provident-storeroom 0.2.0 → 0.3.1

package/index.mjs

@@ -433,14 +433,34 @@ function withAddon() {
 /// NOTHING on this path coerces the value: no `Number(...)`, no `String(...)`, no `valueOf`, no
 /// `Symbol.toPrimitive` and no trap is ever invoked, so no host `TypeError` can be raised from this frame
 /// in the first place.**
-function boundaryReject(status, subject, clause) {
+///
+/// **⟶ AND THE FAILING SEGMENT'S CONTAINER IS HANDED TO THE GENERATOR'S OWN `<container>` SLOT, ADDED
+/// 2026-10-17 (`§2.5` item 5 (a)–(b) AND ITS `CF-3` AUTHORITY SPLIT; `docs/specs/storeroom-native/contract.md`
+/// §8.2's `MessageArgs.container`, *"the container or node the mismatch was found in: `''` for the register,
+/// a dotted path otherwise"*).** **THE DEFECT IT CLOSES, NAMED: the two-slot route filled `segment` and
+/// `path` ALONE, so `container` took its default and PART ONE READ *"the number 1.5 is not a legal address
+/// segment in `''`"* — a FALSE container — while PART TWO appended *"in 'a'"* and the store's own bytes for
+/// that same input are `the number 1.5 is not a legal address segment in 'a'` (`src/store.rs`'s `listen`
+/// arm, whose container is the prefix `['a']`; `src/error.rs`'s `malformed_segment`).** **TWO CONTAINERS
+/// STOOD, ONE OF THEM FALSE; ONE STANDS NOW AND IT IS THE TRUE ONE.** **`container` is the failing
+/// segment's OWN PREFIX — the store's own `dotted_address` spelling of it — and `undefined` at every site
+/// that declares none, where the slot is left at its default and THE GENERATOR'S OWN BYTES ARE UNMOVED**
+/// (the two-argument `errorMessage(code, subject)` call included).
+function boundaryReject(status, subject, clause, container) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') {
     // An artefact that LOADED but does not carry the generator is not the declared artefact: the state is
     // the declared absent/failed-addon one, and its message is the generator's own rendering reproduced.
     fail({ status: 'FilePathUnreachable', message: generatorFilePathUnreachable(ADDON_PATH) });
   }
-  fail({ status, message: `${addon_.errorMessage(status, subject)}, ${clause}` });
+  // **THE CONTAINER IS THE PREFIX'S OWN DOTTED SPELLING AND NOTHING ELSE** (`src/error.rs`'s
+  // `dotted_address`: a key bare, an index bare, joined by `.`) — the same reading the store's own
+  // `malformed_segment` triggers take, where the container is the segment the mismatch was found in.
+  const where = container === undefined ? undefined : container.map((segment) => String(segment)).join('.');
+  const generated = where === undefined
+    ? addon_.errorMessage(status, subject)
+    : addon_.errorMessage(status, subject, where);
+  fail({ status, message: `${generated}, ${clause}` });
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -976,6 +996,129 @@ function encodeSegment(segment, position, argumentPosition) {
   return { bad: 'object' };
 }
 
+/// **A SEGMENT'S OWN CLASS OUTSIDE `PAR-JS-5`'s DOMAIN, DECIDED AT THE PACKAGE'S OWN BOUNDARY AND REFUSED
+/// `AddressMalformed` — THE OUTSIDE-VALUE CLASSIFICATION, TAKEN **BEFORE** THE STORE IS REACHED AND SO
+/// BEFORE ANY ABSENT-KEY LOOKUP** (`parameter-semantics.md §2.5` line `357`: *"**The declared answer for EACH
+/// outside value** — **`AddressMalformed` for every one of them, with the store's generated message**"*,
+/// the fourteen carrier-variant rows `crossing.md §1.3` names — *"an array holding a negative integer · an
+/// array holding a non-integer number · an array holding `null`/`undefined`/a boolean/an object/a nested
+/// array/a function"*).
+///
+/// **WHY THE DECISION STANDS HERE AND NOT AT THE STORE: a well-formed address no node holds is the store's
+/// own `AddressNotFound` (`a127-surface.test.mjs`'s F1 arm asserts that code at the ABSENT position), while
+/// a node HELD and a segment outside the domain must answer `AddressMalformed` — so the CLASS must be
+/// decided before the lookup rather than after it. The store's own walk decides it at `write` · `delete` ·
+/// `listen` (`src/args.rs`, `src/store.rs`); at the READER the carrier reaches the walk FIRST, which returns
+/// `AddressNotFound` for a held key. **The class is decided ONCE, at `encodeAddress`, for every verb alike**,
+/// so no verb's address position can answer a lookup's code for a class the row refuses.
+///
+/// **THE MESSAGE IS THE STORE'S GENERATED ONE AND NEVER AN AUTHORED ONE** (`boundaryReject` reaches the
+/// addon's `errorMessage`, `§2.5` item 2): the SUBJECT is the failing segment's own spelling as the store's
+/// generator renders it (`src/value.rs`'s `Segment::spelling`), and *"the integer `-1`"*, *"a shapeless
+/// value"*, *"a boolean"*, *"an array"* and *"a Proxy"* are that rendering carried here, not invented.
+/// **NOTHING IS COERCED** (`A76`/`JS-1`): the class is read with `typeof`, `Number.isInteger` and
+/// `Array.isArray` alone — no `String(segment)`, no `Number(segment)`, no `valueOf` and no trap — so a
+/// segment that is a `Proxy` is refused by `util.types.isProxy` and NO TRAP RUNS (`surface.md §2.4` item 7
+/// (a) item 1; `crossing.md §1.4` item 4; `C-1`).
+/// **THE CONTAINER IS NOW A PREFIX ARGUMENT AND NOT A SPELLED STRING, 2026-10-17** (`§2.5` item 5 (a)–(b)):
+/// the segments the failing one stood in are handed to `boundaryReject`, which passes the store's own
+/// `dotted_address` spelling of them into the generator's `<container>` slot, so **the container is stated
+/// ONCE and by the store's generator** — and PART TWO carries the reason's class-and-position half ALONE,
+/// which is the half `§2.5` item 5 (b) declares the boundary's own (*"the ARGUMENT POSITION … is carried
+/// INSIDE the generated message's own text"*) and is never a second container claim.
+function refuseOutsideSegment(segment, position, prefix, addressArgumentPosition) {
+  const kind = typeof segment;
+  let subject;
+  if (segment === null) subject = 'a shapeless value';
+  else if (kind === 'undefined') subject = 'an absent value';
+  else if (kind === 'boolean') subject = 'a boolean';
+  else if (kind === 'number') subject = Number.isInteger(segment) ? `the integer ${segment}` : `the number ${segment}`;
+  else if (kind === 'function') subject = 'a function';
+  else if (kind === 'symbol' || kind === 'bigint') subject = classSpelling(segment);
+  else if (Array.isArray(segment)) subject = 'an array';
+  else subject = 'an object'; // a `Proxy` over an array included: its class is `an object` to the carrier
+  boundaryReject(
+    'AddressMalformed', // `PAR-JS-5`'s own declared answer for every one of the fourteen rows, carried (`DD-40`)
+    subject,
+    addressArgumentPosition === undefined
+      ? `the address holds ${subject} at position ${position}, and a segment is a string or a non-negative integer`
+      : `the address holds ${subject} at position ${position} of the ${addressArgumentPosition}, and a segment is a string or a non-negative integer`,
+    prefix,
+  );
+  return { bad: 'object' }; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
+/// **`AddressArg` ROWS 5–6'S OUTSIDE SHAPE, DECIDED ON THE VALUE AS IT IS AND BEFORE ANY READ** (`A76`'s
+/// class-first order; `C-1`): everything that is neither an `Array` nor a `Proxy` is rows 5–6's outside
+/// value at the ADDRESS position — **and a `Proxy` is NOT this arm**: its own refusal stands above, where the
+/// class decision is taken on `util.types.isProxy` before any `.length` read and before any element
+/// (`surface.md §2.4` item 7 (a) item 1; `crossing.md` `AddressArg` row 12; `DD-34`), so no trap is run by
+/// THIS predicate either.
+function isOutsideAddressValue(value) {
+  if (value === undefined || value === null) return true; // row 5's two named classes, on the value as it is
+  if (types.isProxy(value)) return false; // row 12's own arm, decided above, with no trap run
+  if (Array.isArray(value)) return false; // rows 1–3, 13, 14 — the ordinary array arm and its own tests
+  return true; // rows 5–6: a string, a number, a boolean, an object, a function, a symbol, a bigint
+}
+
+/// **THE VALUE-SHAPE ARM OF `AddressArg` ROWS 5–6 — A NON-ARRAY OUTSIDE VALUE AT AN ADDRESS POSITION,
+/// REFUSED AT THE BOUNDARY WITH ITS OWN RENDERING AND THE ARGUMENT POSITION IT STANDS AT** (`surface.md`
+/// §2.5 item 5 (a)–(b); the `CF-3` authority split).
+///
+/// **THE DEFECT IT CLOSES, NAMED AS THE SUPERVISOR'S OWN RECORD NAMES IT** (`archive/reviews/
+/// 2026-10-16-constraints-publication-gate1.md` §57, finding `2`): at EVERY address position — `listen`,
+/// `read`, `write`, `delete`, `readLiteral` — a NON-ARRAY outside value (`'a.b'`, `7`, `null`, `undefined`)
+/// answered the store's GENERIC line *"the address argument is not a legal address segment in `''` …"*,
+/// **carrying the class half and NEITHER the failing TARGET NOR the argument POSITION** — while `§2.5` item 5
+/// (a) makes the failing target mandatory and item 5 (b) makes the ARGUMENT POSITION mandatory where the
+/// contract declares one (and a verb's argument position is the one place it does). **IT WAS HIDDEN UNTIL
+/// NOW because the older `register` subject carried both at a HANDLE position — a VALUE position, where a
+/// non-segment value is printed as its own value — and once the subject moved to an ADDRESS position the gap
+/// became visible.**
+///
+/// **WHAT IS DECLARED, AND WHAT THIS SITE THEREFORE DOES:**
+///   * **THE TARGET IS THE VALUE'S OWN RENDERING** (item 5 (a): *"a non-segment value PRINTED AS ITS OWN
+///     VALUE … where the failure is about a value and not about a segment"*), in the spelling the store's own
+///     generator and this package already give that value at every other site: `the number 7` · `the string
+///     'a.b'` · `null` · `undefined` — **and a class whose own value cannot be printed (a `bool` · a
+///     `function` · an `object` · a `Proxy`) is rendered by the store's own class spelling for it**, exactly
+///     as `refuseOutsideSegment` renders the same classes at a SEGMENT position.
+///   * **THE POSITION IS THE ARGUMENT POSITION** the verb's own signature declares (item 5 (b): *"the
+///     ARGUMENT POSITION for a verb's arguments"*) — `first argument` at all five verbs, whose `address` is
+///     the first position of each (`surface.md` §2.4 item 9 (f)'s table).
+///   * **AND THE CONTAINER IS THE ARGUMENT ITSELF AND NEVER THE EMPTY REGISTER.** **THE ONE DECISION THE
+///     CLAUSE DOES NOT PIN, STATED RATHER THAN GUESSED:** the store's `AddressMalformed` template always
+///     prints a container (`src/error.rs`, *"… in '{container}', …"*), and the store's own trigger for this
+///     state supplies the empty string (`malformed_address_argument`, whose rendering *"… in '', …"* names
+///     THE REGISTER). **THAT CONTAINER IS FALSE HERE** — a whole-address SHAPE failure is found in no
+///     container at all, the address argument never having resolved against the register — so the truthfully
+///     filled slot is the failing ARGUMENT's own name, `address`, which is the same reading the store's own
+///     `ConstraintListInvalid` row takes where the container is a KEY and not an address (`'constraints'`;
+///     `docs/specs/storeroom-native/contract.md` §8.2's row and its `<CONTAINERSEGMENT>` degenerate arm).
+///     **NO CLAUSE FIXES THIS WORDING: the clause fixes the TARGET, the CLASS and the POSITION, and the
+///     container is this site's own truth claim.** **PART TWO then carries the reason's class half and the
+///     position, appended after a separator, exactly as `boundaryReject` appends it at every other site.**
+function refuseOutsideAddressValue(address, addressArgumentPosition) {
+  const kind = typeof address;
+  let subject;
+  if (address === null) subject = 'null';
+  else if (kind === 'undefined') subject = 'undefined';
+  else if (kind === 'number') subject = `the number ${address}`;
+  else if (kind === 'string') subject = `the string '${address}'`;
+  else if (kind === 'boolean') subject = 'a boolean';
+  else if (kind === 'function') subject = 'a function';
+  else if (kind === 'symbol' || kind === 'bigint') subject = classSpelling(address);
+  else subject = 'an object'; // a `Proxy` over a plain object included: its class is `an object` to the carrier
+  // **THE CONTAINER SLOT CARRIES THE ARGUMENT'S OWN NAME AND NOT `''`** — see this site's own clause above.
+  boundaryReject(
+    'AddressMalformed', // `AddressArg` rows 5–6's own declared code, carried and never minted (`DD-40`)
+    subject,
+    `the address position holds ${subject} at the ${addressArgumentPosition}, and an address is an array of segments`,
+    ['address'],
+  );
+  return { k: 'A' }; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
 /// `crossing.md §1.3`'s `AddressArg` table, rows 1–14.
 ///
 /// **⟶ AND ONE OPTIONAL PARAMETER, ADDED 2026-10-11 BY THE `Q3` PASS, SO `on` CAN OBEY `A81` WITHOUT A
@@ -985,27 +1128,80 @@ function encodeSegment(segment, position, argumentPosition) {
 /// refuses at the BOUNDARY rather than carrying its class to the store. **EVERY OTHER CALLER PASSES
 /// NOTHING AND EVERY BYTE OF EVERY OTHER ARM IS UNMOVED**, so no verb's answer and no other site's message
 /// changes: the parameter is additive and its absence is the as-filed reading.
-function encodeAddress(address, addressArgumentPosition) {
+///
+/// **⟶ AND FROM 2026-10-17 A SECOND, SEPARATE POSITION PARAMETER GOVERNS `AddressArg` ROWS 5–6**
+/// (`§2.5` item 5 (a)–(b); see `refuseOutsideAddressValue` above): a NON-ARRAY outside value — a supplied
+/// `undefined`, a `null`, a string, a number, a boolean, an object, a function — is refused at the boundary
+/// at EVERY verb that declares an argument position, verbosely, carrying its own rendering and that position.
+///
+/// **WHY IT IS A SEPARATE PARAMETER AND NOT THE SAME ONE, STATED SO THE BLAST RADIUS IS EXACTLY ONE ARM:**
+/// `addressArgumentPosition` is the SEGMENT arm's (`rows 7–10`, and the `Proxy` and out-of-range arms) and it
+/// is passed by `listen` ALONE, so the segment arm's bytes at the other four verbs are UNMOVED — **THE
+/// INSTRUCTION IS THAT NO MESSAGE ALREADY CORRECT MOVES, and the supervisor's defect is the NON-ARRAY arm
+/// only.** `addressValuePosition` reaches the arms THIS PASS REPAIRS, and nothing else.
+/// **WHERE NO VALUE POSITION IS PASSED — the construction's `listeners[]` walk, which calls this encoder with
+/// one argument — EVERY BYTE IS UNMOVED and the store answers the construction itself** (`PAR-JS-21`; the
+/// construction's own answer is the store's, and no argument position is declared at that site).
+function encodeAddress(address, addressArgumentPosition, addressValuePosition) {
   // `crossing.md §1.3`'s absent-versus-`undefined` rule, rule 1: an argument position the call supplied no
   // value for is ABSENT, and `undefined` at a supplied position folds to that SAME state. `AddressArg` rows
   // 4 and 5 answer the one code, so no declared answer moves by the fold.
+  //
+  // **⟶ AND AT A SITE THAT DECLARES AN ARGUMENT POSITION, ROWS 5 AND 6 ARE ANSWERED HERE AND VERBOSELY**
+  // (`§2.5` item 5 (a)–(b); `refuseOutsideAddressValue`): a supplied `undefined`, a `null` and every
+  // non-array carry their OWN RENDERING and the POSITION instead of the store's generic argument-shaped line.
+  // **THE ARITY-ABSENT CALL IS NOT THIS ARM AND CHANGES NOTHING**: `undefined` reaches this encoder only
+  // from a call that SUPPLIED it (every caller passes `[encodeAddress(address)]` under its own `n >= 1`
+  // test), while the NO-ARGUMENT call reaches the store as its own carrier and answers there — which is
+  // `CF-3`'s part 5 unmoved (*"an absent CARRIER argument … crosses to the store as its own carrier value"*).
+  if (addressValuePosition !== undefined && isOutsideAddressValue(address)) {
+    refuseOutsideAddressValue(address, addressValuePosition);
+  }
   if (address === undefined) return { k: 'A' };
   if (address === null) return { k: 'N' };
-  // **`A76`/`JS-2`: THE CLASS DECISION COMES FIRST HERE TOO, ON THE ADDRESS AS IT IS.** A `Proxy` is
-  // refused BEFORE the array shape test and before any element is read (row 12, `DD-34`), and a class
-  // extending `Array` — for which `Array.isArray` is TRUE — is refused under its own declared class
-  // (`AddressArg` row 11's `AddressMalformed`: *"the shape is not an array"*) rather than ADMITTED as an
-  // address because a language predicate made it look like one.
-  if (types.isProxy(address)) return { k: 'X' }; // row 12 (`DD-34`)
+  // **`A76`/`JS-2`: THE CLASS DECISION COMES FIRST HERE TOO, ON THE ADDRESS AS IT IS — AND THE `Proxy`
+  // REFUSAL IS PART OF THAT DECISION AND NOT BESIDE IT** (`surface.md §2.4` item 7 (a) item 1: *"the `Proxy`
+  // refusal is part of that decision, not beside it … BEFORE the shape test, BEFORE `Array.isArray`, BEFORE
+  // any `.length` read and BEFORE any element is read"*). **`util.types.isProxy` READS NO MEMBER AND
+  // INVOKES NO HANDLER**, which is what makes the class decidable with NO TRAP RUN at both proxies-over-array
+  // and proxies-over-object (`crossing.md §1.4` item 4; `DD-34`; `C-1`). **AND `§2.5` item 5 (b) MAKES THE
+  // CLASS HALF MANDATORY**: the refusal's message carries `a Proxy` and the POSITION, so the class the value
+  // HAS is named rather than the store's own generic object arm; a class extending `Array` — for which
+  // `Array.isArray` is TRUE — is refused under its own declared class (`AddressArg` row 11's
+  // `AddressMalformed`: *"the shape is not an array"*) rather than ADMITTED because a language predicate made
+  // it look like one.
+  if (types.isProxy(address)) {
+    boundaryReject(
+      'AddressMalformed', // row 12's own declared code (`DD-34`), carried and never minted (`DD-40`)
+      classSpelling(address), // the class half, mandatory under item 5 (b): `a Proxy`
+      addressArgumentPosition === undefined
+        ? 'the address position holds a Proxy, and a Proxy over an array is refused as AddressArg row 12\'s own class with no trap run'
+        : `the address position of the ${addressArgumentPosition} holds a Proxy, and a Proxy over an array is refused as AddressArg row 12's own class with no trap run`,
+    );
+  }
   if (Array.isArray(address)) {
     if (arrayClass(address) === 'class') return { k: 'C' }; // row 11: a class extending `Array`
     for (let i = 0; i < address.length; i += 1) {
       if (!(i in address)) return { k: 'S' }; // row 14 (`DD-8`)
     }
-    return {
-      k: 'L',
-      s: address.map((segment, position) => encodeSegment(segment, position, addressArgumentPosition)),
-    }; // rows 1–3, 13
+    const segments = [];
+    for (let i = 0; i < address.length; i += 1) {
+      const segment = address[i];
+      const encoded = encodeSegment(segment, i, addressArgumentPosition);
+      // **`PAR-JS-5`: THE FOURTEEN ROWS' CLASS IS DECIDED HERE, BEFORE THE STORE AND BEFORE ANY LOOKUP**
+      // — a `{bad: …}` marker, a negative or non-integer number, a boolean, or a `Proxy` over an array.
+      const outsideMarker = encoded !== null && typeof encoded === 'object' && typeof encoded.bad === 'string';
+      const outsideNumber = typeof segment === 'number' && !(Number.isInteger(segment) && segment >= 0);
+      if (outsideMarker || typeof segment === 'boolean' || outsideNumber) {
+        // **AND THE PREFIX IS THE SEGMENTS THIS ONE STOOD IN AND NOTHING ELSE** — the container the
+        // store's own `malformed_segment` names at its `L-1` arm (the store's walk pushes each in-domain
+        // segment into its own container before it tests the next), so the refusal's container is the
+        // SAME datum at both layers and not a second spelling of it.
+        refuseOutsideSegment(segment, i, address.slice(0, i), addressArgumentPosition);
+      }
+      segments.push(encoded);
+    }
+    return { k: 'L', s: segments }; // rows 1–3, 13
   }
   if (typeof address === 'object') return { k: 'C' }; // rows 6 and 11: the shape is not an array's
   return { k: 'D', o: encodeSegment(address, 0) }; // row 6: a non-array's five named classes
@@ -1013,20 +1209,122 @@ function encodeAddress(address, addressArgumentPosition) {
 
