-in-commit.test.mjs:95-115`), with the commit named by the repair's own hand:
+
+```js
+const store = storeCreate({ journalLength: 256, listeners: [] });
+
+store.write(['a'], 'mem', 1);
+store.addConstraint({ address: ['a'], id: 'two-goes-elsewhere' }, (context) =>
+  (context.value === 2
+    ? {
+        message: 'the landed value is not one this pair admits, and the repair moves it elsewhere',
+        repair: (repairContext) => {
+          const landed = store.write(['b'], 'mem', 11, repairContext);   // the commit, at write's fourth position
+          return { ok: true, op: landed.op };                            // the store's own record, not a copy
+        },
+      }
+    : true));
+
+const written = store.write(['a'], 'mem', 2);   // the pair refuses 2, its repair writes 11 at ['b'], the re-run passes
+store.read(['a']);   // 2  — the address your pair judges; the repair did not move it
+store.read(['b']);   // 11 — where the repair landed, inside the commit it is part of
+```
+
+**WHAT THE EXAMPLE SHOWS, IN THE ORDER THE MACHINERY RUNS IT.** **Your constraint returns ONE object literal carrying both members** — `message` the refusal's sentence, `repair` a function — so both instants read the same pair. **The repair runs with ITS OWN RECORD, makes its OWN `write` at `['b']` with that record in the fourth position, and RETURNS `{ ok: true, op: landed.op }`: the store's own record of the write it just made, never a number and never a record you assembled yourself.** **And the credit is visible to you:** `written.op` is that same op — in the drive named below, `{"opId":"op-3","kind":"write","address":["b"],"seq":3,…}` — **so the op the repair returned IS the op its own edit produced, which is what makes the re-run come back through that op's own landing and hand your body the value the repair landed (`11`) while the address your pair judges still stands at `2`.** **The write answers its record because that re-run passes; a repair that returned an op it did not land fails `KC-4` instead.** **Note what is NOT in the block: no type annotation, no new symbol, no import the guide does not already publish (`§3`), and no fourth outcome arm.**
+
+**MEASURED 2026-10-30, on this checkout, through the published entry (`bindings/js/index.mjs`), on the block above's exact bytes:** the write's own record carries `op` `{"opId":"op-3","kind":"write","address":["b"],"tier":"mem","before":{"present":false},"after":{"present":true,"value":11},"seq":3,"compacted":false}`, `store.read(['a'])` answers `2` and `store.read(['b'])` answers `11` — **so the repair was READ, its edit LANDED at the beside address, and its op was CREDITED.** **That drive is a measurement of the landing pass and not a committed test**; the package's own suite drives this arm at `tests/e2e/repair-in-commit.test.mjs`.
+
+**(1) WHAT CROSSED.** **A repair's answer that the credit check does not admit FAILS THE ATTEMPT, and what your caller catches is the refusal crossing as the set's rank-`20` member `ConstraintPassRefused`, with the kernel's token `KC-4` riding the TERMINAL entry's `state`** — `KC-4` is the kernel's repair-failed token (`bindings/js/src/entry/kernel-foundations.mjs:62`), the crossing and the token's seat are declared at `docs/specs/storeroom-js/surface.md:2079`, and the repair-body path that answers it prints at `docs/specs/storeroom-constraints/contract.md:557`. **This clause names `KC-4` and declares no member of any set.**
+**(2) WHAT THE REFUSAL SAYS — THREE MESSAGES REACH THE ARM AND THE COPY BELOW IS THE FALL-THROUGH'S ALONE.** **The message a `KC-4` refusal carries is drawn from ONE OF THREE SOURCES, the choice among them standing at `bindings/js/src/entry/kernel-attempt.mjs:878`-`:883`: where `ok` is `true` and the op the return names is defective, the kernel's own OP-IDENTITY SENTENCE, which stands at `bindings/js/src/entry/kernel-foundations.mjs:1139`-`:1150` and which this clause NAMES AND NEVER QUOTES; where `ok` is `false` and the return's `message` is a non-empty string, THE CALLER'S OWN `message`, which is no kernel sentence at all, so a caller holding a `{ok: false, message}` refusal is holding THEIR OWN WORDS and not the copy below; and, on the remaining arm, the `produced no op` template at `bindings/js/src/entry/kernel-attempt.mjs:883`, COPIED ON 2026-11-01 FROM THAT ONE LINE, template literal and interpolations included, character for character:**
+
+```js
+`the repair ${pair.id} produced no op at ${addressSpelling(attempt.address)}`
+```
+
+**and the one thing a reader must not take from it is this: the address in that sentence is the ATTEMPT's, and it is no claim about where the repair wrote** — **the sentence's own text is unedited here, this clause mints no second address, and it claims no correction and no fix of it; and the scope holds at EVERY sentence this arm composes, the op-identity pair interpolating the same `addressSpelling(attempt.address)`, while the caller's own arm composes no sentence to conclude anything from.**
+**(3) WHAT THE LIST IS — THE CENSUS, THE ONE RULE ABOUT IT, AND THE POINTER TO `§8.0a`.** **THE CENSUS IS THIS CLAUSE'S: the `log` a `KC-4` refusal crosses with is the COMMIT's one list and not the attempt's** (`docs/guides/package-use.md:1337`-`:1345`), **and the reading rule about a count of entries and a count of verdicts is `§8.0a`'s alone — this clause SENDS YOU TO THAT SENTENCE, names its home and not its content, and prints no count, no member census and no kind** (`docs/guides/package-use.md:1389`-`:1392`). **THE ONE RULE THIS CLAUSE STATES, AND IT IS A RULE ABOUT THE LIST: THE VERDICT IS THE LAST ENTRY WHOSE `state` IS NOT `null`; the terminal act appends the deciding attempt's `outcome` entry ONCE and it carries the arm's one token (`bindings/js/src/entry/kernel-terminal.mjs:66`-`:72`); it stands last because that attempt appended it LAST, and NEVER because no other entry carries a `state`.** **A CROSSED LIST MAY LAWFULLY CARRY MORE THAN ONE SUCH ENTRY: a constraint body's refused write shows that refusal's own entries VERBATIM before the enclosing `outcome` entry, as `§8.0a`'s nested-write bullet says in its own words, and `tests/e2e/blind-defect-cases.test.mjs:633`-`:646` prints an inner refusal's own `outcome` entry in ONE list beside the enclosing attempt's entries — so AN INNER REFUSAL'S ENTRY IS NOT THE VERDICT, and the LAST such entry is.** **The member the verdict is found by is the one `bindings/js/index.d.ts:357`-`:358` prints, cited for that member alone and for NO per-attempt scope, that scope being this clause's own statement of what a list may hold.** **The instance is cited and not re-taken: `tests/e2e/downstream-claims.test.mjs:1498`-`:1501` prints a `passed` entry inside a refusal's own list.** **The seat that token rides is already printed in this guide, at `§7.8`'s step 3 (`docs/guides/package-use.md:1102`-`:1105`), and this clause cites it there instead of re-deriving it.**
+**(4) WHETHER YOUR REPAIR'S EDIT STANDS — THE ADDRESS GEOMETRY, BOTH CONJUNCTS OF THE SWEEP, AND THE PLAN'S ONE SKIP ARM THAT BEARS ON IT.** **THE TEST IS THE ADDRESS, and it is the credit rule's declared consequence: whether the address the repair wrote IS ONE THE ATTEMPT'S OWN OPS NAMED — AT IT OR UNDER IT — because the floor call's candidates are taken from `attempt.ops` ALONE (`bindings/js/src/entry/kernel-terminal.mjs:288`-`:343`), each call's own scope is the named op's ADDRESSED SUBTREE AT OR AFTER THAT OP'S `seq` (`bindings/js/src/entry/kernel-terminal.mjs:255`-`:256`), and the store's own filter is `is_prefix(address, entry.address) && entry.seq >= floor` (`src/store.rs:2628`), where `address` is the call's named op's own address (`src/store.rs:2617`) and `floor` is that op's own `seq` (`src/store.rs:2622`).** **CREDIT IS THE MECHANISM AND NEVER THE TEST: the refusal returns before the uncredited op ever joins `attempt.ops` (`bindings/js/src/entry/kernel-attempt.mjs:885`-`:892`), and the ground that refused it is the kernel's own credit check (`bindings/js/src/entry/kernel-foundations.mjs:1105`-`:1131`).** **THE SWEEP DECIDES AT BOTH HALVES OF ITS FILTER: an entry must stand AT OR UNDER the address the call named AND ITS ORDINAL AT OR ABOVE THAT CALL'S FLOOR — so a write whose ordinal stands below the call's floor is NOT swept by that call whatever its address, and the prefix half ALONE sweeps nothing.** **AND THE FLOOR CALL'S PLAN DECLARES TWO SKIP CASES AT ITS OWN RANGE AND NAMES THEM, `COVERED` and `UNREACHABLE`, and this clause states those two names and no third case (`bindings/js/src/entry/kernel-terminal.mjs:264`-`:274`): `COVERED`, where every entry was already swept; and `UNREACHABLE`, where an already-issued address is a prefix of the candidate's and that call's floor stands AFTER the candidate's own first owed op while that address still has an owed op at or after that floor — and `UNREACHABLE` is the one that bears on the consequence, because the OUTER CALL IS KEPT AND THE INNER ADDRESS'S EARLIER ENTRIES STAND, so a write at an address the attempt DID name can still stand and *"credited or not"* is no answer at that end either.**
+**(5) WHAT THAT MEANS FOR THE STORE — THE CONSEQUENCE IN THE GEOMETRY'S OWN TERMS, AND `§5.4` READ BY LINE AT BOTH OF ITS SENTENCES.** **The store's answer for the address the repair wrote: a write AT OR UNDER AN ADDRESS THE ATTEMPT'S OWN OPS NAMED IS SWEPT WITH THE ATTEMPT, and a write at an address NO attempt op named STANDS — and it stands too where that address's call is skipped on `UNREACHABLE`, the arm item (4) names at `bindings/js/src/entry/kernel-terminal.mjs:264`-`:274`.** **AND `§5.4` IS READ BY LINE, AT BOTH OF ITS SENTENCES: `docs/guides/package-use.md:469` declares that the floor call restores the address the attempt wrote and that an address a repair landed at BESIDE it is NOT restored — the arm where the address lies OUTSIDE the attempt's own addressed subtree, so it STANDS; `docs/guides/package-use.md:476`(2) declares that A REPAIR'S WRITE GOES WITH THE WRITE — the arm where the repair's write lies INSIDE the attempt's own commit, so it is UNDONE WITH THE WRITE — and that sentence is UNSCOPED BY CREDIT, so it is no statement about credited writes only.** **THE DISCRIMINATOR BETWEEN THE TWO IS THE ADDRESS AND NEVER THE CREDIT, which is what lets both stand at once: this clause sends you to both lines, adjudicates neither, and moves no byte of `§5.4`.**
+**CONSOLIDATED, 2026-11-02 — ONE CLAUSE OF FIVE ITEMS, ONE QUOTE AND THIS MARK.** **What stands above is the five items as ONE clause, consolidated on 2026-11-02 from a first draft whose superseded sentences moved out, and the move is declared at `docs/specs/storeroom-repair-failure-path/contract.md`, the unit's live corpus path.** **The first draft got six things wrong, and here is each in one sentence.** **It presented the copy as the arm's sentence, when the copy is the fall-through's, one of three.** **It put the reading rule at this clause as well as at `§8.0a`, when the rule is `§8.0a`'s alone and this clause keeps the census and the pointer.** **It made the verdict the one entry whose `state` is not `null`, when the verdict is the LAST such entry and a crossed list may lawfully carry more than one.** **It made credit the test, when the axis is the address's membership in the attempt's ops, read at both conjuncts of the filter and at the plan's `UNREACHABLE` arm.** **It named `§5.4` once only, when both of its lines are read here at `docs/guides/package-use.md:469` and `docs/guides/package-use.md:476`(2), with the address as the discriminator and never the credit.** **It stated the store-state consequence by credit, when the consequence is stated in the address geometry.**
+
 **★ AND THE CONSEQUENCE A READER GETS WRONG, IN `D-50`'S OWN WORDS: *"a constraint that reads inside its body is
 caller code entering the surface, so by `D-45` that read opens its own commit"* — **⟶ MEASURED 2026-10-28, AND THAT CLAUSE IS WRONG: A READ BRACKETS NO COMMIT AT ALL.** `read`, `readLiteral` and `constraints` are the surface's **NON-BRACKETING** calls — the count during a constraint body's read is the attempt's own and is left undisturbed, `attempt-opened` does not fire for it, and the same `attempt` is in force. **So the accurate consequence is the shorter one: a read inside a body runs INSIDE the attempt's window, opens nothing, and disturbs nothing.** (The `D-45` quote above is kept as the reading of its own date; this sentence governs.) — AND A READ RUNS NO CHECK, SO
 NOTHING IS JUDGED BY IT.** **No constraint is asked on the value it returns, no pass runs, and the value you
@@ -1330,10 +1398,13 @@ with. **NO OTHER MEMBER, KIND, STATUS, COUNT OR SENTENCE OF THIS GUIDE MOVES** (
   detached member's — and a `TypeError` from a constraint method carries `[]` too. **The list is the COMMIT's
   and there is no commit there.**
 
