provident-storeroom 1.8.0 → 1.9.0

package/README.guide.md

@@ -30,7 +30,7 @@ preflight REFUSES when these two lines do not read what it computed** (`scripts/
 one check, read-only). **THE TWO LINES ARE THIS GUIDE'S OPERATIVE FIGURES; every dated paragraph below is the
 reading of its own date and is read through them.**
 
-PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.8.0`.
+PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.9.0`.
 PUBLISH-GUIDE-CUT-STATE: NOT STATED -- this document describes the behaviour at the version line above, and the cut-state is the release's to state, not a shipped document's (`D-57`).
 
 **⟶ AND THE CUT-STATE SENTENCE ABOVE IS WITHDRAWN, 2026-10-28 — THE CUT-STATE IS NOT A DOCUMENT'S TO STATE.** `RCA-8(g)` ANNOTATE-BESIDE, and the architect's ruling verbatim (`strata/decisions.md` · `D-57`): *"Drop the cut-state."* **The two marked lines above stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause — not one byte of either is deleted — and the sentence this clause withdraws is the SECOND of them, the one that claims to say whether the release this guide travels in is cut.** **THE REASON IS MEASURED, THREE TIMES OVER, AND IT IS STRUCTURAL RATHER THAN A MISTAKE: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and the change list's head was stale within minutes of the tag that falsified it. **SO THE CUT-STATE SENTENCE IS DROPPED AS A CLAIM AND THE VERSION LINE STAYS**, because the version line is the ONE figure a tarball can be right about: the manifest knows it and travels beside it. **`scripts/publish.sh --figures` GENERATES AND ASSERTS THE VERSION LINE AND NOTHING ELSE** — the cut-state generation and its assertion are removed in the same act, so a tag set that moves can no longer redden this guide — **and the same one line is asserted in THREE shipped documents: this guide, `README.md` beside it, and the change list** (`DEF-AC`'s remaining demand, *"guard the release notes too"* and *"`README.md` still declares no version at all"*). **THE TAG SET IS NOT DELETED AND NOT DENIED: it is a RECORD OF RELEASES held in the change list, PAST TENSE — a list of what has been cut — and never a claim about the current one.** **AND WHAT THIS CLAUSE DOES NOT SAY, SAID PLAINLY BECAUSE A READER WILL LOOK FOR IT: it does not say whether the version this guide prints is cut.** That is not a document's to state; the record of what has been cut is in `RELEASE-NOTES.md`, and the registry is the registry.
@@ -659,6 +659,18 @@ standing and NO row in the kernel's registry**, so the store's `triggered` names
 for it, and it stays in the residue; **it fires NOTHING, silently, and its body's one run is the registration's own
 evaluation** (`surface.md §2.4` rule 1). (`D-69`; `D-66`; `D-67`; `kernel-surface.md §2.1` item 2's `A112` reading.)
 
+**⟶ AND THE DELIVERED SET GAINS ONE ACT'S WORTH AND `pending` ONE SOURCE, 2026-11-01 — `D-104`, AND EVERY CLAUSE ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH THIS ONE.** `RCA-8(g)` ANNOTATE-BESIDE: **the record's four members, the seed, the check-off, the residue's reading, the failing arm's whole-set arm and every figure the clauses above print do not move; what moves is WHOSE listeners the member may carry and WHICH SET the one delivery fires.** **THE DEFECT THIS CLAUSE CLOSES, STATED FIRST SO THE BEHAVIOUR IS NOT READ AS A WIDENING FOR ITS OWN SAKE: a repair's write's `triggered` listeners stood on the REPAIR'S OWN WRITE RECORD** — `bindings/js/index.mjs:444`-`:448`'s `{op, watched, triggered}`, the record the entry stands in its leg slot at `:452` — **and NO DELIVERY SITE READ THEM**: the terminal arm delivers the COMMIT's `pending` residue, and the repair's write's own delivery is withheld (*"this frame is the leg … its silence is total"*), **so a listener the repair's edit fired was invoked by NOTHING** (`strata/decisions.md` · `D-104` item `1`, verbatim: *"This is a behavior defect, wrap into the fix patch"*). **FROM THIS DATE IT IS INVOKED, AND THE FIVE THINGS YOU CAN OBSERVE ARE THESE:**
+
+1. **IT IS DELIVERED IN THE COMMIT'S ONE DELIVERY, AFTER THE PASS** — the same `deliver` call and the same instant as the residue's, at the terminal arm, after the attempt is closed, after the mark and after a `file`-tier save — **so no listener a repair's edit fired runs inside the repair body or inside the pass** (`D-104` item `2`; the architect's own flow, *"any new non-constraint listeners are bookmarked to be run after commit"*; `surface.md §2.7` item `6`'s ordering law, unmoved by this clause).
+2. **ONE INVOCATION PER DISTINCT HANDLE** (rule `4` above; `surface.md §2.4` rule `3`): **a listener fired by BOTH the original write and the repair's edit is invoked ONCE.** **And the MEMBER carries ONE element for it** — a second de-duplication, by `handle` against the handles that stand in `pending` now, with its own ground: `pending` is also YOUR work list, and a member carrying one handle twice would let your own loop run that body twice.
+3. **A PAIR IS NEVER IN THE SET, AND ITS HANDLE IS NOT MERGED EITHER.** A repair's edit that triggers a constraint's `id` has that id ASKED and never delivered (`D-69`); **the id is kept out of the member exactly as it is kept out of the delivery**, so `pending` carries no id the pass will not evaluate.
+4. **THE DELIVERED SET CARRIES ONE ADDRESS FOR THE WHOLE BATCH — THE LEG'S OP ADDRESS, WHICH IS THE REPAIR'S WHERE A REPAIR LANDED — AND NO PER-HANDLE ATTRIBUTION IS ASSERTED.** **No member, no clause and no cell says which of the two acts fired a doubly-fired handle** (`DD-22`, `DD-37`: the trigger set has no order and no per-element provenance; `AB-3`). **A handle fired by the repair's edit alone is handed the act that fired it; a handle the ORIGINAL write alone fired is handed the repair's address as well** — one leg slot, **PRE-EXISTING, and `Q-3`'s and not this fix's**.
+5. **`pending` NOW CARRIES THE REPAIR'S LISTENERS TOO, AND ITS READING IS UNMOVED: THE HANDLES THE PASS DID NOT EVALUATE — AND A LISTENER IS NEVER THE PASS'S.** (`D-56`; `D-69`; the clause above at its own words, *"NO CONSTRAINT AT AN ADDRESS IT ASKED, AND EVERY LISTENER THE DELIVERY WILL FIRE"*.) **So a passing repaired write's residue has A SOURCE WIDER THAN THE COMMIT'S OWN WRITE, and that is the whole of the change: an entry may be a listener a REPAIR's edit fired that the commit's write never returned.** **AND THE SUBSEQUENCE, PRINTED BECAUSE THE SET RELATION WAS ASSERTABLE UNTIL THIS DATE: on a repaired write `pending` is NO LONGER A SUBSET OF `triggered`** — `triggered` stays the store's own returned set for the COMMIT's write, VERBATIM, and writing a second act's handles into it would forge a store result.
+
+**AND THE FAILING ARM DISCARDS THEM WITH THE REST, WHICH IS `surface.md §2.7` item `6` READ AND NOT A NEW RULE:** **a failed attempt invokes NONE of them and its `pending` ends EMPTY.** The discard's filter is widened to the union of the failed write's returned set and the sets this attempt's repairs' writes returned — **one removal, by the set each entry came back in.**
+
+**TWO HALVES ARE HELD AND ARE PRINTED AS HELD, NOT ASSERTED — the architect's word is owed on each, and the behaviour above is unaffected by either answer.** **`Q-7` — THE `discarded` WITNESS CANNOT NAME THEM.** `D-104` item `2`'s *"the witness (`discarded`) reads them as it reads any other discarded raise"* cannot be honoured at the bytes: **a failed write's arm answers no record at all** (it throws the four-member refusal, `§8`), **and the witness's element is `{opId, addresses}` — a discarded REVERSAL REQUEST — into which no listener handle could be written**, and minting a member for one is a record-shape move `D-104` item `4` forbids. **So this guide asserts the failing arm's two observables — the invocation count `0` and a `pending` holding none of those handles — and prints no witness claim.** **`Q-2` — THE DELETE-SHAPED COMMIT.** A repair during a `delete`'s pass lands on the same repair arm, so its listeners reach the DELETE's own delivery **by construction** (`D-55` item `3`); **whether that scope is confirmed or narrowed is the architect's**, and no clause here asserts it.
+
 **And one store behaviour that shows up in the records if you use integer addresses: a delete of an indexed
 version of an array container RENUMBERS the surviving anchors in container order from `0`, each keeping its tier
 and its node** (`write-and-read.md §4.4`'s renumbering clause).
@@ -1060,6 +1072,12 @@ its address.** **The read is the whole difference.**
 
 **THE REPAIR IS HANDED ONE ARGUMENT — ITS OWN RECORD, WHICH IS NOT YOUR CONSTRAINT'S AND IS NOT INTERCHANGEABLE WITH IT: the two records stand apart at THREE PLACES — by COUNT, SIX against FIVE; by `id`, which the repair's record carries where the constraint's carries `attempt`; and by `pending`, which rides the repair's record ALONE** (`bindings/js/src/entry/kernel-attempt.mjs:607-613`, `:756-782`; the kernel's own words at `bindings/js/src/entry/kernel-registration.mjs:373-374`). **AND THE COMMIT YOUR REPAIR IS PART OF RIDES THAT RECORD — its own `pending` member, the `CommitRecord.pending` this package declares at `bindings/js/index.d.ts:772`, POINTED AT and re-declared nowhere: pass it as `write`'s DECLARED FOURTH POSITION and the write you make JOINS the commit you are inside** (`bindings/js/index.d.ts:862`; `strata/decisions.md` · `D-46`). **No member census of either record is printed here, and that position's own class test is not restated.** A repair that names nothing in the fourth place also joins, by the kernel's own name; the fourth position is how YOU name it.
