provident-storeroom 0.1.3 → 0.3.0

package/index.mjs

@@ -12,15 +12,24 @@
 // CONSTRUCTS THE CROSSING MODEL, HANDS IT TO THE ADDON'S `storeCreate`/`call` DISPATCH, AND MAPS THE
 // ADDON'S ANSWER BACK INTO JS VALUES.** **THE STORE'S OWN LOGIC IS THE RUST CORE'S**
 // (`bindings/js/src/crossing.rs`): the register tree, the anchors, the journal and its compaction, the
-// listener home and the prefix test, the file image and its boot, the fifteen-member fail set and its
+// listener home and the prefix test, the file image and its boot, the SIXTEEN-member fail set and its
 // generated messages are ALL reached through the facade, and NOTHING of them is re-implemented here.
 //
+// **⟶ RE-SPELLED 2026-10-15 BY THE GATE-4 FINDINGS PASS: THE FAIL SET'S FIGURE ON THE LINE ABOVE — the
+// as-filed *"the fifteen-member fail set"* — IS THE FILING-TIME PRINT AND IS READ THROUGH THIS CLAUSE.
+// THE OPERATIVE READING IS *"the SIXTEEN-member fail set"*, with `ConstraintListInvalid` at rank `16` and
+// `FileCommitFailed` at `15`, so `FileCommitFailed` is NOT the last member from that date
+// (`11 + 2 + 1 + 1 + 1 = 16` ✓).** The set is the store's own and is carried, never minted, here
+// (`docs/specs/storeroom-native/contract.md §8.1`'s dated clause of 2026-10-15, the ONE home of the set's
+// size; `§8.2` for the appended member's generated row; `src/error.rs`'s `CODES`, `[&'static str; 16]`,
+// with `ConstraintListInvalid` last; `bindings/js/index.d.ts`'s `StoreStatus`, the published spelling).
+//
 // **WHAT STAYS IN JS, AND WHY IT IS NOT STORE LOGIC** (`A75`: *"THE REGISTRY, THE OPAQUE HANDLE AND THE
 // SINGLE FAILURE FORM STAY IN JS (they are the PACKAGE's surface, `§2.4`)"*):
 //   * **THE PACKAGE'S OWN OPAQUE HANDLE** (`surface.md §2.3` item 2, `DD-14`): a frozen, memberless JS
 //     object whose token is private — the store's token crosses OUT of the addon and is wrapped here.
 //   * **THE PACKAGE'S OWN REGISTRY** (`surface.md §2.4`): the caller's FUNCTION, held per instance and
-//     reached through the ONE member `storeCreate` returns (`register(handle, listener)`). **The store
+//     reached through the member `storeCreate` returns (`register(handle, listener)`) — **⟶ RE-SPELLED 2026-10-16: the `ONE member` figure this line printed is the AS-FILED `surface.md §2.4` item 5 (a) reading, and the instance's OPERATIVE member set is `{ register, on, off, settle }`, FOUR OWN MEMBERS (`surface.md §2.7` item 8 AS AMENDED; `§2.11` clause 7; `docs/decisions.md` `A116` (D1)) — the registry being reached through each of them**. **The store
 //     returns handles and invokes nothing** (`A57`), so the invocation is the package's — performed after
 //     the addon's call has returned, with the triggering ADDRESS as its ONE argument (`PAR-JS-12`).
 //   * **THE SINGLE FAILURE FORM** (`surface.md §2.5`, `DD-12`): the addon THROWS the store's own
@@ -75,6 +84,59 @@ import { types } from 'node:util';
 const require_ = createRequire(import.meta.url);
 const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release', 'storeroom_js_binding.node');
 
+/**
+ * **THE PASS'S OWN CHECK-OFFS, CARRIED FROM THE KERNEL TO THE TERMINAL ARM'S DELIVERY UNDER A SYMBOL KEY
+ * (`docs/decisions.md` · `A117` (D5)–(D6); `surface.md §2.7` item 7's keying of 2026-10-15).**
+ *
+ * `§2.7` item 7 (a) delivers **THE RESIDUE** — *"the handle set that stands in `CommitRecord.pending` at
+ * that instant"* — and item 7's keying of 2026-10-15 fixes what the check-off consumed: *"the check-off
+ * consumes the evaluated pair's own delivery of that identity and NEVER that identity's whole owed
+ * delivery"*. **So the residue is one term of the arm's delivered set and the pass's own checked-off
+ * identities are a second**, and this key is how the kernel's finding reaches this file: the kernel
+ * records each identity its check-off took and publishes the list on the record AT ITS PASSING ARM, before
+ * it hands that record back to this instance's own `settle` member.
+ *
+ * **THE KEY IS A SYMBOL ON PURPOSE** (`A117` (D6)): **NO MEMBER IS ADDED** — `CommitRecord` keeps its four
+ * members and the record's enumerable shape does not move, so no census of a record's members changes and
+ * nothing of the named-shape set is widened. **AND THE ENTRY DOES NOT IMPORT THE KERNEL TO READ IT** — the
+ * same well-known symbol is declared on both sides, which is what keeps the entry's zero-dependency rule
+ * and `kernel-surface.md §1` item 1's one checkout home intact. **A RECORD CARRYING NO SUCH KEY** — a
+ * record this instance adopted from a caller, one from a session without the kernel, and the failing
+ * arm's own record — reaches the arm's residue term ALONE and behaves exactly as it behaved before.
+ */
+const CHECKED_OFF = Symbol.for('provident-storeroom.checked-off-at-the-terminal-arm');
+
+/// **⟶ ADDED 2026-10-15 (`surface.md §2.11` clauses 1–2; `contract.md §7.2` item 2 as amended) — THE PASSING
+/// ARM'S OWN MARK: THE SAME DEVICE AS `CHECKED_OFF` ABOVE, ONE CLAUSE EARLIER.**
+///
+/// **THE TERMINAL ARM'S OWN ACT IS SCOPED TO THE PASSING ARM ALONE** (clause 1: *"the `file` tier, the
+/// TERMINAL ARM and the PASSING ARM alone"*), **and the seam reaches ONE instant on BOTH arms**: a
+/// `file`-tier write whose pass FAILED arrives at this same delivery with its record in hand, and clause 1
+/// refuses it a save and a store call of its own — *"a failing arm drives no save"*. **THE ARM IS THE
+/// KERNEL'S OWN FACT** (`attempt-lifecycle.md §2.4` item 4), so the KERNEL marks the record it settled on
+/// its passing arm and the entry reads THAT MARK and nothing else — never a residue, never a member a
+/// caller may set, and never a second store call on the failing arm.
+///
+/// **THE KEY IS A SYMBOL ON PURPOSE, EXACTLY AS `CHECKED_OFF`'s IS** (`A117` (D6)): **NO MEMBER IS ADDED** —
+/// `CommitRecord` keeps its four members, `record.pending` stands exactly as the pass left it, and no
+/// census moves. **THE ENTRY DOES NOT IMPORT THE KERNEL TO READ IT**: the same well-known symbol is
+/// declared on both sides. **A RECORD CARRYING NO SUCH KEY** — a caller's own record, and the failing arm's
+/// own record — performs no save and behaves exactly as it behaved before.
+const SETTLED_ON_THE_PASSING_ARM = Symbol.for('provident-storeroom.settled-on-the-passing-arm');
+
+/// **⟶ ADDED 2026-10-15 — THE FAILED SAVE'S OWN MARK, THE SIBLING OF THE KEY ABOVE AND READ BY THE KERNEL'S
+/// OWN CATCH** (`docs/specs/storeroom-js/surface.md §2.11` clause 5; `kernel-surface.md §2.1` items 3–5).
+/// **`§2.11` clause 5's save IS A CONSTRAINT, EVALUATED LAST — SO A SAVE THAT FAILS IS REPORTED BY THE PASS
+/// THAT FAILED AND NOT BY THE PASSING ARM**: the failed save's own log gains the `outcome` entry, the
+/// terminal answer returns that closed record's FINAL log, and the report carries the rollback that
+/// actually happened (`§2.6` item 3). **THE ENTRY MINTS NO TOKEN AND CONVERTS NO FORM**: it tells the
+/// kernel WHICH ARM this is, on the record identity it was handed, by carrying THE VERY THROWABLE it
+/// rethrows — while the store's own two-member form crosses UNCHANGED. **IT IS A SYMBOL KEY ON PURPOSE**
+/// (`A117` (D6)): `CommitRecord` keeps its four members, `record.pending` stands exactly as the pass left
+/// it, and no census moves. **A RECORD CARRYING NO SUCH KEY** — every arm but the failed save — is
+/// untouched by it.
+const SAVE_FAILED_AT_THE_TERMINAL_ARM = Symbol.for('provident-storeroom.save-failed-at-the-terminal-arm');
+
 // ---------------------------------------------------------------------------------------------
 // THE RESOLUTION RULE — THREE RUNGS, IN ORDER, AND THE CLOSED KEY SET (`docs/specs/storeroom-publish/
 // resolution.md §2` · `§3`; `docs/specs/storeroom-publish/contract.md §1.1` · `§1.3` · `§1.5`).
@@ -371,14 +433,34 @@ function withAddon() {
 /// NOTHING on this path coerces the value: no `Number(...)`, no `String(...)`, no `valueOf`, no
 /// `Symbol.toPrimitive` and no trap is ever invoked, so no host `TypeError` can be raised from this frame
 /// in the first place.**
-function boundaryReject(status, subject, clause) {
+///
+/// **⟶ AND THE FAILING SEGMENT'S CONTAINER IS HANDED TO THE GENERATOR'S OWN `<container>` SLOT, ADDED
+/// 2026-10-17 (`§2.5` item 5 (a)–(b) AND ITS `CF-3` AUTHORITY SPLIT; `docs/specs/storeroom-native/contract.md`
+/// §8.2's `MessageArgs.container`, *"the container or node the mismatch was found in: `''` for the register,
+/// a dotted path otherwise"*).** **THE DEFECT IT CLOSES, NAMED: the two-slot route filled `segment` and
+/// `path` ALONE, so `container` took its default and PART ONE READ *"the number 1.5 is not a legal address
+/// segment in `''`"* — a FALSE container — while PART TWO appended *"in 'a'"* and the store's own bytes for
+/// that same input are `the number 1.5 is not a legal address segment in 'a'` (`src/store.rs`'s `listen`
+/// arm, whose container is the prefix `['a']`; `src/error.rs`'s `malformed_segment`).** **TWO CONTAINERS
+/// STOOD, ONE OF THEM FALSE; ONE STANDS NOW AND IT IS THE TRUE ONE.** **`container` is the failing
+/// segment's OWN PREFIX — the store's own `dotted_address` spelling of it — and `undefined` at every site
+/// that declares none, where the slot is left at its default and THE GENERATOR'S OWN BYTES ARE UNMOVED**
+/// (the two-argument `errorMessage(code, subject)` call included).
+function boundaryReject(status, subject, clause, container) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') {
     // An artefact that LOADED but does not carry the generator is not the declared artefact: the state is
     // the declared absent/failed-addon one, and its message is the generator's own rendering reproduced.
     fail({ status: 'FilePathUnreachable', message: generatorFilePathUnreachable(ADDON_PATH) });
   }
-  fail({ status, message: `${addon_.errorMessage(status, subject)}, ${clause}` });
+  // **THE CONTAINER IS THE PREFIX'S OWN DOTTED SPELLING AND NOTHING ELSE** (`src/error.rs`'s
+  // `dotted_address`: a key bare, an index bare, joined by `.`) — the same reading the store's own
+  // `malformed_segment` triggers take, where the container is the segment the mismatch was found in.
+  const where = container === undefined ? undefined : container.map((segment) => String(segment)).join('.');
+  const generated = where === undefined
+    ? addon_.errorMessage(status, subject)
+    : addon_.errorMessage(status, subject, where);
+  fail({ status, message: `${generated}, ${clause}` });
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -914,6 +996,129 @@ function encodeSegment(segment, position, argumentPosition) {
   return { bad: 'object' };
 }
 