+**⟶ AND THAT BULLET IS SCOPED TO THE STATE IT IS TRUE OF — 2026-11-02.** `RCA-8(g)` ANNOTATE-BESIDE: **the bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause.** **A CONSTRUCTION REFUSAL CARRIES `[]` WHERE THE ELEMENT THAT REFUSED CARRIED NO REPAIR** — **and where that element DID carry one, and its pair was asked, the refusal carries the entries that element's own `constraint-check` and `repair-run` appended**, because a repair is invoked at that instant and its invocation is part of the judgement. **So the two states are told apart by THE ELEMENT YOU SUPPLIED and by nothing about the route**: no repair on the element, no entries; a repair on it, that element's own. **And where the element's pair is SKIPPED — its parent does not resolve — there is nothing to refuse and nothing to carry: `§7.2`'s own clause states what a skip is.** **The counting caution below and the verdict rule it sends you to are UNMOVED by this sentence and neither is restated here.**
+
 **READ THIS BEFORE YOU LOG-COUNT.** `log.length` is **not** *"how many constraints were evaluated"* and not
 *"how many attempts this write made"*: it is **every entry of the commit**, in append order, from every attempt
 the commit held. Count entries by `kind` and `id` (and by `opId` where you need the iteration) rather than
 assuming a shape, because **a repair or a body's own write legitimately adds entries to the list you caught.**
+**And what the count above cannot tell you: where the refusal you caught carries a commit's list, several entries in it may lawfully read *passed*, so a count of entries is not a count of verdicts, and `§7.6`'s clause names the one entry that decides — while on the other arm, where a refusal names no attempt and still carries `[]`, nothing above promises a list to count.**
 