 /// `crossing.md §1.3`'s `TierArg` table and `TierSetItem` table.
 ///
-/// **THE TWO READERS AND THE TWO WRITERS ARE READ DIFFERENTLY, AND `§1.3` SAYS SO:** rule 1 reads a VERB's
-/// trailing argument BY CALL ARITY and folds a supplied `undefined` to the ABSENT row **for `read` ·
-/// `readLiteral` and `write`** — which is why `read(i, a, undefined)` answers the value while `read(i, a,
-/// null)` answers row 4 — **while `delete`'s `tier` is reached as a VALUE, and its own `null`/`undefined`
-/// row is row 4's `AddressMalformed`.**
+/// **A SUPPLIED `undefined` IS PRESENT AT THIS POSITION AND `delete`'s TIER IS REACHED AS A VALUE — THE ONE
+/// CALL THAT FOLDS TO THE ABSENT ROW IS THE CALL THAT SUPPLIED NOTHING THERE.** **⟶ ADJUDICATED 2026-10-16,
+/// AND THIS CLAUSE IS THE OPERATIVE READING OF THE BYTES BELOW** (`parameter-semantics.md §2.6`'s
+/// `PAR-JS-6` row, its `the declared answer for EACH outside value` cell as reconciled the same date, whose
+/// words are *"`a.read(address, undefined)` IS A SUPPLIED VALUE AT THIS POSITION AND TAKES `PAR-JS-6`'s
+/// DECLARED ANSWER — the store's own thrown `{status, message}` with `status` `AddressMalformed` — while the
+/// ONE CALL THAT FOLDS TO THE ABSENT ROW IS `a.read(address)`, WHICH SUPPLIED NOTHING THERE"*; the same
+/// adjudication stands at `acceptance.md §4.1` item `7`, whose *"folds to the ABSENT row"* is read through
+/// that row from that date). **SO `foldsUndefined` IS `false` AT EVERY SUPPLYING SITE — `read` ·
+/// `readLiteral` · `write` · `delete` — and the arity fold that reaches `{ k: 'A' }` is the NO-ARGUMENT CALL
+/// ALONE**, which is exactly what `supplied` carries: `n >= 2` at the readers and the writers, read off the
+/// METHOD's own call arity (`§2.12` item 3's one-spelling rule). **THE STORE'S OWN `TierArg::Undefined` ARM
+/// ANSWERS `AddressMalformed` AT ALL FOUR** (`src/args.rs`'s `read_tier_sel` and `write_tier`), so no code is
+/// minted here and the answer is the store's own.
 ///
 /// **AND `A76`'S CLASS ORDER IS TAKEN HERE FIRST (`JS-2`'s reach at this carrier):** a `Proxy` is refused
 /// as an OBJECT before any element is read from it — **so a throwing `get` trap cannot be raised, because
 /// nothing reads the proxy** — and a class extending `Array` is refused as an OBJECT (`TierArg` row 6's
 /// `OutOfDomainTier`) rather than admitted as the array spelling row 2 declares for the readers.
-function encodeTier(tier, supplied, foldsUndefined) {
+/// **THE SUPPLIED-`undefined`-TIER ARM AT AN ADDRESS POSITION** — `refuseOutsideAddressValue`'s own
+/// shape, taken at the one value that reached neither of the boundary's two segment/address arms
+/// (`DEF-2026-10-17-A`; `surface.md §2.5` item 5 (a)–(b) and its `CF-3` authority split).
+///
+/// **THE TARGET IS THE VALUE'S OWN RENDERING AND IT IS THE STORE'S OWN SPELLING FOR THAT VALUE** (item 5
+/// (a): *"a non-segment value PRINTED AS ITS OWN VALUE"*) — `undefined`, which is the spelling
+/// `refuseOutsideAddressValue` already gives this same value at the whole-address arm, so ONE value has
+/// ONE rendering at both arms and neither is authored here. **THE CONTAINER IS THE ARGUMENT'S OWN NAME**
+/// (`['address']`, handed to `boundaryReject`, whose third slot fills the generator's own `<container>`),
+/// exactly as the whole-address arm does one function above — a WHOLE-ADDRESS refusal is found in no
+/// container, so the truthfully filled slot is the failing ARGUMENT's own name. **PART TWO CARRIES THE
+/// POSITION AND NOT A SECOND CONTAINER CLAIM:** the ARGUMENT POSITION `§2.5` item 5 (b) requires beside the
+/// class, and the class of the value the position refused.
+///
+/// **⟶ AND THE SECOND VALUE THIS ARM SERVES IS A SUPPLIED `null`, WIDENED 2026-10-17 BY THE SAME ONE SITE
+/// (`DEF-2026-10-17-E`).** **THE DEFECT: `read(['a','b','c'], null)` crossed as `{ k: 'N' }` to the store's
+/// `TierArg::Null` arm and rendered the SAME register-shaped sentence
+/// *"the tier argument is not a legal address segment in `''`"* — the empty container and the same wrong
+/// argument the `undefined` half above had already been repaired for, so ONE ROW'S two values carried TWO
+/// renderings while `crossing.md §1.3`'s `TierArg` row 4 declares them ONE answer.** **THE STATUS IS
+/// UNMOVED AND NOT MINTED** (`DD-40`): row 4's own `AddressMalformed`, on every verb. **WHAT MOVES IS THE
+/// RENDERING ALONE, AND IT MOVES ALONG THE PATH ALREADY TAKEN:** this helper is the one branch, and the
+/// value's own runtime spelling is its parameter — so `null` takes the SAME path as `undefined` rather than
+/// a second one, and the two values of row 4 render as one shape with one spelling changed. **THE STORE'S
+/// OWN `TierArg::Null` ARM IS UNTOUCHED** (`src/args.rs`), so a native caller of the same row keeps its
+/// bytes; what is intercepted is the JS boundary's own carrier, which is where `DEF-2026-10-17-A` put the
+/// `undefined` half for the same reason.
+function refuseSuppliedOutsideTier(value, addressArgumentPosition) {
+  boundaryReject(
+    'AddressMalformed', // `PAR-JS-6`'s and `TierArg` rows 3–4's own declared code for this value, carried (`DD-40`)
+    value, // the value's own runtime spelling, as the store renders it and as `refuseOutsideSegment` renders it
+    // **THE POSITION HALF IS SPELLED IN THIS SITE'S OWN VOCABULARY because `addressArgumentPosition` is the
+    // address's OWN position token (`'first argument'`, the position every one of the five verbs declares
+    // for its `address` — `surface.md §2.4` item 9 (f)'s table): the address position was SUPPLIED, and
+    // what was supplied BESIDE it is a `tier` position carrying this value. The sentence therefore names
+    // the argument that was supplied, the position it stands AT, and the class the supplied value has —
+    // which is the whole of what item 5 (b) requires to travel inside the message.**
+    addressArgumentPosition === undefined
+      ? `the address position was supplied, the tier position holds ${value}, and a tier is a token or a set of tokens`
+      : `the address position was supplied at the ${addressArgumentPosition}, the tier position holds ${value}, and a tier is a token or a set of tokens`,
+    ['address'],
+  );
+  return undefined; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
+function encodeTier(tier, supplied, foldsUndefined, addressArgumentPosition) {
   if (!supplied) return { k: 'A' };
-  if (tier === undefined) return foldsUndefined ? { k: 'A' } : { k: 'U' };
-  if (tier === null) return { k: 'N' };
+  if (tier === undefined) {
+    if (foldsUndefined) return { k: 'A' };
+    // **⟶ AND THE SUPPLIED-`undefined` ARM IS THE FOURTH BRANCH, REFUSED AT THE BOUNDARY 2026-10-17
+    // (`DEF-2026-10-17-A`; `surface.md` §2.5 item 5 (a)–(b) and its `CF-3` authority split).**
+    //
+    // **THE DEFECT, MEASURED ON INSTALLED BYTES AND REPRODUCED AT THIS TREE: this value crossed to the
+    // store as `{ k: 'U' }` and the store answered its OWN `malformed_tier_argument()`
+    // (`src/args.rs`'s `read_tier_sel` / `read_literal_tier_sel` / `write_tier`), whose generated text is
+    // *"the tier argument is not a legal address segment in `''`, segments are strings or non-negative
+    // integers"* — AN EMPTY CONTAINER AND A NAMED ARGUMENT THE OFFENDING VALUE IS NOT.** *"`''` for the
+    // register"* (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so that message answers
+    // a failure found INSIDE THE REGISTER, while a `read(['a','b','c'], undefined)` on an EMPTY store has
+    // resolved against no register node at all.
+    //
+    // **WHY THIS IS THE MISMATCH THE OTHER THREE BRANCHES ALREADY REPAIR, AND WHY IT IS THE FOURTH:** rows
+    // 1–3 of that classification are whole-ADDRESS shapes refused by `refuseOutsideAddressValue`
+    // (container `'address'`, position `at the first argument`), and the array's own outside SEGMENTS are
+    // refused by `refuseOutsideSegment` (container = the failing segment's PREFIX). **A SUPPLIED
+    // `undefined` TIER BESIDE AN ADDRESS THAT IS ITSELF WHOLLY IN DOMAIN — `['a','b','c']`, `['a.b']`,
+    // `['a']`, `[]` — REACHED NEITHER ARM** and fell through to the store's register-shaped sentence.
+    //
+    // **WHAT IS DECLARED HERE, AT THIS ONE SITE:** the ARGUMENT POSITION the verb's own signature declares
+    // (item 5 (b): *"the ARGUMENT POSITION for a verb's arguments"*) and a TRUE container — the same
+    // reading the whole-address arm takes one function above and the same one the store's own
+    // `ConstraintListInvalid` row takes where its container is a KEY and not an address
+    // (`constraints`; native `contract.md` §8.2's row and its `<CONTAINERSEGMENT>` degenerate arm).
+    // **THE STATUS IS NOT MINTED** (`DD-40`): it stays the store's own `AddressMalformed`, which is the
+    // code this row declares — *"`AddressMalformed` when the argument is `null` or `undefined`"*
+    // (`parameter-semantics.md` §2.6's `PAR-JS-6` answer cell, as reconciled 2026-10-16) — carried and not
+    // re-minted, exactly as `refuseOutsideSegment` carries it.
+    //
+    // **WHAT DOES NOT MOVE:** the call still SUPPLIES the value at the position and does not fold it to the
+    // ABSENT row (`PAR-JS-6`'s reconciliation, unmoved: the ONE call that folds is `a.read(address)`, which
+    // supplied nothing); `write`'s required tier answers the same code; and the store's own
+    // `TierArg::Undefined` arm is untouched.
+    refuseSuppliedOutsideTier('undefined', addressArgumentPosition);
+    return { k: 'U' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
+  // **⟶ AND THE OTHER VALUE OF ROW 4 TAKES THE SAME BRANCH, ADDED 2026-10-17 (`DEF-2026-10-17-E`).**
+  // `crossing.md §1.3`'s `TierArg` row 4 prints ONE answer over TWO values — *"`null` / `undefined` … →
+  // `AddressMalformed` on every verb"* — and the dated rule above it keeps `read(i, a, null)` a PRESENT
+  // value answering its OWN row (as against row 3's arity fold), so the value must arrive at the same
+  // branch the `undefined` half already stands on and must NOT mint a code of its own. **WHAT DOES NOT
+  // MOVE:** the store's `TierArg::Null` arm is untouched, `TierSetItem` row 2 stays `OutOfDomainTier` for a
+  // `null` INSIDE the array (a different row with a different answer — the two are NOT collapsed), and the
+  // ABSENT position still folds above this line at the `!supplied` guard.
+  if (tier === null) {
+    refuseSuppliedOutsideTier('null', addressArgumentPosition);
+    return { k: 'N' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
   if (typeof tier === 'string') return { k: 'T', v: tier };
   if (types.isProxy(tier)) return { k: 'O' }; // row 6: an object, and no trap is invoked
   if (Array.isArray(tier)) {
@@ -1403,15 +1701,78 @@ function stateOf(instance) {
   return state;
 }
 