 
+**⟶ AND THE UNNAMED POSITION IS UNSUPPORTED FOR A REPAIR, 2026-11-01 — `D-103`, WHICH RE-DERIVES THE PARAGRAPH ABOVE'S LAST SENTENCE AND MOVES NO BYTE OF IT.** **`RCA-8(g)` ANNOTATE-BESIDE: *"A repair that names nothing in the fourth place also joins, by the kernel's own name; the fourth position is how YOU name it"* STANDS BYTE-FOR-BYTE and is read THROUGH this clause; what it describes is a MECHANISM OF THE CODE and NOT a second lawful route, and under `D-103` it is not a route at all.** **THE ARCHITECT, VERBATIM** (`strata/decisions.md` · `D-103`, 2026-11-01): ***"Writing a repair function that does not pass the commit in is unsupported"***. **THE ROUTE IS ONE AND IT IS THE NAMED ONE — THE COMMIT PASSED AT `write`'S DECLARED FOURTH POSITION IS *THE* ROUTE** (`D-46`: the commit id is the discriminator that lets a repair JOIN the attempt being tracked, and the repair's own record carries that commit at its `pending` member, paragraph above) — **so a repair that OMITS the commit is UNSUPPORTED.** **AND THE FRAME'S FALLBACK IS A MECHANISM OF THE CODE, NOT A SUPPORTED ROUTE:** the frame's own name at `bindings/js/src/entry/kernel-attempt.mjs:820`-`:822` (`state.mjs`'s `openCommit`: *"the entry's position wins where it is supplied, and this name is the fallback where it is not"*) is the CODE's and it STAYS, **and what falls is its standing as a DOCUMENTED ROUTE** (`D-103` item `2` — the mechanism's bytes are unmoved here and by that ruling, and this clause neither edits them nor re-spells them).
+
+**AND NOTHING IS PROMISED FOR THE REPAIR THAT OMITS IT — the tracking `D-46` exists for, named item by item, because an unsupported shape promises none of it:** **the op in `attempt.ops`** · **the entries in the commit's log** · **the `pending` delivery** · **the rollback's scope** · **and a `file`-tier save riding the commit's terminal act.** **THE PACKAGE DECLARES NOTHING ABOUT THAT SHAPE** (`D-103` item `1`), so **none of the five is owed for it** — and where one of them happens to hold, it holds as the mechanism's accident and not as a promise of this package.
+
+**AND IT IS NOT A REFUSAL, WHICH IS THE OTHER HALF OF `D-103` (item `3`) AND IS SAID HERE SO THIS CLAUSE IS NOT READ AS ONE:** the position stays `commit?: CommitCarrier`, OPTIONAL, **because a CALLER's own write must not name a commit — its write IS its own commit — and requiring the member would break that route.** **So an unsupported repair is not stopped, not thrown at and given no status and no token of its own**: it is the corpus's standing for an unsupported route, the class `strata/brief.md:252` gives the register-one-thing-as-both anti-pattern (*"an unsupported anti-pattern rather than a defect"*). **NO TYPE MOVES, NO CODE BYTE MOVES AND NO CELL IS RE-DERIVED by this clause** (`D-103`'s own `TERMS`: the mechanism bytes `0`, the types `0`, the code bytes `0`, the refusal it does NOT take `1`).
+
 **AND THE FOUR WAYS THIS ARM MEETS YOU, EACH DECLARED BECAUSE SILENCE HIDES A STATE A CONSUMER MEETS:**
 
 1. **(a) A THROW FROM YOUR REPAIR BODY CROSSES TO YOUR OWN CALL UNCONVERTED ON A WRITE**, where the throwable carries no store code: the write hands you back the very value you threw (`bindings/js/src/entry/kernel-attempt.mjs:833-854`).
@@ -1067,6 +1085,13 @@ its address.** **The read is the whole difference.**
 3. **(c) A PAIR'S REPAIR NEVER RUNS TWICE:** an applied repair may not run again, and a second violation of the same pair FAILS the attempt (`docs/specs/storeroom-constraints/contract.md:736`, `P-SM-6`'s row).
 4. **⟶ (d) AND WHAT A FAILED ATTEMPT DOES TO THE EDITS A REPAIR LANDED IS `docs/guides/package-use.md §5.4`'s OWN RULE — CITED BY PATH AND SECTION, STATED THERE AND NOT RE-SPELLED HERE.** **The plan that rule is read against is live code and is read at its own bytes: `bindings/js/src/entry/kernel-terminal.mjs:184-196`, the call site at `:215`, and `floorCallPlan` at `:288-343`; `strata/decisions.md` · `D-40` is the ruling that CLOSES that scope.** **AND ONE SENTENCE FOLLOWS FROM `§5.4`'s RULE, AS THAT RULE'S CONSEQUENCE AND NOTHING MORE: a repair's own writes are part of the attempt.**
 
+**⟶ AND THE LISTENERS YOUR REPAIR'S OWN WRITE FIRES ARE DELIVERED, 2026-11-01 — `D-104`, AND EVERY CLAUSE OF THIS SECTION ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH THIS ONE.** `RCA-8(g)` ANNOTATE-BESIDE: **the two returned arms, the record's shape, the commit at the fourth position, the credit rule and the address geometry do not move; what this clause adds is what happens to a listener a repair's EDIT fires, and what your repair's record carries when an earlier repair in the same commit fired one.** **WHAT WAS TRUE UNTIL THIS DATE, SAID PLAINLY BECAUSE IT IS WHAT YOU MAY HAVE BUILT AROUND: a repair's write answered its own record — `{op, watched, triggered}` — and no delivery site read that record's `triggered` list, so a listener bound where your repair wrote was invoked by NOTHING** (`D-104` item `1`). **FROM THIS DATE IT IS INVOKED — in the COMMIT's ONE delivery, AFTER the pass, ONCE PER DISTINCT HANDLE — and the five observables and the two held halves live at `§6.4`'s clause of this date, which this clause POINTS AT and does not respell; do not read two rules.** **AND THREE THINGS THAT ARE THIS SECTION'S OWN:**
+1. **THE REPAIR'S WRITE STILL HAS NO PASS OF ITS OWN ON THE SUPPORTED ROUTE, AND THAT IS UNCHANGED**: it names the commit at the fourth position (the `D-103` clause above), joins it, and its op is the attempt's landing that the RE-RUN judges. **So its listeners are discarded exactly where the attempt fails — the store refused the repair's verb, so no op is credited and `KC-4` answers (arm (d)); or the re-run refused the landing (arms (c)/(e)/(f)) — and a failed attempt invokes none of them** (`§6.4`'s failing-arm clause; `surface.md §2.7` item `6`).
+2. **THE ADDRESS YOUR REPAIR'S LISTENERS CARRY IS THE REPAIR'S OWN OP ADDRESS**, because the delivery's one argument is the leg's op and the leg is the repair's write's record where a repair landed. **It is ONE address for the whole batch, and a doubly-fired handle's attribution is asserted nowhere** (`§6.4`'s item `4`; `DD-22`, `DD-37`).
+3. **`RepairContext.pending` GAINS THE SAME SOURCE — AND THIS IS A MEMBER YOUR OWN BODY READS** (the record clause above, `:1073`; `index.d.ts`'s `RepairContext`). The member is a FRESH LIST read per evaluation off the commit's record, **so in a commit with MORE THAN ONE REPAIR, every repair after the first is handed a `pending` carrying an EARLIER repair's listener elements.** **Its declared shape does not move** — six members, the pair element `{handle, address}`, a fresh list — **and the alternative is refused**: handing a repair the member minus those elements would make the context disagree with the record it stands for.
+
+**AND ONE THING THIS ACT MOVES THAT IS NOT A CLAIM — A LINE NUMBER, DECLARED RATHER THAN LEFT TO BE FOUND.** The two clauses of 2026-11-01 add **`12`** lines inside `§6.4` (the clause opens at `:662`) and **`7`** inside `§7.6` (the clause opens at `:1088`), so **a line number this guide printed in the tree the act inherited reads `+12` where it named a line at or after `§6.4`'s clause and `+19` where it named a line at or after `§7.6`'s**; **a printed number is read through that table until a re-anchoring pass re-derives it at its own site, and the words and the claims each of them carries are unmoved by this act** (`RCA-8(g)`; the same shape the 2026-11-01 anchor's own re-anchoring declared, and `typecheck/consumer-fixture.ts`'s citation of the worked example stays owed to its owner).
+
 **⟶ AND HERE IS THE EXAMPLE THIS SECTION OWES — a repair that lands SOMEWHERE ELSE, which is this section's own subject, self-contained and driveable as written through the package's one export.** It is the shape the package's own e2e drive takes (`tests/e2e/repair-in-commit.test.mjs:95-115`), with the commit named by the repair's own hand:
 
 ```js
@@ -1127,6 +1152,14 @@ body.**
 
 **⟶ AND A WRITE'S TOUCHED SET IS NOW BOTH VALUES', 2026-10-29 — `D-66` READ SYMMETRICALLY, AND THE CLAUSE ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH THIS ONE.** `RCA-8(g)` ANNOTATE-BESIDE: **the one sentence this clause supersedes is that clause's bullet *"a `write` touches exactly the paths its value contains"*, named here rather than overwritten; the `delete` bullet and every other figure of this section are unmoved.** **THE GAP, MEASURED BEFORE IT WAS CLOSED: A WRITE THAT REPLACES A NODE DROPS THE SUB-PATHS THE OLD VALUE CARRIED.** Write `{c: 1}` over `{c:{x:1}}` and the path `['a','b','c','x']` stands PRESENT before the act and ABSENT after it — **a change to what a read there returns** — **and `x` is in neither the written value's path set nor the word "descendant", so the pair standing there went unasked.** **THE CRITERION THAT CLAUSE ALREADY NAMES DECIDES IT WITHOUT A NEW RULE** — *"your pair is asked when the act changes the value at your pair's address"* — **and a path that DISAPPEARS changed as surely as a path that APPEARS.** **SO THE WRITE ARM IS SYMMETRIC: your pair is asked when the act touched the value it WROTE *or* the value it REPLACED** (`op.before.value`, the state the store's own journal carries), **and the touched set is the union of the two path sets** — a path in both being yours once, not twice. **THE `delete` ARM DOES NOT MOVE**: the whole subtree it removed, exactly as the clause above states it. **AND A FIRST WRITE AT AN ADDRESS HAS NO BEFORE VALUE AND NEEDS NONE**: `op.before` is present on every op and answers `present: false` where nothing stood, so that write's union is the written value's path set exactly and nothing throws. **`['a','b','e']` IS STILL NOT ASKED**, for the reason the clause above gives: `e` stands in neither value, so neither half of the union touches it. **MEASURED 2026-10-29, ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY** (`tests/e2e/discard-witness.mjs`'s `DW-13.5` and `DW-13.6`, with `DW-13.1`–`DW-13.4` still green): a write of `{c:1}` over `{c:{x:1}}` at `['a','b']` now ASKS the pair at `['a','b','c','x']` and does NOT ask `['a','b','c','z']` or `['a','b','y']`, which stand in neither value; the first write at an empty `['f']` asks `['f','g']` and `['f','g','q']` and not `['f','h']`; **and the pass's set is still ONE snapshot, FIXED WHEN THE PASS BEGINS, in ONE registration order.** (`D-66`; `D-56`; §7.6's touched-set clause of the same date; `bindings/js/src/entry/kernel-foundations.mjs`'s `touchedAddresses`.)