 **AND THE ONE PLACE THE INVARIANT IS NOT REACHED, SAID PLAINLY RATHER THAN LEFT TO A MEASUREMENT: a pair body
 invoked at a REVERSAL's judgement has no commit record standing beside it to name**, so a write such a body
@@ -2175,3 +2246,5 @@ quietly.**
   the instrument that decides between them.**
 
 **⟶ CORRECTED 2026-10-28 — THE BULLET ABOVE'S *"the two of 2026-10-26"* NO LONGER COUNTS THIS FILE, AND THE FIGURE IS MOVED RATHER THAN THE RULE.** `RCA-8(g)` ANNOTATE-BESIDE: **the bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause.** **This file now names FOUR measurements of its own — the two of 2026-10-26 the bullet carries, §7.6's two-address `b1` drive and §7.7's 60/40-reversal restart-budget drive, both taken 2026-10-28 on this checkout through the published entry — and each is named where it stands rather than gathered here.** **WHAT DOES NOT MOVE IS THE BULLET'S RULE AND THE DOCUMENT'S OWN STANDING: this guide is a consumer document and not a test report; a figure it states is either declared and cited or measured and marked; and the declared documents and the driven batteries remain the instruments for questions of semantics and of behaviour respectively.** **A reader who wants the measurements re-run finds their drives named at their sites, and no figure of this file is offered as a green.**
+
+**⟶ CORRECTED 2026-10-30 — THE COUNT IN THE CLAUSE ABOVE NO LONGER COUNTS THIS FILE EITHER, AND THE FIGURE IS MOVED RATHER THAN THE RULE.** `RCA-8(g)` ANNOTATE-BESIDE: **that clause stands BYTE-FOR-BYTE and is read THROUGH this one.** **This file now names FIVE measurements of its own — the FOUR that clause counts, and `§7.6`'s landing drive of 2026-10-30, taken on this checkout through the published entry on its block's exact bytes — and each is named where it stands rather than gathered here.** **WHAT DOES NOT MOVE IS THE BULLET'S RULE AND THE DOCUMENT'S OWN STANDING: this guide is a consumer document and not a test report; a figure it states is either declared and cited or measured and marked; and the declared documents and the driven batteries remain the instruments for questions of semantics and of behaviour respectively.**

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.6.1`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.6.2`.
 
 ## The one entry
 

package/RELEASE-NOTES.md

@@ -16,7 +16,7 @@ claims to be installable.**
 
 **⟶ AND THE CUT-STATE IS DROPPED FROM THIS FILE, 2026-10-28 — `D-57`, THE ARCHITECT VERBATIM: *"Drop the cut-state."*** `RCA-8(g)` ANNOTATE-BESIDE: **the title line and every dated paragraph of this file stand BYTE-FOR-BYTE as the reading of their own date, THIS clause is the one that reads them, and not one byte is deleted.** **THE REASON IS STRUCTURAL AND IT WAS MEASURED THREE TIMES: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and this file's own head was stale within minutes of the tag that falsified it. **SO EVERY SENTENCE BELOW THAT CLAIMS WHETHER SOME VERSION IS OR IS NOT CUT — *"PREPARED — NOT CUT"*, *"no `v1.3.0`"*, *"nothing in this section is cut"*, *"the release is not cut"*, *"what is installed today is still `1.1.0`"*, and each reading printed beside them — IS READ THROUGH THIS CLAUSE: the cut-state is not a document's to state.** **WHAT SURVIVES IS THE ONE FIGURE A SHIPPED DOCUMENT CAN BE RIGHT ABOUT, AND IT IS GENERATED FROM THE MANIFEST AND ASSERTED BY THE PREFLIGHT:**
 
-PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.6.1`.
+PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.6.2`.
 
 **AND THE TAG SET SURVIVES AS A RECORD OF RELEASES — PAST TENSE, A LIST OF WHAT HAS BEEN CUT, NEVER A CLAIM ABOUT THE CURRENT ONE** (the record stands in `§1.4.0` below — the section this file's head called `§main` until it was re-cut to name the version it prepares, 2026-10-28 — beside the section for the tree this file describes). (`D-57`; `DEF-AC` (b) — `scripts/publish.sh --figures` generates that line from `bindings/js/package.json`'s `version` and refuses on any disagreement, in this file, in `bindings/js/README.md` and in the shipped guide: three documents, three version lines, one generator, one assertion.)
 
@@ -55,6 +55,35 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
+## §1.6.2 · **PREPARED — the release this tree is being cut as** — a BEHAVIOUR release: what the thirty-four commits past the previous tag carry, the one additive member, the workaround it retires, and the four things it does not fix
+
+**THE VERSION: `1.6.2`, AT ELEVEN CELLS THAT MOVE TOGETHER AND NEVER SINGLY** — the main manifest's `version`, its **five** exact `optionalDependencies` pins, and the **five** `platforms/*/package.json` versions — **plus the three shipped documents' one generated version line each.** **The artefact is stamped from the manifest by `bindings/js/build.rs`, so `version()` answers the release figure** and that is the value the coupling rule is asserted against, not the crate's own `Cargo.toml` version.
+
+**THE ARITHMETIC, MEASURED AT THIS TREE: `git rev-list --count v1.6.1..HEAD` READS `34`.** The release's own work is `U-STOREROOM-CONSTRAINT-REGISTRATION-INSTANT` — the constraint registration instant — and the guide and corpus corrections it carried.
+
+**WHAT A CONSUMER SEES CHANGE, EACH A RULING OF 2026-11-02 AND EACH IN THE SHIPPED GUIDE:**
+
+1. **A pair whose PARENT address does not resolve is SKIPPED, not asked** (`D-90`). Before, it was asked with `undefined` and could refuse a construction; now the pair is **carried**, the registration stands, and it is applied at the first instant its parent resolves.
+2. **A pair whose parent RESOLVES is applied — including where the parent holds a LEAF** (`D-96`). **The pair's presence declares that parent a container**, so a leaf standing there is the state the pair judges: the body is asked, and a body that refuses refuses the registration at rank `19`.
+3. **A boot no longer refuses a constraint list for an unresolvable address** (`D-90` (5)). The list-wide walk is gone; `ConstraintListInvalid` now answers **the malformed list alone**, and a well-formed pair is never answered by the shape arm.
+4. **A repair invoked at a registration instant can WRITE** (`D-91`). The repair's own record carries a `write` function taking exactly the store write's first three positions; it joins the registration's own commit, and the repair is credited by returning the op it landed.
+5. **The re-run after a repair always runs, and reads the pair-application rule** (`D-94`).
+6. **`value` on a registration record is read once, and a write does not refresh it** (`D-95`).
+7. **A `rollback`'s own judgement reads the same rule** (`D-97`).
+
+**AND ONE MEMBER IS ADDED, WHICH IS WHY THIS IS A PATCH AND NOT A FEATURE** — **the package's own policy, `PUB-DD-9`: a PATCH is *"a fix inside the declared surface"*.** `write` exists **on the repair's record at a REGISTRATION instant only**: the landing instant's record still has six members, the constraint body's context still has five, **no status, verb, config key, `KC` token or other member moves**, and the closed status set stays twenty ranked `1`…`20`. A consumer that enumerates the registration repair record sees seven; one that enumerates either of the other two sees what it saw before.
+
+**THE WORKAROUND THIS RELEASE RETIRES, MEASURED ON THIS TREE.** Until now a "must exist, with a repair" pair could not travel in `cfg.constraints`, and this project's own register told a consumer to add it after construction instead. **That is no longer true:** with a `cfg.constraints` element whose body refuses on `ctx.value === undefined` and whose repair writes through the route, the construction **stands**, the body is asked **twice**, the repair's record carries `write` as a function, the object lands, and the pair stands. **The `addConstraint`-after-construction advice is withdrawn by this release.**
+
+**TWO CHANGES WITH A MIGRATION COST, SAID PLAINLY RATHER THAN LEFT TO A BUG REPORT:**
+
+- **A pair registered at a deep address no longer guards its ancestor's removal.** A `delete` of `['window']` reaches a pair at `['window','tabs']` and **skips it**, so the delete lands. **To guard a container, register the pair AT the container** — its parent is the register, which always resolves.
+- **A construction that refused for a well-formed pair whose parent was absent now stands.** A consumer who relied on that refusal to catch a stale list gets an instance with the pairs carried instead.
+
+**WHAT THIS RELEASE DOES NOT FIX**, recorded with owners in the unit's tracker entry and the live ledger: the refusal sentence's address at `kernel-attempt.mjs` (a recorded defect row, no successor queued); `§5.4`'s beside-write sentence, a named adjacent tension read through and edited by no pass; a body's direct write, now **declared unsupported** while the capability stays (`D-92`/`D-93`); and four corpus residuals — two property rows' wording, a `KC` token that no registration refusal prints, and a re-run arm unreachable through this route.
+
+---
+
 ## §1.4.0 · **CUT AND PUBLISHED — tag `v1.4.0`** — what that release carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states
 