+/// **A SEGMENT'S OWN CLASS OUTSIDE `PAR-JS-5`'s DOMAIN, DECIDED AT THE PACKAGE'S OWN BOUNDARY AND REFUSED
+/// `AddressMalformed` — THE OUTSIDE-VALUE CLASSIFICATION, TAKEN **BEFORE** THE STORE IS REACHED AND SO
+/// BEFORE ANY ABSENT-KEY LOOKUP** (`parameter-semantics.md §2.5` line `357`: *"**The declared answer for EACH
+/// outside value** — **`AddressMalformed` for every one of them, with the store's generated message**"*,
+/// the fourteen carrier-variant rows `crossing.md §1.3` names — *"an array holding a negative integer · an
+/// array holding a non-integer number · an array holding `null`/`undefined`/a boolean/an object/a nested
+/// array/a function"*).
+///
+/// **WHY THE DECISION STANDS HERE AND NOT AT THE STORE: a well-formed address no node holds is the store's
+/// own `AddressNotFound` (`a127-surface.test.mjs`'s F1 arm asserts that code at the ABSENT position), while
+/// a node HELD and a segment outside the domain must answer `AddressMalformed` — so the CLASS must be
+/// decided before the lookup rather than after it. The store's own walk decides it at `write` · `delete` ·
+/// `listen` (`src/args.rs`, `src/store.rs`); at the READER the carrier reaches the walk FIRST, which returns
+/// `AddressNotFound` for a held key. **The class is decided ONCE, at `encodeAddress`, for every verb alike**,
+/// so no verb's address position can answer a lookup's code for a class the row refuses.
+///
+/// **THE MESSAGE IS THE STORE'S GENERATED ONE AND NEVER AN AUTHORED ONE** (`boundaryReject` reaches the
+/// addon's `errorMessage`, `§2.5` item 2): the SUBJECT is the failing segment's own spelling as the store's
+/// generator renders it (`src/value.rs`'s `Segment::spelling`), and *"the integer `-1`"*, *"a shapeless
+/// value"*, *"a boolean"*, *"an array"* and *"a Proxy"* are that rendering carried here, not invented.
+/// **NOTHING IS COERCED** (`A76`/`JS-1`): the class is read with `typeof`, `Number.isInteger` and
+/// `Array.isArray` alone — no `String(segment)`, no `Number(segment)`, no `valueOf` and no trap — so a
+/// segment that is a `Proxy` is refused by `util.types.isProxy` and NO TRAP RUNS (`surface.md §2.4` item 7
+/// (a) item 1; `crossing.md §1.4` item 4; `C-1`).
+/// **THE CONTAINER IS NOW A PREFIX ARGUMENT AND NOT A SPELLED STRING, 2026-10-17** (`§2.5` item 5 (a)–(b)):
+/// the segments the failing one stood in are handed to `boundaryReject`, which passes the store's own
+/// `dotted_address` spelling of them into the generator's `<container>` slot, so **the container is stated
+/// ONCE and by the store's generator** — and PART TWO carries the reason's class-and-position half ALONE,
+/// which is the half `§2.5` item 5 (b) declares the boundary's own (*"the ARGUMENT POSITION … is carried
+/// INSIDE the generated message's own text"*) and is never a second container claim.
+function refuseOutsideSegment(segment, position, prefix, addressArgumentPosition) {
+  const kind = typeof segment;
+  let subject;
+  if (segment === null) subject = 'a shapeless value';
+  else if (kind === 'undefined') subject = 'an absent value';
+  else if (kind === 'boolean') subject = 'a boolean';
+  else if (kind === 'number') subject = Number.isInteger(segment) ? `the integer ${segment}` : `the number ${segment}`;
+  else if (kind === 'function') subject = 'a function';
+  else if (kind === 'symbol' || kind === 'bigint') subject = classSpelling(segment);
+  else if (Array.isArray(segment)) subject = 'an array';
+  else subject = 'an object'; // a `Proxy` over an array included: its class is `an object` to the carrier
+  boundaryReject(
+    'AddressMalformed', // `PAR-JS-5`'s own declared answer for every one of the fourteen rows, carried (`DD-40`)
+    subject,
+    addressArgumentPosition === undefined
+      ? `the address holds ${subject} at position ${position}, and a segment is a string or a non-negative integer`
+      : `the address holds ${subject} at position ${position} of the ${addressArgumentPosition}, and a segment is a string or a non-negative integer`,
+    prefix,
+  );
+  return { bad: 'object' }; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
+/// **`AddressArg` ROWS 5–6'S OUTSIDE SHAPE, DECIDED ON THE VALUE AS IT IS AND BEFORE ANY READ** (`A76`'s
+/// class-first order; `C-1`): everything that is neither an `Array` nor a `Proxy` is rows 5–6's outside
+/// value at the ADDRESS position — **and a `Proxy` is NOT this arm**: its own refusal stands above, where the
+/// class decision is taken on `util.types.isProxy` before any `.length` read and before any element
+/// (`surface.md §2.4` item 7 (a) item 1; `crossing.md` `AddressArg` row 12; `DD-34`), so no trap is run by
+/// THIS predicate either.
+function isOutsideAddressValue(value) {
+  if (value === undefined || value === null) return true; // row 5's two named classes, on the value as it is
+  if (types.isProxy(value)) return false; // row 12's own arm, decided above, with no trap run
+  if (Array.isArray(value)) return false; // rows 1–3, 13, 14 — the ordinary array arm and its own tests
+  return true; // rows 5–6: a string, a number, a boolean, an object, a function, a symbol, a bigint
+}
+
+/// **THE VALUE-SHAPE ARM OF `AddressArg` ROWS 5–6 — A NON-ARRAY OUTSIDE VALUE AT AN ADDRESS POSITION,
+/// REFUSED AT THE BOUNDARY WITH ITS OWN RENDERING AND THE ARGUMENT POSITION IT STANDS AT** (`surface.md`
+/// §2.5 item 5 (a)–(b); the `CF-3` authority split).
+///
+/// **THE DEFECT IT CLOSES, NAMED AS THE SUPERVISOR'S OWN RECORD NAMES IT** (`archive/reviews/
+/// 2026-10-16-constraints-publication-gate1.md` §57, finding `2`): at EVERY address position — `listen`,
+/// `read`, `write`, `delete`, `readLiteral` — a NON-ARRAY outside value (`'a.b'`, `7`, `null`, `undefined`)
+/// answered the store's GENERIC line *"the address argument is not a legal address segment in `''` …"*,
+/// **carrying the class half and NEITHER the failing TARGET NOR the argument POSITION** — while `§2.5` item 5
+/// (a) makes the failing target mandatory and item 5 (b) makes the ARGUMENT POSITION mandatory where the
+/// contract declares one (and a verb's argument position is the one place it does). **IT WAS HIDDEN UNTIL
+/// NOW because the older `register` subject carried both at a HANDLE position — a VALUE position, where a
+/// non-segment value is printed as its own value — and once the subject moved to an ADDRESS position the gap
+/// became visible.**
+///
+/// **WHAT IS DECLARED, AND WHAT THIS SITE THEREFORE DOES:**
+///   * **THE TARGET IS THE VALUE'S OWN RENDERING** (item 5 (a): *"a non-segment value PRINTED AS ITS OWN
+///     VALUE … where the failure is about a value and not about a segment"*), in the spelling the store's own
+///     generator and this package already give that value at every other site: `the number 7` · `the string
+///     'a.b'` · `null` · `undefined` — **and a class whose own value cannot be printed (a `bool` · a
+///     `function` · an `object` · a `Proxy`) is rendered by the store's own class spelling for it**, exactly
+///     as `refuseOutsideSegment` renders the same classes at a SEGMENT position.
+///   * **THE POSITION IS THE ARGUMENT POSITION** the verb's own signature declares (item 5 (b): *"the
+///     ARGUMENT POSITION for a verb's arguments"*) — `first argument` at all five verbs, whose `address` is
+///     the first position of each (`surface.md` §2.4 item 9 (f)'s table).
+///   * **AND THE CONTAINER IS THE ARGUMENT ITSELF AND NEVER THE EMPTY REGISTER.** **THE ONE DECISION THE
+///     CLAUSE DOES NOT PIN, STATED RATHER THAN GUESSED:** the store's `AddressMalformed` template always
+///     prints a container (`src/error.rs`, *"… in '{container}', …"*), and the store's own trigger for this
+///     state supplies the empty string (`malformed_address_argument`, whose rendering *"… in '', …"* names
+///     THE REGISTER). **THAT CONTAINER IS FALSE HERE** — a whole-address SHAPE failure is found in no
+///     container at all, the address argument never having resolved against the register — so the truthfully
+///     filled slot is the failing ARGUMENT's own name, `address`, which is the same reading the store's own
+///     `ConstraintListInvalid` row takes where the container is a KEY and not an address (`'constraints'`;
+///     `docs/specs/storeroom-native/contract.md` §8.2's row and its `<CONTAINERSEGMENT>` degenerate arm).
+///     **NO CLAUSE FIXES THIS WORDING: the clause fixes the TARGET, the CLASS and the POSITION, and the
+///     container is this site's own truth claim.** **PART TWO then carries the reason's class half and the
+///     position, appended after a separator, exactly as `boundaryReject` appends it at every other site.**
+function refuseOutsideAddressValue(address, addressArgumentPosition) {
+  const kind = typeof address;
+  let subject;
+  if (address === null) subject = 'null';
+  else if (kind === 'undefined') subject = 'undefined';
+  else if (kind === 'number') subject = `the number ${address}`;
+  else if (kind === 'string') subject = `the string '${address}'`;
+  else if (kind === 'boolean') subject = 'a boolean';
+  else if (kind === 'function') subject = 'a function';
+  else if (kind === 'symbol' || kind === 'bigint') subject = classSpelling(address);
+  else subject = 'an object'; // a `Proxy` over a plain object included: its class is `an object` to the carrier
+  // **THE CONTAINER SLOT CARRIES THE ARGUMENT'S OWN NAME AND NOT `''`** — see this site's own clause above.
+  boundaryReject(
+    'AddressMalformed', // `AddressArg` rows 5–6's own declared code, carried and never minted (`DD-40`)
+    subject,
+    `the address position holds ${subject} at the ${addressArgumentPosition}, and an address is an array of segments`,
+    ['address'],
+  );
+  return { k: 'A' }; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
 /// `crossing.md §1.3`'s `AddressArg` table, rows 1–14.
 ///
 /// **⟶ AND ONE OPTIONAL PARAMETER, ADDED 2026-10-11 BY THE `Q3` PASS, SO `on` CAN OBEY `A81` WITHOUT A
@@ -923,27 +1128,80 @@ function encodeSegment(segment, position, argumentPosition) {
 /// refuses at the BOUNDARY rather than carrying its class to the store. **EVERY OTHER CALLER PASSES
 /// NOTHING AND EVERY BYTE OF EVERY OTHER ARM IS UNMOVED**, so no verb's answer and no other site's message
 /// changes: the parameter is additive and its absence is the as-filed reading.
-function encodeAddress(address, addressArgumentPosition) {
+///
+/// **⟶ AND FROM 2026-10-17 A SECOND, SEPARATE POSITION PARAMETER GOVERNS `AddressArg` ROWS 5–6**
+/// (`§2.5` item 5 (a)–(b); see `refuseOutsideAddressValue` above): a NON-ARRAY outside value — a supplied
+/// `undefined`, a `null`, a string, a number, a boolean, an object, a function — is refused at the boundary
+/// at EVERY verb that declares an argument position, verbosely, carrying its own rendering and that position.
+///
+/// **WHY IT IS A SEPARATE PARAMETER AND NOT THE SAME ONE, STATED SO THE BLAST RADIUS IS EXACTLY ONE ARM:**
+/// `addressArgumentPosition` is the SEGMENT arm's (`rows 7–10`, and the `Proxy` and out-of-range arms) and it
+/// is passed by `listen` ALONE, so the segment arm's bytes at the other four verbs are UNMOVED — **THE
+/// INSTRUCTION IS THAT NO MESSAGE ALREADY CORRECT MOVES, and the supervisor's defect is the NON-ARRAY arm
+/// only.** `addressValuePosition` reaches the arms THIS PASS REPAIRS, and nothing else.
+/// **WHERE NO VALUE POSITION IS PASSED — the construction's `listeners[]` walk, which calls this encoder with
+/// one argument — EVERY BYTE IS UNMOVED and the store answers the construction itself** (`PAR-JS-21`; the
+/// construction's own answer is the store's, and no argument position is declared at that site).
+function encodeAddress(address, addressArgumentPosition, addressValuePosition) {
   // `crossing.md §1.3`'s absent-versus-`undefined` rule, rule 1: an argument position the call supplied no
   // value for is ABSENT, and `undefined` at a supplied position folds to that SAME state. `AddressArg` rows
   // 4 and 5 answer the one code, so no declared answer moves by the fold.
+  //
+  // **⟶ AND AT A SITE THAT DECLARES AN ARGUMENT POSITION, ROWS 5 AND 6 ARE ANSWERED HERE AND VERBOSELY**
+  // (`§2.5` item 5 (a)–(b); `refuseOutsideAddressValue`): a supplied `undefined`, a `null` and every
+  // non-array carry their OWN RENDERING and the POSITION instead of the store's generic argument-shaped line.
+  // **THE ARITY-ABSENT CALL IS NOT THIS ARM AND CHANGES NOTHING**: `undefined` reaches this encoder only
+  // from a call that SUPPLIED it (every caller passes `[encodeAddress(address)]` under its own `n >= 1`
+  // test), while the NO-ARGUMENT call reaches the store as its own carrier and answers there — which is
+  // `CF-3`'s part 5 unmoved (*"an absent CARRIER argument … crosses to the store as its own carrier value"*).
+  if (addressValuePosition !== undefined && isOutsideAddressValue(address)) {
+    refuseOutsideAddressValue(address, addressValuePosition);
+  }
   if (address === undefined) return { k: 'A' };
   if (address === null) return { k: 'N' };
-  // **`A76`/`JS-2`: THE CLASS DECISION COMES FIRST HERE TOO, ON THE ADDRESS AS IT IS.** A `Proxy` is
-  // refused BEFORE the array shape test and before any element is read (row 12, `DD-34`), and a class
-  // extending `Array` — for which `Array.isArray` is TRUE — is refused under its own declared class
-  // (`AddressArg` row 11's `AddressMalformed`: *"the shape is not an array"*) rather than ADMITTED as an
-  // address because a language predicate made it look like one.
-  if (types.isProxy(address)) return { k: 'X' }; // row 12 (`DD-34`)
+  // **`A76`/`JS-2`: THE CLASS DECISION COMES FIRST HERE TOO, ON THE ADDRESS AS IT IS — AND THE `Proxy`
+  // REFUSAL IS PART OF THAT DECISION AND NOT BESIDE IT** (`surface.md §2.4` item 7 (a) item 1: *"the `Proxy`
+  // refusal is part of that decision, not beside it … BEFORE the shape test, BEFORE `Array.isArray`, BEFORE
+  // any `.length` read and BEFORE any element is read"*). **`util.types.isProxy` READS NO MEMBER AND
+  // INVOKES NO HANDLER**, which is what makes the class decidable with NO TRAP RUN at both proxies-over-array
+  // and proxies-over-object (`crossing.md §1.4` item 4; `DD-34`; `C-1`). **AND `§2.5` item 5 (b) MAKES THE
+  // CLASS HALF MANDATORY**: the refusal's message carries `a Proxy` and the POSITION, so the class the value
+  // HAS is named rather than the store's own generic object arm; a class extending `Array` — for which
+  // `Array.isArray` is TRUE — is refused under its own declared class (`AddressArg` row 11's
+  // `AddressMalformed`: *"the shape is not an array"*) rather than ADMITTED because a language predicate made
+  // it look like one.
+  if (types.isProxy(address)) {
+    boundaryReject(
+      'AddressMalformed', // row 12's own declared code (`DD-34`), carried and never minted (`DD-40`)
+      classSpelling(address), // the class half, mandatory under item 5 (b): `a Proxy`
+      addressArgumentPosition === undefined
+        ? 'the address position holds a Proxy, and a Proxy over an array is refused as AddressArg row 12\'s own class with no trap run'
+        : `the address position of the ${addressArgumentPosition} holds a Proxy, and a Proxy over an array is refused as AddressArg row 12's own class with no trap run`,
+    );
+  }
   if (Array.isArray(address)) {
     if (arrayClass(address) === 'class') return { k: 'C' }; // row 11: a class extending `Array`
     for (let i = 0; i < address.length; i += 1) {
       if (!(i in address)) return { k: 'S' }; // row 14 (`DD-8`)
     }
-    return {
-      k: 'L',
-      s: address.map((segment, position) => encodeSegment(segment, position, addressArgumentPosition)),
-    }; // rows 1–3, 13
+    const segments = [];
+    for (let i = 0; i < address.length; i += 1) {
+      const segment = address[i];
+      const encoded = encodeSegment(segment, i, addressArgumentPosition);
+      // **`PAR-JS-5`: THE FOURTEEN ROWS' CLASS IS DECIDED HERE, BEFORE THE STORE AND BEFORE ANY LOOKUP**
+      // — a `{bad: …}` marker, a negative or non-integer number, a boolean, or a `Proxy` over an array.
+      const outsideMarker = encoded !== null && typeof encoded === 'object' && typeof encoded.bad === 'string';
+      const outsideNumber = typeof segment === 'number' && !(Number.isInteger(segment) && segment >= 0);
+      if (outsideMarker || typeof segment === 'boolean' || outsideNumber) {
+        // **AND THE PREFIX IS THE SEGMENTS THIS ONE STOOD IN AND NOTHING ELSE** — the container the
+        // store's own `malformed_segment` names at its `L-1` arm (the store's walk pushes each in-domain
+        // segment into its own container before it tests the next), so the refusal's container is the
+        // SAME datum at both layers and not a second spelling of it.
+        refuseOutsideSegment(segment, i, address.slice(0, i), addressArgumentPosition);
+      }
+      segments.push(encoded);
+    }
+    return { k: 'L', s: segments }; // rows 1–3, 13
   }
   if (typeof address === 'object') return { k: 'C' }; // rows 6 and 11: the shape is not an array's
   return { k: 'D', o: encodeSegment(address, 0) }; // row 6: a non-array's five named classes
@@ -951,11 +1209,20 @@ function encodeAddress(address, addressArgumentPosition) {
 
 /// `crossing.md §1.3`'s `TierArg` table and `TierSetItem` table.
 ///
-/// **THE TWO READERS AND THE TWO WRITERS ARE READ DIFFERENTLY, AND `§1.3` SAYS SO:** rule 1 reads a VERB's
-/// trailing argument BY CALL ARITY and folds a supplied `undefined` to the ABSENT row **for `read` ·
-/// `readLiteral` and `write`** — which is why `read(i, a, undefined)` answers the value while `read(i, a,
-/// null)` answers row 4 — **while `delete`'s `tier` is reached as a VALUE, and its own `null`/`undefined`
-/// row is row 4's `AddressMalformed`.**
+/// **A SUPPLIED `undefined` IS PRESENT AT THIS POSITION AND `delete`'s TIER IS REACHED AS A VALUE — THE ONE
+/// CALL THAT FOLDS TO THE ABSENT ROW IS THE CALL THAT SUPPLIED NOTHING THERE.** **⟶ ADJUDICATED 2026-10-16,
+/// AND THIS CLAUSE IS THE OPERATIVE READING OF THE BYTES BELOW** (`parameter-semantics.md §2.6`'s
+/// `PAR-JS-6` row, its `the declared answer for EACH outside value` cell as reconciled the same date, whose
+/// words are *"`a.read(address, undefined)` IS A SUPPLIED VALUE AT THIS POSITION AND TAKES `PAR-JS-6`'s
+/// DECLARED ANSWER — the store's own thrown `{status, message}` with `status` `AddressMalformed` — while the
+/// ONE CALL THAT FOLDS TO THE ABSENT ROW IS `a.read(address)`, WHICH SUPPLIED NOTHING THERE"*; the same
+/// adjudication stands at `acceptance.md §4.1` item `7`, whose *"folds to the ABSENT row"* is read through
+/// that row from that date). **SO `foldsUndefined` IS `false` AT EVERY SUPPLYING SITE — `read` ·
+/// `readLiteral` · `write` · `delete` — and the arity fold that reaches `{ k: 'A' }` is the NO-ARGUMENT CALL
+/// ALONE**, which is exactly what `supplied` carries: `n >= 2` at the readers and the writers, read off the
+/// METHOD's own call arity (`§2.12` item 3's one-spelling rule). **THE STORE'S OWN `TierArg::Undefined` ARM
+/// ANSWERS `AddressMalformed` AT ALL FOUR** (`src/args.rs`'s `read_tier_sel` and `write_tier`), so no code is
+/// minted here and the answer is the store's own.
 ///
 /// **AND `A76`'S CLASS ORDER IS TAKEN HERE FIRST (`JS-2`'s reach at this carrier):** a `Proxy` is refused
 /// as an OBJECT before any element is read from it — **so a throwing `get` trap cannot be raised, because
@@ -1089,8 +1356,92 @@ function encodeListeners(listeners) {
   });
 }
 