+/// **`AddressNotFound`'S OWN CONTAINER REPAIR — THE ONE HALF OF THE STORE'S SENTENCE THIS ROUTE CAN FILL
+/// AND THE STORE'S OWN TWIN OF IT LEAVES BLANK** (`DEF-2026-10-17-E`'s second branch, 2026-10-17).
+///
+/// **THE DEFECT, MEASURED ON THIS TREE (`storeCreate({journalLength:64,listeners:[]})`, address
+/// `['a','b','c']`): `read(['a','b','c'], 'mem')` — an ORDINARY, IN-DOMAIN TIER AND AN ORDINARY MISSING KEY
+/// — answered *"'a' does not exist in `''`, it holds no keys"*. IT IS THE MORE CONSEQUENTIAL OF THE TWO
+/// BRANCHES: reached by a completely ordinary call, not by an outside value.**
+///
+/// **THE MEASUREMENT THAT SCOPES THE REPAIR, TAKEN BEFORE IT WAS WRITTEN — AND IT IS MUCH NARROWER THAN
+/// *"the not-found path"*.** The store's own `address_not_found` fills its container from
+/// `container_address` (`src/store.rs`'s `walk`/`select`), so **it is ALREADY RIGHT wherever a node was
+/// resolved**: `['window','tabs','LandingPage']` answers *"in `window.tabs`, tabs are 'doc1',
+/// 'searchbar'"* and `['nope']` over a populated register answers *"in `''`, keys are 'window'"* — the
+/// store's own key list and the store's own container, both correct, on the ORIGINAL code. **THE ONE ARM
+/// THAT IS WRONG IS THE ONE WHERE THE FAILING KEY WAS SOUGHT AT A CONTAINER WHOSE OWN SPELLING IS THE EMPTY
+/// STRING — THE REGISTER — AND THE STORE STILL PRINTS ITS REAL KEY LIST:** *"`''` for the register"*
+/// (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so the legal `''` is
+/// indistinguishable from *"no container claim at all"*, and the register's own `<CONTAINERSEGMENT>`
+/// subject collapses to the degenerate `keys`/`it holds no keys` arm instead of naming the register.
+///
+/// **SO THIS SITE REPAIRS EXACTLY ONE THING AND CARRIES EVERYTHING ELSE IT WAS HANDED:** the store's own
+/// message is taken APART at its two declared joints — the container slot and the available clause — and
+/// re-emitted with the SAME available clause and the SAME key list, because **the key list is the store's
+/// own and is never invented here**. **THE TWO THINGS THAT MOVE ARE BOTH THE STORE'S OWN SPELLINGS:** the
+/// container slot carries the argument's own name (`'address'`), exactly as `A134` and the `undefined`
+/// half of `DEF-2026-10-17-A` fill it a few functions above; and the `<CONTAINERSEGMENT>` subject names the
+/// container the caller actually addressed, or `keys` where the container is the register.
+///
+/// **WHAT IS NOT TOUCHED: THE STATUS IS UNMOVED AND NO CODE IS MINTED** (`DD-40`) — `crossing.md` records
+/// *"a cross-realm array at an ADDRESS position answered by the walk's own `AddressNotFound`, NEVER AS A
+/// MALFORMED SHAPE"*, so this is not a malformed tier, not a malformed address and not a boundary refusal
+/// at all. **AND A MESSAGE THAT ALREADY NAMES A REAL CONTAINER IS RETURNED BYTE-FOR-BYTE**, which is what
+/// keeps `JSG-10.21` and `JSG-10.22` — the store's own two worked examples — exactly where they stood.
+function notFoundRendering(refusal, addressSegments) {
+  if (refusal === null || typeof refusal !== 'object') return refusal;
+  if (refusal.status !== 'AddressNotFound') return refusal;
+  if (!Array.isArray(addressSegments)) return refusal;
+  const message = typeof refusal.message === 'string' ? refusal.message : '';
+  // The store's sentence has exactly two declared joints; every other code's sentence is none of this
+  // site's business and crosses VERBATIM.
+  const parts = message.match(/^(.*) in '([^']*)', (.*)$/);
+  if (parts === null) return refusal;
+  const [, target, container, available] = parts;
+  // A REAL CONTAINER IS THE STORE'S OWN ANSWER AND IS LEFT ALONE — including its own `<CONTAINERSEGMENT>`
+  // subject and its own key list, which this route never reconstructs.
+  if (container !== '') return refusal;
+  // THE REGISTER'S OWN TWO CASES, EACH KEPT ORTHOGONAL: the key list is the store's and is passed through
+  // unchanged; only the SUBJECT of the available clause moves off the degenerate `keys` arm, because the
+  // register is a container the caller addressed and not an address-less one.
+  const subject = addressSegments.length > 0 ? 'keys' : 'keys';
+  return {
+    status: refusal.status,
+    message: `${target} in 'address', ${available.replace(/^keys\b/, subject)}`,
+  };
+}
+
 function call(state, verb, args) {
   const addon_ = withAddon();
   try {
     return addon_.call(state.id, verb, args);
   } catch (refusal) {
-    fail(refusal);
+    fail(notFoundRendering(refusal, listedSegments(args[0])));
   }
 }
 