 **⟶ THE HEADING THAT STOOD HERE WAS *"`## §1.4.0 · **PREPARED** — what `1.4.0` carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states`"*, AND IT IS CORRECTED AT ITS OWN LINE, 2026-10-28.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted above, every paragraph of this section below stands BYTE-FOR-BYTE as the reading of its own date, and nothing is deleted.** **THE DEFECT IS THE `DEF-AC` CLASS AT ITS THIRD ITERATION AND AT ITS SHARPEST: A HEADING THAT DENIED THE RELEASE ITS OWN TAG NAMES.** The tag set at this date reads `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`; **the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes**, its five `optionalDependencies` pins read `1.4.0` with it, and the five platform manifests' `version` fields read `1.4.0` with them; and **a reader opening this file met *"PREPARED"* over a version the registry carries.** **SO THE HEADING NOW READS `CUT AND PUBLISHED — tag `v1.4.0``, which is a PAST-TENSE RECORD OF A RELEASE AND NOT A CLAIM ABOUT THE TREE YOU ARE READING** — the tag set is the record of what has been cut, and the state of the current tree's version is not a document's to state (`D-57`, and the head clause of this file, which stands). **AND WHAT THE SECTION BELOW DECLARES IS UNMOVED BY THE CORRECTION: the ancestor set (`D-56`), the `delete`'s own attempt and its `CommitRecord` (`D-57`), the five smaller items of `D-55`, and the one shipped sentence that all of it falsified — those are `1.4.0`'s content, they travelled in its tarball, and a consumer who installed `1.4.0` has them.** (`D-57`; the head clause of 2026-10-28 above; `git tag --list` and `bindings/js/package.json` read at their own bytes this date.)
@@ -77,7 +106,14 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
-## §1.6.1 · **PREPARED** — a DOCUMENTATION release: what `1.6.1` carries, and the arithmetic that says how many commits
+## §1.6.1 · **CUT AND PUBLISHED — tag `v1.6.1`** — a DOCUMENTATION release: what `1.6.1` carries, and the arithmetic that says how many commits
+
+**⟶ AND THIS HEADING CARRIED THE PRE-RELEASE MARKER UNTIL THE TAG WAS CUT, 2026-10-30 — `D-83`.** `RCA-8(g)`
+ANNOTATE-BESIDE: **the withdrawn heading's bytes stand in the withdrawn record and are read THROUGH this clause; this
+sentence deliberately does not quote them, because a quotation of a claim reads as a claim and the scan cannot tell
+them apart — which is `D-80`'s own finding.** **A cut-state is the tag set's to answer: the tag exists, so this section
+names a past act and not a present claim — and it is the one new cut-claim `D-82`'s ratchet could not admit until
+`D-83` gave it the arm.**
 
 **⟶ THIS SECTION IS NEW, 2026-10-30, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.6.0`, and that section's heading is corrected at its own line in the same act.** **AND THIS SECTION DOES NOT STATE WHETHER `1.6.1` HAS BEEN CUT: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 above, which governs every sentence here).
 

