provident-storeroom 0.4.0 → 1.0.0

package/index.d.ts

@@ -10,18 +10,72 @@
 // NAMED EXPORT SET — **ONE NAME, `storeCreate`, AND NOTHING ELSE** (`surface.md §2.9` item 1's `A127`
 // clause; `docs/decisions.md` · `A127`/`A128`, 2026-10-16: the module-level count is `11 → 1` ✓, the
 // deprecation window of `A128`'s fiat being declared away at that clause); (2) the instance's own member
-// set, **TWELVE OWN MEMBERS AND NOTHING ELSE — `10 + 1 + 1 = 12` ✓** (`distribution.md §5.2` item 2 read
+// set, **FOURTEEN OWN MEMBERS AND NOTHING ELSE — `10 + 1 + 1 + 2 = 14` ✓** (`distribution.md §5.2` item 2 read
 // with `surface.md §2.4` item 9 (f)'s `A127` clause): **THE TEN METHODS** `read(address, tier?)` ·
 // `readLiteral(address, tier?)` · `write(address, tier, value, commit?)` · `delete(address, tier?)` ·
-// `rollback(opId)` · `listen(address)` · `unlisten(handle)` · `addConstraint(pair, constraint)` ·
+// `rollback(opId)` · `listen(handle, addresses)` · `unlisten(handle)` · `addConstraint(pair, constraint)` ·
 // `constraintOn(pair, constraint)` · `constraintOff(pair, constraint)`, **PLUS `register(handle, listener)
-// -> undefined` and `settle(record) -> undefined`** — the last being THE ORDERING SEAM the kernel calls and
-// the entry implements; and (3) the failure surface, a thrown plain object with exactly
+// -> undefined`, `constraints() -> ConstraintPair[]`, `removeListener(handle) -> undefined` AND
+// `removeConstraint(pair) -> undefined`** — the first two the singles the 2026-10-18 clause below names, the
+// last two the members `contract.md §2.7` item 9 adds — the first being the
+// listener registration, the second the registered-pair read; **`settle(record) -> undefined` STOOD HERE
+// AS THE ORDERING SEAM AND IS REMOVED WHOLE** (the clause below carries the mark and the ruling); and (3) the
+// failure surface, a thrown plain object with exactly
 // `{status, message, log}` — **THREE MEMBERS FROM 2026-10-16, `2 → 3`, on the architect's ruling *"Bubble
 // the message log to the client on failure, override any clauses that forbid this."*** (`surface.md §2.5`'s
 // clause of that date, the crossing form's ONE home; **the ONE figure that moves is the arity, and
 // `storeCreate` remains the namespace's one name and the product its twelve own members**).
 //
+// **⟶ AND THE METHOD LIST ABOVE CARRIES ONE STALE SPELLING AND ONE STALE ARITY, SUPERSEDED HERE, 2026-10-19:**
+// **`listen` IS `listen(handle, addresses)` AND NOT `listen(address)` — arity `2`, position `1` the
+// caller-spelled `handle` (a non-empty `string`) and position `2` `addresses`, a SET of addresses whose
+// member is an address and whose EMPTY ARRAY is in the domain** (`docs/specs/storeroom-held-listener-identity/
+// contract.md §2.2` item 1; `listen-verb.md §1` item 1 and `§2.2` items 1–2: the arity figure moves `1 → 2`
+// at four declared sites, each needing its own dated clause). **THE BYTES LISTING `listen(address)` STAND AS
+// THE PRE-2026-10-18 READING AND ARE READ THROUGH THIS CLAUSE** (`DEF-2026-10-02`: no whole-file rewrite).