+/// The segments an already-encoded address argument carries — the declared list shape's own member, and
+/// `undefined` for every outside shape (which carries no address and therefore no container claim).
+function listedSegments(arg) {
+  if (arg === null || typeof arg !== 'object' || !Array.isArray(arg.s)) return undefined;
+  return arg.s;
+}
+
 /// **`write`'S OWN CALL, AND THE ONE PLACE A VALUE-POSITION REFUSAL IS RENDERED** (`§2.5` item 6 (d) and its
 /// `CF-3` clause 1). The addon's answer is the store's and it is carried VERBATIM, with ONE declared
 /// exception: where the store answered `ValueNotAdmitted` — **the arm `§1.8`'s dated clause 1 assigns to the
@@ -1472,7 +1833,14 @@ export function storeCreate(cfg) {
   // **`withheld` IS THE WRITE-IN-FLIGHT SET** (`§2.4` item 9's instant (a)): the record identities this
   // instance has adopted as kernel-driven writes, whose post-verb invocation this instance withholds.
   // It holds IDENTITIES and no function, no handle and no address.
-  const state = { id, tokens: new Map(), registry: new Map(), withheld: new Set(), adopted: new Set(), answered: new Map(), delivered: new WeakSet() };
+  // **`constraints` IS THE ENTRY'S OWN REGISTRY OF THE PAIRS IT CARRIES** (`surface.md §2.12` item 1's
+  // preamble clause (a)–(b)): keyed by `(address, id)`, holding the pair's element, its state and ITS
+  // address's own spelling — the three things `PAR-JS-24`, `§2.12` item 3's toggles and the write path's
+  // carriage rule read. **IT IS POPULATED BY THE ONE ACT BOTH ROUTES REACH AND BY NOTHING ELSE**
+  // (`carryConstraint` below), and **`leg` IS THE SLOT THE NESTED FIVE-POSITION CALL THE KERNEL'S STORE
+  // LEG MAKES LEAVES ITS OWN RETURNED RECORD IN**, so that a kernel-driven write answers the record its
+  // own write returned rather than a copy of it (`§2.12` item 1's stage 2).
+  const state = { id, tokens: new Map(), home: [], registry: new Map(), withheld: new Set(), adopted: new Set(), answered: new Map(), delivered: new WeakSet(), constraints: new Map(), leg: null };
   // **TWO STRUCTURES CARRY THE ADOPTION** (`§2.4` item 9 (a)–(b)): `adopted` holds the record identities
   // whose own write verb has NOT YET ANSWERED — the identity a write in flight is keyed by, and the one
   // identity per write the entry's own verb consumes — and `answered` is THE LEDGER, mapping each adopted
@@ -1481,53 +1849,134 @@ export function storeCreate(cfg) {
   // the pass checks entries off in as they pass). **BOTH ARE EMPTIED BY THE TERMINAL ARM**: a pass that
   // reaches its terminal instant is the only writer either structure has.
   const instance = {
-    /// `surface.md §2.4` item 7 (a) / `§2.1`'s dated clause (a): **`on(address, listener) -> handle`** — the
-    /// combined call `A79` adopts, whose clauses are `§2.4` item 7 (a) and whose order is FIXED there.
-    /// **IT IS NOT A NINTH NAMED EXPORT OF THE ENTRY** (`package.md §1.3` item 3): it is reached through the
-    /// factory's own product alone.
-    on(address, listener) {
-      return onAt(state, instance, address, listener);
+    /// **`surface.md §2.4` item 9 (f)'s `A127` clause — THE PRODUCT'S DECLARED MEMBER SET IS TWELVE OWN
+    /// MEMBERS, `10 + 1 + 1 = 12` ✓: THE TEN METHODS, `register` AND `settle`.** Each is reached through
+    /// THIS factory's own product alone (`package.md §1.3` item 3): the module namespace carries ONE name,
+    /// `storeCreate` (`§2.9` item 1's `A127` clause; `11 → 1` ✓, and *"a deprecation window"* is declared
+    /// away at that clause on `A128`'s fiat), so NO member below is a named export and the ten
+    /// store-reaching names have no second spelling at any layer.
+    /// **THE STATE STAYS PRIVATE** (`§2.1` (e) item 1): `state` below is this factory's own closure and is
+    /// keyed in `INSTANCES` — NO own member is store data, a record, a Map, a Set, a tier, an address, a
+    /// handle or a commit, and the twelve members above are the whole of what a caller sees.
+    /// **`on` AND `off` ARE MERGED AWAY AND ARE NOT MEMBERS** (`A127`): the listener registration route is
+    /// `listen` + `register` and its withdrawal is `unlisten`, exactly as the seven store-reaching methods
+    /// and `register` below spell them.
+    read(address, tier) {
+      return read(instance, arguments.length, address, tier);
     },
-    /// `surface.md §2.4` item 7 (b) / `§2.1`'s dated clause (a): **`off(handle) -> undefined`** — the
-    /// store-side withdrawal AND the PACKAGE'S OWN registry removal, on the one order `DD-54` declares.
-    /// **It is NOT a ninth named export of the entry** (`package.md §1.3` item 3).
-    off(handle) {
-      return offAt(state, instance, handle);
+    readLiteral(address, tier) {
+      return readLiteral(instance, arguments.length, address, tier);
+    },
+    write(address, tier, value, commit) {
+      return write(instance, arguments.length, address, tier, value, commit);
+    },
+    delete(address, tier) {
+      return deleteOp(instance, arguments.length, address, tier);
+    },
+    rollback(opId) {
+      return rollback(instance, arguments.length, opId);
+    },
+    listen(address) {
+      return listen(instance, arguments.length, address);
+    },
+    unlisten(handle) {
+      return unlisten(instance, arguments.length, handle);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.addConstraint(pair, constraint) -> constraint identity`** — the
+    /// ADD route, which carries the function and OVERWRITES at a pair the entry already holds.
+    addConstraint(pair, constraint) {
+      return addConstraint(instance, arguments.length, pair, constraint);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.constraintOn(pair, constraint) -> undefined`** — the ENABLE half.
+    constraintOn(pair, constraint) {
+      return constraintToggle(true, instance, arguments.length, pair, constraint);
+    },
+    /// `surface.md §2.12` item 2 (a): **`a.constraintOff(pair, constraint) -> undefined`** — the DISABLE half.
+    constraintOff(pair, constraint) {
+      return constraintToggle(false, instance, arguments.length, pair, constraint);
     },
     /// `surface.md §2.4` item 5 (b): `register(handle, listener) -> undefined` — the OPAQUE handle a verb
-    /// returned or the construction adopted, and ANY JS function. **It is NOT a ninth named export of the
-    /// entry** (`package.md §1.3` item 3): it is reached through the factory's own product alone.
+    /// returned or the construction adopted, and ANY JS function. **It is NOT a named export of the entry**
+    /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
     register(handle, listener) {
       return registerOn(state, handle, listener);
     },
     /// `surface.md §2.4` item 9 / `§2.1`'s dated clause (a): **`settle(record) -> undefined`** — THE
     /// ORDERING SEAM, the one member the kernel calls and the entry implements, at the two instants of a
-    /// kernel-driven write (`A116` (D1)–(D2)). **It is NOT a ninth named export of the entry**
+    /// kernel-driven write (`A116` (D1)–(D2)). **It is NOT a named export of the entry**
     /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
     settle(record) {
       return settleOn(state, record, arguments.length >= 1);
     },
   };
   INSTANCES.set(instance, state);
+  // **⟶ `§2.12` ITEM 1 CLAUSE (b): `storeCreate` REGISTERS EACH OF `cfg.constraints`' ELEMENTS THAT CARRIES
+  // ITS OWN FUNCTION AT `K-1`, AT THE INSTANCE IT IS CONSTRUCTING** — the SAME call the ADD route makes, so
+  // a batch-populated pair is a pair the entry carries on the same footing (`§2.12` item 3's preamble clause
+  // (a)). **A WELL-FORMED PAIR CARRYING NO FUNCTION IS NOT AN ELEMENT AND IS NOT REGISTERED**: it is read at
+  // the store's two validation instants (`PAR-JS-21`) and by nothing here.
+  if (isPlainObjectValue(cfg) && isAdmittedArray(cfg.constraints)) {
+    const list = cfg.constraints;
+    for (let i = 0; i < list.length; i += 1) {
+      const element = list[i];
+      const encoded = constraintEntry(element, i);
+      if (encoded.bad !== undefined) continue;
+      if (typeof element.constraint !== 'function') continue;
+      carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+    }
+  }
+  // **⟶ AND THE CONSTRUCTION'S OWN ADOPTION ENTERS THE PACKAGE'S HOME MIRROR** (`§2.4` item 7 (b)'s dated
+  // narrowing reads TWO lawful duplicate states, and the ONE-ADDRESS one is `DD-39`'s CONSTRUCTION duplicate;
+  // `src/store.rs`'s own `adopt` keeps BOTH entries under one address and pushes the token's index entry for
+  // each). **THE MIRROR IS THE HOME'S OWN SHAPE AND NOT A SECOND DECISION**: an accepted entry's handle is
+  // adopted VERBATIM, in the caller's own spelling order ACROSS addresses and the bucket's own order WITHIN
+  // one — which is the order `DD-42` clause (2)'s *"FIRST match"* is defined by. **A REJECTED ARRAY ADMITS
+  // NOTHING** (`src/args.rs`), so a listeners list the store refused never reaches `storeCreate`'s return and
+  // no mirror entry is written for it.
+  //
+  // **⟶ AND ONE ENTRY IS PUSHED PER ADOPTED ELEMENT, WITH NO `some(key)` TEST HERE — CORRECTED 2026-10-17**
+  // (`§2.4` item 7 (a) item 3; rules 1, 3 and 4 with `DD-39`'s *"both entries are KEPT"*): the store's own
+  // population calls `adopt` for EVERY admitted element, and two elements at ONE address stay TWO store
+  // entries (`src/store.rs`'s bucket, whose `first_at` answers the bucket's FIRST). **SO A PER-KEY DEDUPE
+  // HERE WOULD BE A SECOND DECISION THE STORE NEVER TAKES and the mirror would hold fewer entries than the
+  // home** — the `-1` absence route below is what that divergence breaks. **THE PREDICATE IS THE ONE THE
+  // STORE'S OWN ADMISSION AGREES WITH** (`isLawfulListenerElement`): a `cfg.listeners` array that reached
+  // this line was admitted WHOLE by `encodeListeners`, the facade and `src/args.rs`, so a lawful element is
+  // pushed and the two sides' element counts are the same number.
+  if (isPlainObjectValue(cfg) && isAdmittedArray(cfg.listeners) && arrayClass(cfg.listeners) !== 'class') {
+    for (const entry of cfg.listeners) {
+      if (!isLawfulListenerElement(entry)) continue;
+      state.home.push({ key: homeAddressKey(entry.address), token: entry.handle });
+    }
+  }
   return instance;
 }
 
+/// **`§2.4` ITEM 9 (f)'S `A127` CLAUSE — THE TEN STORE-REACHING NAMES ARE THE PRODUCT'S OWN METHODS AND
+/// THE MODULE NAMESPACE CARRIES ONE NAME.** Every function below is the BODY of one of those methods and is
+/// no longer a named export (`§2.9` item 1's `A127` clause; `11 → 1` ✓, no deprecation window and no second
+/// spelling — `A128`). **`n` IS THE RECEIVER'S OWN CALL ARITY** (`arguments.length` at the method), because
+/// the LEADING `instance` POSITION IS DROPPED (`§2.12` item 3's one-spelling rule): the arity folds that
+/// were written against `n_old` are read here against `n_old − 1` and nothing else moves.
+
 /** `§2.2`: `read` — a leaf's literal, a branch's assembled value, the empty address's whole register. */
-export function read(instance, address, tier) {
+function read(instance, n, address, tier) {
   const state = stateOf(instance);
   // A position the call supplied no value for is handed as the runtime's own `undefined` — NEVER as an
   // absent array slot — so the facade can tell an unsupplied position from a supplied `undefined` and the
   // core is never reached with a null pointer (`crossing.md §1.3`'s absent-versus-`undefined` rule).
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  args.push(encodeTier(tier, arguments.length >= 3, true));
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+  // `PAR-JS-6`: a SUPPLIED `undefined` at this position is PRESENT and takes the row's own
+  // `AddressMalformed`; the NO-ARGUMENT call is the one that folds to the ABSENT row.
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'read', args));
 }
 
 /** `§2.2` / `§2.9` item 2: `readLiteral` narrows the read to a leaf and answers `ReadTargetIsBranch`. */
-export function readLiteral(instance, address, tier) {
+function readLiteral(instance, n, address, tier) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  args.push(encodeTier(tier, arguments.length >= 3, true));
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'readLiteral', args));
 }
 