-/// `surface.md §2.1` / `DD-36`: `cfg` carries the store's THREE declared keys and no fourth. **Each key's
-/// own ABSENCE is the member's own absence** — `crossing.md §1.3`'s absent-versus-`undefined` rule reads a
+/// **⟶ ADDED 2026-10-15 (`parameter-semantics.md §2.21`; `surface.md §2.1`'s `cfg` block dated 2026-10-15;
+/// `contract.md §8.1` #16) — THE CONSTRUCTION'S FOURTH DECLARED KEY, `constraints`: THE LIST'S OWN WALK.**
+///
+/// **THE CLASS DECISION IS TAKEN FIRST, ON THE VALUE AS IT IS, AND NO COERCION IS PERFORMED ANYWHERE
+/// HERE** (`A76`'s part (1)): a `Proxy`, a class extending `Array` and every non-array is the LIST's own
+/// outside form and is carried as one; a plain array is walked element by element; **and ONE ELEMENT
+/// OUTSIDE THE `{ address, id }` PAIR'S SHAPE crosses as THE FAILING ENTRY'S OWN `<SEGMENT>` SPELLING**
+/// (`§8.2`'s row: *"the failing ENTRY's `address` spelling, joined by `/` … or the element's own position
+/// printed bare where the failing element carries no address at all"*). **THE CODE AND THE MESSAGE STAY THE
+/// STORE'S** (`§8.1` #16, `DD-40`): nothing here mints a status and nothing here authors a sentence.
+function encodeConstraints(constraints) {
+  if (constraints === undefined) return undefined;
+  if (constraints === null) return null;
+  if (types.isProxy(constraints)) return { bad: 'non-array' }; // `DD-34`'s class order, taken first
+  if (!Array.isArray(constraints)) return { bad: 'non-array' };
+  if (arrayClass(constraints) === 'class') return { bad: 'non-array' };
+  return constraints.map((entry, position) => constraintEntry(entry, position));
+}
+
+/// ONE `constraints[]` ELEMENT: the closed `{ address, id }` pair, or the element's own `<SEGMENT>`
+/// spelling (`§8.2`). **AN ELEMENT THAT IS NOT A PLAIN OBJECT — an array, a `Proxy`, a class instance and
+/// every non-object included — CARRIES NO ADDRESS AT ALL**, so its slot is the element's own POSITION
+/// printed bare.
+function constraintEntry(entry, position) {
+  const where = `the constraint entry at position ${position}`;
+  if (!isPlainObjectValue(entry)) return { bad: 'element', subject: where };
+  if (!Object.hasOwn(entry, 'address') || entry.address === undefined) {
+    return { bad: 'element', subject: where };
+  }
+  const address = constraintAddress(entry.address);
+  if (typeof address === 'string') return { bad: 'element', subject: address };
+  // AN ELEMENT CARRYING NO `id` AT ALL IS THE SAME OUTSIDE FORM AS ONE WHOSE `id` IS NOT A STRING: the
+  // `<SEGMENT>` slot prints the entry's own `address` spelling and the `<KEYLIST>`'s members are the
+  // entry's own, read by the store's generator and never here.
+  if (
+    !Object.hasOwn(entry, 'id')
+    || entry.id === undefined
+    || typeof entry.id !== 'string'
+    || entry.id === ''
+  ) {
+    return { bad: 'element', subject: spellConstraintAddress(address.s) };
+  }
+  return { address, id: entry.id };
+}
+
+/// `§1.5`'s segment array as the carrier `encodeAddress` declares it — **or, where the value lies outside
+/// that domain, the failing ELEMENT's own `address` spelling as a STRING** (`§8.2`'s `<SEGMENT>` slot: a
+/// string key single-quoted, an integer index bare, joined by `/`).
+function constraintAddress(address) {
+  if (types.isProxy(address) || !Array.isArray(address) || arrayClass(address) === 'class') {
+    return `'${valueTargetSpelling(address)}'`;
+  }
+  const segments = [];
+  for (let i = 0; i < address.length; i += 1) {
+    if (!(i in address)) {
+      return `${spellConstraintAddress(segments)} and no segment at position ${i}`;
+    }
+    const segment = address[i];
+    if (typeof segment === 'string' && !hasLoneSurrogate(segment)) {
+      segments.push(segment);
+    } else if (typeof segment === 'number' && Number.isInteger(segment) && segment >= 0
+      && Number.isSafeInteger(segment)) {
+      segments.push(segment);
+    } else {
+      return `${spellConstraintAddress(segments)} and ${classSpelling(segment)} at position ${i}`;
+    }
+  }
+  return { k: 'L', s: segments };
+}
+
+/// `§8.2`'s whole-address spelling: **a string key SINGLE-QUOTED (`'a'`) and an integer index BARE (`0`),
+/// JOINED BY `/`** — the same spelling the store's own generator prints at its `<SEGMENT>` slot.
+function spellConstraintAddress(segments) {
+  return segments
+    .map((segment) => (typeof segment === 'string' ? `'${segment}'` : String(segment)))
+    .join('/');
+}
+
+/// `surface.md §2.1` / `DD-36`: the as-filed *"`cfg` carries the store's THREE declared keys and no
+/// fourth"* is read THROUGH this clause and is **the FOUR declared keys and no FIFTH** — `filePath` ·
+/// `journalLength` · `listeners` · `constraints` (`surface.md §2.1`'s `cfg` block dated 2026-10-15 and its
+/// dated clause of 2026-10-16; `parameter-semantics.md §2.21` = `PAR-JS-21`) — **and a CALLER-SUPPLIED key
+/// beyond those four is IGNORED, never refused: no code, no refusal and no member moved** (`§2.1`'s dated
+/// clause of 2026-10-16, `contract.md §7.1`'s third-key row governing the caller's key; `§8.1`'s
+/// complement). **Each key's own ABSENCE is the member's own absence** — `crossing.md §1.3`'s
+/// absent-versus-`undefined` rule reads a
 /// `cfg` key by MEMBERSHIP and never by arity, and **`A76`/`JS-5` fixes that membership as OWNERSHIP:
 /// `Object.hasOwn` and never `in`, which walks the prototype chain.**
 ///
@@ -1107,15 +1458,21 @@ function encodeListeners(listeners) {
 function encodeConfig(cfg) {
   if (!isPlainObjectValue(cfg)) {
     boundaryReject(
-      'AddressMalformed', // `PAR-JS-1`'s declared answer for every outside form of `cfg`, carried
+      'AddressMalformed', // `PAR-JS-1`'s declared answer for every outside form of `cfg`, carried — **AND THE MESSAGE BELOW IS RE-SPELLED IN PLACE, 2026-10-16: *"carrying the store's three declared keys"* READS *"carrying the store's four declared keys"*, THE COUNT ALONE MOVING, because the set is `filePath` · `journalLength` · `listeners` · `constraints` (`§2.1`'s `cfg` block and dated clause, both of 2026-10-15), because the sentence's subject is the `cfg` CARRIER CLASS and NEVER a caller obligation (a CALLER-SUPPLIED key BEYOND the four is still IGNORED and never refused, `contract.md §7.1` — no semantics and no refusal path moves with the word), and because NOTHING PINNED THE OLD WORDING: no clause of `docs/specs/**` declares this message's figure and no test reads it — the drives read the TARGET `cfg` and the CLASS that failed (`negative-generators.test.mjs` · `registry.test.mjs`) — so it was ordinary prose written when the count was three and NOT a clause's own byte.**
       'cfg',
-      `the construction's cfg is ${classSpelling(cfg)}, and cfg is one plain object carrying the store's three declared keys`,
+      `the construction's cfg is ${classSpelling(cfg)}, and cfg is one plain object carrying the store's four declared keys`,
     );
   }
   const out = {};
   if (Object.hasOwn(cfg, 'filePath')) out.filePath = encodeFilePath(cfg.filePath);
   if (Object.hasOwn(cfg, 'journalLength')) out.journalLength = encodeJournalLength(cfg.journalLength);
   if (Object.hasOwn(cfg, 'listeners')) out.listeners = encodeListeners(cfg.listeners);
+  // **⟶ THE FOURTH DECLARED KEY** (`§2.21`; `§2.1`'s `cfg` block dated 2026-10-15): `constraints` passes
+  // through by the SAME membership rule the three above take, so a key the caller did not supply is
+  // ABSENT and a key the caller supplied as `undefined` is the key's own outside form. **A key BEYOND the
+  // four is IGNORED and produces no code** (`§8.1`'s complement), and no default, no rename and no fifth
+  // key is added here (`DD-36`).
+  if (Object.hasOwn(cfg, 'constraints')) out.constraints = encodeConstraints(cfg.constraints);
   return out;
 }
 
@@ -1190,7 +1547,7 @@ function decodeJournalOp(encoded) {
 // THE PACKAGE'S OWN SURFACE — the opaque handle (`§2.3` item 2) and the per-instance registry (`§2.4`)
 // ---------------------------------------------------------------------------------------------
 /// **THE PACKAGE'S OWN INSTANCE HANDLE'S STATE**, keyed by the instance the factory returned. The handle
-/// itself carries EXACTLY ONE member, `register` (`surface.md §2.4` item 5 (a)).
+/// itself carries EXACTLY ONE member, `register` (`surface.md §2.4` item 5 (a)) — **⟶ RE-SPELLED 2026-10-16: THAT ONE-MEMBER FIGURE IS THE AS-FILED READING AND IS SUPERSEDED AS A MEMBER-SET FIGURE — the instance's OPERATIVE member set is `{ register, on, off, settle }`, FOUR OWN MEMBERS AND NOTHING ELSE (`surface.md §2.7` item 8 AS AMENDED, where the as-filed `{register, on, off}` reads `{register, on, off, settle}`; `§2.11` clause 7; `docs/decisions.md` `A116` (D1)) — while the WeakMap below is still keyed by the INSTANCE alone and no member is added to it by this clause.**
 const INSTANCES = new WeakMap(); // instance -> {id, tokens: Map(handle -> token)}
 
 function wrapHandles(state, tokens) {
@@ -1287,14 +1644,17 @@ function writeCall(state, args, fault) {
 // (`A63`), no `exists` verb exists (`§2.9` item 3) and no release verb is declared (`A74`).
 // ---------------------------------------------------------------------------------------------
 
-/// `§2.1`: `storeCreate(cfg)` takes ONE plain object carrying the store's THREE declared keys, passes them
-/// through WITHOUT adding a default, a rename or a fourth key (`DD-36`), and **never returns a partial
-/// instance** — it throws the single failure form instead. **⟶ `§2.1`'s dated clause (a), LANDED 2026-10-11
+/// `§2.1`: `storeCreate(cfg)` takes ONE plain object carrying the store's FOUR declared keys, passes them
+/// through WITHOUT adding a default, a rename or a fifth key (`DD-36`) — **the as-filed *"THREE declared
+/// keys … a fourth key"* is read THROUGH this re-spelling, at `§2.1`'s `cfg` block dated 2026-10-15 and its
+/// dated clause of 2026-10-16, and a CALLER-SUPPLIED key beyond the four is IGNORED, never refused
+/// (`contract.md §7.1`; `§8.1`'s complement)** — and **never returns a partial instance** — it throws the
+/// single failure form instead. **⟶ `§2.1`'s dated clause (a), LANDED 2026-10-11
 /// BY THE `Q1` CONTRACT AMENDMENT, RE-DERIVES THE MEMBER FIGURE THIS SENTENCE CARRIED: *"the object it
 /// returns carries EXACTLY the one own member `surface.md §2.4` item 5 (a) declares, and not one member
 /// beside it"* STANDS BYTE-FOR-BYTE ABOVE AND IS READ THROUGH THIS CLAUSE — from this date the member set
-/// is `{ register, on, off }`, THREE OWN MEMBERS AND NOTHING ELSE, and `§2.4` item 5 (a)'s *"one own
-/// member"* is superseded AS A MEMBER-SET FIGURE at its own `§` by the same amendment.** **THE MODULE
+/// is `{ register, on, off }`, THREE OWN MEMBERS AND NOTHING ELSE — **⟶ AND THAT FIGURE IS RE-SPELLED IN PLACE, 2026-10-16 BY THE FILE-TIER-SAVE COMMENT PASS: *"THREE OWN MEMBERS"* IS THE 2026-10-11 FIGURE OF THE CLAUSE ABOVE AND NOT THE OPERATIVE ONE, WHICH IS `{ register, on, off, settle }`, FOUR OWN MEMBERS AND NOTHING ELSE** — the fourth being the `A116` ORDERING SEAM, the ONE member the KERNEL calls and the entry implements (`docs/decisions.md` `A116` (D1): the set *"opens by ONE clause"* to carry it; (D3): the lift is NARROW, so NO FIFTH member; its own home is `surface.md §2.4` item 9, and a CALLER's addressable sub-surface stays the three there declared), the count read at `surface.md §2.7` item 8 AS AMENDED (the as-filed `{register, on, off}` there is *"SUPERSEDED AS FIGURES"* and reads `{register, on, off, settle}`), at `§2.11` clause 7, and by the live battery's `FTS-12.1`, whose members are exactly those four. And `§2.4` item 5 (a)'s *"one own
+/// member"* is superseded AS A MEMBER-SET FIGURE at its own `§` by the same amendment (`surface.md §2.11` clause 7: *"the instance's member set stays `{ register, on, off, settle }`"*).** **THE MODULE
 /// NAMESPACE IS UNMOVED at the eight declared verbs: neither new member is a named export, because both
 /// are reached through THIS factory's own product and through nothing else** (`surface.md §2.1`'s dated
 /// clauses (a)–(b); `A79`).
@@ -1314,70 +1674,313 @@ export function storeCreate(cfg) {
   // (rule 2, never a fan-out). **⟶ AND `off` — the ONE declared member that DOES remove an entry —
   // removes THE ONE THE HANDLE NAMES** (`§2.4` item 7 (b); `DD-53`), while the instance's own state is
   // still released with the instance and by nothing else (`DD-17`; `A74`: `off` is not a release verb).
-  const state = { id, tokens: new Map(), registry: new Map() };
+  // **`withheld` IS THE WRITE-IN-FLIGHT SET** (`§2.4` item 9's instant (a)): the record identities this
+  // instance has adopted as kernel-driven writes, whose post-verb invocation this instance withholds.
+  // It holds IDENTITIES and no function, no handle and no address.
+  // **`constraints` IS THE ENTRY'S OWN REGISTRY OF THE PAIRS IT CARRIES** (`surface.md §2.12` item 1's
+  // preamble clause (a)–(b)): keyed by `(address, id)`, holding the pair's element, its state and ITS
+  // address's own spelling — the three things `PAR-JS-24`, `§2.12` item 3's toggles and the write path's
+  // carriage rule read. **IT IS POPULATED BY THE ONE ACT BOTH ROUTES REACH AND BY NOTHING ELSE**
+  // (`carryConstraint` below), and **`leg` IS THE SLOT THE NESTED FIVE-POSITION CALL THE KERNEL'S STORE
+  // LEG MAKES LEAVES ITS OWN RETURNED RECORD IN**, so that a kernel-driven write answers the record its
+  // own write returned rather than a copy of it (`§2.12` item 1's stage 2).
+  const state = { id, tokens: new Map(), home: [], registry: new Map(), withheld: new Set(), adopted: new Set(), answered: new Map(), delivered: new WeakSet(), constraints: new Map(), leg: null };
+  // **TWO STRUCTURES CARRY THE ADOPTION** (`§2.4` item 9 (a)–(b)): `adopted` holds the record identities
+  // whose own write verb has NOT YET ANSWERED — the identity a write in flight is keyed by, and the one
+  // identity per write the entry's own verb consumes — and `answered` is THE LEDGER, mapping each adopted
+  // identity to THE IDENTITY THE WRITE ITSELF RETURNED, which is the identity the terminal arm reads the
+  // residue off (`record.pending`, the member `K-2` fills from its own verb's returned set and the member
+  // the pass checks entries off in as they pass). **BOTH ARE EMPTIED BY THE TERMINAL ARM**: a pass that
+  // reaches its terminal instant is the only writer either structure has.
   const instance = {
-    /// `surface.md §2.4` item 7 (a) / `§2.1`'s dated clause (a): **`on(address, listener) -> handle`** — the
-    /// combined call `A79` adopts, whose clauses are `§2.4` item 7 (a) and whose order is FIXED there.
-    /// **IT IS NOT A NINTH NAMED EXPORT OF THE ENTRY** (`package.md §1.3` item 3): it is reached through the
-    /// factory's own product alone.
-    on(address, listener) {
-      return onAt(state, instance, address, listener);
+    /// **`surface.md §2.4` item 9 (f)'s `A127` clause — THE PRODUCT'S DECLARED MEMBER SET IS TWELVE OWN
+    /// MEMBERS, `10 + 1 + 1 = 12` ✓: THE TEN METHODS, `register` AND `settle`.** Each is reached through
+    /// THIS factory's own product alone (`package.md §1.3` item 3): the module namespace carries ONE name,
+    /// `storeCreate` (`§2.9` item 1's `A127` clause; `11 → 1` ✓, and *"a deprecation window"* is declared
+    /// away at that clause on `A128`'s fiat), so NO member below is a named export and the ten
+    /// store-reaching names have no second spelling at any layer.
+    /// **THE STATE STAYS PRIVATE** (`§2.1` (e) item 1): `state` below is this factory's own closure and is
+    /// keyed in `INSTANCES` — NO own member is store data, a record, a Map, a Set, a tier, an address, a
+    /// handle or a commit, and the twelve members above are the whole of what a caller sees.
+    /// **`on` AND `off` ARE MERGED AWAY AND ARE NOT MEMBERS** (`A127`): the listener registration route is
+    /// `listen` + `register` and its withdrawal is `unlisten`, exactly as the seven store-reaching methods
+    /// and `register` below spell them.
+    read(address, tier) {
+      return read(instance, arguments.length, address, tier);
     },
-    /// `surface.md §2.4` item 7 (b) / `§2.1`'s dated clause (a): **`off(handle) -> undefined`** — the
-    /// store-side withdrawal AND the PACKAGE'S OWN registry removal, on the one order `DD-54` declares.
-    /// **It is NOT a ninth named export of the entry** (`package.md §1.3` item 3).
-    off(handle) {
-      return offAt(state, instance, handle);
+    readLiteral(address, tier) {
+      return readLiteral(instance, arguments.length, address, tier);
+    },
+    write(address, tier, value, commit) {
+      return write(instance, arguments.length, address, tier, value, commit);
+    },
+    delete(address, tier) {
+      return deleteOp(instance, arguments.length, address, tier);
+    },
+    rollback(opId) {
+      return rollback(instance, arguments.length, opId);
+    },
+    listen(address) {
+      return listen(instance, arguments.length, address);
+    },
+    unlisten(handle) {
+      return unlisten(instance, arguments.length, handle);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.addConstraint(pair, constraint) -> constraint identity`** — the
+    /// ADD route, which carries the function and OVERWRITES at a pair the entry already holds.
+    addConstraint(pair, constraint) {
+      return addConstraint(instance, arguments.length, pair, constraint);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.constraintOn(pair, constraint) -> undefined`** — the ENABLE half.
+    constraintOn(pair, constraint) {
+      return constraintToggle(true, instance, arguments.length, pair, constraint);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.constraintOff(pair, constraint) -> undefined`** — the DISABLE half.
+    constraintOff(pair, constraint) {
+      return constraintToggle(false, instance, arguments.length, pair, constraint);
     },
     /// `surface.md §2.4` item 5 (b): `register(handle, listener) -> undefined` — the OPAQUE handle a verb
-    /// returned or the construction adopted, and ANY JS function. **It is NOT a ninth named export of the
-    /// entry** (`package.md §1.3` item 3): it is reached through the factory's own product alone.
+    /// returned or the construction adopted, and ANY JS function. **It is NOT a named export of the entry**
+    /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
     register(handle, listener) {
       return registerOn(state, handle, listener);
     },
+    /// `surface.md §2.4` item 9 / `§2.1`'s dated clause (a): **`settle(record) -> undefined`** — THE
+    /// ORDERING SEAM, the one member the kernel calls and the entry implements, at the two instants of a
+    /// kernel-driven write (`A116` (D1)–(D2)). **It is NOT a named export of the entry**
+    /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
+    settle(record) {
+      return settleOn(state, record, arguments.length >= 1);
+    },
   };
   INSTANCES.set(instance, state);
+  // **⟶ `§2.12` ITEM 1 CLAUSE (b): `storeCreate` REGISTERS EACH OF `cfg.constraints`' ELEMENTS THAT CARRIES
+  // ITS OWN FUNCTION AT `K-1`, AT THE INSTANCE IT IS CONSTRUCTING** — the SAME call the ADD route makes, so
+  // a batch-populated pair is a pair the entry carries on the same footing (`§2.12` item 3's preamble clause
+  // (a)). **A WELL-FORMED PAIR CARRYING NO FUNCTION IS NOT AN ELEMENT AND IS NOT REGISTERED**: it is read at
+  // the store's two validation instants (`PAR-JS-21`) and by nothing here.
+  if (isPlainObjectValue(cfg) && isAdmittedArray(cfg.constraints)) {
+    const list = cfg.constraints;
+    for (let i = 0; i < list.length; i += 1) {
+      const element = list[i];
+      const encoded = constraintEntry(element, i);
+      if (encoded.bad !== undefined) continue;
+      if (typeof element.constraint !== 'function') continue;
+      carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+    }
+  }
+  // **⟶ AND THE CONSTRUCTION'S OWN ADOPTION ENTERS THE PACKAGE'S HOME MIRROR** (`§2.4` item 7 (b)'s dated
+  // narrowing reads TWO lawful duplicate states, and the ONE-ADDRESS one is `DD-39`'s CONSTRUCTION duplicate;
+  // `src/store.rs`'s own `adopt` keeps BOTH entries under one address and pushes the token's index entry for
+  // each). **THE MIRROR IS THE HOME'S OWN SHAPE AND NOT A SECOND DECISION**: an accepted entry's handle is
+  // adopted VERBATIM, in the caller's own spelling order ACROSS addresses and the bucket's own order WITHIN
+  // one — which is the order `DD-42` clause (2)'s *"FIRST match"* is defined by. **A REJECTED ARRAY ADMITS
+  // NOTHING** (`src/args.rs`), so a listeners list the store refused never reaches `storeCreate`'s return and
+  // no mirror entry is written for it.
+  //
+  // **⟶ AND ONE ENTRY IS PUSHED PER ADOPTED ELEMENT, WITH NO `some(key)` TEST HERE — CORRECTED 2026-10-17**
+  // (`§2.4` item 7 (a) item 3; rules 1, 3 and 4 with `DD-39`'s *"both entries are KEPT"*): the store's own
+  // population calls `adopt` for EVERY admitted element, and two elements at ONE address stay TWO store
+  // entries (`src/store.rs`'s bucket, whose `first_at` answers the bucket's FIRST). **SO A PER-KEY DEDUPE
+  // HERE WOULD BE A SECOND DECISION THE STORE NEVER TAKES and the mirror would hold fewer entries than the
+  // home** — the `-1` absence route below is what that divergence breaks. **THE PREDICATE IS THE ONE THE
+  // STORE'S OWN ADMISSION AGREES WITH** (`isLawfulListenerElement`): a `cfg.listeners` array that reached
+  // this line was admitted WHOLE by `encodeListeners`, the facade and `src/args.rs`, so a lawful element is
+  // pushed and the two sides' element counts are the same number.
+  if (isPlainObjectValue(cfg) && isAdmittedArray(cfg.listeners) && arrayClass(cfg.listeners) !== 'class') {
+    for (const entry of cfg.listeners) {
+      if (!isLawfulListenerElement(entry)) continue;
+      state.home.push({ key: homeAddressKey(entry.address), token: entry.handle });
+    }
+  }
   return instance;
 }
 