+//
+// **⟶ AND THE MEMBER-SET FIGURE ABOVE IS SUPERSEDED AND IS READ THROUGH THIS CLAUSE, 2026-10-18: THE
+// OPERATIVE SET IS TWELVE OWN MEMBERS, `10 + 1 + 1 = 12` ✓ — THE TEN METHODS, `register` AND `constraints`** —
+// declared at `surface.md §2.4` item 9 (f)'s clause of that date, which moves the set `13 → 12` on the
+// architect's rulings of 2026-10-18, VERBATIM: *"Settle is redundant because the kernel is always in the
+// loop."* · *"Always route to the kernel, because the JS code does not decide whether constraints trigger."* ·
+// *"The kernel is always supposed to be in the middle. Any occasion where the write path is not governed by
+// the kernel is a hallucination."* **`settle` IS THE MEMBER THAT LEAVES AND NO OTHER MEMBER MOVES WITH IT**
+// (`§2.4` item 9's `REMOVED-WHOLE` pointer of the same date, whose own words are *"NO DRIVE MAY ASSERT A CALL
+// OF `settle` FROM THIS DATE, ON ANY INSTANCE, FOR ANY ARGUMENT"*). **THE TWO REMAINING SINGLES ARE `register`
+// AND `constraints`, AND THEY ARE NAMED BECAUSE A LONE `+1` WOULD NOT COMPUTE.** **SO A DECLARATION FILE THAT
+// STILL DECLARES A `settle(record) -> undefined` MEMBER AT ANY POSITION, OR THAT READS THIRTEEN OWN MEMBERS,
+// AFTER THIS DATE IS A FINDING BY THAT CLAUSE'S OWN WORDS** (`surface.md §2.4` item 9 (f)'s clause of
+// 2026-10-18, item 4: *"a declaration file that still reads THIRTEEN own members, or that declares a
+// `settle(record) -> undefined` member at any position, after this date is a FINDING"*). **THE BYTES ABOVE
+// STAND AS THE `A127` PASS'S READING (`DEF-2026-10-02`: no whole-file rewrite) and every "twelve own members"
+// figure in this file is read through the 2026-10-17 thirteen-mark and through THIS clause as TWELVE AGAIN,
+// with the thirteen being the 2026-10-17 reading and not the operative one.** **THE TWO ROUTES THAT WOULD
+// HAVE MOVED THE SET EARLIER ARE STILL REFUSED BY NAME AND NEITHER IS ONE OF THESE** (`§2.5`'s clause of
+// 2026-10-16: a `constraintLog(commit)` reader and a second module-namespace name).
+//
+// **⟶ AND THE MEMBER-SET FIGURE ABOVE IS SUPERSEDED AND IS READ THROUGH THIS CLAUSE, 2026-10-19: THE
+// OPERATIVE SET IS FOURTEEN OWN MEMBERS, `10 + 1 + 1 + 2 = 14` ✓ — THE TEN METHODS, `register`, `constraints`
+// AND THE TWO REMOVE MEMBERS `removeListener(handle)` AND `removeConstraint(pair)`** — **WHICH SUPERSEDES THE
+// METHOD LIST'S OWN *"THE TWO REMAINING SINGLES ARE `register` AND `constraints`"* OF 2026-10-18: the singles
+// that remain are still those two, and the fourteen-member set carries them PLUS the two remove members, so
+// no reader counts the `+ 2` into the singles** — declared at
+// `docs/specs/storeroom-held-listener-identity/contract.md §2.7` item 9, THE MEMBER SET `14`, whose own list
+// is `{ read, readLiteral, write, delete, rollback, listen, unlisten, addConstraint, constraintOn,
+// constraintOff, register, constraints, removeListener, removeConstraint }`. **THE FIGURE MOVES `12 → 14`
+// and the two new members are reached through the factory's product ALONE — the module namespace keeps its
+// ONE name (`11 → 1` ✓), because the two new members are NOT module exports** (`contract.md §2.7` item 9's
+// `[CENSUS]` and its closing clause). **AND THE `12 → 13` FIGURE IS WITHDRAWN BY NAME: the thirteen-mark of
+// 2026-10-17 is a SUPERSEDED READING and was never the operative one** (`P: docs/pending.md · (AA-5)`,
+// verbatim: *"the member set is 14 and the `12 → 13` figure is withdrawn by name"*). **SO EVERY "twelve own
+// members" FIGURE BELOW — the `A127` pass's reading at its own bytes, the 2026-10-18 clause's operative
+// `TWELVE`, and `StoreInstance`'s `"THE TWELVE"` — IS READ THROUGH THIS CLAUSE AS FOURTEEN, and a
+// declaration file that declares twelve while the product ships fourteen is the FINDING `contract.md §2.7`
+// item 9 exists to prevent.** **THE TWO ROUTES THAT WOULD HAVE MOVED THE SET EARLIER ARE STILL REFUSED BY
+// NAME AND NEITHER IS ONE OF THESE** (`§2.5`'s clause of 2026-10-16: a `constraintLog(commit)` reader and a
+// second module-namespace name) — the 2026-10-18 paragraph's closing sentence above stands BYTE-FOR-BYTE and
+// is read through this clause.
+//
 // **THE TEN METHODS TAKE THE RECEIVER'S OWN POSITION AWAY: `8 → 1` ✓ AND `4 → 12` ✓** (`surface.md §2.9`
 // item 1's and `§2.4` item 9 (f)'s `A127` clauses). The seven verbs that reach the store are METHODS of the
 // object `storeCreate` returned, so **NO DECLARED SIGNATURE CARRIES A LEADING `instance` POSITION** — the
@@ -37,16 +91,22 @@
 // them is a STORE type**: no register, no anchor, no tier tree, no journal and no store verb is declared
 // here (`§5.2` item 4).