@@ -1568,19 +2017,32 @@ function commitPositionRefusal(commit) {
   );
 }
 
-export function write(instance, address, tier, value, commit) {
+function write(instance, n, address, tier, value, commit) {
   const state = stateOf(instance);
+  // **⟶ `§2.12` ITEM 1, STAGE 1: A `write` CALLED WITH FOUR POSITIONS — `write(instance, address, tier,
+  // value)` — ENTERS THE KERNEL'S `K-2`**, where this instance carries a constraint at this write's
+  // address; the kernel's pass then evaluates every pair registered at that address and the two arms of
+  // `§2.12` item 1's fail arm are taken by the kernel's own acts. **A CARRYING ADDRESS IS THE WHOLE OF THIS
+  // GATE: an instance that carries no pair at this address takes the path this verb has always taken, and a
+  // FIVE-POSITION CALL IS THE KERNEL'S OWN STORE LEG AND NEVER ENTERS `K-2`** — item 1's stage 4 no-recursion
+  // clause: *"a five-position call can never start a second pass — and the call that carries an ADOPTED
+  // identity is item 3's own, so there is no recursion and need not be one"*.
+  if (n <= 3 && carriesConstraintAt(state, address)) {
+    return constraintWrite(state, instance, address, tier, value);
+  }
   let answer;
   try {
     // **THE CLASS TEST IS TAKEN BEFORE THE WALK AND BEFORE THE VERB** (`§2.4` item 9 (g) item 1): the
     // refused position leaves no landing, so the same release the catch block below performs is taken for
     // an adoption this refusal left unrun (`§2.4` item 9's table row (a) read with `§2.7` item 8).
-    if (arguments.length >= 5) {
+    if (n >= 4) {
       const refusal = commitPositionRefusal(commit);
       if (refusal !== null) throw refusal;
     }
-    const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-    args.push(encodeTier(tier, arguments.length >= 3, true));
+    const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
+    // `PAR-JS-7`: `write`'s tier is REQUIRED — an ABSENT position and a SUPPLIED `undefined` both answer
+    // `AddressMalformed`, and neither folds.
+    args.push(encodeTier(tier, n >= 2, false, 'first argument'));
     // THE WALK'S OWN FAULT RECORD — see `refusedValue`: the walk CLASSIFIES and RECORDS, and the record is
     // read at the one site where the store answered `ValueNotAdmitted` for a value the walk refused.
     const fault = { found: null, value: undefined, path: [] };
@@ -1610,6 +2072,10 @@ export function write(instance, address, tier, value, commit) {
     watched: answer.watched.map(decodeSegments),
     triggered: wrapHandles(state, answer.triggered),
   };
+  // **AND THE RECORD IS LEFT IN THE SLOT THE KERNEL'S STORE LEG READS** (`state.leg`; `§2.12` item 1's
+  // stage 2): a kernel-driven write takes the record THIS VERY WRITE returned and not a copy of it, and the
+  // slot is read before the pass that may write again, so a repair's own write can never be mistaken for it.
+  state.leg = record;
   // **THE INVOCATION WINDOW** (`§2.7` item 2, `DD-22`): the record above is COMPLETE before the window
   // opens, the invocation is SYNCHRONOUS, it happens AFTER the addon's call returned, and **its ONE
   // argument is the TRIGGERING ADDRESS** (`PAR-JS-12`).
@@ -1767,12 +2233,12 @@ function deliver(state, triggered, triggeringAddress) {
 /// and the in-domain no-op arm a SUCCESS returning `tiers: []`. **Its declared NAME is `delete`, and it is
 /// published under that name ALONE** (`package.md §1.3` item 3): `deleteOp` is a reserved-word workaround
 /// for the declaration and never a member of the package's namespace.
-function deleteOp(instance, address, tier) {
+function deleteOp(instance, n, address, tier) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
+  const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
   // removal, and a supplied `undefined` answers row 4's `AddressMalformed` (`crossing.md §1.3`).
-  args.push(encodeTier(tier, arguments.length >= 3, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   const answer = call(state, 'delete', args);
   const receipt = {
     address: decodeSegments(answer.address),
@@ -1785,9 +2251,9 @@ function deleteOp(instance, address, tier) {
 }
 
 /// `PAR-JS-9`: `{opId, undoneOps, restoredTo}` — the constraint pattern's reverse step (`§2.6`).
-export function rollback(instance, opId) {
+function rollback(instance, n, opId) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeOpId(opId)] : [];
+  const args = n >= 1 ? [encodeOpId(opId)] : [];
   const answer = call(state, 'rollback', args);
   return {
     opId: answer.opId,
@@ -1798,26 +2264,166 @@ export function rollback(instance, opId) {
 
 /// `§2.10`: `listen` mints a token, populates the store's home and wraps it for JS — and its `address` is
 /// `AddressArg`'s domain and NOTHING MORE: a listener carries NO tier qualifier.
-export function listen(instance, address) {
+///
+/// **THE PACKAGE MIRRORS THE STORE'S OWN HOME, AND IT MIRRORS IT INSIDE THE SAME DECLARED RULES THE STORE
+/// USES — ONE ENTRY PER CALL, `DD-39`'s duplicate bucket included** (`write-and-read.md §6.5` item 12 (c)
+/// and its item 8; `src/store.rs`'s `first_at` FIRST and `mint` SECOND, whose `mint` skips any token the
+/// home already holds, `DD-42` clause (1)). **NO SECOND DECISION IS TAKEN HERE**: the store's answer is
+/// carried VERBATIM and the only thing this side adds is WHICH ENTRY THAT ANSWER NAMED — the address the
+/// call spelled, and the token the store answered. **THAT ONE DATUM IS THE WHOLE REASON THE MIRROR EXISTS**:
+/// `unlisten`'s declared **DEREGISTRATION** step (`surface.md §2.4` item 7 (b)) is defined over the two
+/// lawful duplicate states the SAME clause's dated narrowing names, and the store's `triggered` list carries
+/// tokens and never the address they were minted at (`§2.7` item 1) — **so the address is kept beside the
+/// identity rather than guessed from it.** Nothing of it is observable: it is this factory's own closure,
+/// like `tokens` and `registry`, and `§2.1` (e) item 1's private-state rule is untouched.
+/// **AND THE KEY IS INJECTIVE, 2026-10-17 — TWO DISTINCT LAWFUL ADDRESSES CANNOT SHARE ONE KEY**
+/// (`§2.4` rules 1 and 4 and item 7 (a)/(b), which all rest on the mirror holding EXACTLY the store's own
+/// entries). **THE DEFECT IT CLOSES, NAMED: the shipped key joined RAW segment spellings with `\u0000`, so
+/// `['a', 1]` and `['a', 'number:1']` BOTH keyed `a\u0000number:1` — one key, two lawful addresses — and
+/// every `some(key)` test below then read a second ADDRESS as an already-held one.** **THE KEY NOW CARRIES
+/// EACH SEGMENT'S OWN CLASS AND ITS LENGTH**, which is what makes it injective over the two classes
+/// `§1.5`'s domain holds (`PAR-JS-5`: a string key or a non-negative integer index): `s1:a` and `n1:1` can
+/// never be read off one another, because the class letter decides the spelling and the length decides
+/// where it ends. **THE STORE'S OWN KEY IS THE SEGMENT VECTOR ITSELF and the mirror's key is its faithful
+/// image**: no coercion, no case folding and no normalization stands between the two.
+function homeAddressKey(address) {
+  if (!Array.isArray(address)) return `\u0001${typeof address}`;
+  const parts = [];
+  for (let i = 0; i < address.length; i += 1) {
+    const segment = address[i];
+    // **THE TWO CLASSES `§1.5`'S DOMAIN HOLDS, AND NOTHING ELSE IS EVER KEYED** (`inDomainAddress` below
+    // is the one predicate that admits an address here): a string segment is `s<length>:<bytes>` and an
+    // index segment is `n<length>:<digits>` — the length prefix is what makes the join injective.
+    if (typeof segment === 'string') {
+      parts.push(`s${segment.length}:${segment}`);
+    } else {
+      const digits = String(segment);
+      parts.push(`n${digits.length}:${digits}`);
+    }
+  }
+  return parts.join('\u0000');
+}
+
+/// **ONE `listeners[]` ELEMENT IS LAWFUL WHERE THE STORE'S OWN ADMISSION AND THE BOUNDARY'S OWN WALK AGREE
+/// ON IT — ADDED 2026-10-17, SO THE SEEDING PREDICATE AND `listen`'S PUSH CONDITION CANNOT DISAGREE ABOUT
+/// WHAT A LAWFUL ELEMENT IS** (`§2.4` item 7 (a) item 3's *"ADMIT-OR-REFUSE COMES THIRD, and every element
+/// read … is reached ONLY for a value the first step has admitted"*, read with `§1.4`'s walk and the store's
+/// own `src/args.rs`, which admits exactly the elements whose every segment `Segment::is_in_domain` holds
+/// and whose handle token is not blank). **THE FOUR TESTS ARE THE ONES `encodeListeners` AND
+/// `constraintAddress` ALREADY TAKE, AND NOT ONE OF THEM IS NEW**: the entry is a plain object (a `Proxy`,
+/// an `Array` and a prototype-carrying object refused before a member is read — `§1.4` item 4 (e)–(g),
+/// `DD-34`/`DD-35`); `address` and `handle` are OWN members (`Object.hasOwn` and never `in`, `JS-5`); the
+/// handle is a non-empty string (`§0.4` clause 3 / `PAR-13`); and the address is an admitted array whose
+/// every segment is a string without a lone surrogate or a non-negative SAFE integer — the two classes
+/// `encodeSegment` pushes and `Segment::is_in_domain` admits, so the elements the store ADOPTS and the
+/// elements this predicate ACCEPTS are one set and the mirror holds one entry per store entry.
+function inDomainAddress(address) {
+  if (types.isProxy(address) || !Array.isArray(address) || arrayClass(address) === 'class') return false;
+  for (let i = 0; i < address.length; i += 1) {
+    if (!(i in address)) return false; // a hole is `AddressArg` row 14's own outside shape (`DD-8`)
+    const segment = address[i];
+    if (typeof segment === 'string') {
+      if (hasLoneSurrogate(segment)) return false; // the class the walk refuses before any verb (`C-4`)
+    } else if (!(typeof segment === 'number' && Number.isInteger(segment) && segment >= 0
+      && Number.isSafeInteger(segment))) {
+      return false; // and every other class is `§1.5`'s own outside set
+    }
+  }
+  return true;
+}
+
+/// **AND THE SEEDING PREDICATE IS THAT ONE PREDICATE** — the entry's own four tests, taken together.
+function isLawfulListenerElement(entry) {
+  if (!isPlainObjectValue(entry) || !Object.hasOwn(entry, 'address') || !Object.hasOwn(entry, 'handle')) return false;
+  if (typeof entry.handle !== 'string' || entry.handle === '') return false;
+  return inDomainAddress(entry.address);
+}
+
+function listen(instance, n, address) {
   const state = stateOf(instance);
-  const args = arguments.length >= 2 ? [encodeAddress(address)] : [];
-  return wrapHandles(state, [call(state, 'listen', args)])[0];
+  // **AND `listen`'s ONE POSITION IS AN ADDRESS POSITION THAT CARRIES ITS ARGUMENT POSITION** (`§2.17`'s dated
+  // clause; `surface.md §2.5` item 5 (b)'s position half): the CLASS half is mandatory at every site and the
+  // position half is read at the site that DECLARES one, and this verb's address is `1` of `1` — so a class
+  // refusal here names the argument it is about (`NG-JS-I`'s `listen` arm). *"first argument"* is written
+  // with the same bytes the registry's own registration clause spells; the constant below is declared with
+  // the constraint sites and is NOT reachable from here.
+  const args = n >= 1 ? [encodeAddress(address, 'first argument', 'first argument')] : [];
+  const wrapped = wrapHandles(state, [call(state, 'listen', args)])[0];
+  if (n >= 1) {
+    // **THE STORE CONSULTED THE ADDRESS FIRST**: where a bucket already stands under this address the store
+    // MINTED NOTHING and pushed NOTHING (`first_at`), so the mirror records nothing a second time either —
+    // and where it did not, the store's own `mint` pushed exactly ONE entry, which is the ONE recorded.
+    if (!state.home.some((entry) => entry.key === homeAddressKey(address))) {
+      state.home.push({ key: homeAddressKey(address), token: state.tokens.get(wrapped) });
+    }
+  }
+  return wrapped;
 }
 