+/// **`§2.4` ITEM 9 (f)'S `A127` CLAUSE — THE TEN STORE-REACHING NAMES ARE THE PRODUCT'S OWN METHODS AND
+/// THE MODULE NAMESPACE CARRIES ONE NAME.** Every function below is the BODY of one of those methods and is
+/// no longer a named export (`§2.9` item 1's `A127` clause; `11 → 1` ✓, no deprecation window and no second
+/// spelling — `A128`). **`n` IS THE RECEIVER'S OWN CALL ARITY** (`arguments.length` at the method), because
+/// the LEADING `instance` POSITION IS DROPPED (`§2.12` item 3's one-spelling rule): the arity folds that
+/// were written against `n_old` are read here against `n_old − 1` and nothing else moves.
+
 /** `§2.2`: `read` — a leaf's literal, a branch's assembled value, the empty address's whole register. */
-export function read(instance, address, tier) {
+function read(instance, n, address, tier) {
   const state = stateOf(instance);
   // A position the call supplied no value for is handed as the runtime's own `undefined` — NEVER as an
   // absent array slot — so the facade can tell an unsupplied position from a supplied `undefined` and the
   // core is never reached with a null pointer (`crossing.md §1.3`'s absent-versus-`undefined` rule).
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  args.push(encodeTier(tier, arguments.length >= 3, true));
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+  // `PAR-JS-6`: a SUPPLIED `undefined` at this position is PRESENT and takes the row's own
+  // `AddressMalformed`; the NO-ARGUMENT call is the one that folds to the ABSENT row.
+  args.push(encodeTier(tier, n >= 2, false));
   return decodeValue(call(state, 'read', args));
 }
 
 /** `§2.2` / `§2.9` item 2: `readLiteral` narrows the read to a leaf and answers `ReadTargetIsBranch`. */
-export function readLiteral(instance, address, tier) {
+function readLiteral(instance, n, address, tier) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  args.push(encodeTier(tier, arguments.length >= 3, true));
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+  args.push(encodeTier(tier, n >= 2, false));
   return decodeValue(call(state, 'readLiteral', args));
 }
 
 /// `PAR-JS-13`: the returned record is `{op, watched, triggered}` — fresh on every call, never a view.
-export function write(instance, address, tier, value) {
+///
+/// **⟶ AMENDED 2026-10-15 (`surface.md §2.2`'s dated clause of 2026-10-15; `parameter-semantics.md §2.20`):
+/// THE DECLARED ORDER IS `write(instance, address, tier, value, commit?)`** — FOUR REQUIRED ARGUMENTS AND
+/// THE OPTIONAL ONE AT POSITION FIVE (`proposal-review.md §22.5` item 5). **THE PACKAGE ADDS NO ARITY
+/// CHECK, NO DEFAULT AND NO VALIDATION OF ITS OWN AT THIS POSITION** (§2.2 clause 3): an ABSENT `commit` is
+/// IN DOMAIN — *"the write opens or joins a commit all the same"* — and **no default record is fabricated
+/// for it.**
+///
+/// **THE FIFTH POSITION'S CLASS TEST IS `§2.4` ITEM 9 (g) ITEM 1's OWN** — *"an object position is a record
+/// position only where it CARRIES A `pending` MEMBER whose value is present and not `undefined`"* — **and
+/// ITS ANSWER IS ONE INSTANCE OF ONE CLASS, `TypeError`, whose `status` MEMBER IS ABSENT and whose string
+/// `message` member is required** (`§2.20`'s answer cell; the same refusal `settleOn` takes at the record
+/// position). **A REFUSED POSITION STOPS THE WRITE**: no store call is reached, so no version lands and no
+/// byte moves. **IT IS A CLASS TEST AND NEVER AN IDENTITY TEST** — no clause reads the caller's history
+/// here.
+function commitPositionRefusal(commit) {
+  if (commit !== null && typeof commit === 'object') {
+    // **A `Proxy` IS OUTSIDE THE POSITION'S DOMAIN** (`§2.20`'s outside-value row) and is refused BEFORE a
+    // member is read from it, so a `get` trap is never raised — the class order `encodeAddress` and
+    // `encodeTier` already take at their own carriers (`A76`/`JS-2`).
+    if (!types.isProxy(commit) && !Array.isArray(commit)) {
+      let pending;
+      try {
+        pending = commit.pending;
+      } catch {
+        pending = undefined; // the guarded read `JS-1` declares: catch, then classify
+      }
+      if (Object.hasOwn(commit, 'pending') && pending !== undefined) return null;
+    }
+  }
+  return new TypeError(
+    `the write's fifth argument is ${classSpelling(commit)}, and the commit position takes an object `
+    + 'carrying a `pending` member',
+  );
+}
+
+function write(instance, n, address, tier, value, commit) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  args.push(encodeTier(tier, arguments.length >= 3, true));
-  // THE WALK'S OWN FAULT RECORD — see `refusedValue`: the walk CLASSIFIES and RECORDS, and the record is
-  // read at the one site where the store answered `ValueNotAdmitted` for a value the walk refused.
-  const fault = { found: null, value: undefined, path: [] };
-  args.push(encodeValue(value, [], 0, [], fault));
-  const answer = writeCall(state, args, fault);
+  // **⟶ `§2.12` ITEM 1, STAGE 1: A `write` CALLED WITH FOUR POSITIONS — `write(instance, address, tier,
+  // value)` — ENTERS THE KERNEL'S `K-2`**, where this instance carries a constraint at this write's
+  // address; the kernel's pass then evaluates every pair registered at that address and the two arms of
+  // `§2.12` item 1's fail arm are taken by the kernel's own acts. **A CARRYING ADDRESS IS THE WHOLE OF THIS
+  // GATE: an instance that carries no pair at this address takes the path this verb has always taken, and a
+  // FIVE-POSITION CALL IS THE KERNEL'S OWN STORE LEG AND NEVER ENTERS `K-2`** — item 1's stage 4 no-recursion
+  // clause: *"a five-position call can never start a second pass — and the call that carries an ADOPTED
+  // identity is item 3's own, so there is no recursion and need not be one"*.
+  if (n <= 3 && carriesConstraintAt(state, address)) {
+    return constraintWrite(state, instance, address, tier, value);
+  }
+  let answer;
+  try {
+    // **THE CLASS TEST IS TAKEN BEFORE THE WALK AND BEFORE THE VERB** (`§2.4` item 9 (g) item 1): the
+    // refused position leaves no landing, so the same release the catch block below performs is taken for
+    // an adoption this refusal left unrun (`§2.4` item 9's table row (a) read with `§2.7` item 8).
+    if (n >= 4) {
+      const refusal = commitPositionRefusal(commit);
+      if (refusal !== null) throw refusal;
+    }
+    const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+    // `PAR-JS-7`: `write`'s tier is REQUIRED — an ABSENT position and a SUPPLIED `undefined` both answer
+    // `AddressMalformed`, and neither folds.
+    args.push(encodeTier(tier, n >= 2, false));
+    // THE WALK'S OWN FAULT RECORD — see `refusedValue`: the walk CLASSIFIES and RECORDS, and the record is
+    // read at the one site where the store answered `ValueNotAdmitted` for a value the walk refused.
+    const fault = { found: null, value: undefined, path: [] };
+    args.push(encodeValue(value, [], 0, [], fault));
+    answer = writeCall(state, args, fault);
+  } catch (refusal) {
+    // **⟶ A WRITE THAT NEVER RAN RELEASES THE ADOPTION IT WAS TAKEN FOR** (`§2.4` item 9's table row (a)
+    // read with `§2.7` item 8, and `PAR-JS-19`'s own keying of one adoption to one write): the adoption
+    // instant (a) took is KEYED TO ONE WRITE and is *"never a queue an unrelated write may draw from"*,
+    // so a `commit` the store refused between instant (a) and the verb — or a walk this boundary refused
+    // before the verb was reached — leaves NO write for that adoption to belong to (`kernel-surface.md
+    // §2.1` item 2: a refused `commit` *"threw BEFORE the write verb ran"*, so no residue exists for any
+    // terminal arm to reach). **IT IS RELEASED HERE AND NOT CARRIED FORWARD**, so the NEXT write reaches
+    // no adoption at all: `§2.7` ITEM 8'S POST-VERB INSTANT FOR A BARE CALLER-MADE WRITE IS UNMOVED BY
+    // ANY KERNEL ACT (`§2.4` item 9 (e); `A116` (D1): the seam withholds *"the write in flight"* and
+    // only it), and an abandoned adoption standing as a pending identity is exactly the withholding this
+    // clause forbids. The store's own refusal crosses back UNCHANGED AND UNCONVERTED.
+    const unrun = state.adopted.size === 0 ? null : state.adopted.values().next().value;
+    if (unrun !== null) {
+      state.adopted.delete(unrun);
+      state.answered.delete(unrun);
+    }
+    throw refusal;
+  }
   const record = {
     op: decodeJournalOp(answer.op),
     watched: answer.watched.map(decodeSegments),
     triggered: wrapHandles(state, answer.triggered),
   };
+  // **AND THE RECORD IS LEFT IN THE SLOT THE KERNEL'S STORE LEG READS** (`state.leg`; `§2.12` item 1's
+  // stage 2): a kernel-driven write takes the record THIS VERY WRITE returned and not a copy of it, and the
+  // slot is read before the pass that may write again, so a repair's own write can never be mistaken for it.
+  state.leg = record;
   // **THE INVOCATION WINDOW** (`§2.7` item 2, `DD-22`): the record above is COMPLETE before the window
   // opens, the invocation is SYNCHRONOUS, it happens AFTER the addon's call returned, and **its ONE
   // argument is the TRIGGERING ADDRESS** (`PAR-JS-12`).
-  deliver(state, record.triggered, answer.triggeringAddress);
+  //
+  // **⟶ AND WHERE THIS WRITE IS ONE `commit` ISSUED, THE WINDOW IS WITHHELD** (`§2.7` items 6–8 with
+  // `§2.4` item 9's instant (a), and `A115` (D2)): the record identity the seam adopted BEFORE this
+  // verb was called stands in `state.withheld`, so this instance invokes NO handle of that write here
+  // and the delivery waits for the pass's terminal arm, where the seam delivers the record's `pending`
+  // residue. **A BARE CALLER-MADE WRITE REACHES NO ADOPTION AND ITS POST-VERB INSTANT STANDS UNMOVED**
+  // (`§2.7` item 8; `§2.4` item 9 (e)): such a record was never passed to the seam, so its set is
+  // delivered exactly as it always was.
+  // **THE ADOPTION IS CONSUMED HERE, AND THE IDENTITY THAT STANDS IN `withheld` IS THIS RECORD'S**
+  // (`§2.4` item 9's table row (a): *"the record identity the instance adopted at instant (a)"*): the
+  // seam marks the write in flight, and this verb — the very write that marker was made for, called by
+  // `commit` on the next statement — is the one write it withholds. **A WRITE THAT FINDS NO ADOPTION IS A
+  // BARE CALLER-MADE WRITE AND ITS POST-VERB INSTANT STANDS UNMOVED** (`§2.7` item 8; `§2.4` item 9 (e)).
+  // **⟶ THE BARE WRITE'S OWN GUARD IS `withheld`, BECAUSE THE MARKER IS THE WITHHOLD AND NOT A
+  // CONSTRUCTION ORDER** (`§2.4` item 9's table row (a): *"WITHHOLDS the package's own delivery for
+  // IT"*; row (b): *"AT THE PASS'S TERMINAL ARM … the SAME record identity"*). **THE ONLY ADOPTION A
+  // KERNEL-DRIVEN WRITE CAN FIND IS ITS OWN**: `settle`'s FIRST call records the identity in BOTH
+  // structures, and the verb that carries that identity DELETES IT FROM `adopted` at `:1438` — so an
+  // entry standing in `adopted` beside a non-empty `withheld` is a second identity, which is another
+  // kernel-driven write's, and this write finds no marker of its own. **ONLY THIS WRITE'S OWN IDENTITY
+  // IS CONSUMED AND ONLY ITS OWN WINDOW IS WITHHELD** — *"A WRITE THAT FINDS NO ADOPTION IS A BARE
+  // CALLER-MADE WRITE AND ITS POST-VERB INSTANT STANDS UNMOVED"* (`§2.7` item 8; `§2.4` item 9 (e)).
+  const pending = state.withheld.size === 0 ? null : state.adopted.values().next().value;
+  // **WHETHER THIS WRITE'S LEDGER ENTRY WAS STILL EMPTY WHEN THE CALL CAME** (`§2.4` item 9 (a)): an
+  // adoption whose own write verb has not yet answered is one a CALLER's own `settle` call may deliver
+  // before the write runs, and it is that delivery the write's own record carries the mark of (`:1456`).
+  const pendingAnswerEmpty = pending !== null && pending !== undefined && state.answered.get(pending) === null;
+  if (pending === null || pending === undefined) {
+    deliver(state, record.triggered, answer.triggeringAddress);
+  } else {
+    state.adopted.delete(pending);
+    state.answered.set(pending, record); // THE IDENTITY THIS ADOPTION'S OWN WRITE RETURNED
+    state.withheld.add(record);
+    // **⟶ AND BOTH IDENTITIES ARE MARKED DELIVERED, BECAUSE THIS WRITE'S DELIVERY HAS NOW HAPPENED**
+    // (`§2.4` item 9: the two instants are counted, and NO third instant is declared — *"there is NO
+    // second adoption"*; `PAR-JS-19`'s domain cell). A delivery taken while the ledger entry stood EMPTY
+    // is a caller's own call and it DELIVERS THIS WRITE'S RESIDUE — the adopted identity `pending` names —
+    // so that identity's occurrence after this instant is no longer a first call, and **THE IDENTITY THE
+    // WRITE RETURNED IS MARKED WITH IT**: `K-2` hands the write's own record to the seam at its terminal
+    // arm, and where the caller took the delivery first, that record arrives with no ledger entry left to
+    // answer it (`state.answered.delete(pending)` above) and would be READ AS A FIRST CALL — adopted, put
+    // in flight a second time, and its marker left standing for a pass that never comes, which withholds
+    // the next bare caller-made write's window (`§2.7` item 8; `§2.4` item 9 (e)). **THE MARK IS TAKEN
+    // ONLY WHERE THE LEDGER ENTRY WAS EMPTY**: an identity delivered at the terminal arm is answered by
+    // the write's own record through `answered`, and marking it there would reach the abandoned attempt's
+    // late arm as a no-op — the delivery the clause owes at that instant (`§2.4` item 9 (b);
+    // `ck_neg_dm_09_*`).
+    if (pendingAnswerEmpty) {
+      state.delivered.add(pending);
+      state.delivered.add(record);
+    }
+    // **AND THE IDENTITY IS THIS WRITE'S FROM HERE ON** (`§2.4` item 9's table row (a): the write *"the
+    // adopted identity names"* is the one its window withholds): a delivery this identity had already
+    // taken — a caller's own call, made while the ledger entry stood EMPTY (`:1735`) — is SUPERSEDED by
+    // the write it belongs to, and the seam's SECOND call for it is the terminal arm's delivery and not
+    // a no-op, so the abandonment's own late arm still reaches the residue (`§2.4` item 9 (b)).
+    state.delivered.delete(record);
+  }
   return record;
 }
 