 
+**⟶ AND THE CREDIT IS THE FAILING PAIR'S MARK, NOT THE OP YOUR REPAIR RETURNS, 2026-11-01 — `D-105`, AND EVERY CLAUSE OF THIS SECTION ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH THIS ONE.** `RCA-8(g)` ANNOTATE-BESIDE: **what this clause supersedes is NAMED rather than overwritten — `:1071`'s *"`{ ok: true, op }` is the repairable arm: `op` is REQUIRED"* and its *"At the write's own evaluation a return carrying any other identity fails `KC-4`"*; `:1117`'s *"a repair that returned an op it did not land fails `KC-4` instead"*, WITHDRAWN BY NAME; and `:1122`'s THREE sources of a `KC-4` refusal's message, which are TWO on the write path from this date** — **those three sentences stand as the reading of their own date and are read through this clause; not one byte of them moves.** **THE ARCHITECT, VERBATIM** (`strata/decisions.md` · `D-105`, 2026-11-01): ***"You don't need the ops, the rollback point is determined independently. Track the failing constraints for the duplicate repairs. The only supported route for repairs is with the commit id so that its triggers can be joined to the commit and the constraint battery run again."*** **SO A REPAIR THAT DOES ITS WRITE AND RETURNS `undefined` — the natural shape of `repair: () => { … }` — IS CREDITED.** **Its credit is the FAILING PAIR'S MARK (`attempt.appliedRepairs`, keyed by the pair), THE VALUE IT RETURNED IS READ BY NOTHING, and the same one arm takes `{ ok: true }`, `{ ok: true, op }` — the store's own journal record, INFORMATIONAL — and every value outside the declared arms at all (`true`, `false`, `7`, `'done'`, `{ ok: 'yes' }`, `{ ok: false }` with no `message`).** **WHY THE RETURN IS READ BY NOTHING IS THE SAME FACT AS WHY THE CREDIT MOVED: what this attempt knows about your repair's landing is your repair's own WRITE'S LEG (the clause below) and never your return** — so a returned `op` cannot set a pin, cannot join `attempt.ops`, cannot become the re-run's landing, cannot move the checkpoint and is named by no sentence (`bindings/js/src/entry/kernel-attempt.mjs:1003`, `:1048`-`:1052`). **AND THE ONE RETURN THAT STILL FAILS IS THE DECLARED FAILED ARM: `{ ok: false, message }` with a non-empty `message` fails the attempt `KC-4` CARRYING THE CALLER'S OWN WORDS, verbatim, and nothing is pinned, credited or merged** (`bindings/js/src/entry/kernel-attempt.mjs:1017`-`:1019`; `D-105` item `4`: *"The failed arm still fails (`{ok: false, message}` — the caller's words)"*). **THE RESIDUAL `KC-4` KEEPS THE `produced no op` TEMPLATE BYTE-FOR-BYTE, AND IT ANSWERS ONE OF THE TWO ARMS THAT REMAIN.** **The template is the sentence this section already prints, unedited — template literal and interpolations included — and it stands at `bindings/js/src/entry/kernel-attempt.mjs:1040`:** **the two arms are `(d1)` THE DECLARED FAILED ARM, which composes the CALLER'S sentence and no kernel sentence at all, and `(d2)` THE INVOCATION LANDED NOTHING, which is the template's own arm and its whole population.** **`(d2)`'s FIVE ABSENT ARMS, EACH READ AT ITS OWN GUARD, ARE THESE AND NO OTHERS** (`bindings/js/src/entry/kernel-attempt.mjs:189`-`:196`): **no invocation bracket** (the channel is read away, so a bare read would answer a PREVIOUS invocation's legs) · **a nested attempt opened across the invocation** · **a store carrying no `REPAIR_LEG` channel** · **a channel that THREW** · and **a bracketed invocation whose answer is not a non-empty array of elements carrying an `op`.** **NO STATUS IS MINTED: `KC-4` is the one token that answers both arms, and the closed status set is unmoved.** **AND `D-88` (2)'s *"recorded, not repaired"* DISPOSITION IS READ THROUGH THIS CLAUSE — HALVED, AND NOT CLOSED.** **THE OP-DENIAL HALF DISSOLVES BY CARRIER:** the arm that denied an op the kernel was HANDED is gone, because a repair whose edit lands on the supported route is CREDITED and never reaches the arm. **THE ADDRESS HALF SURVIVES, ON `(d2)`'S NESTED-ATTEMPT ARM**, where the repair's edit DID land — in its own commit, at an address the sentence does not name — **so the row stays OPEN with its population NARROWED in its own record and no successor unit queued, and the address that sentence names is the ATTEMPT's and remains no claim about where your repair wrote** (`:1128`'s sentence, unmoved). **AND WHAT THIS CLAUSE IS NOT: a decision on any of the six questions the declaration sends up.** **They are OPEN, printed as open, and answered by no sentence of this guide** (`docs/L1/op-free-repair-credit.md` §8.3): **`Q-1`** the registration instant is a second credit site and keeps its own rule · **`Q-2`** the unnamed route's regression (the third clause below) · **`Q-3`** whether a refused repair's landed edit should be undone too · **`Q-4`** the sentence's own text · **`Q-5`** two bookkeeping items owed to the battery · **`Q-6`** `delete`'s missing commit position (the third clause below).
+
+**⟶ AND THE LEG IS YOUR REPAIR'S OWN WRITE — THE PINS FOLLOW THE LEG AND NEVER YOUR RETURN, 2026-11-01.** `RCA-8(g)` ANNOTATE-BESIDE: **no clause above moves; this one declares what the attempt takes, and `:1052`-`:1054`'s sentence is now TRUE OF THE LEG rather than of the return.** **THE REPAIR'S WRITE IS THE COMMIT'S LEG.** **Every `write` your repair makes through the commit it names mints ONE LEG — `{op, triggered}`, that write's own journal `op` and the elements it returned — at `appendRepairLeg`** (`bindings/js/src/entry/state.mjs:421`, the element mint at `:437`, the leg mint at `:469`), **and the kernel reads the legs of THAT INVOCATION once, synchronously after your body returns** (`bindings/js/src/entry/kernel-attempt.mjs:189`-`:196`, `:1023`). **THE PINS, ONE BY ONE, SO YOU CAN CHECK THE RECORD YOU HOLD AGAINST THEM:** **`entry.opId` IS THE LAST LEG'S `opId`** — the `repair-run` entry names the LANDING and not the invocation; **`attempt.ops` IS THE COMMIT'S OWN LANDING PLUS EVERY LEG'S OP, IN LEG ORDER** — `attempt.ops = [written.op]` at a write's mint and `[removal.op]` at a delete's (`bindings/js/src/entry/kernel-commit.mjs:178`, `:368`), then one append per leg, de-duplicated by `opId` (`bindings/js/src/entry/kernel-attempt.mjs:1059`-`:1066`); **and `attempt.checkpoint` is the PASS's and not the credit's** — a passing sweep bumps it, a failing one leaves it. **SO THE RE-RUN'S VALUE IS THE LEG'S LANDED VALUE: `attempt.ops`' TAIL IS THE LEG'S OP, and the context your body is handed is built from it — `op` is that op, `tier` is its tier, and `value` is its `op.after.value`** (`bindings/js/src/entry/kernel-attempt.mjs:567`-`:568`). **A REPAIR THAT WRITES TWICE APPENDS TWO OPS AND THE LAST IS THE LANDING** — the first landing is not the state the repair left — **so a record's `ops` grows by the repair's WRITE COUNT and not by its repair count, and a cell asserting `1 + repairs` is green only on fixtures whose repairs write once.** **AND WHAT THE RETURN NO LONGER DOES, AS THE LIST IT IS: it cannot be the credit (the pair's mark is), cannot set any pin above, cannot be the rollback's instrument** — the rollback point is `D-63`'s restore mark and the floor call's candidates are taken from `attempt.ops` alone, which is the commit's own record, not your return — **and cannot be the sentence your caller reads.** (`D-105` items `1`-`2`; `docs/L1/op-free-repair-credit.md` §2, §4.)