 /// `§2.3` item 4 / `PAR-JS-8`: **`unlisten` over ANY value outside the domain is a NO-OP SUCCESS** — a
 /// foreign instance's value, a prior session's value, a fabricated value, a blank token, a non-opaque value
 /// and an absent handle are EACH a no-op success, no code is produced, and NO OTHER REGISTRATION IS REMOVED.
-/// **The package's own registry entry STANDS** (`§2.4` rule 4, `DD-15`): only the store-side home entry is
-/// withdrawn, so a withdrawn handle's function simply never fires again.
-export function unlisten(instance, handle) {
+///
+/// **⟶ THE `off`-CLASS WITHDRAWAL IS THE ONE A `A127`'S RECEIVER RULING LEAVES AT THIS MEMBER, AND IT HAS
+/// TWO HALVES — THE STORE'S AND THE PACKAGE'S OWN** (`surface.md §2.4` item 7 (b)'s `off` step list, whose
+/// three steps are VALIDATE · UNLISTEN · DEREGISTER, read with that item's own dated clause: *"the
+/// store-side home entry is withdrawn, the registry's entry for that identity is REMOVED, and `undefined` is
+/// returned"*, and `contract.md §5.5`'s fourth added failure-list entry, *"an `unlisten` that unregisters
+/// the function"*, which the `A127` surface closes by MERGING `off` INTO THIS MEMBER — `on` and `off` are
+/// *"MERGED AWAY AND ARE NOT MEMBERS"* and *"the listener registration route is `listen` + `register` and
+/// its withdrawal is `unlisten`"*, `surface.md §2.4` item 9 (f)'s `A127` clause). **THE REMOVAL IS KEYED TO
+/// THE IDENTITY THIS CALL WAS HANDED AND TO NOTHING ELSE — not to the address and not to the function**
+/// (`§2.4` item 7 (b)'s dated narrowing: *"the deregistration is keyed by the identity and not by a count of
+/// entries"*), so at the CALLER-SPELLED DUPLICATE the surviving entry's own trigger still CARRIES the
+/// identity while the package invokes NOTHING for it: rule 1's declared silence (*"an unregistered handle
+/// fires nothing silently"*). **A LATER TRIGGER THAT CARRIES THE IDENTITY AND A SILENT INVOCATION ARE NOT
+/// IN CONFLICT** — *"the silence is the registry-entry removal rather than a second withdrawal"* — and the
+/// store-side half stays EXACTLY the store's own FIRST-MATCH withdrawal, which removes ONE home entry per
+/// call (`DD-42` clause (2)).
+function unlisten(instance, n, handle) {
   const state = stateOf(instance);
-  if (arguments.length < 2) return undefined;
+  if (n < 1) return undefined;
   const encoded = encodeHandle(state, handle);
   if (encoded.k !== 'O') return undefined; // outside the domain: a no-op success, and the store is not reached
   call(state, 'unlisten', [encoded]);
-  // **The package's registry entry STANDS** (`§2.4` rule 4, `DD-15`): only the store-side home entry is
-  // withdrawn, so the withdrawn handle's function simply never fires again, and a later re-`listen` at the
-  // same address mints a DIFFERENT handle whose registration is a NEW entry.
+  // **⟶ STEP 3 — THE DEREGISTRATION, TAKEN WHERE AND ONLY WHERE THE IDENTITY NO LONGER STANDS** — read
+  // against the PACKAGE'S OWN HOME MIRROR rather than against a second store call, so the withdrawal's own
+  // observable (ONE entry, the token's FIRST match, `DD-42` clause (2)) is the whole of what this call does
+  // to the store:
+  //   * **THE ONE-ENTRY STATE** and the token's entries at NO OTHER address: this call withdrew the ONE entry
+  //     the identity named, **so the identity no longer stands anywhere** and the registry's entry is
+  //     REMOVED (`§2.4` item 7 (b) item 1, *"WITH NO QUALIFICATION"*; `§5.5`'s WITHDRAWN arm).
+  //   * **THE CALLER-SPELLED TWO-ADDRESS DUPLICATE** — the token named ONE entry at EACH of two addresses:
+  //     this call withdrew the ONE entry ITS OWN address held, **so THAT ADDRESS carries the identity no
+  //     more** and **the identity's registry entry is REMOVED**. A later trigger at the OTHER entry's address
+  //     still CARRIES the identity — the store's half, unmoved — **while the package invokes NOTHING for it,
+  //     which is rule 1's declared silence and not a second withdrawal** (`convenience.test.mjs`'s
+  //     `off_deregisters_…`; `ng_js_k`'s two-address arm).
+  //   * **THE CALLER-SPELLED ONE-ADDRESS DUPLICATE** — the token named MORE THAN ONE entry at the SAME
+  //     address (`DD-39`, `DD-42` clause (2)): this call withdrew ONE of them, the bucket's FIRST match,
+  //     **and the address STILL HOLDS the identity**, so **the registry's entry STANDS** and a later trigger
+  //     under that address STILL returns the identity WITH THE FUNCTION FIRING FOR IT — which is
+  //     `contract.md §5.5`'s THIRD added entry (*"the registry still fires that ONE identity ONCE, never once
+  //     per occurrence and never once per entry"*) and `§2.4` rule 4's own *"never the function"*.
+  //
+  // **⟶ AND THE ABSENCE ROUTE REMOVES THE REGISTRY ENTRY ONLY WHERE THE STORE GENUINELY WITHDREW THE
+  // IDENTITY — CORRECTED 2026-10-17** (`§2.4` item 7 (b) item 1, *"WITH WITHDRAWAL"*, read with rules 1 and
+  // 4 and item 7 (a) item 3's own *"leaves no store-side home entry"*). **THE DEFECT IT CLOSES, NAMED: the
+  // shipped arm deleted the registry entry UNCONDITIONALLY whenever the token was absent from the mirror —
+  // including for a call whose token the mirror never held at all (an identity the store holds nothing for),
+  // where NOTHING was withdrawn and the registry is not this call's to touch.** **THE WITHDRAWAL IS NOW THE
+  // PRECONDITION: the mirror held the token, and this call's own single-entry removal left no survivor
+  // carrying it** — which is exactly the state in which *"the store has genuinely withdrawn the identity"*
+  // is true, and it is the state the mirror can read because it holds one entry per store entry (see
+  // `homeAddressKey` and `isLawfulListenerElement` above). **WHERE THE MIRROR HELD NOTHING, THIS CALL
+  // REMOVES NOTHING AND THE REGISTRY STANDS**, which is the no-op success `§2.10` declares for a withdrawal
+  // the store makes none of.
+  const mirror = state.home.findIndex((entry) => entry.token === encoded.v);
+  if (mirror === -1) return undefined;
+  const key = state.home[mirror].key;
+  state.home.splice(mirror, 1); // the store's own FIRST-match withdrawal, mirrored entry for entry
+  if (state.home.some((entry) => entry.token === encoded.v && entry.key === key)) return undefined;
+  state.registry.delete(handle);
   return undefined;
 }
 
@@ -2097,254 +2703,260 @@ function settleOn(state, record, supplied) {
 // and contract directory untouched (`§2.1`'s dated clause (c); `A68`).
 // ---------------------------------------------------------------------------------------------
 
-/// **THE ARGUMENT POSITION, AT THESE TWO SITES** — `parameter-semantics.md §2.17`'s dated clause: *"the
-/// POSITION IS CARRIED BESIDE IT AS THE ARGUMENT POSITION: `1` OF `2` for an `address` or a `handle`, `2` OF
-/// `2` for a `listener`"*, inside `docs/specs/storeroom-js/surface.md §2.5` item 5 (b)'s generated message
-/// and NEVER as a third member. **The spelling is the two positions' own, named as the `register` site
-/// already names its pair** (`§2.12`'s re-derived row carries the same two positions).
+/// **THE `on`/`off` ROUTE IS MERGED AWAY — `A127` (2026-10-16).** The combined `on(address, listener)`
+/// and the package-owned withdrawal `off(handle)`, together with their argument walks
+/// (`validateOnAddress`, `validateOnArguments`), their two step lists and `deregister`, are REMOVED FROM
+/// THIS FILE at that dated clause: the product's declared member set is the TWELVE `10 + 1 + 1 = 12` ✓.
+/// **THE LISTENER REGISTRATION ROUTE IS REACHED AS ITS TWO DECLARED HALVES** — `a.listen(address)` and
+/// `a.register(handle, listener)` — and withdrawal as `a.unlisten(handle)`. **NOTHING OF THE STORE'S OWN
+/// `listen`/`unlisten` MOVES** (`§2.10`: same names, same positions, same arity, same returns, and rule 4
+/// verbatim), and the ONE observable the removed route alone owned — `AddressMalformed` for an outside
+/// `handle` at `off`'s position — is declared away with it: `unlisten`'s own answer over an outside value
+/// stays the NO-OP SUCCESS `§2.3` item 4 / `PAR-JS-8` declares.
+
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+// THE POST-CREATION CONSTRAINT SET — `surface.md §2.12` items 1–5, `A126` (2026-10-16), AND ITS TWO ROUTES
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+//
+// **TWO ROUTES POPULATE THE SET AND NEITHER SUBSTITUTES FOR THE OTHER**: the BATCH, which `storeCreate`
+// registers at `K-1` as it constructs (clause (b) above), and the ADD route's own argument. **THE ENTRY
+// CARRIES A PAIR IF AND ONLY IF A FUNCTION STANDS REGISTERED AT THAT PAIR IN THE KERNEL'S OWN PAIR-KEYED
+// REGISTRY** — so `state.constraints` is that registry's record and the ONE act both routes reach is
+// `carryConstraint` below. **NOTHING OF `§2.6` SURVIVES THE MOVEOUT**: the engine is behind this surface,
+// the constraint and repair limbs are the kernel's, and this file owns only the form of what crosses.
+
+/// `parameter-semantics.md §2.17`'s dated clause, at this section's own sites: the two positions' own
+/// spelling, **read at the method's own arity — `pair` at `1` of `2` and `constraint` at `2` of `2`**, since
+/// the LEADING `instance` POSITION IS DROPPED by `§2.4` item 9 (f)'s `A127` clause (the receiver is not a
+/// position of any declared signature; `§2.12` item 3's one-spelling rule).
 const ARGUMENT_POSITION_FIRST = 'first argument';
 const ARGUMENT_POSITION_SECOND = 'second argument';
 