@@ -1474,12 +2077,12 @@ function deliver(state, triggered, triggeringAddress) {
 /// and the in-domain no-op arm a SUCCESS returning `tiers: []`. **Its declared NAME is `delete`, and it is
 /// published under that name ALONE** (`package.md §1.3` item 3): `deleteOp` is a reserved-word workaround
 /// for the declaration and never a member of the package's namespace.
-function deleteOp(instance, address, tier) {
+function deleteOp(instance, n, address, tier) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
   // removal, and a supplied `undefined` answers row 4's `AddressMalformed` (`crossing.md §1.3`).
-  args.push(encodeTier(tier, arguments.length >= 3, false));
+  args.push(encodeTier(tier, n >= 2, false));
   const answer = call(state, 'delete', args);
   const receipt = {
     address: decodeSegments(answer.address),
@@ -1492,9 +2095,9 @@ function deleteOp(instance, address, tier) {
 }
 
 /// `PAR-JS-9`: `{opId, undoneOps, restoredTo}` — the constraint pattern's reverse step (`§2.6`).
-export function rollback(instance, opId) {
+function rollback(instance, n, opId) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeOpId(opId)] : [];
+  const args = n >= 1 ? [encodeOpId(opId)] : [];
   const answer = call(state, 'rollback', args);
   return {
     opId: answer.opId,
@@ -1505,26 +2108,166 @@ export function rollback(instance, opId) {
 
 /// `§2.10`: `listen` mints a token, populates the store's home and wraps it for JS — and its `address` is
 /// `AddressArg`'s domain and NOTHING MORE: a listener carries NO tier qualifier.
-export function listen(instance, address) {
+///
+/// **THE PACKAGE MIRRORS THE STORE'S OWN HOME, AND IT MIRRORS IT INSIDE THE SAME DECLARED RULES THE STORE
+/// USES — ONE ENTRY PER CALL, `DD-39`'s duplicate bucket included** (`write-and-read.md §6.5` item 12 (c)
+/// and its item 8; `src/store.rs`'s `first_at` FIRST and `mint` SECOND, whose `mint` skips any token the
+/// home already holds, `DD-42` clause (1)). **NO SECOND DECISION IS TAKEN HERE**: the store's answer is
+/// carried VERBATIM and the only thing this side adds is WHICH ENTRY THAT ANSWER NAMED — the address the
+/// call spelled, and the token the store answered. **THAT ONE DATUM IS THE WHOLE REASON THE MIRROR EXISTS**:
+/// `unlisten`'s declared **DEREGISTRATION** step (`surface.md §2.4` item 7 (b)) is defined over the two
+/// lawful duplicate states the SAME clause's dated narrowing names, and the store's `triggered` list carries
+/// tokens and never the address they were minted at (`§2.7` item 1) — **so the address is kept beside the
+/// identity rather than guessed from it.** Nothing of it is observable: it is this factory's own closure,
+/// like `tokens` and `registry`, and `§2.1` (e) item 1's private-state rule is untouched.
+/// **AND THE KEY IS INJECTIVE, 2026-10-17 — TWO DISTINCT LAWFUL ADDRESSES CANNOT SHARE ONE KEY**
+/// (`§2.4` rules 1 and 4 and item 7 (a)/(b), which all rest on the mirror holding EXACTLY the store's own
+/// entries). **THE DEFECT IT CLOSES, NAMED: the shipped key joined RAW segment spellings with `\u0000`, so
+/// `['a', 1]` and `['a', 'number:1']` BOTH keyed `a\u0000number:1` — one key, two lawful addresses — and
+/// every `some(key)` test below then read a second ADDRESS as an already-held one.** **THE KEY NOW CARRIES
+/// EACH SEGMENT'S OWN CLASS AND ITS LENGTH**, which is what makes it injective over the two classes
+/// `§1.5`'s domain holds (`PAR-JS-5`: a string key or a non-negative integer index): `s1:a` and `n1:1` can
+/// never be read off one another, because the class letter decides the spelling and the length decides
+/// where it ends. **THE STORE'S OWN KEY IS THE SEGMENT VECTOR ITSELF and the mirror's key is its faithful
+/// image**: no coercion, no case folding and no normalization stands between the two.
+function homeAddressKey(address) {
+  if (!Array.isArray(address)) return `\u0001${typeof address}`;
+  const parts = [];
+  for (let i = 0; i < address.length; i += 1) {
+    const segment = address[i];
+    // **THE TWO CLASSES `§1.5`'S DOMAIN HOLDS, AND NOTHING ELSE IS EVER KEYED** (`inDomainAddress` below
+    // is the one predicate that admits an address here): a string segment is `s<length>:<bytes>` and an
+    // index segment is `n<length>:<digits>` — the length prefix is what makes the join injective.
+    if (typeof segment === 'string') {
+      parts.push(`s${segment.length}:${segment}`);
+    } else {
+      const digits = String(segment);
+      parts.push(`n${digits.length}:${digits}`);
+    }
+  }
+  return parts.join('\u0000');
+}
+
+/// **ONE `listeners[]` ELEMENT IS LAWFUL WHERE THE STORE'S OWN ADMISSION AND THE BOUNDARY'S OWN WALK AGREE
+/// ON IT — ADDED 2026-10-17, SO THE SEEDING PREDICATE AND `listen`'S PUSH CONDITION CANNOT DISAGREE ABOUT
+/// WHAT A LAWFUL ELEMENT IS** (`§2.4` item 7 (a) item 3's *"ADMIT-OR-REFUSE COMES THIRD, and every element
+/// read … is reached ONLY for a value the first step has admitted"*, read with `§1.4`'s walk and the store's
+/// own `src/args.rs`, which admits exactly the elements whose every segment `Segment::is_in_domain` holds
+/// and whose handle token is not blank). **THE FOUR TESTS ARE THE ONES `encodeListeners` AND
+/// `constraintAddress` ALREADY TAKE, AND NOT ONE OF THEM IS NEW**: the entry is a plain object (a `Proxy`,
+/// an `Array` and a prototype-carrying object refused before a member is read — `§1.4` item 4 (e)–(g),
+/// `DD-34`/`DD-35`); `address` and `handle` are OWN members (`Object.hasOwn` and never `in`, `JS-5`); the
+/// handle is a non-empty string (`§0.4` clause 3 / `PAR-13`); and the address is an admitted array whose
+/// every segment is a string without a lone surrogate or a non-negative SAFE integer — the two classes
+/// `encodeSegment` pushes and `Segment::is_in_domain` admits, so the elements the store ADOPTS and the
+/// elements this predicate ACCEPTS are one set and the mirror holds one entry per store entry.
+function inDomainAddress(address) {
+  if (types.isProxy(address) || !Array.isArray(address) || arrayClass(address) === 'class') return false;
+  for (let i = 0; i < address.length; i += 1) {
+    if (!(i in address)) return false; // a hole is `AddressArg` row 14's own outside shape (`DD-8`)
+    const segment = address[i];
+    if (typeof segment === 'string') {
+      if (hasLoneSurrogate(segment)) return false; // the class the walk refuses before any verb (`C-4`)
+    } else if (!(typeof segment === 'number' && Number.isInteger(segment) && segment >= 0
+      && Number.isSafeInteger(segment))) {
+      return false; // and every other class is `§1.5`'s own outside set
+    }
+  }
+  return true;
+}
+
+/// **AND THE SEEDING PREDICATE IS THAT ONE PREDICATE** — the entry's own four tests, taken together.
+function isLawfulListenerElement(entry) {
+  if (!isPlainObjectValue(entry) || !Object.hasOwn(entry, 'address') || !Object.hasOwn(entry, 'handle')) return false;
+  if (typeof entry.handle !== 'string' || entry.handle === '') return false;
+  return inDomainAddress(entry.address);
+}
+
+function listen(instance, n, address) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  return wrapHandles(state, [call(state, 'listen', args)])[0];
+  // **AND `listen`'s ONE POSITION IS AN ADDRESS POSITION THAT CARRIES ITS ARGUMENT POSITION** (`§2.17`'s dated
+  // clause; `surface.md §2.5` item 5 (b)'s position half): the CLASS half is mandatory at every site and the
+  // position half is read at the site that DECLARES one, and this verb's address is `1` of `1` — so a class
+  // refusal here names the argument it is about (`NG-JS-I`'s `listen` arm). *"first argument"* is written
+  // with the same bytes the registry's own registration clause spells; the constant below is declared with
+  // the constraint sites and is NOT reachable from here.
+  const args = n >= 1 ? [encodeAddress(address, 'first argument', 'first argument')] : [];
+  const wrapped = wrapHandles(state, [call(state, 'listen', args)])[0];
+  if (n >= 1) {
+    // **THE STORE CONSULTED THE ADDRESS FIRST**: where a bucket already stands under this address the store
+    // MINTED NOTHING and pushed NOTHING (`first_at`), so the mirror records nothing a second time either —
+    // and where it did not, the store's own `mint` pushed exactly ONE entry, which is the ONE recorded.
+    if (!state.home.some((entry) => entry.key === homeAddressKey(address))) {
+      state.home.push({ key: homeAddressKey(address), token: state.tokens.get(wrapped) });
+    }
+  }
+  return wrapped;
 }
 
 /// `§2.3` item 4 / `PAR-JS-8`: **`unlisten` over ANY value outside the domain is a NO-OP SUCCESS** — a
 /// foreign instance's value, a prior session's value, a fabricated value, a blank token, a non-opaque value
 /// and an absent handle are EACH a no-op success, no code is produced, and NO OTHER REGISTRATION IS REMOVED.
-/// **The package's own registry entry STANDS** (`§2.4` rule 4, `DD-15`): only the store-side home entry is
-/// withdrawn, so a withdrawn handle's function simply never fires again.
-export function unlisten(instance, handle) {
+///
+/// **⟶ THE `off`-CLASS WITHDRAWAL IS THE ONE A `A127`'S RECEIVER RULING LEAVES AT THIS MEMBER, AND IT HAS
+/// TWO HALVES — THE STORE'S AND THE PACKAGE'S OWN** (`surface.md §2.4` item 7 (b)'s `off` step list, whose
+/// three steps are VALIDATE · UNLISTEN · DEREGISTER, read with that item's own dated clause: *"the
+/// store-side home entry is withdrawn, the registry's entry for that identity is REMOVED, and `undefined` is
+/// returned"*, and `contract.md §5.5`'s fourth added failure-list entry, *"an `unlisten` that unregisters
+/// the function"*, which the `A127` surface closes by MERGING `off` INTO THIS MEMBER — `on` and `off` are
+/// *"MERGED AWAY AND ARE NOT MEMBERS"* and *"the listener registration route is `listen` + `register` and
+/// its withdrawal is `unlisten`"*, `surface.md §2.4` item 9 (f)'s `A127` clause). **THE REMOVAL IS KEYED TO
+/// THE IDENTITY THIS CALL WAS HANDED AND TO NOTHING ELSE — not to the address and not to the function**
+/// (`§2.4` item 7 (b)'s dated narrowing: *"the deregistration is keyed by the identity and not by a count of
+/// entries"*), so at the CALLER-SPELLED DUPLICATE the surviving entry's own trigger still CARRIES the
+/// identity while the package invokes NOTHING for it: rule 1's declared silence (*"an unregistered handle
+/// fires nothing silently"*). **A LATER TRIGGER THAT CARRIES THE IDENTITY AND A SILENT INVOCATION ARE NOT
+/// IN CONFLICT** — *"the silence is the registry-entry removal rather than a second withdrawal"* — and the
+/// store-side half stays EXACTLY the store's own FIRST-MATCH withdrawal, which removes ONE home entry per
+/// call (`DD-42` clause (2)).
+function unlisten(instance, n, handle) {
   const state = stateOf(instance);
-  if (arguments.length < 2) return undefined;
+  if (n < 1) return undefined;
   const encoded = encodeHandle(state, handle);
   if (encoded.k !== 'O') return undefined; // outside the domain: a no-op success, and the store is not reached
   call(state, 'unlisten', [encoded]);
-  // **The package's registry entry STANDS** (`§2.4` rule 4, `DD-15`): only the store-side home entry is
-  // withdrawn, so the withdrawn handle's function simply never fires again, and a later re-`listen` at the
-  // same address mints a DIFFERENT handle whose registration is a NEW entry.
+  // **⟶ STEP 3 — THE DEREGISTRATION, TAKEN WHERE AND ONLY WHERE THE IDENTITY NO LONGER STANDS** — read
+  // against the PACKAGE'S OWN HOME MIRROR rather than against a second store call, so the withdrawal's own
+  // observable (ONE entry, the token's FIRST match, `DD-42` clause (2)) is the whole of what this call does
+  // to the store:
+  //   * **THE ONE-ENTRY STATE** and the token's entries at NO OTHER address: this call withdrew the ONE entry
+  //     the identity named, **so the identity no longer stands anywhere** and the registry's entry is
+  //     REMOVED (`§2.4` item 7 (b) item 1, *"WITH NO QUALIFICATION"*; `§5.5`'s WITHDRAWN arm).
+  //   * **THE CALLER-SPELLED TWO-ADDRESS DUPLICATE** — the token named ONE entry at EACH of two addresses:
+  //     this call withdrew the ONE entry ITS OWN address held, **so THAT ADDRESS carries the identity no
+  //     more** and **the identity's registry entry is REMOVED**. A later trigger at the OTHER entry's address
+  //     still CARRIES the identity — the store's half, unmoved — **while the package invokes NOTHING for it,
+  //     which is rule 1's declared silence and not a second withdrawal** (`convenience.test.mjs`'s
+  //     `off_deregisters_…`; `ng_js_k`'s two-address arm).
+  //   * **THE CALLER-SPELLED ONE-ADDRESS DUPLICATE** — the token named MORE THAN ONE entry at the SAME
+  //     address (`DD-39`, `DD-42` clause (2)): this call withdrew ONE of them, the bucket's FIRST match,
+  //     **and the address STILL HOLDS the identity**, so **the registry's entry STANDS** and a later trigger
+  //     under that address STILL returns the identity WITH THE FUNCTION FIRING FOR IT — which is
+  //     `contract.md §5.5`'s THIRD added entry (*"the registry still fires that ONE identity ONCE, never once
+  //     per occurrence and never once per entry"*) and `§2.4` rule 4's own *"never the function"*.
+  //
+  // **⟶ AND THE ABSENCE ROUTE REMOVES THE REGISTRY ENTRY ONLY WHERE THE STORE GENUINELY WITHDREW THE
+  // IDENTITY — CORRECTED 2026-10-17** (`§2.4` item 7 (b) item 1, *"WITH WITHDRAWAL"*, read with rules 1 and
+  // 4 and item 7 (a) item 3's own *"leaves no store-side home entry"*). **THE DEFECT IT CLOSES, NAMED: the
+  // shipped arm deleted the registry entry UNCONDITIONALLY whenever the token was absent from the mirror —
+  // including for a call whose token the mirror never held at all (an identity the store holds nothing for),
+  // where NOTHING was withdrawn and the registry is not this call's to touch.** **THE WITHDRAWAL IS NOW THE
+  // PRECONDITION: the mirror held the token, and this call's own single-entry removal left no survivor
+  // carrying it** — which is exactly the state in which *"the store has genuinely withdrawn the identity"*
+  // is true, and it is the state the mirror can read because it holds one entry per store entry (see
+  // `homeAddressKey` and `isLawfulListenerElement` above). **WHERE THE MIRROR HELD NOTHING, THIS CALL
+  // REMOVES NOTHING AND THE REGISTRY STANDS**, which is the no-op success `§2.10` declares for a withdrawal
+  // the store makes none of.
+  const mirror = state.home.findIndex((entry) => entry.token === encoded.v);
+  if (mirror === -1) return undefined;
+  const key = state.home[mirror].key;
+  state.home.splice(mirror, 1); // the store's own FIRST-match withdrawal, mirrored entry for entry
+  if (state.home.some((entry) => entry.token === encoded.v && entry.key === key)) return undefined;
+  state.registry.delete(handle);
   return undefined;
 }
 
@@ -1577,6 +2320,214 @@ function registerOn(state, handle, listener) {
   return undefined;
 }
 