package/index.d.ts

@@ -1173,6 +1173,75 @@ export interface ConstraintPair {
  * item 1: `true` is the only pass value). **Every non-function is outside the position AT EVERY ONE OF THE
  * THREE METHODS**, and a non-function at the toggle's position is refused on the ARGUMENT's ground and
  * never on the pair's.
+ *
+ * **⟶ AND THE TWO RETURNS THIS POSITION ADMITS ARE DECLARED HERE, ADDED 2026-10-30 — WHAT YOUR
+ * CONSTRAINT MAY RETURN, AND WHAT ITS REPAIR MAY RETURN.** **EVERY SENTENCE OF THIS CLAUSE — THE ONE THIS MARK
+ * OPENS, ADDED 2026-10-30 — HOLDS AT THE WRITE'S OWN EVALUATION, THE INSTANT THE KERNEL EVALUATES THE VALUE
+ * YOUR FUNCTION RETURNED, AND AT THAT INSTANT ONLY, EXCEPT WHERE A SENTENCE NAMES ITS OWN INSTANT IN ITS OWN
+ * WORDS.** **AND A SENTENCE STANDING ABOVE THIS CLAUSE IS OUTSIDE THIS FRAME AND IS READ AT ITS OWN INSTANTS
+ * BY ITS OWN WORDS — this clause moves none of it.** The clause above prints the answer's PASS value;
+ * this one declares the rest of the closed set IN ITS OWN WORDS, so a reader holding this package reads the
+ * rule and needs no second document for it.
+ *
+ * **THE OUTCOME IS A CLOSED THREE-ARM SET, READ IN THIS ORDER: `true` — THE ONLY PASS VALUE;
+ * `{ message, repair }` — A REPAIRABLE VIOLATION; `{ message }` — AN UNREPAIRABLE VIOLATION, ITS `message`
+ * THE REFUSAL'S OWN SENTENCE. A VALUE OUTSIDE THE THREE IS READ AS THE `{ message }` ARM AND NEVER AS A
+ * FOURTH ARM OF ITS OWN**, so a return you invent beyond them declares an outcome this kernel does not
+ * distinguish.
+ *
+ * **AND `message` IS REQUIRED ON THE REPAIR ARM AND IS READ FIRST**: the gate is the `message` member,
+ * read before any `repair` is looked for, and a `repair` is looked for only inside that branch — **so a
+ * return carrying only `repair` is the arm outside the three and ITS REPAIR IS NEVER SEEN**, and **AT THE
+ * WRITE'S OWN EVALUATION a `message` that is not a NON-EMPTY STRING keeps the repair readable while the
+ * refusal answers the kernel's own unrecognized sentence** (the closed set, its order and this read stand at
+ * `bindings/js/src/entry/kernel-attempt.mjs:686-699`).
+ *
+ * **THE ATTACH: the `repair` your function returns IS A FUNCTION TAKING ONE ARGUMENT — ITS OWN RECORD,
+ * WHICH IS NOT YOUR CONSTRAINT'S AND IS NOT INTERCHANGEABLE WITH IT.** **The two records stand apart at
+ * THREE PLACES: by COUNT, SIX against FIVE; by `id`, which the repair's record carries where the
+ * constraint's carries `attempt`; and by `pending`, which rides the repair's record ALONE**
+ * (`bindings/js/src/entry/kernel-attempt.mjs:607-613`, `:756-782`; the kernel's own words at
+ * `bindings/js/src/entry/kernel-registration.mjs:373-374`). **No member census of either record is
+ * printed here.**
+ *
+ * **AT THE WRITE'S OWN EVALUATION — AT THAT INSTANT AND NO OTHER — THE KERNEL READS `message` AND
+ * `repair` AS OWN MEMBERS OF THE OBJECT YOUR FUNCTION RETURNED: a pair carried on a prototype is NOT SEEN
+ * there, and such a return answers the kernel's unrecognized sentence instead**
+ * (`bindings/js/src/entry/kernel-attempt.mjs:690-696`). **THIS IS THE ONLY SENTENCE IN THIS FILE THAT
+ * STATES THAT RULE, AND IT IS THE LANDING INSTANT'S**: the registration act reads the same
+ * closed outcome at `bindings/js/src/entry/kernel-registration.mjs:330-332`, where an inherited `repair`
+ * IS seen and invoked — **ONE RETURNED SHAPE ANSWERING TWO DIFFERENT THINGS AT THE TWO INSTANTS, a repair
+ * at registration and no repair at a write — and that divergence is OWED to a code-bearing unit and is
+ * CONTRADICTED BY NO SENTENCE HERE** (`strata/decisions.md` · `D-35`, whose parameter-access rule the
+ * registration read does not yet hold).
+ *
+ * **THE REPAIR'S OWN RETURN IS A CLOSED TWO-ARM SET: `{ ok: true, op }` — the repairable arm, `op`
+ * REQUIRED and BEING THE OPERATION RECORD THE STORE'S OWN VERB RETURNED (`WriteRecord.op`, or
+ * `DeleteRecord.op` where that member is non-`null` — a `delete` that removed nothing answers `null` and
+ * credits nothing) — and `{ ok: false, message }` — the failed arm. WHERE `ok` IS FALSE THE RETURNED
+ * OBJECT'S MEMBERS ARE `ok` AND `message`, AND `op` IS ABSENT AND NEVER `null`, BECAUSE AN `op` THERE IS
+ * READ BY NOTHING. **AT THE WRITE'S OWN EVALUATION A RETURN CARRYING ANY OTHER IDENTITY FAILS `KC-4`**
+ * (`KC-4`'s token and the repair-body path print at `docs/specs/storeroom-constraints/contract.md:552`,
+ * and the two arms print at `:558`). **That one sentence covers every outside form of that return, and
+ * this file enumerates none of them.**
+ *
+ * **AND THE OP MUST BE ONE THE ATTEMPT CAN BE SHOWN TO HAVE LANDED: that ground is the kernel's own credit
+ * check, and it is POINTED AT here and never re-spelled** —
+ * `bindings/js/src/entry/kernel-foundations.mjs:1105-1131` — **and NO ORDINAL GROUND IS CLAIMED AT THE
+ * REGISTRATION INSTANT, whose credit check runs with no invoked-for op**
+ * (`bindings/js/src/entry/kernel-registration.mjs:510-517`).
+ *
+ * **AND THE COMMIT YOUR REPAIR IS PART OF RIDES THAT ONE ARGUMENT: supply it at `write`'s DECLARED FOURTH
+ * POSITION and the write your repair makes JOINS the commit it is part of**
+ * (`bindings/js/index.d.ts:862`) — **the record the repair is handed carries that commit at its `pending`
+ * member, the `CommitRecord.pending` this file declares at `bindings/js/index.d.ts:772`, POINTED AT here
+ * and re-declared nowhere.** **That position's own class test is not restated.**
+ *
+ * **AND NOTHING HERE MINTS A TYPE, A SYMBOL, AN ALIAS, A SEAM, A RECORD MEMBER OR AN EXPORT**: this clause
+ * DOCUMENTS the pair your function returns and a two-arm result the kernel already reads, and DECLARES
+ * nothing — `Constraint` below is unmoved, one `unknown` in and one `unknown` out. **Nor does it name an
+ * archived part as the place its rule is to be read: the rule IS the sentences above, and every point they
+ * cite is a live print of the kept contract or a live source range on this branch.**
  */
 export type Constraint = (context: unknown) => unknown;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -41,11 +41,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.6.1",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.6.1",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.6.1",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.6.1",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.6.1"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.6.2",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.6.2",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.6.2",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.6.2",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.6.2"
   },
   "publishConfig": {
     "access": "public"

package/src/entry/constraints.mjs

@@ -19,7 +19,7 @@ import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver,
 // function the pass appends with — rather than pushed here with a member set of its own; the REFUSAL's own
 // list keeps its five members and no `seq`, because no attempt stands at the judgement that built it
 // (`D-41` item 4). Two records, two honest forms, one append.
-import { append, boundedEntryMessage, boundedQuotation, externalCall, kernelFor, throwableForm } from './kernel-foundations.mjs';
+import { append, boundedEntryMessage, boundedQuotation, externalCall, kernelFor, pairAppliesAt, throwableForm } from './kernel-foundations.mjs';
 // **⟶ AND THE TWO KERNEL ACTS THE DELETE'S PATH OWES — `D-55` ITEM 3, 2026-10-29.** The kernel's public
 // barrel (`src/constraint-kernel.mjs`) is untouched and keeps its five names; **these are two PART modules' own
 // acts, reached here the way `append` and `kernelFor` above are** (`kernel-surface.md §1` item 1's empty import
@@ -2529,6 +2529,20 @@ export function judgeReversal(instance, watched, reversalId) {
     const moved = movedStanding(instance, watched);
     for (let index = 0; index < moved.length; index += 1) {
       const one = moved[index];
+      // ═══════════════════════════════════════════════════════════════════════════════════════════════
+      // **⟶ THE PAIR-APPLICATION RULE IS READ AT THE REVERSAL'S JUDGEMENT — `D-96`, `PIN-2` (v), `PIN-3`,
+      // `PIN-4` (iv).**
+      // ═══════════════════════════════════════════════════════════════════════════════════════════════
+      //
+      // **A `rollback` APPENDS NO JOURNAL ENTRY, so no pass reaches it** (`kernel-attempt.mjs`'s loop runs on a
+      // landed act): **the reversal's judgement is this walk, and the rule reaches it because the rule is
+      // GLOBAL** — a reversal over a state that leaves a pair's parent unresolvable is the fifth instant's own
+      // case (`D-90` (4)). **ONE GUARD, THE PASS'S OWN PREDICATE** (`pairAppliesAt`, asked of the pair's own
+      // registry row and never minted again here): **a pair the rule skips is NOT ASKED here either** — it is
+      // not refused for, it appends no `constraint-check` entry, and it cannot refuse the reversal, so the
+      // reversal LANDS. **IT IS NOT REMOVED**: the pair stays CARRIED (`PIN-4` (i)) and is asked at the first
+      // later instant its parent stands.
+      if (pairAppliesAt(instance, one.entry) === false) continue;
       // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
       // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
       // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).