+
+**⟶ AND YOUR REPAIR'S EDIT'S TRIGGERED PAIRS ARE ASKED BY THE COMMIT'S NEXT BATTERY — ONCE, AT THE RE-RUN, AGAINST THE OP AND THE VALUE YOUR REPAIR LANDED, 2026-11-01.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read through this one; the membership rule, the snapshot rule and the read rule do not move, and this clause adds one subject to the battery rather than a second battery.** **THE PAIRS YOUR REPAIR'S WRITE FIRED JOIN THE COMMIT.** **At the merge seat — after the credit, before the re-run — the legs are split by ONE membership test: a LISTENER's handle is DELIVERED, a CARRIED PAIR's `id` joins `attempt.repairPaired`** (`bindings/js/src/entry/kernel-commit.mjs:110`, `:334`; `bindings/js/src/entry/kernel-attempt.mjs:1103`, the split at `:1096`, the member's own de-duplication at `:1281`-`:1282`) **— and the next battery's snapshot is the SAME selection function with ONE more argument, `pairsTriggered(kernel, stored, attempt.repairPaired)`** (`bindings/js/src/entry/kernel-attempt.mjs:648`; `bindings/js/src/entry/kernel-foundations.mjs:1264`). **SO THE REGISTRY STILL SUPPLIES THE ORDER, the commit's own triggered set plus the joined list supply the MEMBERSHIP, and the set is materialised ONCE PER RUN AT THE SAME INSTANT** — a pair joined by one repair enters the snapshot of the run that follows it and of no other. **WHAT THAT MEANS TO YOUR BODY, IN THE ONE FORM THAT MATTERS: a pair standing where your repair wrote IS ASKED — exactly ONCE, at the RE-RUN, against the repair's `op` and the value it landed — even though the commit's own write never touched it.** **A pair already in the commit's triggered set is asked ONCE and not twice; a handle the store returned TWICE inside one leg's list stands ONCE in the member; and a pair an earlier run already checked off IS re-asked** — the loop guard is the applied-repair marker and the restart budget, and neither moves (`D-42`). **AND THE LISTENERS your repair's edit fires are NOT a second rule here: they ride the COMMIT's ONE delivery, after the pass, once per distinct handle — the clause of 2026-11-01 at `:1088`-`:1091` owns that, and this clause POINTS AT IT and respells none of it.** **TWO CONSEQUENCES MARKED AND NOT ABSORBED, EACH A QUESTION THIS GUIDE DOES NOT ANSWER:** **(a) THE UNNAMED ROUTE'S REPAIR NOW FAILS ITS ENCLOSING WRITE.** A repair that omits the commit (`:1073`'s last sentence, read through `:1075`-`:1077`) lands in its OWN commit, and the enclosing attempt cannot track an op landed in ANOTHER commit (`D-46`) — **so its caller's own write now meets `ConstraintPassRefused` where it met a receipt: `D-103`'s *unsupported* arriving as a refusal IN FACT and not by decree, while `D-103` item `3` is unmoved — the position, the type and the code's fallback take no byte.** **That is the declaration's `Q-2`, and it is the architect's to confirm or refuse; it is printed here and not decided, with the alternative routes priced at `docs/L1/op-free-repair-credit.md` §8.3.** **(b) A `delete` HAS NO COMMIT POSITION, SO A DELETION-REPAIR CANNOT BE ON THE SUPPORTED ROUTE.** `delete`'s declared arity is `delete(address, tier?)` (`bindings/js/index.d.ts:936`; `bindings/js/index.mjs:564`) — **there is no fourth position for it to name a commit at** — **so a repair whose only edit is a deletion opens its own commit by construction and is refused `KC-4` on `(d2)` from this date.** **Giving `delete` a fourth position is a member-and-arity move and a MINOR of its own, and that is the architect's** — the declaration's `Q-6`, open. (`D-105` item `3`; `D-69`; `docs/L1/op-free-repair-credit.md` §3, §8.3.)
+
+**AND ONE THING THIS ACT MOVES THAT IS NOT A CLAIM — A LINE NUMBER, DECLARED RATHER THAN LEFT TO BE FOUND, ON THE TERMS THE 2026-11-01 ACT ABOVE ALREADY SET.** **This act adds `8` lines inside `§7.6` — the three clauses and this movement clause, with their separating blank lines — so a line number this guide prints that names a line at or after `§7.7`'s heading (`:1155` as this act found it) reads `+8` from this date, and every line number this guide prints INSIDE `§7.6` above these clauses is unmoved.** **A printed number is read through that table until a re-anchoring pass re-derives it at its own site; the words, and the claim each number carries, are unmoved by this act** (`RCA-8(g)`).
+
 ### §7.7 ★ The check is BOUNDED — THREE restarts per terminal act, and past the budget it fails closed
 
 **★ THE LIMIT, DECLARED HERE BECAUSE NO CLAUSE OF THIS GUIDE SAID IT: A CONSTRAINT CHECK RESTARTS AT MOST THREE TIMES PER TERMINAL ACT.** The bound is **`RESTART_LIMIT` = `3`**, one exported constant at **`bindings/js/src/entry/constraints.mjs:1366`**. **THE BUDGET IS SPENT AND NOT RESET by an action raised inside a restart** — a body that reverses again inside a restart's own ask spends the SAME budget and not a fresh one — **AND PAST IT THE CHECK FAILS CLOSED IN THE ONE FORM:** the write throws the same plain `{status, message, log, address}` it throws for a refused pass (§8), with `status` **`'ConstraintPassRefused'`** and **ONE log entry** whose message says the budget was spent rather than that a pair refused a state it never judged. **The store is restored** — the request's own watch records what is owed — so the terminal act leaves no unjudged effect standing (`D-42` item `3`; `D-41` item `4`).

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.8.0`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.9.0`.
 
 ## The one entry
 

package/RELEASE-NOTES.md

@@ -16,7 +16,7 @@ claims to be installable.**
 
 **⟶ AND THE CUT-STATE IS DROPPED FROM THIS FILE, 2026-10-28 — `D-57`, THE ARCHITECT VERBATIM: *"Drop the cut-state."*** `RCA-8(g)` ANNOTATE-BESIDE: **the title line and every dated paragraph of this file stand BYTE-FOR-BYTE as the reading of their own date, THIS clause is the one that reads them, and not one byte is deleted.** **THE REASON IS STRUCTURAL AND IT WAS MEASURED THREE TIMES: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and this file's own head was stale within minutes of the tag that falsified it. **SO EVERY SENTENCE BELOW THAT CLAIMS WHETHER SOME VERSION IS OR IS NOT CUT — *"PREPARED — NOT CUT"*, *"no `v1.3.0`"*, *"nothing in this section is cut"*, *"the release is not cut"*, *"what is installed today is still `1.1.0`"*, and each reading printed beside them — IS READ THROUGH THIS CLAUSE: the cut-state is not a document's to state.** **WHAT SURVIVES IS THE ONE FIGURE A SHIPPED DOCUMENT CAN BE RIGHT ABOUT, AND IT IS GENERATED FROM THE MANIFEST AND ASSERTED BY THE PREFLIGHT:**
 
-PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.8.0`.
+PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.9.0`.
 
 **AND THE TAG SET SURVIVES AS A RECORD OF RELEASES — PAST TENSE, A LIST OF WHAT HAS BEEN CUT, NEVER A CLAIM ABOUT THE CURRENT ONE** (the record stands in `§1.4.0` below — the section this file's head called `§main` until it was re-cut to name the version it prepares, 2026-10-28 — beside the section for the tree this file describes). (`D-57`; `DEF-AC` (b) — `scripts/publish.sh --figures` generates that line from `bindings/js/package.json`'s `version` and refuses on any disagreement, in this file, in `bindings/js/README.md` and in the shipped guide: three documents, three version lines, one generator, one assertion.)
 
@@ -55,6 +55,87 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
+## §1.9.0 · a MINOR — the op-free repair credit: what a consumer sees now, the one declaration that moves, what does not move, the twelve re-derived cells, and the arithmetic that says how many commits
+
+**⟶ THIS SECTION IS NEW, 2026-11-01, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.8.1`, whose body stands BYTE-FOR-BYTE as the reading of its own date and is read through no clause here.** **AND THIS SECTION DOES NOT STATE WHETHER `1.9.0` HAS BEEN RELEASED: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 and the authority clause of 2026-10-29 above, which govern every sentence here).
+
+**THE VERSION IS `1.9.0` AND ITS CLASS IS A MINOR — `D-105`'s OWN DECLARATION, MADE AT `docs/L1/op-free-repair-credit.md` §8.2 and taken here as the number it names: *"MINOR, unnumbered; the number is the release pass's … the next line's candidate is `1.9.0`."*** **THE CLASS IS `PUB-DD-9`'s `MINOR` ROW, and its ground is two-armed and MEASURED rather than preferred:** **(i) THE BEHAVIOUR MOVES** — a repair's answer that was refused is credited, a repair's edit's triggered pairs are asked by the commit's next battery, and the `KC-4` arm's population shrinks to two predicates and grows by one regression; **and (ii) THE DECLARATION MOVES CONSUMER-VISIBLY** — `RepairOutcome`'s `op` is no longer required and admits `null`, so a consumer reading `op` off a value typed `RepairOutcome` **must now narrow** — which is exactly why this release is not `1.8.1`'s class: a patch changes behaviour *"without adding a member, an arity, a type or a status"*, and this release moves a type (`D-105`; `docs/L1/op-free-repair-credit.md` §8.2).
+
+**THE ELEVEN CELLS AND THE THREE VERSION LINES MOVE TOGETHER, AS EVERY RELEASE OF THIS FILE'S** — `bindings/js/package.json`'s `version`, its five exact `optionalDependencies` pins and the five `bindings/js/platforms/*/package.json` `version` fields at `1.9.0`, with the main manifest still carrying `"version"` exactly once (`grep -o '"version"' bindings/js/package.json | wc -l` reads `1`, which is the carrier's own precondition rather than a style note) — beside the three shipped documents' one generated version line each: this change list's `PUBLISH-NOTES-VERSION-LINE`, the consumer guide's `PUBLISH-GUIDE-VERSION-LINE` and `bindings/js/README.md`'s `PUBLISH-README-VERSION-LINE`. **And the artefact is stamped from that manifest by `bindings/js/build.rs`, so `version()` answers `1.9.0` at the rebuilt artefact** — `1.8.1` at the artefact this pass found, `1.9.0` at the artefact it rebuilt — **and that, and not the crate's own `Cargo.toml` version, is the value the coupling rule is asserted against** (three cells read it, all through one helper: `P-PUB-2::S-KEYSET`, `P-PUB-6::S-SCOPE` and `P-PUB-7::S-MANIFEST`, whose `declaredReleaseVersion` reads the SHIPPED BYTE rather than a document).