 //
-// **AND TWO MORE SHAPES STAND BESIDE THOSE ELEVEN WITHOUT A BYTE OF EITHER BEING MINTED HERE, BECAUSE
-// `settle`'s ONE ARGUMENT POSITION IS THE KERNEL'S OWN RECORD AND NOT THIS PACKAGE'S** (`§2.4` item 9
+// **AND TWO MORE SHAPES STAND BESIDE THOSE ELEVEN WITHOUT A BYTE OF EITHER BEING MINTED HERE, BECAUSE THE
+// WRITE'S COMMIT POSITION IS THE KERNEL'S OWN RECORD AND NOT THIS PACKAGE'S** (`§2.4` item 9
 // (f)'s *"each with its argument types"* read with its *"no `pending`-shaped record type this unit does
 // not declare"*): **`AttemptRef` (`1` member) and `CommitRecord` (`4` members — `attempt` · `op` ·
 // `triggered` · `pending`) are THE KERNEL'S OWN NAMED SHAPES, DECLARED BY THE KERNEL AND NOT BY THIS
 // UNIT** (`kernel-surface.md §1` item 4's closed record enumeration; its `§2.1` item 2 for the record's
-// four members; `attempt-lifecycle.md §2.4` item 1 for the one-member `AttemptRef`) — so the seam's
-// argument carries its own `pending` member and this file MINTS NO RECORD TYPE OF ITS OWN to carry it.
+// four members; `attempt-lifecycle.md §2.4` item 1 for the one-member `AttemptRef`) — so the record position
+// carries its own `pending` member and this file MINTS NO RECORD TYPE OF ITS OWN to carry it.
 // **`AttemptRef` and `CommitRecord` are therefore not STORE types either, and not store records**: they
-// are kernel-side shapes the instance's `settle` member takes, cited from their own unit's declaration.
+// are kernel-side shapes, cited from their own unit's declaration.
+// **⟶ AND THE POSITION THEY ARE CITED FOR MOVED WITH `settle`'s REMOVAL, 2026-10-18**: `settle`'s own
+// argument is gone with the member, and these two shapes now stand here for the ONE position that still
+// reads a `CommitRecord` — the `commit` argument of `write` (`§2.4` item 9 (g) item 1's class test, the
+// record position `A120` (1) admits). **THE SHAPES THEMSELVES ARE UNMOVED AND `CommitRecord` KEEPS ITS
+// `FOUR` MEMBERS, `pending` AMONG THEM** (`§2.4` item 9's adoption-machinery clause of that date, item
+// `(vi)`: *"THE ADOPTION SYSTEM CONSUMED IT AND DID NOT OWN IT"*).
 //
 // **AND THE ONE THING THIS DECLARATION MUST NOT CARRY, STATED SO THE FINDING RULE IS CHECKABLE**
 // (`distribution.md §5.2` item 4): **it declares NO store type, NO store verb, NO `findAddress`, NO
@@ -70,7 +130,10 @@
 //    `AddressMalformed`. The narrowest lawful widening a declaration can make is `number`, and this file
 //    makes it.
 // 3. **THE INSTANCE'S *"TWELVE OWN MEMBERS AND NOTHING ELSE"* IS NOT STRUCTURALLY ENFORCEABLE HERE**
-//    (`§2.4` item 9 (f)'s `A127` clause; `§2.9` item 1's). An interface declares the members a value HAS
+//    (`§2.4` item 9 (f)'s `A127` clause; `§2.9` item 1's) — **AND THE COUNT IT NAMES IS THE SUPERSEDED ONE:
+//    THE OPERATIVE FIGURE IS FOURTEEN, read through the member-set clause of 2026-10-19 above**
+//    (`docs/specs/storeroom-held-listener-identity/contract.md §2.7` item 9). An interface declares the
+//    members a value HAS
 //    and constrains no excess member, so a product carrying a thirteenth own member still satisfies
 //    `StoreInstance`. The count is driven at the boundary instead (`a127-surface.test.mjs`'s
 //    `Object.getOwnPropertyNames` cell, which exists precisely because this declaration cannot fail on it).
@@ -140,8 +203,45 @@ export interface StoreConfig {
    * no-constraint store, and no default is declared for it"* — **and every element and every shape outside
    * the list is refused at the store's own construction with ITS OWN code and ITS OWN message**, which is
    * why the element type is the caller's own shape and not a narrowed record here.