package/src/entry/kernel-attempt.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, throwableForm, boundedEntryMessage, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsTriggered, enterCommitFrame, leaveCommitFrame, commitLogInFlight, sealHandoff } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, throwableForm, boundedEntryMessage, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsTriggered, pairAppliesAt, enterCommitFrame, leaveCommitFrame, commitLogInFlight, sealHandoff } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close, dropHandoff } from './kernel-terminal.mjs';
 
 /// **⟶ ADDED 2026-10-28 — THE BUMP'S CHANNEL, SPELLED ON THIS SIDE TOO (`D-63`).** **THE PASSING SWEEP MOVES THE
@@ -601,6 +601,34 @@ function evaluate(kernel, attempt, landing) {
     for (const key of list) {
       const pair = kernel.pairs.get(key);
       if (pair === undefined) continue;
+      // ═══════════════════════════════════════════════════════════════════════════════════════════════
+      // **⟶ THE PAIR-APPLICATION RULE IS READ AT THE LOOP'S HEAD, BEFORE THE CONTEXT IS BUILT — `D-90`,
+      // `PIN-2` (v), `PIN-3`, `PIN-4` (iv).**
+      // ═══════════════════════════════════════════════════════════════════════════════════════════════
+      //
+      // **A PAIR WHOSE PARENT DOES NOT RESOLVE IS SKIPPED AT EVERY INSTANT THAT WOULD APPLY IT**, and the pass
+      // over a `write`, a `delete` or a `rollback` is the fifth of those instants (`D-90` (4)). **⟶ CORRECTED
+      // 2026-11-02 ON `D-96` (1)–(3): THIS SENTENCE READ *"A PAIR WHOSE PARENT IS NOT A CONTAINER"*, AND THE
+      // THRESHOLD IS ABSENCE ALONE** — the architect, verbatim: *"Reject this, the constraint being there
+      // implicitly expects `'x'` to be a container"* — **so the answers that APPLY a pair are the BRANCH parent
+      // and the LEAF parent, and the one answer that SKIPS it is `AddressNotFound` at the parent.**
+      // **The rule is read HERE and not at the store: the store still computes the reach** (`D-56`/`D-66`/`D-69`,
+      // untouched — the membership filter above is byte-unmoved), and what this clause decides is only **which of
+      // the pairs that reach names is actually ASKED**. **THE ADDRESS IT IS ASKED AT IS THE PAIR'S OWN** — the
+      // array it was registered at, and never the act's — because the rule's discriminator is *"the address's
+      // parent"*: a pair at `['window','tabs']` is SKIPPED after a `delete` of `['window']` however the act is
+      // addressed.
+      // **A pair standing over more than one address is applicable where ANY of them RESOLVES at its parent — as a
+      // container, as a leaf, or as the register**: one body is asked once, and the pair is not killed for a
+      // second address's sake.
+      //
+      // **A SKIP IS NOT A REFUSAL** (`PIN-3`): the pair is not asked, it joins neither `ran` nor
+      // `appliedRepairs`, it appends no `constraint-check` entry, it opens no repair and it cannot reach a
+      // terminal arm — **so an act the pair would have refused LANDS.** It is not counted as a judgement.
+      // **AND IT IS NOT REMOVED**: the pair stays CARRIED and is asked at the first later instant its parent
+      // stands and an act's own touched set reaches it (`PIN-4` (i)–(ii)). **The `pending`/`triggered`
+      // machinery moves no byte**: `releasePending` reads the run's snapshot and never the pairs that were asked.
+      if (!pairAppliesAt(attempt.store, pair)) continue;
       // `kernel-surface.md §2.3` item 1 — THE OP WHOSE LANDING LEFT THE STATE THIS EVALUATION RUNS AT,
       // VERBATIM, and the value that write returned, VERBATIM: "the data the constraint confirms".
       const op = landing;

package/src/entry/kernel-foundations.mjs

@@ -1164,6 +1164,80 @@ function opSpelling(value) {
   return `a ${typeof value} (which is no op)`;
 }
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ THE PAIR-APPLICATION PREDICATE — ONE PREDICATE AT ONE HOME, AND ITS THIRD ARM READ THROUGH `D-96`
+// (2026-11-02).**
+//
+// **THE DISCRIMINATOR IS THE ADDRESS'S PARENT, AND THE SKIP THRESHOLD IS ABSENCE ALONE.** A pair's ADDRESS is
+// the array it was registered at, its KEY is that array's LAST segment, and its PARENT is the array MINUS that
+// segment; **the EMPTY PARENT IS THE REGISTER, WHICH ALWAYS RESOLVES.** So a pair is **SKIPPED** exactly when
+// its PARENT DOES NOT RESOLVE and **APPLICABLE** exactly when the walk reaches it at all.
+//
+// **THE WALK IS THE STORE'S OWN `readLiteral(parent)` WITH THE TIER ARGUMENT OMITTED, AND ITS THREE ANSWERS ARE
+// THE THREE ARMS**: `ReadTargetIsBranch` ⇒ the parent is a CONTAINER ⇒ APPLICABLE · `AddressNotFound` ⇒ the
+// parent does not resolve ⇒ SKIPPED · A VALUE ANSWERED ⇒ the parent is a LEAF ⇒ APPLICABLE. **The tier argument
+// is omitted because the zero-tier call selects every tier**, and the omission is the whole of the call's
+// shape: this predicate asks the store nothing else and reads no value class of its own.
+//
+// **THE LEAF ARM IS APPLICABLE BECAUSE A PAIR'S PRESENCE DECLARES ITS PARENT A CONTAINER, SO A LEAF STANDING
+// THERE IS THE STATE THAT PAIR IS THERE TO JUDGE.** A pair registered at `['x','deep']` is registered because
+// `['x']` is meant to hold it: the body is asked with `context.value === undefined` (its own address cannot be
+// read), it may refuse, and a repair may replace the leaf with the container the pair declares.
+//
+// **THE VERDICT IS AN INSTANT'S FACT AND IS STORED NOWHERE** (`PIN-2` (v)): every caller asks at the instant it
+// would apply the pair. **A SKIP IS NOT A REFUSAL** (`PIN-3`): it crosses nothing, opens no attempt, appends no
+// entry and removes no pair — the pair stays CARRIED and applies at the first instant its parent stands
+// (`PIN-4`). **NO STATUS IS MINTED AND NO VERB IS ADDED**: the two answers are two EXISTING members of the
+// store's closed set and one existing value.
+// ---------------------------------------------------------------------------------------------
+
+/** **APPLICABLE** — the pair's parent RESOLVES (as a container or as a leaf), so the pair is APPLIED at this instant. */
+export const PAIR_APPLICABLE = 'applicable';
+/** **SKIPPED, ABSENT** — the pair's parent does not resolve, so the pair is SKIPPED at this instant. */
+const PAIR_SKIPPED_ABSENT = 'absent';
+
+/**
+ * **THE PAIR-APPLICATION PREDICATE** — one answer per call, at the one instant it is asked:
+ * `PAIR_APPLICABLE` or `PAIR_SKIPPED_ABSENT` — **a leaf parent ANSWERS APPLICABLE**, because a pair's presence
+ * declares its parent a container (`D-96`).
+ *
+ * `store` IS THE CALLER'S INTERFACE AND IT IS ASKED ONE THING: `readLiteral(address's PARENT)` with the tier
+ * argument omitted. **NOTHING IS CAUGHT BUT THE STORE'S OWN ANSWER**, and a refusal that names any other status
+ * is read as the absence arm — an in-domain address's parent can answer only the three answers the clause names,
+ * so a fourth cannot arise and is not invented here.
+ */
+export function pairApplication(store, address) {
+  const parent = address.slice(0, address.length - 1);
+  try {
+    // THE ONE CALL: the tier argument is OMITTED, so the walk selects every tier.
+    store.readLiteral(parent);
+  } catch (refused) {
+    const status = refused !== null && typeof refused === 'object' ? ownMember(refused, 'status') : undefined;
+    return status === 'ReadTargetIsBranch' ? PAIR_APPLICABLE : PAIR_SKIPPED_ABSENT;
+  }
+  // A VALUE ANSWERED: the parent is a LEAF, and a pair's presence declares its parent a container — APPLICABLE.
+  return PAIR_APPLICABLE;
+}
+
+/**
+ * **THE SAME ONE PREDICATE, READ OVER THE ADDRESSES A REGISTRY ROW STANDS AT** — the form the pass, the
+ * registration's re-run and a reversal's judgement need, and the ONLY place the row's address set is walked.
+ *
+ * **ONE PAIR IS ONE BODY AND IS ASKED ONCE**, so a pair registered over more than one address cannot be asked
+ * at one address and skipped at another: **it is APPLICABLE at an instant where ANY of its own addresses
+ * resolves at its parent**, and SKIPPED only where none does. **THE PREDICATE IS NOT RE-STATED HERE** — this
+ * loop asks `pairApplication` of each address in the registry's own order and answers the first APPLICABLE one;
+ * a row carrying no address at all is SKIPPED, which is the absent arm's own answer.
+ */
+export function pairAppliesAt(store, pair) {
+  const addresses = pair !== null && typeof pair === 'object' ? pair.addresses : undefined;
+  if (!Array.isArray(addresses)) return false;
+  for (let i = 0; i < addresses.length; i += 1) {
+    if (pairApplication(store, addresses[i]) === PAIR_APPLICABLE) return true;
+  }
+  return false;
+}
+
 /**
  * **THE PASS'S EVALUATED SET — A FILTER OVER THE STORE'S OWN `triggered`, AND NO SECOND REACH.**
  *