+
+**THE ARITHMETIC — TWO INSTRUMENTS, ONE OF WHICH REFUSES, AND BOTH PRINTED.** **`git rev-list --count v1.8.1..HEAD` DOES NOT ANSWER: it exits `128` with *"fatal: ambiguous argument 'v1.8.1..HEAD': unknown revision or path not in the working tree"*, because NO TAG NAMES `1.8.1`.** **The tag set answers `v1.8.0` last** (`git tag --list`: twelve tags, `v1.0.0` through `v1.8.0`, and `git describe --tags --abbrev=0` answers `v1.8.0`), **so the count is taken from the tag the tag set actually carries: `git rev-list --count v1.8.0..HEAD` READS `3`, AND THE SPLIT BY WHAT THE COMMITS ARE IS THIS MINOR'S OWN PRE-HISTORY.** **`7a31053`, *"Fix the repair's write's listeners: delivered in the commit's batch, once per handle, and cut 1.8.1"*** — `25` files, `+2757`/`−30`: the `D-104` delivery fix and its thirteen cells, the guide's live-listener clause, the declaration, and the `1.8.1` eleven cells with their two landed copies — **`90cd8a7`, *"Re-stage the guide's landing after the D-103 clause"*** — `1` file, `+6`/`−0`, the generated landing re-produced from its authored home so the preflight's drift leg stayed green — **and `24f5b94`, *"Make the unnamed commit position unsupported (`D-103`), and record the published 1.8.0 verification"*** — `4` files, `+105`/`−0`, the guide's clause and the two records. **NEITHER THE `1.8.1` TAG'S ABSENCE NOR THAT COMMIT MESSAGE IS THIS DOCUMENT'S TO SETTLE: the cut-state is the tag set's** (`D-57`), **and this section prints what the tag set answers rather than what a commit subject claims.** **AND THIS RELEASE'S OWN LANDING COMMIT IS NOT YET MADE — it is the one that will carry the five code paths, the nine test and typecheck paths, the declaration, the guide's three clauses, this section, the eleven cells and the two landed copies — so no figure above is summed with it, and none of the three commits is a behaviour commit of THIS release.** (`git rev-list --count v1.8.0..HEAD`; `git log --oneline v1.8.0..HEAD`; `git show --stat 24f5b94 90cd8a7 7a31053`.)
+
+**WHAT A CONSUMER SEES, EACH AN OBSERVABLE TO DRIVE RATHER THAN A SENTENCE TO TRUST:**
+
+1. **AN OP-LESS REPAIR IS CREDITED — AND UNTIL THIS RELEASE IT WAS `ConstraintPassRefused`.** A repair that does its write and returns `undefined` (the natural shape of `repair: () => { … }`), or a bare `{ ok: true }`, or any value outside the declared arms at all, **is credited: the failing pair is marked applied (`attempt.appliedRepairs`), the re-run judges the landing, and the write answers its record.** **The value the repair returned is read by NOTHING** — it sets no pin, joins no list, becomes no landing and is named by no sentence. **The one return that still fails is the declared failed arm `{ ok: false, message }`, whose `message` is your own sentence and whose `KC-4` refusal carries it verbatim** (`D-105` item `1` and item `4`; `docs/L1/op-free-repair-credit.md` §1.1).
+2. **THE COMMIT'S LEG CARRIES THE REPAIR'S LANDING.** The repair's own `write`, made through the commit it names, **mints one leg — `{op, triggered}` — per write**, and the attempt pins from the leg and never from the return: **`entry.opId` is the last leg's `opId`; `attempt.ops` is the commit's own landing plus every leg's op, in leg order, de-duplicated by `opId`; and the re-run hands your body the value the leg's op landed (`op.after.value`)** — so `context.value` after a repaired write is the repair's landed value, which is what `§7.6`'s clause has always said it is. **A repair that writes twice appends two ops and the last is the landing**, and the rollback point is `D-63`'s restore mark, which the returned op never was (see `§7.6`'s second clause of 2026-11-01).
+3. **THE REPAIR'S EDIT'S TRIGGERED PAIR IS ASKED BY THE COMMIT'S NEXT BATTERY.** A pair standing where a repair wrote — **not in the commit's own triggered set** — **is asked ONCE, at the re-run, against the repair's op and the value it landed**; the registry still supplies the order, the set is still materialised once per run, and a pair already in the commit's triggered set is asked once and not twice (see `§7.6`'s third clause of 2026-11-01).
+4. **AND THE LISTENER HALF WAS `1.8.1`'S, NOT THIS RELEASE'S.** A listener a repair's edit fires rides **the commit's one delivery, after the pass, once per distinct handle** — `D-104`'s patch, declared at `§1.8.1` above, **whose five observables, two held halves and thirteen cells stand unmoved by this release and are not restated here** (`§1.8.1` item 1's list; that section's own cell clause, not one assertion changed).
+
+**THE DECLARATION'S CHANGE — ONE ALIAS, MOVED CONSUMER-VISIBLY, AND IT IS THE ONLY DECLARED SURFACE THIS RELEASE MOVES** (`bindings/js/index.d.ts:1540`; the docblock above it carries the dated re-derivation):
+
+```ts
+export type RepairOutcome =
+  | void
+  | { readonly ok: true; readonly op?: WriteRecord['op'] | null }
+  | { readonly ok: false; readonly message: string };
+```
+
+**TWO MOVES AND NO THIRD: `void` joins the union, so `undefined` is ASSIGNABLE; and `op` becomes OPTIONAL and admits `null`.** **WHAT THAT COSTS A CONSUMER, SAID PLAINLY RATHER THAN LEFT TO A COMPILER'S OWN WORDS: a value annotated `RepairOutcome` whose `op` is READ must now be narrowed first** — that is the declared break, and it is the reason the class is MINOR. **The failed arm is unmoved, no name is minted, and the type still declares the shape a consumer SHOULD return rather than judging what a consumer DOES return:** the runtime credits `true`, `false`, `7`, `'done'`, `{ ok: 'yes' }` and `{ ok: false }` with no message, and this alias admits none of them — **the type declines, the runtime credits, and a green compile was never evidence of a credit** (`docs/L1/op-free-repair-credit.md` §6.1; the alias's own docblock says so at the bytes).
+
+**WHAT DOES NOT MOVE, ENUMERATED SO THE MINOR IS NOT READ AS WIDER THAN IT IS:**
+
+- **NO STATUS IS MINTED. The closed status set stays TWENTY, ranked `1`…`20`, and no status name, rank or message moves** (`src/error.rs`'s `CODES: [&str; 20]`). `KC-4` is the token that answers both `KC-4` arms and it is not new; **the `KC` token set stays at NINE.**
+- **NO MEMBER, NO ARITY, AND NO COUNT IN THE MAP.** The instance's **fourteen own members**, the log entry's five, the failure form's four and `storeCreate` as the namespace's only value name are unmoved; **`write`'s fourth position keeps its arity and its type (`commit?: CommitCarrier`)** — what changed is what a repair RETURNS, never the position it passes; and the module map is unmoved at **`19` modules / `61` endpoints**.
+- **THE `1.8.1` LISTENER CELLS ARE UNMOVED.** The thirteen cells of that patch — eight `RLD` in `tests/e2e/repair-listener-delivery.test.mjs` and five at the kernel in `tests/integration/js-constraints/repair-listener-delivery.test.mjs` — **have no assertion changed by this release**; what moves beside three of them is the GROUND a comment states, and those re-derivations are printed at the cells.
+- **THE REFUSAL TEMPLATE IS UNMOVED.** *"the repair `<id>` produced no op at `<address>`"* stands **BYTE-FOR-BYTE** — template literal and interpolations included — and answers the invocation-landed-nothing arm alone, over `repairLegs`' five absent arms; **the two op-identity sentences that stood beside it are DELETED with the private helper that spelled them, so the write path's three `KC-4` messages become two.** **`D-88` (2)'s *"recorded, not repaired"* row is READ THROUGH this release and is HALVED, not closed:** the op-denial half dissolves by carrier, the address half survives on the nested-attempt arm, and the row stays OPEN with its population narrowed in its own record (`D-105` item `1`; `docs/L1/op-free-repair-credit.md` §5.1).
+
+**THE TWELVE RE-DERIVED CELLS, NAMED SO A READER CAN CHECK THE BATTERY AGAINST THEM, AND THE FIFTEEN THIS RELEASE ADDS.** **The twelve are those whose assertions moved with the carrier — four in Class A (a four-position repair that lands, whose cell asserted the RETURNED op was the credit: three cells of `tests/integration/js-constraints/constraint-kernel-repairop.test.mjs` and `constraint-kernel-negatives.test.mjs`'s `P-NEG-18`), seven in Class B (the three-position route, whose four asserted goods are `D-103` item `1`'s own non-promises: four cells of `tests/e2e/blind-constraints-unit.test.mjs`, `constraint-kernel-states.test.mjs`'s `ck_neg_2`, `tests/e2e/repair-in-commit.test.mjs`'s `D-46` (1), and `discard-witness.mjs`'s `DW-08.1`), and one counted cell in Class C (the typecheck fixture's two retired directives and its un-narrowed `op` reading, named as three edits inside one arithmetic).** **★ AND ONE FINDING THIS RELEASE PRINTS RATHER THAN ABSORBS: `tests/e2e/discard-witness.mjs` IS OUTSIDE `npm test`'s GLOB.** The suite's command is the root manifest's own `"test": "node --test \"tests/**/*.test.mjs\""`, and that file's basename ends `-witness.mjs` — **so `DW-08.1`'s re-derivation is executed by NO leg the suite runs, and it is measured by the standalone drive the guide's own `MEASURED` claims cite (`node tests/e2e/discard-witness.mjs`, 85 cells, all passing) rather than by the battery's count.** **THE FIFTEEN ADDED CELLS:** **nine in `tests/e2e/op-free-repair-credit.test.mjs`** (`ORC-1` the op-less credit · `ORC-2` the bare receipt · `ORC-3` the op still lawful and not the carrier · `ORC-4` the declared failed arm · `ORC-5` the residual `KC-4`'s four drives · `ORC-6` the repair's edit's triggered pair asked · `ORC-7` the repair's edit's triggered listener · `ORC-8` the floor call's undo on a failing arm · `ORC-9` the delete-shaped repair not credited) **and six at the kernel's own surface in `tests/integration/js-constraints/op-free-repair-credit.test.mjs`** (`ORC-I1` the credit is the mark · `ORC-I2` the pins and the order · `ORC-I3` the residual's two predicates · `ORC-I4` the joined pair · `ORC-I5` the leg's shape · `ORC-I6` the failed arm's undo plan), **each reaching the entry by path and claiming nothing about the packaged resolution** (`D-6`/`D-7`'s `O4` set). **The typecheck fixture's three edits are the same release's** (`ORC-T1`–`ORC-T3`).