+/// **THE ORDERING SEAM — `settle(record) -> undefined`** (`surface.md §2.4` item 9; `A116` (D1)–(D4);
+/// `PAR-JS-19`). The one member the kernel calls and the entry implements, taken at the two instants of a
+/// kernel-driven write, AND IT REACHES THE REGISTRY AND NOTHING ELSE: no store verb is called, no node is
+/// minted and no journal entry is appended.
+///
+/// * **INSTANT (a) — BEFORE THE STORE'S WRITE VERB IS CALLED.** The identity's FIRST call on this instance
+///   IS ITS ADOPTION (`PAR-JS-19`'s own domain cell: *"the adoption happens AT the first call and is not
+///   required before it"*). The record identity is marked as a kernel-driven write in flight, which is
+///   what makes the write's own post-verb window (`write` above) deliver NOTHING: `§2.4` item 9's table
+///   row (a), *"WITHHOLDS the package's own delivery for it: the package's post-verb invocation reaches
+///   NO handle of that write, so its in-window invocation set is EMPTY"*.
+/// * **INSTANT (b) — AT THE PASS'S TERMINAL ARM.** The SECOND call for that identity IS the delivery: the
+///   residue standing in the record's `pending` at that instant is iterated through this instance's own
+///   registry, one invocation per handle, each carrying the TRIGGERING ADDRESS as its single argument
+///   (`§2.4` item 9's table row (b); `§2.7` items 5 and 7 (a)–(b)). **WHAT IT ITERATES IS THE RESIDUE AND
+///   NEVER `triggered`**: on a passing attempt the check-off has removed the evaluated pair's entry, and on
+///   a write that FAILED on constraints the DISCARD has emptied the member — so an empty residue is a
+///   no-op and not a failure (`§2.7` item 7 (c)–(d)).
+/// * **EVERY OTHER FORM AT THE RECORD POSITION THROWS THE REGISTRATION SITE'S OWN `TypeError`** — absent,
+///   `undefined`, `null`, a primitive, a `function`, a `Proxy`, and an identity this instance never
+///   adopted — **and CHANGES NOTHING** (`§2.4` item 9 (a)–(b); `PAR-JS-19`'s outside-value row).
+/// * **A RESIDUE HANDLE WITH NO REGISTERED FUNCTION IS A SILENT NO-OP** (`§2.4` rule 1 read at instant
+///   (b), item 9 (c)): no code, no warning, no log and no throw.
+function settleOn(state, record, supplied) {
+  // **THE CLASS DECISION COMES FIRST, ON THE VALUE AS IT IS** (`§2.4` item 5 (a)'s order walk;
+  // `crossing.md §1.7`): an absent argument, every non-object and every `Proxy` is refused before any
+  // marker is read or set.
+  if (!supplied || record === null || typeof record !== 'object' || types.isProxy(record)) {
+    throw new TypeError(
+      `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
+    );
+  }
+  // **⟶ ONE WRITE, ONE ADOPTION, AND TWO IDENTITIES CARRY IT** (`§2.4` item 9's table rows (a) and (b);
+  // `PAR-JS-19`: *"the adoption happens AT the first call, and the SECOND call for that identity is the
+  // delivery"*). `K-2` builds its record BEFORE the write verb and hands that identity to the seam at
+  // instant (a); **THE ENTRY'S OWN `write` MINTS THE RECORD IT RETURNS** (`PAR-JS-13`), and that is the
+  // identity this instance puts in flight and whose `pending` member carries the residue the terminal arm
+  // reads. The two calls are ONE identity apart: the arm calls `settle` with the identity it built, and
+  // the ledger entry made at instant (a) carries the write's own record forward to it.
+  //
+  // **THE DOMAIN IS THE INSTANCE'S OWN MARKER AND NOTHING ELSE** (`§2.4` item 9 (a)–(b)): an object this
+  // instance never adopted — *"another instance's record included"* — carries no `pending` member and no
+  // ledger entry, and is refused here with the registration site's own `TypeError`; nothing is set for it.
+  const pre = state.answered.has(record); // this identity is the one a write verb was ADOPTED for
+  const written = pre ? state.answered.get(record) : null;
+  // **AN IDENTITY WHOSE DELIVERY HAS ALREADY HAPPENED SETS NO MARKER** (`§2.4` item 9's two instants,
+  // counted: THE FIRST CALL IS THE ADOPTION and THE SECOND IS THE DELIVERY — *"there is NO second
+  // adoption"*, and no third instant is declared). **THE SECOND CALL REMOVES THE IDENTITY FROM `answered`
+  // AND FROM `adopted`, so its next occurrence arrives with NO LEDGER ENTRY** — and were that occurrence
+  // read as a FIRST call, it would ADOPT, leaving the marker `:1438`'s own deletion never reaches: a
+  // KERNEL-DRIVEN WRITE PUT IN FLIGHT A SECOND TIME, whose window is withheld for a pass that never
+  // comes. **SO A THIRD CALL IS A NO-OP AND CHANGES NOTHING**, which leaves the write that OWNS the
+  // identity as the only act that consumes it, and NO IDENTITY STANDING ADOPTED ON THIS INSTANCE that no
+  // write belongs to — the state the caller-made bare write below reads, which `§2.7` item 8 declares
+  // *"does not move"* whatever stands on the instance (`§2.4` item 9 (e); `PAR-JS-19`).
+  if (!pre && state.delivered.has(record)) {
+    // **AND AN OCCURRENCE AFTER THE TWO DECLARED INSTANTS ENDS ANY IN-FLIGHT STATE STANDING FOR IT**:
+    // a marker is put in flight only by an adoption, and this identity's adoption was consumed (or the
+    // write that would have consumed it never arrived), so the marker this occurrence names is the stale
+    // one the NEXT BARE CALLER-MADE WRITE would otherwise draw on (`§2.4` item 9 (e); `§2.7` item 8).
+    // **NOTHING ELSE CHANGES** — no invocation, no ledger, no residue, and the member's return `undefined`.
+    state.withheld.delete(record);
+    return undefined;
+  }
+  if (!pre) {
+    if (record.pending === undefined) {
+      throw new TypeError(
+        `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
+      );
+    }
+    // INSTANT (a): the adoption. The ledger entry stands EMPTY until the verb answers, so the write that
+    // drains it is the one write identity this adoption is for.
+    state.adopted.add(record);
+    state.answered.set(record, null);
+    // **AND THE IDENTITY IS THE WRITE IN FLIGHT FROM THIS INSTANT** (`§2.4` item 9's table row (a):
+    // *"ADOPTS that identity as a kernel-driven write in flight AND WITHHOLDS the package's own delivery
+    // for it"*): the two structures above carry the LEDGER, and `withheld` is the WITHHOLD ITSELF — the
+    // marker the write verb reads (`:1450`) to know that the delivery of THIS write is not made in its own
+    // window. **BOTH HALVES OF INSTANT (a) ARE TAKEN AT THIS ONE SITE OR NEITHER IS**: without it the
+    // write delivers in-window and the terminal arm's `settle` finds no marker to end. **IT IS SET HERE AND
+    // NOT AT THE VERB, BECAUSE THE SEAM IS CALLED BEFORE THE VERB IS REACHED** (`A116` (D1)).
+    state.withheld.add(record);
+    return undefined;
+  }
+  // **⟶ THE TERMINAL ARM'S OWN ACT, 2026-10-15** (`surface.md §2.11` clause 2; `contract.md §7.2` item 2 as
+  // amended): **on the PASSING arm of a `file`-tier write, the arm PERFORMS THE STORE'S `commit_file` AS
+  // ITS FIRST ACT — BEFORE ANY BODY OF THE DELIVERED SET IS INVOKED** (clause 3 (ii): *"no body before the
+  // save"*; the delivery's one invocation site is `deliver`, below). **Its key is THE SETTLED RECORD'S OWN
+  // `op`** — *"the record the kernel settled carries the journal op that write returned, and that op is the
+  // key this act reads"* — and it is the FIRST THING this arm does, so an arm whose pass FAILED drives no
+  // save and no store call of the write's own at all (clause 1: the lift's scope is the passing arm alone).
+  // **THE ARM IS READ OFF THE MARK THE KERNEL SETS ON ITS PASSING ARM AND OFF NOTHING ELSE**: a `file`-tier
+  // write whose pass failed reaches this same instant, and the act is NOT ITS.
+  //
+  // **A FAILED SAVE IS ANSWERED HERE AND ITS THROW TRAVELS OUT OF THE ARM**: the STORE has already rolled
+  // the write back (`§8.1` #15; clause 5: ROLLBACK FIRST, MESSAGE SECOND) and no body of the delivered set
+  // is reached.
+  //
+  // **⟶ AND THE KERNEL'S OWN HALF OF THIS CELL IS TOLD, ON THE IDENTITY IT HOLDS, 2026-10-15** (`§2.11`
+  // clause 5; `kernel-surface.md §2.1` items 3–5; `fail-surface.md §1.1` item 3): **THE SAVE IS A CONSTRAINT
+  // EVALUATED LAST, AND THE PASS REPORTS ITS FAILURE AS IT REPORTS ANY OTHER** — so the failed save's own
+  // log gains the `outcome` entry, the closed record is the terminal answer and the report carries the
+  // rollback that happened. **THE FAILURE'S OWN CHANNEL IS NOT MOVED BY THIS MARK**: the store's verb
+  // produced it, so its two-member form reaches the caller UNCHANGED (`§1.2` item 2) and NO `log` member and
+  // NO THIRD MEMBER IS ADDED HERE. The mark carries THE VERY THROWABLE — one identity, not a copy — so the
+  // kernel's own catch reads the arm and NOTHING ELSE, and a body of the delivered set that throws (which
+  // this arm never reaches: the throw above leaves the arm first) is never mistaken for the save.
+  if (
+    record[SETTLED_ON_THE_PASSING_ARM] === true
+    && written !== null
+    && written.op !== null
+    && written.op !== undefined
+    && written.op.tier === 'file'
+  ) {
+    try {
+      call(state, 'commitFile', [encodeOpId(written.op.opId)]);
+    } catch (saveFailure) {
+      record[SAVE_FAILED_AT_THE_TERMINAL_ARM] = saveFailure;
+      throw saveFailure;
+    }
+  }
+  // **THE RESIDUE IS READ OFF THE ADOPTED IDENTITY** (`§2.4` item 9 (b)): the write's own record and the
+  // adopted one are ONE WRITE AND ONE RESIDUE — `K-2` fills the member it built from the very set its own
+  // verb returned (`record.pending = written.triggered.slice()`), and it is THAT member the pass checks each
+  // entry off in as it passes (`releasePending`), so the adopted identity is the record whose `pending`
+  // holds the residue AT THIS INSTANT and the write's own record is the identity that was put in flight.
+  // **A SECOND CALL FOR THAT IDENTITY IS THE DELIVERY, WHATEVER THE LEDGER ENTRY HOLDS** (`§2.4` item 9's
+  // table row (b): *"the SECOND call for that identity IS the delivery"* — the ONE clause that decides
+  // this instant; `PAR-JS-19`'s domain cell). **THE EARLY RETURN THIS SITE ONCE SHIPPED — `if
+  // (state.answered.get(record) === null) return undefined;` — WAS A CONSTRUCTION-ORDER DISCRIMINATOR
+  // AND NOT THE CLAUSE'S READING: it asked whether the write verb had answered YET, left the marker
+  // standing, and reached this seam's SECOND call as a no-op.** **A CALLER THAT MADE INSTANT (a)'s CALL
+  // ITSELF — an identity whose write never ran (`§2.4` item 9 (a): *"the RECORD POSITIONS … AND NEVER AN
+  // IDENTITY'S ADOPTION HISTORY"*) — therefore left an adopted identity standing for a write no act
+  // issued, and THE NEXT BARE CALLER-MADE WRITE DREW ON IT: that write's marker was consumed by an
+  // identity that was not its own, its own post-verb window was withheld, and `§2.7` item 8's instant
+  // MOVED for a write the kernel never issued.** **THE DECLARED READING OF THIS CALL IS THE DELIVERY OF
+  // THE IDENTITY'S OWN RESIDUE — the member the RECORD carries at THIS instant** (`§2.4` item 9 (c):
+  // *"A TERMINAL ARM WHOSE RESIDUE CARRIES NO REGISTERED FUNCTION IS A SILENT NO-OP … this member's
+  // return still `undefined`"*) — **AND IT ENDS THE IN-FLIGHT STATE IT TOOK**: the ledger entry goes with
+  // it, so the identity is left adopted by NO write.
+  state.adopted.delete(record);
+  // **AND THE IDENTITY LEAVES `withheld` HERE, WHATEVER THE LEDGER ENTRY HOLDS** (`§2.4` item 9's table
+  // row (b): the delivery *"ends the in-flight state"*, and a second call reaching a write whose verb has
+  // not answered ends it too). **A MARKER THIS CALL LEAVES STANDING IS THE ONE THE NEXT BARE CALLER-MADE
+  // WRITE DRAWS ON** (`§2.4` item 9 (e); `§2.7` item 8) — its window withheld for an act the kernel never
+  // issued — and the identity that marker was taken for is the one this call names.
+  state.withheld.delete(record);
+  // INSTANT (b): the identity leaves the in-flight set and the residue it carries is delivered.
+  state.answered.delete(record);
+  state.withheld.delete(written);
+  // **AND AN IDENTITY'S DELIVERY IS COUNTED WHERE IT HAPPENS, SO THE OCCURRENCES AFTER IT ARE READ AS
+  // NEITHER AN ADOPTION NOR A DELIVERY** (`§2.4` item 9: THE FIRST CALL IS THE ADOPTION AND THE SECOND IS
+  // THE DELIVERY — *"there is NO second adoption"*). **AN EMPTY RESIDUE MARKS NOTHING** (`ck_neg_dm_07_*`
+  // route (i): a caller's first call takes an identity whose `pending` is empty, and its LATER call is
+  // still the delivery that ends it, carrying nothing): the mark is taken by the write's own consumption
+  // of its adoption below (`:1456`), which is the one place both the adopted identity and THE IDENTITY THE
+  // WRITE RETURNED are in hand.
+  // THE DELIVERY THIS CALL MAKES IS STILL THE CLAUSE'S DELIVERY WHATEVER THE LEDGER ENTRY HOLDS.
+  // **THE RESIDUE IS THE MEMBER'S OWN VALUE AT THIS INSTANT** (`§2.7` item 7 (a): *"the handle set that
+  // stands in `CommitRecord.pending` at that instant"*), and each member is the SAME opaque identity this
+  // instance wraps its token as (`§2.3` item 1: handle identity is token equality alone; `§2.4` item 6
+  // (b): the registry's lookup is by THAT identity and by nothing else). **A MEMBER THIS INSTANCE HOLDS
+  // NO HANDLE FOR — the identity a FOREIGN instance minted — is not a member of this registry's key set
+  // and fires nothing silently** (`§2.4` rule 1): this seam writes no entry and mints no identity, so
+  // such a member is passed to `deliver` as it stands and matches no function there.
+  const triggered = Array.isArray(record.pending) ? record.pending.slice() : [];
+  // **⟶ AND BESIDE THE RESIDUE, THE IDENTITIES THE PASS CHECKED OFF WHOSE OWED FIRING STANDS**
+  // (`docs/decisions.md` · `A117` (D5); `surface.md §2.7` item 7's keying of 2026-10-15 and its sub-item
+  // (a)). **THE CHECK-OFF CONSUMES THE EVALUATED PAIR'S OWN DELIVERY OF THAT IDENTITY, NOT THAT
+  // IDENTITY'S WHOLE OWED DELIVERY**: the carrier has ONE entry per address, and the entry's own owed
+  // firings are not counted in `pending` — they are counted where the owed firings live, THIS REGISTRY.
+  // So an identity whose pair the pass evaluated and checked off is NOT an identity with no owed firing,
+  // and where this registry still holds a function for it the terminal arm delivers it ONCE, exactly as
+  // the residue's own members are delivered (`§2.7` item 6 — the other listeners are reached ONCE every
+  // constraint has passed — read with `§2.4` item 8 (c) AS CORRECTED 2026-10-15: *"the app's registration
+  // at a pair-adopted address IS OWED ITS FIRING AFTER THE PASS"*).
+  //
+  // **THIS IS NOT A SECOND CHANNEL**: the resolution is the SAME ONE the residue is delivered by — this
+  // registry's lookup by the identity alone — and it is the resolution that DECIDES the arm, so an
+  // identity the registry holds no function for fires NOTHING SILENTLY, exactly as a residue member with
+  // no function does (`§2.4` rule 1; item 9 (c)). **NO MEMBER IS ADDED ANYWHERE** (`A117` (D6)): the
+  // finding is the kernel's own, carried on the record under a SYMBOL key, and `record.pending` — the
+  // member the residue's own assertions read — stands EXACTLY as the check-off left it (the returned set
+  // minus the checked-off entries and minus nothing else). **AND ON A FAILING WRITE NOTHING IS
+  // DELIVERED**: the kernel publishes no such list on that arm, and its residue stands empty by the
+  // discard (`§2.7` item 7 (d); `A114` (D1)/(D2)).
+  const checkedOff = record[CHECKED_OFF];
+  if (Array.isArray(checkedOff)) {
+    for (const handle of checkedOff) {
+      if (!triggered.includes(handle)) triggered.push(handle);
+    }
+  }
+  // **THE INVOCATION'S ONE ARGUMENT IS THE TRIGGERING ADDRESS** (`§2.7` item 5): the address the
+  // trigger's own op landed at, read off the op the record carries — the OP's address and never the
+  // registration's watch address (`kernel-surface.md §2.1` item 2 (ii)).
+  // **A SECOND CALL ARRIVING BEFORE THE WRITE VERB HAS ANSWERED CARRIES NO OP, AND ITS ADDRESS IS
+  // `undefined` BESIDE IT** (`written` is the ledger entry and it stands EMPTY at instant (a)): the record
+  // carries no op yet, and `§2.7` item 5's argument is the OP's own address or nothing.
+  const triggeringAddress = written === null || written.op === null || written.op === undefined
+    ? undefined
+    : written.op.address;
+  // `deliver` is THE SAME loop the post-verb window uses (`§2.4` rules 1–3 read once, at both instants):
+  // ONE invocation per DISTINCT handle, and a handle with no registered function fires nothing silently.
+  deliver(state, triggered, triggeringAddress);
+  return undefined;
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE TWO NEW INSTANCE MEMBERS — `surface.md §2.4` ITEM 7, READ AT ITS OWN BYTES, AND `§2.1`'s DATED
 // CLAUSE (a): `on(address, listener) -> handle` AND `off(handle) -> undefined`, BESIDE `register`.
@@ -1596,254 +2547,260 @@ function registerOn(state, handle, listener) {
 // and contract directory untouched (`§2.1`'s dated clause (c); `A68`).
 // ---------------------------------------------------------------------------------------------
 