package/src/entry/kernel-registration.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9b`) — the registration act, its evaluation, and the registry's removal: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsTriggered, enterCommitFrame, leaveCommitFrame } from './kernel-foundations.mjs';
+import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsTriggered, enterCommitFrame, leaveCommitFrame, pairApplication, PAIR_APPLICABLE } from './kernel-foundations.mjs';
 import { dropHandoff } from './kernel-terminal.mjs';
 
 /// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON A REPAIR INVOCATION'S OWN ENTRY, SPELLED HERE AS
@@ -289,6 +289,30 @@ function withdrawRegistration(kernel, address, id, fresh, home) {
  * invocation below is NOT wrapped — a throwing body reaches the caller as the very value it threw.
  */
 function registrationEvaluation(kernel, store, address, id, constraint) {
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  // **⟶ THE PAIR-APPLICATION RULE IS READ HERE, FIRST — `D-90`, `PIN-2` (v), `PIN-3`, `PIN-4` (iv).**
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  //
+  // **A PAIR WHOSE PARENT DOES NOT RESOLVE IS SKIPPED AT EVERY REGISTRATION INSTANT** — construction, a boot
+  // over an existing `filePath`, `addConstraint` and a re-arm alike, because the rule is GLOBAL and not
+  // batch-only (`D-90` (4)). **⟶ CORRECTED 2026-11-02 ON `D-96` (1)–(2): THIS CLAUSE READ *"A PAIR WHOSE PARENT
+  // IS NOT A CONTAINER IS SKIPPED"* AND THE SKIP'S THRESHOLD IS ABSENCE ALONE** — the architect, verbatim: *"Reject
+  // this, the constraint being there implicitly expects `'x'` to be a container"* — **so a parent that RESOLVES
+  // applies its pair, as a CONTAINER, as a LEAF or as the REGISTER, and only `AddressNotFound` at the parent skips
+  // it: a leaf standing at the pair's parent is the state the pair is asked to judge, not one to look away from.**
+  // **THE PREDICATE IS ASKED BEFORE THE CONTEXT IS BUILT AND BEFORE THE COMMIT FRAME IS
+  // ENTERED**, so a skipped pair builds no context, appends no `constraint-check` or `repair-run` entry, enters
+  // no frame and opens no attempt; **it returns state 1's answer (`null`) and the registry row the caller's
+  // `K-1` already wrote stands UNMOVED** — the pair is CARRIED and `constraints()` names it (`PIN-4` (i)).
+  //
+  // **A SKIP IS NOT A REFUSAL AND IT IS NOT A REFUSAL OF THE PAIR** (`PIN-3`, `D-90` (3)): the body is not
+  // asked, so nothing runs, nothing is refused for it, and no `status`, `message` or `log` entry crosses. **THE
+  // ONE THING THIS EARLY RETURN MUST NOT DO IS WITHDRAW THE ROW** — `withdrawRegistration` runs only on the
+  // refusing arm, one frame above, and a skip never reaches it.
+  //
+  // **THE REGISTRY WRITE AND THE STORE'S `listen` HAVE ALREADY HAPPENED** above this function, so a skipped pair
+  // is carried BY CONSTRUCTION and not by a second act: this function is the third step and no step moves.
+  if (pairApplication(store, address) !== PAIR_APPLICABLE) return null;
   // **⟶ THE REGISTRATION'S OWN COMMIT AND ITS OWN ONE LIST — `D-53`, 2026-10-28.** A registration is a commit
   // (`addConstraint`'s and `constraintOn`'s brackets open one, and `3-bis` (a) already declares *"the
   // `CommitRecord` of the registration act"*), so the record is built FIRST and the list beside it: **a verb the
@@ -383,6 +407,19 @@ function readCurrent(store, address) {
  * `RollbackStep.checkpoint` precedent already fixes — while `value` is the store's CURRENT value at the
  * pair's address, read and not landed (its (3)). **`id` IS THE PAIR'S OWN**, which the constraint's context
  * does not carry at all, the repair's shape declaring it.
+ *
+ * **⟶ AND THE RECORD GAINS ITS SEVENTH MEMBER AT THIS INSTANT AND AT NO OTHER — `write`, 2026-11-02.** `D-91`,
+ * the architect, verbatim: ***"Give the registration instant a lawful write route."*** **THE CARRIER IS THIS
+ * RECORD AND NOTHING ELSE** (`PIN-6` (i)): the constraint body's five-member context is UNMOVED and gains
+ * nothing at any instant (`D-92` (1): the route *"is the repair's own record and by nothing else"*), and a
+ * third carrier would have to be a second argument to a ONE-argument invocation. **THE MEMBER IS
+ * INSTANT-SCOPED** (`PIN-8` (iii) (c)): the LANDING instant's six-member record at `kernel-attempt.mjs` is
+ * byte-unmoved and gains no route, so *"six"* and *"seven"* are one census each, never one census across the
+ * two instants.
+ *
+ * **THE MEMBER'S VALUE IS A FUNCTION OF THE STORE'S OWN THREE POSITIONS — `(address, tier, value)` — AND NO
+ * FOURTH.** It is built by `registrationRoute` below, which names THE REGISTRATION'S OWN `CommitRecord` and
+ * refuses a supplied fourth position BEFORE any store act.
  */
 function registrationRepairContext(store, address, id, commitRecord) {
   return {
@@ -394,6 +431,51 @@ function registrationRepairContext(store, address, id, commitRecord) {
     op: null,
     // THE COMMIT THE REPAIR IS PART OF — a FRESH LIST, never the record's own member (`§2.3` item 2).
     pending: Array.isArray(commitRecord.pending) ? commitRecord.pending.slice() : [],
+    // THE SEVENTH MEMBER, AT THIS INSTANT ALONE (`PIN-6` (ii)): the route the repair may take.
+    write: registrationRoute(store, commitRecord),
+  };
+}
+
+/**
+ * **THE WRITE ROUTE A REPAIR MAY TAKE AT A REGISTRATION INSTANT — `D-91` (ii), `PIN-6`, `PIN-7`.**
+ *
+ * **THREE POSITIONS, EXACTLY THE STORE'S `write`'S FIRST THREE — `(address, tier, value)` — AND THE COMMIT IS
+ * NOT A POSITION.** The route NAMES the registration's own `CommitRecord` — the record `registrationEvaluation`
+ * built and this record's `pending` copy-carries — **and the caller cannot name another, which is what the
+ * arity refusal below secures.** **WHERE A COMMIT WINDOW STANDS (`addConstraint`, the re-arm) THE WRITE JOINS IT
+ * AND OPENS NOTHING; WHERE NONE STANDS FOR THE CALLER (construction, a boot) THE CALL OPENS THE WINDOW ITS OWN
+ * WRITE NEEDS AND RELEASES IT ON EVERY ARM** (`state.mjs`'s `openCommit`: *"A JOIN CAN ONLY BE A JOIN OF A
+ * COMMIT THAT IS OPEN"*). Both arms are the entry's own, reached by handing the record to `write`'s FOURTH
+ * position — the position `D-46` declares for a commit — and no second mechanism is minted here.
+ *
+ * **A SUPPLIED FOURTH POSITION IS REFUSED BEFORE ANY STORE ACT, WHATEVER ITS CLASS — A LAWFUL `CommitRecord`
+ * INCLUDED — AND THE TEST IS THIS UNIT'S OWN AND NOT THE COMMIT POSITION'S.** The position's own test ACCEPTS
+ * any object carrying an own present `pending` (`delivery.mjs`), **which is exactly the record a repair holds**,
+ * so re-using it would admit the very call this clause forbids. **The refusal's form is the entry's class
+ * refusal: ONE `TypeError` whose `status` member is ABSENT, which carries NO `log` member, and which is thrown
+ * unwrapped** — the form the commit position's own refusal takes. **NO STATUS IS MINTED** (`PIN-10`): this is
+ * the package's class refusal and not a store code.
+ *
+ * **WHAT IT ANSWERS AND WHAT IT DOES NOT DO.** It answers THE STORE'S OWN `WriteRecord` — `{op, watched,
+ * triggered}`, the very record `write` answers — and a refusal CROSSES UNCONVERTED AND UNCAUGHT, in the store's
+ * own form (`WriteParentNotLink`, `AddressNotFound`, `AddressMalformed`, `ContainerKindConflict`, and the
+ * boundary's own `ValueRefusedAtBoundary` where the value is one the crossing refuses): **the route converts
+ * nothing, catches nothing and mints no code** (`PIN-6` (iv)). **IT RUNS NO PASS OF ITS OWN** (`PIN-6` (v)): it
+ * appends no `constraint-check` entry, no `outcome` entry and no terminal act, delivers no listener, and opens
+ * no attempt — **the pair is judged by the registration's own re-run over the op it landed** (`PIN-7` (iii)).
+ * **AND IT IS NOT A COPY OF THE STORE**: it is the route the kernel binds to the instance the registration is
+ * constructing, so it answers this store and no other.
+ */
+function registrationRoute(store, commitRecord) {
+  return function write(address, tier, value) {
+    // THE ARITY TEST IS THIS UNIT'S OWN AND IT STANDS BEFORE ANY STORE ACT (`PIN-6` (iii)).
+    if (arguments.length > 3) {
+      throw new TypeError(
+        'the registration write route takes three positions — (address, tier, value) — and no fourth: the '
+        + 'commit is the registration\'s own and cannot be named',
+      );
+    }
+    return store.write(address, tier, value, commitRecord);
   };
 }
 