+
+**THE RECORDS THIS RELEASE CARRIES, AND THE SIX QUESTIONS IT DOES NOT ANSWER.** **`strata/decisions.md` · `D-105`** is the ruling, quoted at the guide's first clause of 2026-11-01 and at `docs/L1/op-free-repair-credit.md`'s head; **`D-88` (2)'s row is read THROUGH it and halved rather than closed**; and the L1 declaration `docs/L1/op-free-repair-credit.md` is the corpus path that names the credit, the leg, the rollback, the sentence, the types, the cells and the class. **AND THE SIX OPEN QUESTIONS ARE PRINTED AS OPEN, NEVER DECIDED** (`docs/L1/op-free-repair-credit.md` §8.3): **`Q-1`** the registration instant is a second credit site and keeps its own rule · **`Q-2`** the unnamed route's observables regress, and that consequence is the question `D-103` reserved — **a repair that omits the commit now fails its enclosing write**, which the guide's third clause of 2026-11-01 states and no sentence of this document settles · **`Q-3`** whether a refused repair's landed edit should be undone too · **`Q-4`** the sentence's own text · **`Q-5`** two bookkeeping items owed to the battery · **`Q-6`** `delete` has no commit position, so a deletion-repair cannot be on the supported route — **and giving `delete` a fourth position is a MINOR of its own and the architect's.**
+
+**WHAT TRAVELS, SAID SO NO CONSUMER READS A CLAIM THIS RELEASE'S TARBALL DOES NOT CARRY** (`D-51` item 1's lesson): **the declaration ships** — `bindings/js/index.d.ts` carries the re-derived alias and its dated docblock, and the manifest's `files` names it; **the guide's three clauses ship** — the guide lands BYTE-FOR-BYTE as `README.guide.md` and that row is named as well; **and this change list ships at `node_modules/provident-storeroom/RELEASE-NOTES.md`.** **So a consumer holding the tarball reads the credit's rule, the leg, the joined battery and the declaration's change at the shipped homes, not only in this repository.**
+
+**AND WHAT THIS SECTION IS NOT: a restatement of `§1.8.1`.** **That section is the previous release's change list and stands BYTE-FOR-BYTE beneath this one; this release restates none of its five observables, its two held halves, its thirteen cells or its arithmetic.** **The two releases touch the same member — `pending` — from two sides and neither moves it: `§1.8.1` said whose LISTENERS the member may carry, and this one says which of a repair's triggered handles are ASKED and which are delivered, so the member's own population is unmoved.**
+
+---
+
+## §1.8.1 · a PATCH — the repair's write's listeners: what a consumer sees now, the docs corrections this patch carries, the cells, and the arithmetic that says how many commits
+
+**⟶ THIS SECTION IS NEW, 2026-11-01, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.8.0`, whose body stands BYTE-FOR-BYTE as the reading of its own date and is read through no clause here.** **AND THIS SECTION DOES NOT STATE WHETHER `1.8.1` HAS BEEN RELEASED: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 and the authority clause of 2026-10-29 above, which govern every sentence here).
+
+**THE VERSION IS `1.8.1` AND ITS CLASS IS A PATCH — `D-104` ITEM 4, THE ARCHITECT'S RULING OF 2026-11-01 (`strata/decisions.md` `D-104`), VERBATIM: *"This is a behavior defect, wrap into the fix patch"*.** **THE CLASS IS `PUB-DD-9`'s `PATCH` row — *"a fix inside the declared surface"* — AND ITS GROUND IS ENUMERATED RATHER THAN ASSERTED: NOTHING THE SURFACE DECLARES MOVES.** **The closed status set stays TWENTY, ranked `1`…`20`** (`src/error.rs:113`, `pub const CODES: [&str; 20]`) · **the instance's FOURTEEN own members, the log entry's five, `KC`'s nine tokens and `storeCreate` as the namespace's only value name are unmoved** · **the declaration's NAMED-TYPE SET stays at `27`** (the `21 → 27` figure `§1.8.0` prints, asserted at `tests/e2e/blind-entry-module.test.mjs`'s `DECLARED_TYPE_NAMES`) · **no member, no arity, no type and no refusal message moves** · and **`triggered` is unmoved as well** — it stays the store's own returned set for the commit's write, VERBATIM.
+
+**THE ELEVEN CELLS AND THE THREE VERSION LINES MOVE TOGETHER, AS EVERY RELEASE OF THIS FILE'S** — `bindings/js/package.json`'s `version`, its five exact `optionalDependencies` pins and the five `bindings/js/platforms/*/package.json` `version` fields at `1.8.1`, with the main manifest still carrying `"version"` exactly once (`grep -c` reads `1`), beside the three shipped documents' one generated version line each — **and the artefact is stamped from that manifest by `bindings/js/build.rs`, so `version()` answers `1.8.1` at the rebuilt artefact and at a package installed from it**; that, and not the crate's own `Cargo.toml` version, is the value the coupling rule is asserted against (`scripts/publish.sh`'s own cell enumeration, `§2.5` item `2`).
+
+**THE ARITHMETIC, MEASURED AT THIS TREE BEFORE THE LANDING: `git rev-list --count v1.8.0..HEAD` READS `2`, AND THE SPLIT BY WHAT THE COMMITS ARE IS THIS PATCH'S OWN STORY.** **`24f5b94`, *"Make the unnamed commit position unsupported (`D-103`), and record the published 1.8.0 verification"*** — `4` files, `+105`/`−0`: the guide's `§7.6` clause, the declaration's `§7.1` withdrawal, and the two records (`strata/decisions.md` `D-103`, `strata/research.md` §11) — **and `90cd8a7`, *"Re-stage the guide's landing after the D-103 clause"*** — `1` file, `+6`/`−0`, the generated landing re-produced from its authored home so the preflight's drift leg stayed green. **NEITHER COMMIT IS A BEHAVIOUR COMMIT: they move documents and a landing, and no byte of `bindings/js/src/` or `src/`.** **AND THE FIX'S OWN LANDING IS THE ONE COMMIT THAT CARRIES THIS SECTION** — the six code paths, the five test paths, the two records, the L1 declaration, the guide's two clauses, this section and the eleven cells — **so the figure above is printed with its instrument and is not summed with that commit.** (`git rev-list --count v1.8.0..HEAD`; `git log --oneline v1.8.0..HEAD`; `git show --stat 24f5b94 90cd8a7`.)
+
+**WHAT A CONSUMER SEES, EACH AN OBSERVABLE TO DRIVE RATHER THAN A SENTENCE TO TRUST:**
+
+1. **A REPAIR'S WRITE'S LISTENERS ARE INVOKED — AND UNTIL THIS PATCH THEY WERE INVOKED BY NOTHING.** A repair's write answers its own record (`{op, watched, triggered}`), the terminal arm delivered only the COMMIT's `pending` residue, and the repair's own frame's delivery is withheld (*"this frame is the leg … its silence is total"*), **so a listener bound where a repair wrote fired never** (`D-104` item 1; `strata/research.md` §12's chain, confirmed at every link at `docs/L1/repair-listener-delivery.md` §1). **From this patch it is invoked in the COMMIT's ONE delivery, AFTER the pass** — the same `deliver` call and the same recipient snapshot as the residue's — **so no listener a repair's edit fired runs inside the repair body or inside the pass.**
+2. **ONCE PER DISTINCT HANDLE, AND ONE MEMBER ELEMENT FOR IT.** A listener fired by BOTH the original write and the repair's edit is invoked ONCE (`surface.md §2.4` rule 3), and **`CommitRecord.pending` carries ONE element for it** — the member's own de-duplication, by `handle`, with its own ground: `pending` is also a caller's work list, so a member carrying one handle twice would let a caller's own loop run that body twice.
+3. **WITH THE REPAIR'S OWN DELIVERY ADDRESS — AND NO PER-HANDLE ATTRIBUTION.** The delivery takes ONE `triggeringAddress`, read off the leg's op, which is the repair's write's record where a repair landed; **so the whole batch is handed the repair's address, and no member, no clause and no cell asserts which of the two acts fired a doubly-fired handle** (`DD-22`, `DD-37`). **The pre-existing half — a handle the commit's own write alone fired is handed the repair's address too — is unmoved and is `docs/L1/repair-listener-delivery.md` §10's `Q-3`.**
+4. **AND `pending` CARRIES THEM TOO, WHICH IS A MEMBER A CONSUMER READS.** `pending` is **the handles the pass did not evaluate** and **a listener is never the pass's** (`D-56`; `D-69`), so **an entry may now be a listener a repair's edit fired that the commit's write never returned** — and **on a repaired write `pending` is no longer a subset of `triggered`.** **AND THE ONE SENTENCE A LATER REPAIR SEES, BECAUSE IT IS A MEMBER A CONSUMER'S OWN BODY READS:** `RepairContext.pending` is a fresh list read per evaluation, so **in a multi-repair commit every repair after the first is handed a member carrying an earlier repair's listener elements** — its declared shape unmoved (six members, the pair element `{handle, address}`, a fresh list).