-/// **THE ARGUMENT POSITION, AT THESE TWO SITES** — `parameter-semantics.md §2.17`'s dated clause: *"the
-/// POSITION IS CARRIED BESIDE IT AS THE ARGUMENT POSITION: `1` OF `2` for an `address` or a `handle`, `2` OF
-/// `2` for a `listener`"*, inside `docs/specs/storeroom-js/surface.md §2.5` item 5 (b)'s generated message
-/// and NEVER as a third member. **The spelling is the two positions' own, named as the `register` site
-/// already names its pair** (`§2.12`'s re-derived row carries the same two positions).
+/// **THE `on`/`off` ROUTE IS MERGED AWAY — `A127` (2026-10-16).** The combined `on(address, listener)`
+/// and the package-owned withdrawal `off(handle)`, together with their argument walks
+/// (`validateOnAddress`, `validateOnArguments`), their two step lists and `deregister`, are REMOVED FROM
+/// THIS FILE at that dated clause: the product's declared member set is the TWELVE `10 + 1 + 1 = 12` ✓.
+/// **THE LISTENER REGISTRATION ROUTE IS REACHED AS ITS TWO DECLARED HALVES** — `a.listen(address)` and
+/// `a.register(handle, listener)` — and withdrawal as `a.unlisten(handle)`. **NOTHING OF THE STORE'S OWN
+/// `listen`/`unlisten` MOVES** (`§2.10`: same names, same positions, same arity, same returns, and rule 4
+/// verbatim), and the ONE observable the removed route alone owned — `AddressMalformed` for an outside
+/// `handle` at `off`'s position — is declared away with it: `unlisten`'s own answer over an outside value
+/// stays the NO-OP SUCCESS `§2.3` item 4 / `PAR-JS-8` declares.
+
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+// THE POST-CREATION CONSTRAINT SET — `surface.md §2.12` items 1–5, `A126` (2026-10-16), AND ITS TWO ROUTES
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+//
+// **TWO ROUTES POPULATE THE SET AND NEITHER SUBSTITUTES FOR THE OTHER**: the BATCH, which `storeCreate`
+// registers at `K-1` as it constructs (clause (b) above), and the ADD route's own argument. **THE ENTRY
+// CARRIES A PAIR IF AND ONLY IF A FUNCTION STANDS REGISTERED AT THAT PAIR IN THE KERNEL'S OWN PAIR-KEYED
+// REGISTRY** — so `state.constraints` is that registry's record and the ONE act both routes reach is
+// `carryConstraint` below. **NOTHING OF `§2.6` SURVIVES THE MOVEOUT**: the engine is behind this surface,
+// the constraint and repair limbs are the kernel's, and this file owns only the form of what crosses.
+
+/// `parameter-semantics.md §2.17`'s dated clause, at this section's own sites: the two positions' own
+/// spelling, **read at the method's own arity — `pair` at `1` of `2` and `constraint` at `2` of `2`**, since
+/// the LEADING `instance` POSITION IS DROPPED by `§2.4` item 9 (f)'s `A127` clause (the receiver is not a
+/// position of any declared signature; `§2.12` item 3's one-spelling rule).
 const ARGUMENT_POSITION_FIRST = 'first argument';
 const ARGUMENT_POSITION_SECOND = 'second argument';
 
-/// **`crossing.md §1.3`'s `AddressArg` domain AT ITS OWN ROWS 7–10 AND 14, DECIDED AT THE BOUNDARY FOR `on`
-/// ALONE — `A81`'s *"always validate"*, VERBATIM** (`parameter-semantics.md §2.17`'s dated clause: *"An
-/// `address` outside `AddressArg`'s domain at `on`'s position `1` of `2` → `AddressMalformed`"*).
-///
-/// **WHY THIS WALK EXISTS, AND WHY IT IS NOT `DD-46`'s PRE-CHECK:** **`DD-46` is a declaration about the
-/// DECLARED VERBS of `§2.2` and `§2.10`, whose arguments are passed through to the store's own carrier
-/// so the STORE chooses which refusal answers** — and this walk is not taken on any of their paths.
-/// **The listener home is the ONE store surface where that division fails: `listen` keeps the address's
-/// segments as the caller spelled them, so an out-of-domain segment reaches the home's key without the
-/// `L-1` walk ever running over it — measured, not assumed** (`bindings/js/test/convenience.test.mjs`'s
-/// second cell drives the rows below through `on`). **`§2.4` item 7 (a) step 1 makes `on` the site that owns
-/// this validation, so `on` decides the four rows the carrier cannot.**
-///
-/// **THE ROWS DECIDED, EACH NAMED AT ITS OWN `AddressArg` ROW** — row 7: an array holding a NEGATIVE
-/// integer · row 8: an array holding a NON-INTEGER number (`1.5`, `NaN`, `Infinity`) · row 9: an array
-/// holding `null`/`undefined` · row 10: an array holding an object (and, by the same clause's own reading of
-/// `§1.2`'s classes, an array, a `function`, a `symbol` or a `bigint`) · row 14: a sparse array. **AND ROW
-/// 6's SHAPE HALF IS DECIDED FIRST AND BESIDE THEM: a non-array IS `AddressMalformed`, and `'a.b'` is not a
-/// delimited address** — `classSpelling` names each class the value HAS (`§1.8`'s no-repair prohibition: no
-/// value here is converted, defaulted or substituted). **EACH REFUSAL IS THE ONE FORM, with the failing
-/// TARGET printed as its own value, the CLASS that failed and the ARGUMENT POSITION** (`§2.5` items 5 (a)
-/// and (b); `§2.17`'s dated clause) — **and NOTHING HERE IS A SECOND STATUS, A THIRD MEMBER OR A RAW HOST
-/// ERROR.**
-///
-/// **AND NOTHING IS LEFT BEHIND:** this walk performs NO store call and NO registry write, so it runs at
-/// step 1 and leaves no home entry, no registry entry, no node and no journal entry.
-///
-/// **⟶ AND THE PROXY DECISION IS TAKEN FIRST, IN `encodeAddress`'S OWN ORDER — `C-1` OF THE GATE-4
-/// ADVERSARIAL PASS, THE STOP-GRADE FINDING, CLOSED AT THIS SITE (2026-10-11).** The walk's first statement
-/// was `isAdmittedArray(address)`, which reads `Array.isArray` and then `arrayClass`'s
-/// `Object.getPrototypeOf` — **so a trap-carrying `Proxy` over an array RAN ITS TRAPS BEFORE ANY DECISION
-/// WAS TAKEN**: a `getPrototypeOf` trap that throws raised a RAW HOST ERROR out of `on` (against
-/// `§2.5` item 5 (e): *"a rejection is NEVER A RAW HOST ERROR"*), a `get` trap's side effects ran, and a
-/// re-entrant verb could be invoked from inside the walk — for an argument the contract refuses as
-/// `AddressArg` row 12 (`DD-34`) without reading it at all. **`encodeAddress` at `:609` already took this
-/// decision first, in its own words** (*"A `Proxy` is refused BEFORE the array shape test and before any
-/// element is read"*), **and this function now does the same, in the same order, with the same refusal.**
-/// **NO TRAP RUNS ON ANY PATH: the shape test, the prototype read that follows it, the `.length` read, every
-/// element read and the listener-position check are each reached only for a value `types.isProxy` has
-/// already answered about — and `util.types.isProxy` reads no member and invokes no handler.** The refusal
-/// is `AddressArg` row 12's own `AddressMalformed`, carried and never minted (`DD-40`).
-function validateOnAddress(address) {
-  if (types.isProxy(address)) {
-    // `AddressArg` row 12 (`DD-34`): the CLASS decision first, before the shape test and before any read —
-    // the order `encodeAddress` takes at the same position.
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(address),
-      `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(address)}, and an address is an array of segments`,
-    );
+/// **THE KERNEL, RESOLVED ON THE FIRST CONSTRAINT ACT AND NEVER AT LOAD** (`kernel-surface.md §1` item 1;
+/// `A121`, `A122`). **IT IS NOT AN EXPORT AND NOT A SUBPATH**: the module is reached as a FILE, at the path
+/// the allowlist publishes it at. **AND THE RESOLUTION IS LAZY ON PURPOSE**: the entry must still LOAD where
+/// nothing is staged beside it — the publish and negative drives assemble trees carrying `index.mjs` alone
+/// — and a load-time import of `./src/` would make every one of those trees unable to reach the artefact
+/// they were built to drive. A drive that never carries and never asks for a constraint reaches no byte of
+/// the kernel.
+let KERNEL = null;
+function constraintsKernel() {
+  if (KERNEL === null) KERNEL = require_('./src/constraint-kernel.mjs');
+  return KERNEL;
+}
+
+/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-8`, read HERE for their ONE use: to tell a
+/// refusal the KERNEL raised from one a STORE VERB raised, so that `A120` (2) can be applied to the first
+/// and not to the second. **NO `KC` SPELLING CROSSES THIS SURFACE** (`§2.12` item 1's read-through clause:
+/// printed here it would be a second, unowned home for the kernel's own vocabulary).
+const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8'];
+
+/// THE PAIR'S OWN KEY — `(address, id)`, the key the kernel's registry is keyed by (`kernel-surface.md §2.2`
+/// item 4). The address half is JSON's own spelling of the segment array, which is TOTAL over every address
+/// the pair's domain admits and collides across no two of them.
+function constraintPairKey(address, id) {
+  return `${JSON.stringify(address)}\u0000${id}`;
+}
+
+/// **THE ONE REFUSAL `§2.12` ITEM 4 DECLARES, TAKEN BEFORE ANY ACT AND LEAVING NOTHING CHANGED** — a JS
+/// `TypeError`, its `status` member ABSENT, no `message` member of this unit's own, **the store's closed
+/// `16`-member set neither minted nor widened, and the store reached by no call this refusal makes.**
+function constraintRefuse(where, value) {
+  throw new TypeError(
+    `the ${where} of this call is ${classSpelling(value)}, and it is not a value this position's domain `
+    + 'admits',
+  );
+}
+
+/// **A POSITION BELOW THE DECLARED ONE — `§2.12` item 4 AND `§2.4` item 9 (f)'s RULE (ii): a SHORT ARITY
+/// TAKES THE SAME ONE `TypeError` AND CHANGES NOTHING.** *"No assertion is made over `message`, and its
+/// absence is the declared reading"* — the member is not one of the three this form is observed by.
+function constraintArity(verb) {
+  throw new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`);
+}
+
+/// **`§2.12` ITEM 4'S TWO CALLER POSITIONS, CLASS FIRST AND IN THEIR DECLARED ORDER** (`PAR-JS-22`–`PAR-JS-24`)
+/// — **the receiver, which was item 4's first position, is DROPPED and is judged by the CALL and no longer by
+/// a walk** (`§2.4` item 9 (f)'s `A127` clause): a member reached through the product IS a product of this
+/// factory, so no instance-domain arm stands here. **NOTHING BELOW RUNS UNLESS BOTH POSITIONS HAVE PASSED**
+/// (`A81`), so a refused call performs no store call, no registry write and no `K-1` — atomicity by the
+/// validation's POSITION.
+function constraintSite(verb, instance, supplied, pair, constraint) {
+  if (supplied < 2) constraintArity(verb);
+  const state = INSTANCES.get(instance);
+  if (!isPlainObjectValue(pair)
+    || !Object.hasOwn(pair, 'address')
+    || pair.address === undefined) {
+    constraintRefuse(`pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\``, pair);
   }
-  if (!isAdmittedArray(address)) {
-    // `AddressArg` row 6 (a non-array, its five named classes), row 11 (a class extending `Array`), row 12
-    // (a `Proxy`) and rows 4–5 (`undefined`/`null`, whose own class spelling is the target's).
-    boundaryReject(
-      'AddressMalformed', // `AddressArg` rows 4–6's own declared code, carried and never minted (`DD-40`)
-      targetSpelling(address),
-      `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(address)}, and an address is an array of segments`,
-    );
+  const encoded = constraintAddress(pair.address);
+  if (typeof encoded === 'string'
+    || !Object.hasOwn(pair, 'id')
+    || pair.id === undefined
+    || typeof pair.id !== 'string'
+    || pair.id === '') {
+    constraintRefuse(`pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\``, pair);
   }
-  for (let i = 0; i < address.length; i += 1) {
-    // Row 14 (`DD-8`): a HOLE refuses the WHOLE value — and `isAdmittedArray` has already decided the
-    // CLASS, so `in` below reads an element of a genuine array and no chain.
-    if (!(i in address)) {
-      boundaryReject(
-        'AddressMalformed',
-        'an array with a hole',
-        `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is a sparse array, and an address is a dense array of segments`,
-      );
-    }
-    const segment = address[i];
-    // Rows 2–3: the two IN-DOMAIN classes — a string (the empty string included) and a non-negative
-    // integer. **The integer test is taken on the value as it is and nothing is repaired**: `1.5`, `-1`,
-    // `NaN` and `Infinity` are each refused as `a number`, which is the class the value HAS.
-    //
-    // **⟶ AND THE TWO CLASSES THIS PASS ADDED ARE DECIDED HERE TOO, BEFORE THE STORE IS REACHED — `C-4`'s
-    // segment half and `C-12` (`2026-10-11`).** They are the same two decisions `encodeSegment` takes for
-    // the other verbs' addresses, taken at this site's own position and with this site's own ARGUMENT
-    // POSITION spelling, **so `on` and `listen` answer one address the same way and neither reaches the
-    // carrier with a value it cannot spell**: a LONE SURROGATE in a string segment (row 1's dated clause —
-    // the class has no Rust spelling and is refused *"at the PACKAGE's own edge, BEFORE any verb is
-    // called"*, never repaired), and an INTEGRAL segment above the `u64` the carrier's `Index` variant
-    // carries (`package.md §4.5` item 2's `JsSegment` row) — **which the facade's `n as u64` used to
-    // SATURATE, folding `2**64` and `1e30` onto one store address and one handle (`C-12`).**
-    if (typeof segment === 'string') {
-      if (hasLoneSurrogate(segment)) {
-        boundaryReject(
-          'ValueNotAdmitted', // row 1's dated clause's own answer, carried and never minted (`DD-40`)
-          // **THE TARGET IS THE SEGMENT POSITION'S OWN NAME AND NOT THE STRING**: a lone surrogate cannot
-          // cross into the generator either — its bytes are not a `String` — so the failing TARGET is named
-          // as `encodeSegment` names it at the same class (`'address'`), and the failing segment is named by
-          // its INDEX beside it. **The class half is mandatory and it is carried; the failing VALUE is not
-          // printed, because the only spellings for it are the caller's own unrepresentable code unit or a
-          // REPAIR of it, and `§1.8` forbids the repair.**
-          'address',
-          `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is a string carrying a lone surrogate, and a segment is a string or a non-negative integer`,
-        );
-      }
-      continue;
-    }
-    if (typeof segment === 'number' && Number.isInteger(segment) && segment >= 0) {
-      if (!Number.isSafeInteger(segment)) {
-        boundaryReject(
-          'AddressMalformed', // `AddressArg` row 8's own declared code, carried and never minted (`DD-40`)
-          targetSpelling(segment),
-          `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is an integral segment above the carrier's own range, and a segment is a string or a non-negative integer a \`u64\` can carry exactly`,
-        );
-      }
-      continue;
-    }
-    // Rows 7–10 + `§1.2`'s class set: every other class is refused AT THE BOUNDARY, inside the one form,
-    // naming the failing SEGMENT — the target the item's own clause names — its class and the position.
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(segment),
-      `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(segment)}, and a segment is a string or a non-negative integer`,
-    );
+  if (typeof constraint !== 'function') {
+    constraintRefuse(`constraint at the ${ARGUMENT_POSITION_SECOND} of \`${verb}\``, constraint);
   }
-  return undefined;
+  return { state, address: encoded.s, id: pair.id };
 }
 