-/// **`crossing.md §1.3`'s `AddressArg` domain AT ITS OWN ROWS 7–10 AND 14, DECIDED AT THE BOUNDARY FOR `on`
-/// ALONE — `A81`'s *"always validate"*, VERBATIM** (`parameter-semantics.md §2.17`'s dated clause: *"An
-/// `address` outside `AddressArg`'s domain at `on`'s position `1` of `2` → `AddressMalformed`"*).
-///
-/// **WHY THIS WALK EXISTS, AND WHY IT IS NOT `DD-46`'s PRE-CHECK:** **`DD-46` is a declaration about the
-/// DECLARED VERBS of `§2.2` and `§2.10`, whose arguments are passed through to the store's own carrier
-/// so the STORE chooses which refusal answers** — and this walk is not taken on any of their paths.
-/// **The listener home is the ONE store surface where that division fails: `listen` keeps the address's
-/// segments as the caller spelled them, so an out-of-domain segment reaches the home's key without the
-/// `L-1` walk ever running over it — measured, not assumed** (`bindings/js/test/convenience.test.mjs`'s
-/// second cell drives the rows below through `on`). **`§2.4` item 7 (a) step 1 makes `on` the site that owns
-/// this validation, so `on` decides the four rows the carrier cannot.**
-///
-/// **THE ROWS DECIDED, EACH NAMED AT ITS OWN `AddressArg` ROW** — row 7: an array holding a NEGATIVE
-/// integer · row 8: an array holding a NON-INTEGER number (`1.5`, `NaN`, `Infinity`) · row 9: an array
-/// holding `null`/`undefined` · row 10: an array holding an object (and, by the same clause's own reading of
-/// `§1.2`'s classes, an array, a `function`, a `symbol` or a `bigint`) · row 14: a sparse array. **AND ROW
-/// 6's SHAPE HALF IS DECIDED FIRST AND BESIDE THEM: a non-array IS `AddressMalformed`, and `'a.b'` is not a
-/// delimited address** — `classSpelling` names each class the value HAS (`§1.8`'s no-repair prohibition: no
-/// value here is converted, defaulted or substituted). **EACH REFUSAL IS THE ONE FORM, with the failing
-/// TARGET printed as its own value, the CLASS that failed and the ARGUMENT POSITION** (`§2.5` items 5 (a)
-/// and (b); `§2.17`'s dated clause) — **and NOTHING HERE IS A SECOND STATUS, A THIRD MEMBER OR A RAW HOST
-/// ERROR.**
-///
-/// **AND NOTHING IS LEFT BEHIND:** this walk performs NO store call and NO registry write, so it runs at
-/// step 1 and leaves no home entry, no registry entry, no node and no journal entry.
-///
-/// **⟶ AND THE PROXY DECISION IS TAKEN FIRST, IN `encodeAddress`'S OWN ORDER — `C-1` OF THE GATE-4
-/// ADVERSARIAL PASS, THE STOP-GRADE FINDING, CLOSED AT THIS SITE (2026-10-11).** The walk's first statement
-/// was `isAdmittedArray(address)`, which reads `Array.isArray` and then `arrayClass`'s
-/// `Object.getPrototypeOf` — **so a trap-carrying `Proxy` over an array RAN ITS TRAPS BEFORE ANY DECISION
-/// WAS TAKEN**: a `getPrototypeOf` trap that throws raised a RAW HOST ERROR out of `on` (against
-/// `§2.5` item 5 (e): *"a rejection is NEVER A RAW HOST ERROR"*), a `get` trap's side effects ran, and a
-/// re-entrant verb could be invoked from inside the walk — for an argument the contract refuses as
-/// `AddressArg` row 12 (`DD-34`) without reading it at all. **`encodeAddress` at `:609` already took this
-/// decision first, in its own words** (*"A `Proxy` is refused BEFORE the array shape test and before any
-/// element is read"*), **and this function now does the same, in the same order, with the same refusal.**
-/// **NO TRAP RUNS ON ANY PATH: the shape test, the prototype read that follows it, the `.length` read, every
-/// element read and the listener-position check are each reached only for a value `types.isProxy` has
-/// already answered about — and `util.types.isProxy` reads no member and invokes no handler.** The refusal
-/// is `AddressArg` row 12's own `AddressMalformed`, carried and never minted (`DD-40`).
-function validateOnAddress(address) {
-  if (types.isProxy(address)) {
-    // `AddressArg` row 12 (`DD-34`): the CLASS decision first, before the shape test and before any read —
-    // the order `encodeAddress` takes at the same position.
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(address),
-      `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(address)}, and an address is an array of segments`,
-    );
+/// **THE KERNEL, RESOLVED ON THE FIRST CONSTRAINT ACT AND NEVER AT LOAD** (`kernel-surface.md §1` item 1;
+/// `A121`, `A122`). **IT IS NOT AN EXPORT AND NOT A SUBPATH**: the module is reached as a FILE, at the path
+/// the allowlist publishes it at. **AND THE RESOLUTION IS LAZY ON PURPOSE**: the entry must still LOAD where
+/// nothing is staged beside it — the publish and negative drives assemble trees carrying `index.mjs` alone
+/// — and a load-time import of `./src/` would make every one of those trees unable to reach the artefact
+/// they were built to drive. A drive that never carries and never asks for a constraint reaches no byte of
+/// the kernel.
+let KERNEL = null;
+function constraintsKernel() {
+  if (KERNEL === null) KERNEL = require_('./src/constraint-kernel.mjs');
+  return KERNEL;
+}
+
+/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-8`, read HERE for their ONE use: to tell a
+/// refusal the KERNEL raised from one a STORE VERB raised, so that `A120` (2) can be applied to the first
+/// and not to the second. **NO `KC` SPELLING CROSSES THIS SURFACE** (`§2.12` item 1's read-through clause:
+/// printed here it would be a second, unowned home for the kernel's own vocabulary).
+const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8'];
+
+/// THE PAIR'S OWN KEY — `(address, id)`, the key the kernel's registry is keyed by (`kernel-surface.md §2.2`
+/// item 4). The address half is JSON's own spelling of the segment array, which is TOTAL over every address
+/// the pair's domain admits and collides across no two of them.
+function constraintPairKey(address, id) {
+  return `${JSON.stringify(address)}\u0000${id}`;
+}
+
+/// **THE ONE REFUSAL `§2.12` ITEM 4 DECLARES, TAKEN BEFORE ANY ACT AND LEAVING NOTHING CHANGED** — a JS
+/// `TypeError`, its `status` member ABSENT, no `message` member of this unit's own, **the store's closed
+/// `16`-member set neither minted nor widened, and the store reached by no call this refusal makes.**
+function constraintRefuse(where, value) {
+  throw new TypeError(
+    `the ${where} of this call is ${classSpelling(value)}, and it is not a value this position's domain `
+    + 'admits',
+  );
+}
+
+/// **A POSITION BELOW THE DECLARED ONE — `§2.12` item 4 AND `§2.4` item 9 (f)'s RULE (ii): a SHORT ARITY
+/// TAKES THE SAME ONE `TypeError` AND CHANGES NOTHING.** *"No assertion is made over `message`, and its
+/// absence is the declared reading"* — the member is not one of the three this form is observed by.
+function constraintArity(verb) {
+  throw new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`);
+}
+
+/// **`§2.12` ITEM 4'S TWO CALLER POSITIONS, CLASS FIRST AND IN THEIR DECLARED ORDER** (`PAR-JS-22`–`PAR-JS-24`)
+/// — **the receiver, which was item 4's first position, is DROPPED and is judged by the CALL and no longer by
+/// a walk** (`§2.4` item 9 (f)'s `A127` clause): a member reached through the product IS a product of this
+/// factory, so no instance-domain arm stands here. **NOTHING BELOW RUNS UNLESS BOTH POSITIONS HAVE PASSED**
+/// (`A81`), so a refused call performs no store call, no registry write and no `K-1` — atomicity by the
+/// validation's POSITION.
+function constraintSite(verb, instance, supplied, pair, constraint) {
+  if (supplied < 2) constraintArity(verb);
+  const state = INSTANCES.get(instance);
+  if (!isPlainObjectValue(pair)
+    || !Object.hasOwn(pair, 'address')
+    || pair.address === undefined) {
+    constraintRefuse(`pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\``, pair);
   }
-  if (!isAdmittedArray(address)) {
-    // `AddressArg` row 6 (a non-array, its five named classes), row 11 (a class extending `Array`), row 12
-    // (a `Proxy`) and rows 4–5 (`undefined`/`null`, whose own class spelling is the target's).
-    boundaryReject(
-      'AddressMalformed', // `AddressArg` rows 4–6's own declared code, carried and never minted (`DD-40`)
-      targetSpelling(address),
-      `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(address)}, and an address is an array of segments`,
-    );
+  const encoded = constraintAddress(pair.address);
+  if (typeof encoded === 'string'
+    || !Object.hasOwn(pair, 'id')
+    || pair.id === undefined
+    || typeof pair.id !== 'string'
+    || pair.id === '') {
+    constraintRefuse(`pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\``, pair);
   }
-  for (let i = 0; i < address.length; i += 1) {
-    // Row 14 (`DD-8`): a HOLE refuses the WHOLE value — and `isAdmittedArray` has already decided the
-    // CLASS, so `in` below reads an element of a genuine array and no chain.
-    if (!(i in address)) {
-      boundaryReject(
-        'AddressMalformed',
-        'an array with a hole',
-        `the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is a sparse array, and an address is a dense array of segments`,
-      );
-    }
-    const segment = address[i];
-    // Rows 2–3: the two IN-DOMAIN classes — a string (the empty string included) and a non-negative
-    // integer. **The integer test is taken on the value as it is and nothing is repaired**: `1.5`, `-1`,
-    // `NaN` and `Infinity` are each refused as `a number`, which is the class the value HAS.
-    //
-    // **⟶ AND THE TWO CLASSES THIS PASS ADDED ARE DECIDED HERE TOO, BEFORE THE STORE IS REACHED — `C-4`'s
-    // segment half and `C-12` (`2026-10-11`).** They are the same two decisions `encodeSegment` takes for
-    // the other verbs' addresses, taken at this site's own position and with this site's own ARGUMENT
-    // POSITION spelling, **so `on` and `listen` answer one address the same way and neither reaches the
-    // carrier with a value it cannot spell**: a LONE SURROGATE in a string segment (row 1's dated clause —
-    // the class has no Rust spelling and is refused *"at the PACKAGE's own edge, BEFORE any verb is
-    // called"*, never repaired), and an INTEGRAL segment above the `u64` the carrier's `Index` variant
-    // carries (`package.md §4.5` item 2's `JsSegment` row) — **which the facade's `n as u64` used to
-    // SATURATE, folding `2**64` and `1e30` onto one store address and one handle (`C-12`).**
-    if (typeof segment === 'string') {
-      if (hasLoneSurrogate(segment)) {
-        boundaryReject(
-          'ValueNotAdmitted', // row 1's dated clause's own answer, carried and never minted (`DD-40`)
-          // **THE TARGET IS THE SEGMENT POSITION'S OWN NAME AND NOT THE STRING**: a lone surrogate cannot
-          // cross into the generator either — its bytes are not a `String` — so the failing TARGET is named
-          // as `encodeSegment` names it at the same class (`'address'`), and the failing segment is named by
-          // its INDEX beside it. **The class half is mandatory and it is carried; the failing VALUE is not
-          // printed, because the only spellings for it are the caller's own unrepresentable code unit or a
-          // REPAIR of it, and `§1.8` forbids the repair.**
-          'address',
-          `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is a string carrying a lone surrogate, and a segment is a string or a non-negative integer`,
-        );
-      }
-      continue;
-    }
-    if (typeof segment === 'number' && Number.isInteger(segment) && segment >= 0) {
-      if (!Number.isSafeInteger(segment)) {
-        boundaryReject(
-          'AddressMalformed', // `AddressArg` row 8's own declared code, carried and never minted (`DD-40`)
-          targetSpelling(segment),
-          `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is an integral segment above the carrier's own range, and a segment is a string or a non-negative integer a \`u64\` can carry exactly`,
-        );
-      }
-      continue;
-    }
-    // Rows 7–10 + `§1.2`'s class set: every other class is refused AT THE BOUNDARY, inside the one form,
-    // naming the failing SEGMENT — the target the item's own clause names — its class and the position.
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(segment),
-      `the segment at index ${i} of the address at the ${ARGUMENT_POSITION_FIRST} of \`on\` is ${classSpelling(segment)}, and a segment is a string or a non-negative integer`,
-    );
+  if (typeof constraint !== 'function') {
+    constraintRefuse(`constraint at the ${ARGUMENT_POSITION_SECOND} of \`${verb}\``, constraint);
   }
-  return undefined;
+  return { state, address: encoded.s, id: pair.id };
+}
+
+/// **THE ONE ACT THAT MAKES A PAIR A PAIR THE ENTRY CARRIES** (`§2.12` item 1's preamble clause (a)–(b)):
+/// `K-1` AT THE INSTANCE — the key at its own positions and the caller's function at the fourth, which is
+/// the SAME call `storeCreate`'s batch registration makes — and THE ENTRY'S OWN RECORD BESIDE IT, whose
+/// `enabled` member is the pair's state and whose `identity` is THE PAIR'S OWN OPAQUE VALUE (`PAR-JS-25`).
+/// **THE IDENTITY IS MINTED ONCE PER PAIR AND IT CARRIES NO READABLE MEMBER**: a second ADD at the same pair
+/// overwrites the element and answers THIS SAME VALUE, and two pairs answer two values. **`PAR-JS-25`'s
+/// opacity is the observable** — *"it has no own enumerable member at all"* — so it is a null-prototype
+/// object and NOT the entry record: every datum above stays the entry's own and never crosses.
+function carryConstraint(state, instance, address, id, constraint) {
+  constraintsKernel().register(instance, address, id, constraint);
+  const entry = {
+    address,
+    addressKey: JSON.stringify(address),
+    id,
+    fn: constraint,
+    enabled: true,
+    identity: Object.create(null),
+  };
+  state.constraints.set(constraintPairKey(address, id), entry);
+  return entry;
+}
+
+/// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
+/// `true` is the only pass value). **THE ELEMENT IS PARKED AND NEVER WITHDRAWN**: `constraintOn` re-registers
+/// `entry.fn`, so *"it is the element the entry carried at that pair — never a second constraint and never a
+/// re-registration"* (`§2.12` item 3's `constraintOn` row).
+function constraintParked() {
+  return true;
+}
+
+/// **A WELL-FORMED PAIR THE ENTRY DOES NOT CARRY — `§2.12` item 3's second answered question and
+/// `PAR-JS-24`'s second declared answer: at EITHER toggle, in EITHER direction, an OUTSIDE VALUE taking
+/// item 4's refusal, ONE THROWN `TypeError`, THE ENTRY NOT WIDENED.** It is NOT a third population route:
+/// were the entry widened with the function the refused call carried, a pair would stand ENABLED WITH NO
+/// FUNCTION — a state no clause of that directory declares.
+function constraintUncarried(verb, pair) {
+  throw new TypeError(
+    `the pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\` carries no constraint in this instance, and `
+    + 'a toggle names a pair the entry carries',
+  );
 }
 
-/// **`on`'s STEP 1, WHOLE: VALIDATE THE `address` THEN THE `listener`, CLASS FIRST AND NOTHING REPAIRED**
-/// (`surface.md §2.4` item 7 (a); `A81` *"always validate"*, verbatim; `crossing.md §1.7`'s order — class,
-/// then shape, then admit-or-refuse). **EACH REFUSAL IS `AddressMalformed` IN `§2.5`'s SINGLE FORM, carrying
-/// the failing TARGET, the CLASS the value HAS and the ARGUMENT POSITION** (`§2.17`'s dated clause, whose
-/// class set is EXHAUSTIVE AND CLOSED and whose two new arms are a non-function at `2` of `2` and an
-/// `address` outside `AddressArg` at `1` of `2`).
-///
-/// **AND NOTHING IS LEFT BEHIND** (`§2.4` item 7 (a)): this function performs NO store call and no registry
-/// write, so a refusal here leaves NO STORE-SIDE HOME ENTRY, NO REGISTRY ENTRY, NO NODE MINTED AND NO
-/// JOURNAL ENTRY APPENDED — **atomicity by the validation's POSITION and not by a rollback.**
-function validateOnArguments(address, listener) {
-  validateOnAddress(address);
-  if (typeof listener !== 'function') {
-    boundaryReject(
-      'AddressMalformed',
-      targetSpelling(listener),
-      `the listener at the ${ARGUMENT_POSITION_SECOND} of \`on\` is ${classSpelling(listener)}, and a listener is a JS function`,
-    );
+/**
+ * **`§2.12` ITEM 2 (a): `addConstraint(pair, constraint) -> constraint identity` — THE ADD ROUTE, WHICH
+ * CARRIES THE FUNCTION.**
+ *
+ * **ITS TARGET STATE AT THE PAIR IS *"the pair's element IS the supplied `constraint`, whether the pair was
+ * HELD or NOT"*, AND THE HELD ARM IS AN OVERWRITE AND NOT A THROW**: *"where the pair was already held, the
+ * supplied constraint OVERWRITES the held one … and the call REFUSES NOTHING and THROWS NOTHING for the mere
+ * fact that the pair was held"* — the SAME identity the pair was already added under is returned, and it is
+ * THE IDENTITY AND NOT THE ENTRY RECORD (`PAR-JS-25`'s opacity, `carryConstraint` above).
+ */
+function addConstraint(instance, n, pair, constraint) {
+  const site = constraintSite('addConstraint', instance, n, pair, constraint);
+  const key = constraintPairKey(site.address, site.id);
+  const held = site.state.constraints.get(key);
+  if (held === undefined) {
+    return carryConstraint(site.state, instance, site.address, site.id, constraint).identity;
   }
+  constraintsKernel().register(instance, site.address, site.id, constraint);
+  held.fn = constraint;
+  held.enabled = true;
+  return held.identity;
 }
 