+5. **AND ON A FAILED ATTEMPT THEY ARE DISCARDED WITH THE REST.** `surface.md §2.7` item 6 is unmoved: **a failed attempt delivers nothing — the repair's listeners are NOT invoked and `pending` ends empty** (the discard's filter widened to the union of the failed write's returned set and this attempt's repairs' sets). **A reader who learns the first half without this one will expect a listener on a refusal.**
+
+**THE TWO HALVES HELD, PRINTED AS HELD AND NOT AS DECLARATIONS** — each needs the architect's word, and the behaviour above is unaffected by either answer: **`Q-7`** — `D-104` item 2's `discarded`-witness sentence cannot be honoured at the bytes (a failed write's arm answers no record at all, and the witness's element is `{opId, addresses}`, a discarded reversal request, into which no listener handle could be written), **so the failing arm is asserted by its two observables alone** — the invocation count `0` and a `pending` holding none of those handles; **`Q-2`** — the delete-shaped commit is in the fix by construction (`D-55` item 3, one repair arm shared by both attempt kinds) **and whether that scope is confirmed or narrowed is the architect's.**
+
+**THE DOCS CORRECTIONS THIS PATCH CARRIES, BOTH POST-`1.8.0` COMMITS AND NEITHER A BEHAVIOUR CHANGE:**
+- **`D-103`'S UNSUPPORTED-COMMIT CLAUSE.** The guide's `§7.6` sentence *"a repair that names nothing in the fourth place also joins, by the kernel's own name; the fourth position is how YOU name it"* is read through a dated clause of 2026-11-01: **the commit passed at `write`'s DECLARED FOURTH POSITION is THE route, and a repair that omits it is UNSUPPORTED** — **not refused, and the frame's fallback bytes stand** (`D-103` items 1–3; the clause at `docs/guides/package-use.md`'s `§7.6`, and the declaration's own withdrawal at `docs/L1/repair-outcome-types.md` §7.1).
+- **THE GUIDE'S LIVE-LISTENER ANCHOR.** `§7.3`'s clause that *"live"* names the SECOND of `§6.2`'s two acts: **an entry a `listen` wrote that `register` has not filled is a RESERVATION — it delivers to no listener and carries no kind — and the cross-kind refusal is read for a listener a `register` has made live.** **It moves no refusal and no status: the four messages `§1.7.0` declares are untouched by it.** **Both corrections move documents and landings and no code byte, and the patch's behaviour change is item 1's alone.**
+
+**THE CELLS THE FIX CARRIES, NAMED SO A READER CAN CHECK THE BATTERY AGAINST THEM:**
+- **THIRTEEN NEW CELLS.** Eight in `tests/e2e/repair-listener-delivery.test.mjs` — **`RLD-1`** the delivery (the defect itself: a count of `1` where the unfixed tree answered `0`), **`RLD-2`** the doubly-fired handle (one invocation, one member element), **`RLD-3`** the failing arm (its `discarded`-witness half HELD on `Q-7` and recorded, never asserted), **`RLD-4`** the seat, **`RLD-5`** `pending`'s re-derivation (the pair element, the member's de-duplication, `pending ⊄ triggered`), **`RLD-6`** the registration instant unmoved (`G3-22`'s two zeros re-asserted), **`RLD-7`** the delete-shaped commit (HELD on `Q-2`: driven, coherent, its delivery recorded), **`RLD-8`** the two-repair commit (both listeners once each) — **and five at the kernel's own surface in `tests/integration/js-constraints/repair-listener-delivery.test.mjs`** — **`RLD-I1`** the predicate (a carried pair's id does not merge, a listener's handle does), **`RLD-I2`** the discard's widened scope, **`RLD-I3`** the seat before the re-run, **`RLD-I4`** the credit gate, **`RLD-I5`** the nested-attempt guard (one invocation, not two).
+- **THE TWO CLAIM RE-DERIVATIONS, IN THE SAME ACT.** `tests/integration/js-constraints/constraint-kernel-layers.test.mjs`'s loop *"a layer (b) handle is a handle THIS call's write returned"* and `constraint-kernel-negatives.test.mjs`'s passing-arm set equality **both become non-total on a repaired write, and both are re-derived as clauses** — each was GREEN on its own fixture, and each would have gone red on the first fixture that lands a repair firing a handle outside the commit's set, which `RLD-5` creates.
+- **ONE `observed` CELL PROMOTED WITH ITS FIGURE UNMOVED.** `FTS-11.6` (`tests/e2e/file-tier-save/scenarios.mjs`) asserted nothing and printed *"the number of times the delivered body ran on the repair-join arm"*; **from this patch it asserts that figure, `1`, and `1` is discriminating**: a merge that appended the repair's set a second time would make it `2`, and a merge that let a carried pair's id through would hand the delivery a constraint's registration to resolve as a listener's.
+- **AND `G3-22` IS THE MECHANISM'S STRUCTURAL CONSTRAINT, NOT ITS SUBJECT.** `tests/e2e/registration-write-route.test.mjs`'s `listenerDelta === 0` stays green because a registration's attempt carries no `record`, and `RLD-6` re-asserts it in the fix's own file so the carrier cannot grow a path to that instant.
+
+**WHAT TRAVELS, SAID SO NO CONSUMER READS A CLAIM THIS PATCH'S TARBALL DOES NOT CARRY** (`D-51` item 1's lesson, applied before it can bite again): **the declaration's clause ships** — `bindings/js/index.d.ts`'s `CommitRecord.pending` docblock carries the dated re-derivation, and `index.d.ts` is named by the manifest's `files` — **and the guide's clauses ship too** — the guide lands BYTE-FOR-BYTE as `README.guide.md`, and that row is named as well — **and this change list ships at `node_modules/provident-storeroom/RELEASE-NOTES.md`.** **So a consumer holding the tarball reads the `pending` sentence's re-derivation at both of its shipped homes.**
+
+**AND WHAT THIS SECTION IS NOT: a restatement of `§1.8.0`.** **That section is the previous release's change list and stands BYTE-FOR-BYTE beneath this one; this patch restates none of its six names, its narrowing, its fixture figures or its arithmetic.** **The two touch the same member — `pending` — from two sides, and neither moves it: `§1.8.0` typed the commit position that CARRIES the member, and this patch says WHOSE listeners the member may carry.**
+
+---
+
 ## §1.8.0 · a MINOR — the typed declaration's landing: the six names a consumer can now annotate, the one type that NARROWS, what does not move, and the arithmetic that says how many commits
 
 **⟶ THIS SECTION IS NEW, 2026-11-01, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.7.0`, whose body stands BYTE-FOR-BYTE as the reading of its own date and is read through no clause here.** **AND THIS SECTION DOES NOT STATE WHETHER `1.8.0` HAS BEEN RELEASED: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 and the authority clause of 2026-10-29 above, which govern every sentence here).

package/index.d.ts

@@ -810,6 +810,19 @@ export interface CommitRecord {
    * **ITS ELEMENT TYPE IS TOTAL — NO BARE HANDLE STANDS IN IT** (`contract.md §2.5` item 2): the bare-handle
    * union the check-off and the discard once carried has no subject under POP, because the checked-off entry
    * is REMOVED rather than carried beside.
+   *
+   * **⟶ RE-DERIVED 2026-11-01 — `D-104`: THE SEED ABOVE IS NOT THE MEMBER'S WHOLE POPULATION ON A REPAIRED
+   * WRITE, AND NO TYPE, MEMBER OR ARITY MOVES WITH THIS CLAUSE** (`docs/L1/repair-listener-delivery.md` §4, §8;
+   * `strata/decisions.md` · `D-104` item `2`, whose item `4` fixes *"no status, no member, no arity, no type may
+   * move"*). The clause above stands BYTE-FOR-BYTE and is read THROUGH this one: `pending` is still seeded as a
+   * clone of `triggered` and still holds *"the whole returned set of triggered constraints"* **as its seed**, and
+   * from this date **A REPAIR'S WRITE'S TRIGGERED LISTENERS ARE MERGED INTO IT** — in the commit's one delivery,
+   * after the pass, one invocation per distinct handle — so **an entry may also be a listener a REPAIR's edit
+   * fired and the commit's own write never returned**. **`triggered` is unmoved**: it stays the store's own
+   * returned set for the commit's write, VERBATIM, so `pending` is no longer a subset of it on a repaired write.
+   * **THE ELEMENT SHAPE IS THE ONE ABOVE, UNCHANGED** (`{ handle, address }` — `contract.md §2.5` item 2's
+   * totality stands), and **a pair is never merged**: a carried pair's handle stays out of the member exactly as
+   * it is never delivered (`D-69`).
    */
   readonly pending: readonly TriggerPair[];
 }
@@ -1484,25 +1497,49 @@ export type ConstraintOutcome =
   | { readonly message: string };
 
 /**
- * **WHAT A REPAIR ANSWERS — THE CLOSED TWO-ARM SET**, read at `bindings/js/src/entry/kernel-attempt.mjs:899`-`:914`
- * and declared at `docs/L1/repair-outcome-types.md` §1.5 of 2026-11-01. **`op` IS REQUIRED ON THE CREDITED ARM, THE
- * ARM IS CLOSED, AND `undefined` IS NOT ONE OF THE TWO** — so a repair answering `undefined` or a bare `{ ok: true }`
- * is a COMPILE ERROR instead of a `ConstraintPassRefused` (`ST-F2`'s measured defect, `strata/research.md` §10).