@@ -593,6 +675,32 @@ function registrationRerun(kernel, attempt, produced, key) {
   for (const evaluated of list) {
     const pair = kernel.pairs.get(evaluated);
     if (pair === undefined) continue;
+    // ═══════════════════════════════════════════════════════════════════════════════════════════════
+    // **⟶ THE RE-RUN IS AN INSTANT THAT WOULD APPLY A PAIR, AND IT READS THE RULE — `D-94`, `PIN-4` (iv).**
+    // ═══════════════════════════════════════════════════════════════════════════════════════════════
+    //
+    // **`D-90`'s RULE IS GLOBAL, SO NO ARM OF IT MAY BE CARVED OUT SILENTLY**: the re-run's one reachable
+    // instance is a repair that leaves the pair's OWN parent UNRESOLVABLE during the registration — it DELETES
+    // it — **and on that arm the parent does not resolve at the instant the re-run would apply the pair.**
+    // **THE PAIR IS SKIPPED THERE AND THE REGISTRATION STANDS ON THE REPAIR'S LANDING**, and the pair is CARRIED
+    // for the first later instant its parent stands (`PIN-4` (i)). **It is not asked, it crosses nothing, and it
+    // cannot refuse the registration** (`PIN-3`).
+    //
+    // **⟶ AND THAT CLAUSE'S FIRST READING IS RE-DERIVED HERE, 2026-11-02 — `D-96` (1)–(5), the architect on this
+    // arm verbatim: *"See above"*.** It read *"a repair that removes the pair's OWN parent … it writes a leaf over
+    // it, or deletes it … THE PAIR IS SKIPPED THERE AND THE REGISTRATION STANDS ON THE REPAIR'S LANDING"*, **and
+    // a LEAF does not skip its pair**: a pair's presence declares its parent a container, so **a repair that
+    // WRITES A LEAF over that parent makes the pair ASKED at the re-run** — the body meets `undefined` as its own
+    // address's state — **and a body that REFUSES refuses the REGISTRATION at rank `19`
+    // `ConstraintRefusedAtRegistration`, on the `KC-5` arm**: the pair is the repaired one. **The inert-pair
+    // hazard survives at the DELETE arm ALONE** (`D-96` (5)): that is the arm that skips, and the pair it skips
+    // is carried until its parent stands again.
+    //
+    // **AND THE RE-RUN ITSELF IS UNCONDITIONAL (`D-94` (1), the architect verbatim: *"Always rerun after a
+    // repair"*).** This clause skips a PAIR inside the re-run and never the re-run: `registrationAttempt` calls
+    // it after every credited repair, `0`-PAIRS-ASKED INCLUDED, and this frame still returns the run's own
+    // answer. **A SKIPPED PAIR LEAVES THE RE-RUN PASSING VACUOUSLY.**
+    if (pairApplication(attempt.store, attempt.address) !== PAIR_APPLICABLE) continue;
     let outcome;
     const context = {
       address: attempt.address.slice(),