-/// **`on(address, listener) -> handle`** — `surface.md §2.4` item 7 (a), ITS THREE STEPS IN THEIR ONE FIXED
-/// ORDER, AND NO FOURTH:
-/// ```
-///   1. VALIDATE   this file's own step, above: the address, then the listener, class first, never repaired
-///   2. LISTEN     the store's own listen(instance, address)   — the SAME declared verb, unchanged
-///   3. REGISTER   the package's registry takes the returned handle with this listener (rule 2 = replacement)
-/// ```
-/// **THE RETURN IS THE HANDLE** in `§2.3` item 2's ONE output spelling — the package's opaque value and
-/// never the token string. **AND AT AN ADDRESS THE STORE'S HOME ALREADY HOLDS IT RETURNS THAT ADDRESS'S
-/// EXISTING HANDLE**, because the store's own address-level idempotence makes a repeat `listen` mint
-/// nothing and answer the entry's own handle (`write-and-read.md §6.5` item 12 (c); `§2.3`'s dated clause).
-/// **THE TWO ARMS ARE THEREFORE THESE AND NO OTHERS:** the FRESH arm, where the store minted a token and
-/// the package wrapped it, and the HELD arm, where the SAME opaque value is answered again and the
-/// registry's function for it becomes THIS listener — **a REPLACEMENT, never a second entry and never a
-/// fan-out** (`§2.4` rule 2), and **including over an entry `register` placed, which `DD-52` settles: the
-/// registry does not record which member wrote an entry.** **SO A LATER WRITE UNDER THAT ADDRESS INVOKES
-/// THIS FUNCTION ONCE AND THE REPLACED ONE NEVER FIRES AGAIN** — and *which* listener fires and *when* is
-/// the STORE's rule, derived from `write-and-read.md §6.5` item 14 and never stated here.
-function onAt(state, instance, address, listener) {
-  // STEP 1 — VALIDATE. Nothing below runs unless BOTH arguments have passed (`A81`; `A76`).
-  validateOnArguments(address, listener);
-  // STEP 2 — LISTEN. The store's own verb, reached with the address the caller supplied and through this
-  // package's ONE declared `listen` spelling (`§2.10`): same name, same position, same arity, same return.
-  const handle = listen(instance, address);
-  // STEP 3 — REGISTER. `§2.4` rule 2 at the registry that holds the function: ONE identity, ONE function.
-  state.registry.set(handle, listener);
-  return handle;
-}
-
-/// **`off(handle) -> undefined`** — `surface.md §2.4` item 7 (b), ITS THREE STEPS IN THEIR ONE FIXED ORDER,
-/// AND `DD-54`'s ONE OBSERVABLE: **after any `off` that throws, BOTH the store-side entry and the registry
-/// entry are exactly as they were.**
-/// ```
-///   1. VALIDATE    the handle against THIS INSTANCE's own handle domain, class first, never repaired
-///   2. UNLISTEN    the store's own unlisten(instance, handle)   — the same declared verb, unchanged
-///   3. DEREGISTER  the package's own registry entry for that identity, and NOTHING ELSE
-/// ```
-/// **AND ITS THREE ARMS, EACH WITH ITS OBSERVABLE** (item 7 (b)'s own table):
-///   * **THE OWN ARM** — an in-domain identity the registry holds a function for: the store-side home entry
-///     is withdrawn, the registry's entry for that identity is REMOVED, and `undefined` is returned.
-///   * **THE OWN-ENTRYLESS ARM** — an in-domain identity the registry holds NO function for (registered
-///     never, or already withdrawn): `undefined`, the store-side withdrawal IS performed, nothing is
-///     removed that was not there and NO OTHER REGISTRATION IS DISTURBED (`DD-53`: `off`'s refusal arm is
-///     the OUTSIDE-DOMAIN handle ALONE).
-///   * **THE OUTSIDE ARM** — a foreign instance's value, a prior session's value, a fabricated value, a bare
-///     `string`, a blank token, a non-opaque value, `null`, `undefined` or an ABSENT argument: **a REFUSAL**
-///     — `AddressMalformed` in `§2.5`'s single form, with the failing target, the class and the position —
-///     **and NEITHER removal is performed.** **THIS is the arm that makes `off` differ from `unlisten` over
-///     one value, and the difference is DECLARED and not incidental** (`§2.3`'s dated clause 3; `§2.8`).
-///
-/// **`unlisten` ITSELF IS UNTOUCHED AND KEEPS RULE 4 VERBATIM**: it withdraws the registration and NEVER the
-/// function, with the registry's entry STANDING. `off` is the PACKAGE-OWNED verb that removes one, and a
-/// reader who takes it as an exception to rule 4 has read a second withdrawal into the store's surface —
-/// there is none. **AND `off` REMOVES NO MORE THAN THE HANDLE NAMES**: a lawful sibling registration —
-/// another address's entry, another identity in the same instance — STANDS. **AND NEITHER IT NOR `on` IS A
-/// RELEASE VERB** (`A74`): no `dispose()`, no `close()`, no finalizer and no teardown is declared here, and
-/// the instance's state is still released with the instance and by nothing else.
-///
-/// **AND `off` DOES NOT CANCEL A DELIVERY IN FLIGHT**, because the delivery's recipient set is read when the
-/// window opens (item 7 (b); `§2.4`'s `CF-DUP-3` re-homing clause; `write-and-read.md §6.5` item 14).
-function offAt(state, instance, handle) {
-  // STEP 1 — VALIDATE. An outside value is refused HERE, and steps 2 and 3 never run (`DD-54`).
-  const encoded = encodeHandle(state, handle);
-  if (encoded.k !== 'O') {
-    // The ONE form, with the failing TARGET printed as its own value (item 5 (a)), the CLASS the value HAS
-    // (item 5 (b), mandatory) and the ARGUMENT POSITION (`§2.17`'s dated clause, `1` of `2`) — **and NOT
-    // `unlisten`'s no-op `undefined`, which is that verb's own declared answer and not this one's.**
-    boundaryReject(
-      'AddressMalformed', // `§2.8`'s own declared code at this site, carried and never minted (`DD-40`)
-      targetSpelling(handle),
-      `the handle at the ${ARGUMENT_POSITION_FIRST} of \`off\` is ${classSpelling(handle)}, and it is not an opaque value THIS INSTANCE minted or adopted`,
-    );
+/**
+ * **`§2.12` ITEM 2 (a): `constraintOn(pair, constraint) -> undefined` / `constraintOff(pair, constraint) ->
+ * undefined` — THE TWO HALVES OF THE ONE TOGGLE, AND NEITHER STANDS IN THE KERNEL.**
+ *
+ * **THEIR THREE ANSWERS, AND THE TWO SHARED CLAUSES:**
+ *   * **IDEMPOTENT SUCCESS WHERE THE PAIR ALREADY STANDS IN THE STATE IT ASKS FOR** (item 3's first answered
+ *     question): `undefined`, the pair and its element EXACTLY as they stood, and NOTHING THROWN.
+ *   * **THE SECOND POSITION IS REQUIRED AND IS A NO-OP ON EVERY SUCCESS** (`item 3`'s `constraintOn` row;
+ *     `§2.4` item 9 (f)'s method table: *"the third position is REQUIRED and is a no-op on success"*): a
+ *     FUNCTION there is never refused on the pair's ground, the entry NEVER SUBSTITUTES ONE, and it is
+ *     `entry.fn` — the element the entry carried — that is evaluated at the next write. **CARRIAGE IS
+ *     PAIR-KEYED AND THE TOGGLE'S OWN ARGUMENTS DO NOT DECIDE IT.**
+ *   * **AN OUTSIDE `pair` OR A SHORT ARITY TAKES `constraintSite`'s ONE `TypeError`**, and a WELL-FORMED PAIR
+ *     THE ENTRY DOES NOT CARRY takes `constraintUncarried`'s (`A126`).
+ */
+function constraintToggle(enabled, instance, n, pair, constraint) {
+  const verb = enabled ? 'constraintOn' : 'constraintOff';
+  const site = constraintSite(verb, instance, n, pair, constraint);
+  const entry = site.state.constraints.get(constraintPairKey(site.address, site.id));
+  if (entry === undefined) constraintUncarried(verb, pair);
+  if (entry.enabled !== enabled) {
+    constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    entry.enabled = enabled;
   }
-  // STEP 2 — UNLISTEN. The store's own verb through the ONE declared `unlisten` spelling (`§2.10`), reached
-  // with the handle this instance already owns. **A THROWING PATH LEAVES THE REGISTRY ENTRY STANDING**
-  // (`DD-54`): there is no `finally` here and none may be added.
-  unlisten(instance, handle);
-  // STEP 3 — DEREGISTER, the PACKAGE'S OWN state and nothing of the store's.
-  deregister(state, handle);
   return undefined;
 }
 
-/// **THE DEREGISTRATION OF ONE IDENTITY — `§2.4` item 7 (b)'s THIRD STEP.** The registry's entry for THIS
-/// identity is removed, and NOTHING ELSE OF THE PACKAGE'S STATE: **the identity's own token-to-handle
-/// binding STANDS**, because it is not the withdrawal's to move and three declared answers rest on it —
-/// `register(h, …)` over a handle this instance adopted or minted is judged by the INSTANCE's own domain
-/// (`§2.4` item 5 (c)) and not by which verbs have run since, `unlisten`'s OPAQUE-only acceptance is the
-/// same domain (`§2.3` item 2), and `off`'s own ENTRY-LESS arm is declared over an identity that has
-/// ALREADY been removed by an earlier `off` (`DD-53`). **AND NO LATER `listen` CAN BE HANDED THIS BINDING
-/// BY ACCIDENT**, because the store MINTS A FRESH TOKEN after its home entry is withdrawn
-/// (`write-and-read.md §6.5` item 12; `A69`'s uniqueness is over the tokens the store MINTS), so a re-`listen`
-/// at the same address reaches `wrapHandles` with a token no map entry holds and is wrapped as a NEW
-/// identity — which is exactly `§2.4` rule 4's *"a later re-`listen` … mints a DIFFERENT handle"*. **A drive
-/// that finds the withdrawn identity's function reachable after one `off` has found a failure of this step
-/// and not of this sentence.**
-function deregister(state, handle) {
-  state.registry.delete(handle);
+/// **WHETHER THIS INSTANCE CARRIES A PAIR AT THIS WRITE'S ADDRESS** (`§2.12` item 1's preamble clause (a)) —
+/// the gate stage 1 takes before the kernel is reached at all. **THE CLASS DECISION COMES FIRST AND NO TRAP
+/// IS RUN ON ANY PATH** (`DD-34`): a `Proxy` address, a class extending `Array` and every non-array lies
+/// outside every pair's own address domain, so no pair of this entry can stand at one.
+function carriesConstraintAt(state, address) {
+  if (state.constraints.size === 0) return false;
+  if (types.isProxy(address) || !isAdmittedArray(address)) return false;
+  const key = JSON.stringify(address);
+  for (const entry of state.constraints.values()) {
+    if (entry.addressKey === key) return true;
+  }
+  return false;
+}
+
+/**
+ * **THE KERNEL-DRIVEN WRITE — `§2.12` ITEM 1'S FIVE STAGES, TAKEN IN THEIR ONE ORDER.**
+ * ```
+ *   1. K-2      the attempt is opened at this address, or the address's own live attempt is JOINED
+ *   2. the store leg     the kernel's own call on this entry's `write`, FIVE POSITIONS, the record
+ *                        identity its fifth position carries — so the delivery of that write's handles
+ *                        is WITHHELD here and owed to stage 5
+ *   3. K-3      the pass: every pair registered at this address, each against this op's own value
+ *   4. K-3      the attempt's terminal arm — the pass's, or the floor's where a save failed
+ *   5. settle   the residue the record's `pending` carries, delivered at instant (b), failing arm alone
+ * ```
+ * **THE CALLER MEETS A THROW INSTEAD OF A RETURN ON THE FAILING ARM, AND THE STORE'S OWN VERB PRODUCED
+ * NEITHER FORM** (`§1.2` item 2): see `constraintCrossing` for what crosses.
+ */
+function constraintWrite(state, instance, address, tier, value) {
+  const kernel = constraintsKernel();
+  let record;
+  try {
+    record = kernel.commit(instance, address, tier, value);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  const answer = state.leg;
+  try {
+    kernel.runAttempt(instance, record);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  return answer;
+}
+
+/// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
+/// STORE'S.** `§2.12` item 1's read-through clause fixes what crosses here: **A PLAIN OBJECT OF EXACTLY THE
+/// TWO MEMBERS `status` AND `message`, `status` A STRING DRAWN FROM THE STORE'S CLOSED `16`-MEMBER SET, the
+/// kernel's third member `log` ABSENT AND UNREACHABLE.** The member `status` carries is the store's
+/// `FileCommitFailed`, because no caller-side status can carry a `KC` token and a constraint-refused write
+/// is a commit that did not stand. **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED** (`§1.2`).
+function constraintCrossing(refusal) {
+  const status = refusal !== null && typeof refusal === 'object' ? refusal.status : undefined;
+  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) throw refusal;
+  throw {
+    status: 'FileCommitFailed',
+    message: typeof refusal.message === 'string'
+      ? refusal.message
+      : 'the write was refused by a constraint of this attempt',
+  };
 }
 
-// `delete` is a reserved word and the declared spelling is preserved on the way out.
-export { deleteOp as delete };
+// **THE MODULE NAMESPACE CARRIES ONE NAME, `storeCreate` ALONE** (`surface.md §2.9` item 1's `A127` clause;
+// `11 → 1` ✓): `delete`'s reserved-word spelling, the ten store-reaching names and the three constraint
+// functions are the product's own members above and have no export and no second spelling at any layer.