+ * **WHAT A REPAIR ANSWERS — THE CREDITED ARM, THE FAILED ARM, AND `void`**, read at
+ * `bindings/js/src/entry/kernel-attempt.mjs`'s repair arm and **RE-DERIVED 2026-11-01 by `D-105`**
+ * (`strata/decisions.md` · `D-105` item `1`; `docs/L1/op-free-repair-credit.md` §6.1). **THE SENTENCES THIS CLAUSE
+ * SUPERSEDES ARE NAMED RATHER THAN OVERWRITTEN** (`RCA-8(g)` ANNOTATE-BESIDE): *"`op` IS REQUIRED ON THE CREDITED
+ * ARM, THE ARM IS CLOSED, AND `undefined` IS NOT ONE OF THE TWO — so a repair answering `undefined` or a bare
+ * `{ ok: true }` is a COMPILE ERROR instead of a `ConstraintPassRefused`"* (`docs/L1/repair-outcome-types.md` §1.5
+ * of 2026-11-01). **THE RULING, VERBATIM: *"A repair that does its write and returns `undefined` — the natural
+ * shape of `repair: () => { … }` — is NOT refused"***, **so the credited arm is `undefined` · `{ ok: true }` ·
+ * `{ ok: true, op }` — three spellings of ONE arm — and `void` is what the body answers when it has no opinion.**
+ * **`ST-F2`'s measured defect is CLOSED BY CARRIER and not by text.**
+ *
+ * **THE CREDITED ARM: `{ ok: true, op? }`, `op` OPTIONAL AND INFORMATIONAL** — the store's own journal record
+ * where a body cares to hand it back, reached by INDEXED ACCESS (`WriteRecord['op']`) so **NO SECOND CARRIER IS
+ * MINTED**. **NO READER IN THE KERNEL READS IT**: the credit is the FAILING PAIR's mark (`attempt.appliedRepairs`),
+ * the op the attempt pins is the repair's write's OWN LEG (`D-105` item `2`), and the re-run's value is that leg's
+ * `op.after.value` — the returned `op` sets no pin, joins no list, becomes no landing and is named by no sentence.
+ * **`op` ADMITS `null`** because the member is informational: `DeleteRecord['op']`'s declared `null` arm — a
+ * `delete` that removed nothing — costs a consumer nothing, and nothing is refused for it.
+ * **THE FAILED ARM IS UNMOVED: `{ ok: false, message }` — `op` ABSENT AND NEVER `null`** — and it is the ONLY
+ * return that fails the attempt (`D-105` item `4`: *"The failed arm still fails (`{ok: false, message}` — the
+ * caller's words)"*, `bindings/js/src/entry/kernel-attempt.mjs`'s `(d1)`).
  *
- * **THE CREDITED ARM: `{ ok: true, op }`, `op` BEING THE OPERATION RECORD THE STORE'S OWN VERB RETURNED** — the
- * store's own journal record, reached by INDEXED ACCESS (`WriteRecord['op']`) so **NO SECOND CARRIER IS MINTED**, and
- * `op.opId` (`string`) and `op.seq` (`number`) are reached by naming that record. **`DeleteRecord['op']`'s declared
- * `null` arm is REFUSED here**: a `delete` that removed nothing answers `null` and credits nothing, so a repair
- * passing `removed.op` narrows first. **THE FAILED ARM: `{ ok: false, message }` — `op` ABSENT AND NEVER `null`**,
- * because an `op` there is read by nothing.
+ * **THE TYPE STAYS NARROWER THAN THE RUNTIME, ON PURPOSE, AND THE GAP IS DECLARED RATHER THAN CLOSED.** The runtime
+ * CREDITS `true`, `false`, `7`, `'done'`, `{ ok: 'yes' }`, `{ ok: false }` WITHOUT A MESSAGE and
+ * `{ ok: true, op: <a whole WriteRecord> }`; **this alias admits none of them** — it declares the shape a consumer
+ * SHOULD return, and the runtime declines to judge what a consumer DOES return. **`{ ok: false }` with no message
+ * is named on both sides deliberately**: the runtime credits it (the declared failed arm needs a non-empty
+ * `message`) and the type refuses it. **THE MIRROR IMAGE OF `CommitCarrier`'s PRINTED LIMIT BELOW**: there an
+ * inherited `pending` and a `Proxy` pass the type and the run-time refusal keeps the position's domain; **here the
+ * RUNTIME IS THE WIDER SIDE — THE TYPE DECLINES, THE RUNTIME CREDITS, AND NOTHING HERE PROMISES THAT A GREEN
+ * COMPILE IS A CREDIT OR THAT A REFUSED COMPILE IS A REFUSAL.** `exactOptionalPropertyTypes` is not set in either
+ * `tsconfig` head, so `{ ok: true, op: undefined }` type-checks as written — a property of the config heads and
+ * not of this alias.
  *
- * **THE TYPE NAMES THE CARRIER; THE GROUND IS PROSE AND IS POINTED AT, NEVER RE-SPELLED HERE**
- * (`bindings/js/src/entry/kernel-foundations.mjs:1105`-`:1131`), **and NO ORDINAL GROUND IS CLAIMED AT THE REGISTRATION
- * INSTANT** (`kernel-registration.mjs:615`-`:616`). **A green compile is not evidence of a credit**, and `op` is read
- * as an OWN member at BOTH instants — a distinction structural typing cannot make.
+ * **THE GROUND IS PROSE AND IS POINTED AT, NEVER RE-SPELLED HERE** (`bindings/js/src/entry/kernel-foundations.mjs`'s
+ * `landedOp`, whose ONE remaining caller is the registration instant — `kernel-registration.mjs:616` — and whose
+ * ordinal ground RETIRES on the write path, `docs/L1/op-free-repair-credit.md` §4 `RB-4`).
+ * **A green compile is not evidence of a credit**, and a returned `op` is read as an OWN member — a distinction
+ * structural typing cannot make. **NO NAME IS MINTED: this declaration adds `0` types.**
  */
 export type RepairOutcome =
-  | { readonly ok: true; readonly op: WriteRecord['op'] }
+  | void
+  | { readonly ok: true; readonly op?: WriteRecord['op'] | null }
   | { readonly ok: false; readonly message: string };
 
 /**

package/index.mjs

@@ -90,7 +90,7 @@ import { admittedConstraintBatch, constraintAddress, decodeBaseState, decodeJour
 // ⟶ `addressSpelling`'s import is DELETED 2026-11-01 with its last two readers (`B-6`'s and `B-4`'s messages,
 // which now name no address at all — `D-98` §3.4). The function keeps its home and its other readers in the
 // entry's other parts.
-import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
+import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, appendRepairLeg, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
 import { commitPositionRefusal, constraintOverwrittenByListen, deliver, installListenRoute, installRegistrationSeam, listenerStandingAt, listenOn, registerOn, terminalArm } from './src/entry/delivery.mjs';
 import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintDelete, constraintWrite, constraintsKernel, currentRaise, defineDiscardWitness, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, witnessRaise, withdrawStanding } from './src/entry/constraints.mjs';
 const require_ = createRequire(import.meta.url);
@@ -450,6 +450,17 @@ export function storeCreate(cfg) {
       // stage 2): a kernel-driven write takes the record THIS VERY WRITE returned and not a copy of it, and the
       // slot is read before the pass that may write again, so a repair's own write can never be mistaken for it.
       state.leg = record;
+      // **⟶ AND THE SAME RECORD'S RETURNED ELEMENTS ARE HANDED TO THE INVOCATION'S OWN LEG LIST — `D-104`,
+      // 2026-11-01** (`docs/L1/repair-listener-delivery.md` §3.2, §8's `js-surface` row;
+      // `strata/decisions.md` · `D-104` item `3`'s mechanism `(a)`). **THE LEG SLOT IS UNTOUCHED**: its four
+      // readers — `delivery.mjs`'s `answer`, the save's gate and the triggering address, and `constraints.mjs`'s
+      // `answer` — take no byte, and this line adds no fifth. **AND THE HAND-OVER IS TAKEN AT THIS SEAT ONLY,
+      // INSIDE THE `n >= 4` ARM AND NEVER AT THE `n <= 3` ROUTE**: the kernel's store leg is this arm, so a
+      // repair's write and a CONSTRAINT body's write are told apart by the KERNEL and not here (§3.1 fact 3) —
+      // each appends to the leg list of the invocation it was made inside, and the kernel's repair arm is what
+      // reads the latter and not the former. **WITH NO INVOCATION BRACKET STANDING THE APPEND GOES NOWHERE**
+      // (`state.mjs`'s `appendRepairLeg`), which is a caller's own write and a direct `K-2` drive's store leg.
+      appendRepairLeg(record);
       // **THE INVOCATION WINDOW** (`docs/specs/storeroom-js/surface.md §2.7` item 2, `DD-22`): the record above is COMPLETE before the window
       // opens, the invocation is SYNCHRONOUS, it happens AFTER the addon's call returned, and **its ONE
       // argument is the TRIGGERING ADDRESS** (`PAR-JS-12`).
@@ -468,6 +479,16 @@ export function storeCreate(cfg) {
       // THE KERNEL TRIGGERS** — `record.pending`'s residue plus the checked-off identities — where the pass has
       // completed and the discard and the check-off have already decided what the set holds.
       //
+      // **⟶ RE-DERIVED 2026-11-01 — `D-104`: THAT RESIDUE GAINS A THIRD SOURCE, AND THIS SENTENCE ABOVE STANDS
+      // BYTE-FOR-BYTE AND IS READ THROUGH THIS CLAUSE** (`docs/L1/repair-listener-delivery.md` §4, §8's
+      // `js-surface` row; `strata/decisions.md` · `D-104` item `2`). The sentence above names the residue and the
+      // checked-off identities; **from this date a handle the commit's own write never returned may also stand in
+      // `record.pending`** — one that a REPAIR's write returned — because the kernel's repair arm MERGES a
+      // repair's write's triggered listeners into that member at its own seat, after the credit and before the
+      // re-run (`kernel-attempt.mjs`), de-duplicated by `handle` and never a pair's. **`triggered` IS UNMOVED**
+      // (it stays the store's own returned set for THIS write, VERBATIM) and **this frame moves no byte**: the one
+      // delivery, its one recipient snapshot and its one address are what they were.
+      //
       // **AND A WRITE WHOSE `commit` THE KERNEL DID NOT SUPPLY IS STILL DELIVERED HERE, AT ITS OWN POST-VERB
       // INSTANT** (`docs/specs/storeroom-js/surface.md §2.7` item 2): that is the `n <= 3` caller path never reaching this frame at all, so THIS
       // frame is reached only as the kernel's leg and its silence is total. **THE ONE INVOCATION PER DISTINCT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -41,11 +41,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.8.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.8.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.8.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.8.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.8.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.9.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.9.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.9.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.9.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.9.0"
   },
   "publishConfig": {
     "access": "public"