+   *
+   * **⟶ AMENDED 2026-10-24 (`D-26`, verbatim: *"The batch in cfg.constraints must supply functions"*): THE
+   * ELEMENT IS THREE MEMBERS AND THE FUNCTION IS REQUIRED. The pair is the element's ADDRESSING and the
+   * function is its SUBSTANCE — the reading the use-case record has carried since 2026-10-16, now the
+   * declaration's own. THE STORE NEVER SEES THE FUNCTION**: a JavaScript function cannot cross into Rust at
+   * any depth, so the crossing carries the pair and **the PACKAGE arms the substance** at construction
+   * through the same act the add route performs (`D-26` items 3–4). The state this key's earlier prose named
+   * — *"a well-formed element that carried no function … is NOT a carried pair"* — therefore **HAS NO
+   * PRODUCER ON THIS ROUTE**: a batch element is always carried.
+   *
+   * **AND THE ELEMENT'S `id` IS THE PAIR'S HANDLE, A HANDLE IS INSTANCE-SCOPED AND UNIQUE, AND TWO RULES
+   * FOLLOW THAT ARE DIFFERENT RULES FOR DIFFERENT ACTS — a declaration that conflates them gets both wrong**
+   * (`D-23`, verbatim: *"Setting a constraint should expect a handle name to be used for handle and
+   * process/error logging purposes"*; `D-24`, verbatim: *"The handle becomes the id - the handle needs to be
+   * unique regardless, and setting a duplicate handle is an overwrite"*; `D-27`'s own table):
+   *
+   * | act | a repeated handle |
+   * |---|---|
+   * | **this key, `cfg.constraints`** | **REJECTED** — the list is ONE supplied act, so an internal ambiguity is malformed input and not a second write |
+   * | **`addConstraint(pair, constraint)`** | **OVERWRITE** — acts are separate in time, so a later one replaces the earlier |
+   *
+   * **SO, AT CONSTRUCTION, TWO REFUSALS THAT THE STORE CANNOT TAKE AND THE PACKAGE OWNS** (`D-27`): **no two
+   * elements of one `cfg.constraints` may name one `id`; and no element's `id` may equal a `handle` this
+   * construction's `listeners` adopts** — a cross-KIND collision, rejected regardless of kind (`D-27`:
+   * *"Reject duplicate handles in batch - regardless of listener/constraint type"*). **The second is not an
+   * overwrite and the first is not a second registration.** Both are refused **before any filesystem act**,
+   * in the surface's one thrown form `{status, message, log}`, under the store's existing
+   * `ConstraintListInvalid` — **the package mints no code**.
+   *
+   * **AND THE NAME'S OTHER TWO READERS NEED NOTHING** (`D-24` items 2–3, both recorded so no pass adds a
+   * member): `constraints()` already returns the bare `id`, so its four exclusions stand exactly as written;
+   * and `LogEntry` already carries `id`, so **the name's logging role moves no member-set** and no undeclared
+   * seventh member exists.
    */
-  readonly constraints?: readonly { readonly address: Address; readonly id: string }[];
+  readonly constraints?: readonly {
+    readonly address: Address;
+    readonly id: string;
+    readonly constraint: Constraint;
+  }[];
 }
 
 /**
@@ -170,6 +270,24 @@ export interface StoreConfig {
  * construction/startup, or of the LOADED state against that list at load — **and the store writes no byte of
  * that list into the file and holds no register key for it** (`contract.md §7.1` step 4 and `§7.2` item 6 as
  * amended 2026-10-15; `seams-and-lifecycle.md §8.1`).