-/// **`on`'s STEP 1, WHOLE: VALIDATE THE `address` THEN THE `listener`, CLASS FIRST AND NOTHING REPAIRED**
-/// (`surface.md §2.4` item 7 (a); `A81` *"always validate"*, verbatim; `crossing.md §1.7`'s order — class,
-/// then shape, then admit-or-refuse). **EACH REFUSAL IS `AddressMalformed` IN `§2.5`'s SINGLE FORM, carrying
-/// the failing TARGET, the CLASS the value HAS and the ARGUMENT POSITION** (`§2.17`'s dated clause, whose
-/// class set is EXHAUSTIVE AND CLOSED and whose two new arms are a non-function at `2` of `2` and an
-/// `address` outside `AddressArg` at `1` of `2`).
-///
-/// **AND NOTHING IS LEFT BEHIND** (`§2.4` item 7 (a)): this function performs NO store call and no registry
-/// write, so a refusal here leaves NO STORE-SIDE HOME ENTRY, NO REGISTRY ENTRY, NO NODE MINTED AND NO
-/// JOURNAL ENTRY APPENDED — **atomicity by the validation's POSITION and not by a rollback.**
-function validateOnArguments(address, listener) {
-  validateOnAddress(address);
-  if (typeof listener !== 'function') {
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(listener),
-      `the listener at the ${ARGUMENT_POSITION_SECOND} of \`on\` is ${classSpelling(listener)}, and a listener is a JS function`,
-    );
+/// **THE ONE ACT THAT MAKES A PAIR A PAIR THE ENTRY CARRIES** (`§2.12` item 1's preamble clause (a)–(b)):
+/// `K-1` AT THE INSTANCE — the key at its own positions and the caller's function at the fourth, which is
+/// the SAME call `storeCreate`'s batch registration makes — and THE ENTRY'S OWN RECORD BESIDE IT, whose
+/// `enabled` member is the pair's state and whose `identity` is THE PAIR'S OWN OPAQUE VALUE (`PAR-JS-25`).
+/// **THE IDENTITY IS MINTED ONCE PER PAIR AND IT CARRIES NO READABLE MEMBER**: a second ADD at the same pair
+/// overwrites the element and answers THIS SAME VALUE, and two pairs answer two values. **`PAR-JS-25`'s
+/// opacity is the observable** — *"it has no own enumerable member at all"* — so it is a null-prototype
+/// object and NOT the entry record: every datum above stays the entry's own and never crosses.
+function carryConstraint(state, instance, address, id, constraint) {
+  constraintsKernel().register(instance, address, id, constraint);
+  const entry = {
+    address,
+    addressKey: JSON.stringify(address),
+    id,
+    fn: constraint,
+    enabled: true,
+    identity: Object.create(null),
+  };
+  state.constraints.set(constraintPairKey(address, id), entry);
+  return entry;
+}
+
+/// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
+/// `true` is the only pass value). **THE ELEMENT IS PARKED AND NEVER WITHDRAWN**: `constraintOn` re-registers
+/// `entry.fn`, so *"it is the element the entry carried at that pair — never a second constraint and never a
+/// re-registration"* (`§2.12` item 3's `constraintOn` row).
+function constraintParked() {
+  return true;
+}
+
+/// **A WELL-FORMED PAIR THE ENTRY DOES NOT CARRY — `§2.12` item 3's second answered question and
+/// `PAR-JS-24`'s second declared answer: at EITHER toggle, in EITHER direction, an OUTSIDE VALUE taking
+/// item 4's refusal, ONE THROWN `TypeError`, THE ENTRY NOT WIDENED.** It is NOT a third population route:
+/// were the entry widened with the function the refused call carried, a pair would stand ENABLED WITH NO
+/// FUNCTION — a state no clause of that directory declares.
+function constraintUncarried(verb, pair) {
+  throw new TypeError(
+    `the pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\` carries no constraint in this instance, and `
+    + 'a toggle names a pair the entry carries',
+  );
+}
+
+/**
+ * **`§2.12` ITEM 2 (a): `addConstraint(pair, constraint) -> constraint identity` — THE ADD ROUTE, WHICH
+ * CARRIES THE FUNCTION.**
+ *
+ * **ITS TARGET STATE AT THE PAIR IS *"the pair's element IS the supplied `constraint`, whether the pair was
+ * HELD or NOT"*, AND THE HELD ARM IS AN OVERWRITE AND NOT A THROW**: *"where the pair was already held, the
+ * supplied constraint OVERWRITES the held one … and the call REFUSES NOTHING and THROWS NOTHING for the mere
+ * fact that the pair was held"* — the SAME identity the pair was already added under is returned, and it is
+ * THE IDENTITY AND NOT THE ENTRY RECORD (`PAR-JS-25`'s opacity, `carryConstraint` above).
+ */
+function addConstraint(instance, n, pair, constraint) {
+  const site = constraintSite('addConstraint', instance, n, pair, constraint);
+  const key = constraintPairKey(site.address, site.id);
+  const held = site.state.constraints.get(key);
+  if (held === undefined) {
+    return carryConstraint(site.state, instance, site.address, site.id, constraint).identity;
   }
+  constraintsKernel().register(instance, site.address, site.id, constraint);
+  held.fn = constraint;
+  held.enabled = true;
+  return held.identity;
 }
 
-/// **`on(address, listener) -> handle`** — `surface.md §2.4` item 7 (a), ITS THREE STEPS IN THEIR ONE FIXED
-/// ORDER, AND NO FOURTH:
-/// ```
-///   1. VALIDATE   this file's own step, above: the address, then the listener, class first, never repaired
-///   2. LISTEN     the store's own listen(instance, address)   — the SAME declared verb, unchanged
-///   3. REGISTER   the package's registry takes the returned handle with this listener (rule 2 = replacement)
-/// ```
-/// **THE RETURN IS THE HANDLE** in `§2.3` item 2's ONE output spelling — the package's opaque value and
-/// never the token string. **AND AT AN ADDRESS THE STORE'S HOME ALREADY HOLDS IT RETURNS THAT ADDRESS'S
-/// EXISTING HANDLE**, because the store's own address-level idempotence makes a repeat `listen` mint
-/// nothing and answer the entry's own handle (`write-and-read.md §6.5` item 12 (c); `§2.3`'s dated clause).
-/// **THE TWO ARMS ARE THEREFORE THESE AND NO OTHERS:** the FRESH arm, where the store minted a token and
-/// the package wrapped it, and the HELD arm, where the SAME opaque value is answered again and the
-/// registry's function for it becomes THIS listener — **a REPLACEMENT, never a second entry and never a
-/// fan-out** (`§2.4` rule 2), and **including over an entry `register` placed, which `DD-52` settles: the
-/// registry does not record which member wrote an entry.** **SO A LATER WRITE UNDER THAT ADDRESS INVOKES
-/// THIS FUNCTION ONCE AND THE REPLACED ONE NEVER FIRES AGAIN** — and *which* listener fires and *when* is
-/// the STORE's rule, derived from `write-and-read.md §6.5` item 14 and never stated here.
-function onAt(state, instance, address, listener) {
-  // STEP 1 — VALIDATE. Nothing below runs unless BOTH arguments have passed (`A81`; `A76`).
-  validateOnArguments(address, listener);
-  // STEP 2 — LISTEN. The store's own verb, reached with the address the caller supplied and through this
-  // package's ONE declared `listen` spelling (`§2.10`): same name, same position, same arity, same return.
-  const handle = listen(instance, address);
-  // STEP 3 — REGISTER. `§2.4` rule 2 at the registry that holds the function: ONE identity, ONE function.
-  state.registry.set(handle, listener);
-  return handle;
-}
-
-/// **`off(handle) -> undefined`** — `surface.md §2.4` item 7 (b), ITS THREE STEPS IN THEIR ONE FIXED ORDER,
-/// AND `DD-54`'s ONE OBSERVABLE: **after any `off` that throws, BOTH the store-side entry and the registry
-/// entry are exactly as they were.**
-/// ```
-///   1. VALIDATE    the handle against THIS INSTANCE's own handle domain, class first, never repaired
-///   2. UNLISTEN    the store's own unlisten(instance, handle)   — the same declared verb, unchanged
-///   3. DEREGISTER  the package's own registry entry for that identity, and NOTHING ELSE
-/// ```
-/// **AND ITS THREE ARMS, EACH WITH ITS OBSERVABLE** (item 7 (b)'s own table):
-///   * **THE OWN ARM** — an in-domain identity the registry holds a function for: the store-side home entry
-///     is withdrawn, the registry's entry for that identity is REMOVED, and `undefined` is returned.
-///   * **THE OWN-ENTRYLESS ARM** — an in-domain identity the registry holds NO function for (registered
-///     never, or already withdrawn): `undefined`, the store-side withdrawal IS performed, nothing is
-///     removed that was not there and NO OTHER REGISTRATION IS DISTURBED (`DD-53`: `off`'s refusal arm is
-///     the OUTSIDE-DOMAIN handle ALONE).
-///   * **THE OUTSIDE ARM** — a foreign instance's value, a prior session's value, a fabricated value, a bare
-///     `string`, a blank token, a non-opaque value, `null`, `undefined` or an ABSENT argument: **a REFUSAL**
-///     — `AddressMalformed` in `§2.5`'s single form, with the failing target, the class and the position —
-///     **and NEITHER removal is performed.** **THIS is the arm that makes `off` differ from `unlisten` over
-///     one value, and the difference is DECLARED and not incidental** (`§2.3`'s dated clause 3; `§2.8`).
-///
-/// **`unlisten` ITSELF IS UNTOUCHED AND KEEPS RULE 4 VERBATIM**: it withdraws the registration and NEVER the
-/// function, with the registry's entry STANDING. `off` is the PACKAGE-OWNED verb that removes one, and a
-/// reader who takes it as an exception to rule 4 has read a second withdrawal into the store's surface —
-/// there is none. **AND `off` REMOVES NO MORE THAN THE HANDLE NAMES**: a lawful sibling registration —
-/// another address's entry, another identity in the same instance — STANDS. **AND NEITHER IT NOR `on` IS A
-/// RELEASE VERB** (`A74`): no `dispose()`, no `close()`, no finalizer and no teardown is declared here, and
-/// the instance's state is still released with the instance and by nothing else.
-///
-/// **AND `off` DOES NOT CANCEL A DELIVERY IN FLIGHT**, because the delivery's recipient set is read when the
-/// window opens (item 7 (b); `§2.4`'s `CF-DUP-3` re-homing clause; `write-and-read.md §6.5` item 14).
-function offAt(state, instance, handle) {
-  // STEP 1 — VALIDATE. An outside value is refused HERE, and steps 2 and 3 never run (`DD-54`).
-  const encoded = encodeHandle(state, handle);
-  if (encoded.k !== 'O') {
-    // The ONE form, with the failing TARGET printed as its own value (item 5 (a)), the CLASS the value HAS
-    // (item 5 (b), mandatory) and the ARGUMENT POSITION (`§2.17`'s dated clause, `1` of `2`) — **and NOT
-    // `unlisten`'s no-op `undefined`, which is that verb's own declared answer and not this one's.**
-    boundaryReject(
-      'AddressMalformed', // `§2.8`'s own declared code at this site, carried and never minted (`DD-40`)
-      targetSpelling(handle),
-      `the handle at the ${ARGUMENT_POSITION_FIRST} of \`off\` is ${classSpelling(handle)}, and it is not an opaque value THIS INSTANCE minted or adopted`,
-    );
+/**
+ * **`§2.12` ITEM 2 (a): `constraintOn(pair, constraint) -> undefined` / `constraintOff(pair, constraint) ->
+ * undefined` — THE TWO HALVES OF THE ONE TOGGLE, AND NEITHER STANDS IN THE KERNEL.**
+ *
+ * **THEIR THREE ANSWERS, AND THE TWO SHARED CLAUSES:**
+ *   * **IDEMPOTENT SUCCESS WHERE THE PAIR ALREADY STANDS IN THE STATE IT ASKS FOR** (item 3's first answered
+ *     question): `undefined`, the pair and its element EXACTLY as they stood, and NOTHING THROWN.
+ *   * **THE SECOND POSITION IS REQUIRED AND IS A NO-OP ON EVERY SUCCESS** (`item 3`'s `constraintOn` row;
+ *     `§2.4` item 9 (f)'s method table: *"the third position is REQUIRED and is a no-op on success"*): a
+ *     FUNCTION there is never refused on the pair's ground, the entry NEVER SUBSTITUTES ONE, and it is
+ *     `entry.fn` — the element the entry carried — that is evaluated at the next write. **CARRIAGE IS
+ *     PAIR-KEYED AND THE TOGGLE'S OWN ARGUMENTS DO NOT DECIDE IT.**
+ *   * **AN OUTSIDE `pair` OR A SHORT ARITY TAKES `constraintSite`'s ONE `TypeError`**, and a WELL-FORMED PAIR
+ *     THE ENTRY DOES NOT CARRY takes `constraintUncarried`'s (`A126`).
+ */
+function constraintToggle(enabled, instance, n, pair, constraint) {
+  const verb = enabled ? 'constraintOn' : 'constraintOff';
+  const site = constraintSite(verb, instance, n, pair, constraint);
+  const entry = site.state.constraints.get(constraintPairKey(site.address, site.id));
+  if (entry === undefined) constraintUncarried(verb, pair);
+  if (entry.enabled !== enabled) {
+    constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    entry.enabled = enabled;
   }
-  // STEP 2 — UNLISTEN. The store's own verb through the ONE declared `unlisten` spelling (`§2.10`), reached
-  // with the handle this instance already owns. **A THROWING PATH LEAVES THE REGISTRY ENTRY STANDING**
-  // (`DD-54`): there is no `finally` here and none may be added.
-  unlisten(instance, handle);
-  // STEP 3 — DEREGISTER, the PACKAGE'S OWN state and nothing of the store's.
-  deregister(state, handle);
   return undefined;
 }
 
-/// **THE DEREGISTRATION OF ONE IDENTITY — `§2.4` item 7 (b)'s THIRD STEP.** The registry's entry for THIS
-/// identity is removed, and NOTHING ELSE OF THE PACKAGE'S STATE: **the identity's own token-to-handle
-/// binding STANDS**, because it is not the withdrawal's to move and three declared answers rest on it —
-/// `register(h, …)` over a handle this instance adopted or minted is judged by the INSTANCE's own domain
-/// (`§2.4` item 5 (c)) and not by which verbs have run since, `unlisten`'s OPAQUE-only acceptance is the
-/// same domain (`§2.3` item 2), and `off`'s own ENTRY-LESS arm is declared over an identity that has
-/// ALREADY been removed by an earlier `off` (`DD-53`). **AND NO LATER `listen` CAN BE HANDED THIS BINDING
-/// BY ACCIDENT**, because the store MINTS A FRESH TOKEN after its home entry is withdrawn
-/// (`write-and-read.md §6.5` item 12; `A69`'s uniqueness is over the tokens the store MINTS), so a re-`listen`
-/// at the same address reaches `wrapHandles` with a token no map entry holds and is wrapped as a NEW
-/// identity — which is exactly `§2.4` rule 4's *"a later re-`listen` … mints a DIFFERENT handle"*. **A drive
-/// that finds the withdrawn identity's function reachable after one `off` has found a failure of this step
-/// and not of this sentence.**
-function deregister(state, handle) {
-  state.registry.delete(handle);
+/// **WHETHER THIS INSTANCE CARRIES A PAIR AT THIS WRITE'S ADDRESS** (`§2.12` item 1's preamble clause (a)) —
+/// the gate stage 1 takes before the kernel is reached at all. **THE CLASS DECISION COMES FIRST AND NO TRAP
+/// IS RUN ON ANY PATH** (`DD-34`): a `Proxy` address, a class extending `Array` and every non-array lies
+/// outside every pair's own address domain, so no pair of this entry can stand at one.
+function carriesConstraintAt(state, address) {
+  if (state.constraints.size === 0) return false;
+  if (types.isProxy(address) || !isAdmittedArray(address)) return false;
+  const key = JSON.stringify(address);
+  for (const entry of state.constraints.values()) {
+    if (entry.addressKey === key) return true;
+  }
+  return false;
+}
+
+/**
+ * **THE KERNEL-DRIVEN WRITE — `§2.12` ITEM 1'S FIVE STAGES, TAKEN IN THEIR ONE ORDER.**
+ * ```
+ *   1. K-2      the attempt is opened at this address, or the address's own live attempt is JOINED
+ *   2. the store leg     the kernel's own call on this entry's `write`, FIVE POSITIONS, the record
+ *                        identity its fifth position carries — so the delivery of that write's handles
+ *                        is WITHHELD here and owed to stage 5
+ *   3. K-3      the pass: every pair registered at this address, each against this op's own value
+ *   4. K-3      the attempt's terminal arm — the pass's, or the floor's where a save failed
+ *   5. settle   the residue the record's `pending` carries, delivered at instant (b), failing arm alone
+ * ```
+ * **THE CALLER MEETS A THROW INSTEAD OF A RETURN ON THE FAILING ARM, AND THE STORE'S OWN VERB PRODUCED
+ * NEITHER FORM** (`§1.2` item 2): see `constraintCrossing` for what crosses.
+ */
+function constraintWrite(state, instance, address, tier, value) {
+  const kernel = constraintsKernel();
+  let record;
+  try {
+    record = kernel.commit(instance, address, tier, value);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  const answer = state.leg;
+  try {
+    kernel.runAttempt(instance, record);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  return answer;
+}
+
+/// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
+/// STORE'S.** `§2.12` item 1's read-through clause fixes what crosses here: **A PLAIN OBJECT OF EXACTLY THE
+/// TWO MEMBERS `status` AND `message`, `status` A STRING DRAWN FROM THE STORE'S CLOSED `16`-MEMBER SET, the
+/// kernel's third member `log` ABSENT AND UNREACHABLE.** The member `status` carries is the store's
+/// `FileCommitFailed`, because no caller-side status can carry a `KC` token and a constraint-refused write
+/// is a commit that did not stand. **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED** (`§1.2`).
+function constraintCrossing(refusal) {
+  const status = refusal !== null && typeof refusal === 'object' ? refusal.status : undefined;
+  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) throw refusal;
+  throw {
+    status: 'FileCommitFailed',
+    message: typeof refusal.message === 'string'
+      ? refusal.message
+      : 'the write was refused by a constraint of this attempt',
+  };
 }
 
-// `delete` is a reserved word and the declared spelling is preserved on the way out.
-export { deleteOp as delete };
+// **THE MODULE NAMESPACE CARRIES ONE NAME, `storeCreate` ALONE** (`surface.md §2.9` item 1's `A127` clause;
+// `11 → 1` ✓): `delete`'s reserved-word spelling, the ten store-reaching names and the three constraint
+// functions are the product's own members above and have no export and no second spelling at any layer.