+ *
+ * **⟶ AMENDED 2026-10-24 (`docs/specs/storeroom-native/contract.md §8.1`'s 2026-10-23 amendment (`A148` Q3,
+ * folded into `U-STOREROOM-JSON-CROSSING`); `strata/decisions.md`'s `FINDING` of this date; `R-3`'s `Q4`;
+ * `REVIEW-2026-10-24.md`'s `Q4`) — THE SET IS SEVENTEEN AND THE DECLARATION WAS ONE BEHIND THE STORE.** The
+ * amendment widens the closed set `16 → 17` with **`ValueRefusedAtBoundary` at rank `17`**, and *"the
+ * operative set is `17` members ranked `1`…`17`"* with the spelling moved to `[&'static str; 17]`; the store
+ * implements seventeen (`src/error.rs`'s `CODES`). **So `ValueRefusedAtBoundary` is written among the
+ * literals at rank `17`, LAST of the seventeen and BEFORE the escape — the position `ConstraintListInvalid`
+ * held, because the amendment APPENDS and moves no rank of `1`…`16`.** **THE ALGEBRA NOW READS
+ * `11 + 2 + 1 + 1 + 1 + 1 = 17` ✓, and the four figures this paragraph carries are read through this clause:
+ * *"THE SIXTEEN MEMBERS BELOW"* reads SEVENTEEN; *"its set has already moved twice … and 2026-10-15 to
+ * SIXTEEN"* reads THREE times, the third being this amendment, **which is the escape arm's own evidence and
+ * therefore reinforces §the arm rather than weakening it**; *"THE SIXTEENTH MEMBER … LAST of the sixteen"*
+ * reads `ValueRefusedAtBoundary` as the SEVENTEENTH and last of the seventeen, with `ConstraintListInvalid`
+ * at rank `16`; and `constraints()`' *"the store's closed `16`-member set is not reached"* keeps its
+ * statement about THAT READ while its FIGURE moves to `17`. **`ValueNotAdmitted` STAYS AT RANK `14` AND IS
+ * NOT REMOVED** — it remains the store's own answer on the native route — **so a pass that reads rank `17`
+ * as a RENAME of rank `14` has destroyed a member** (`DEF-2026-10-02`: no whole-file rewrite).
  */
 export type StoreStatus =
   | 'AddressMalformed'
@@ -188,6 +306,7 @@ export type StoreStatus =
   | 'ValueNotAdmitted'
   | 'FileCommitFailed'
   | 'ConstraintListInvalid'
+  | 'ValueRefusedAtBoundary'
   | (string & {});
 
 /**
@@ -233,8 +352,17 @@ export interface StoreRefusal {
   readonly log: LogEntry[];
 }
 
-/** The opaque handle a listener registration is keyed by: the package's own value for one registration. */
-export type Handle = object;
+/**
+ * **⟶ `U-STOREROOM-HELD-LISTENER-IDENTITY` (`D-GP-SHLI`): `Handle` MOVES `object → string`**
+ * (`contract.md §2.1` item 1; `P: docs/pending.md · P-6`, the type ruling, verbatim: *"Refuse handles that
+ * aren't strings."*). **THE CALLER SPELLS IT, HOLDS IT AND PASSES IT BACK; NOTHING MINTS IT.** The value the
+ * store reports in a trigger pair and the value the caller holds ARE ONE VALUE, and its domain is
+ * `{ s : s ∈ String ∧ s ≠ "" }` (`identity-and-domain.md §2` item 1).
+ *
+ * **THIS IS A CONSUMER-VISIBLE BREAK** (§7 item 2 of the contract): every signature below that names a
+ * handle is re-typed with it, and the release class is the release gate's (`P: docs/pending.md · (AA-4)`).
+ */
+export type Handle = string;
 
 /** The caller's listener: any JS function, invoked with the triggering address as its ONE argument. */
 export type Listener = (address: Address) => void;
@@ -283,14 +411,33 @@ export interface JournalOp {
 export interface WriteRecord {
   readonly op: JournalOp;
   readonly watched: readonly Address[];
-  readonly triggered: readonly Handle[];
+  /** **THE TRIGGER'S PAIRS** (`contract.md §2.4` item 1; `PAR-HL-38`): the pair REPLACES a bare handle list. */
+  readonly triggered: readonly TriggerPair[];
+}
+
+/**
+ * **⟶ `U-STOREROOM-HELD-LISTENER-IDENTITY`: THE TRIGGER'S PAIR, `{handle, address}`** (`contract.md §2.4`
+ * item 1; `trigger-and-pair.md §1`; `PAR-HL-19`, `PAR-HL-20`, `PAR-HL-21`).
+ *
+ * **`handle` IS THE CALLER'S OWN STRING** and **`address` IS THE BINDING'S OWN ADDRESS** — the address the
+ * listener was bound at, never the address the write targeted. **THE TWO ARE TOLD APART**: the write's own
+ * address crosses as the record's `triggeringAddress`, and the invocation's ONE argument is that write
+ * address (`contract.md §2.4` item 7).
+ *
+ * **NO PARALLEL `triggeredAddresses` ARRAY EXISTS AND NONE MAY BE ADDED** — the aligned form is an i-th
+ * correspondence, which reverses `DD-37` (`contract.md §2.4` item 1; `trigger-and-pair.md §2` item 4).
+ */
+export interface TriggerPair {
+  readonly handle: Handle;
+  readonly address: Address;
 }
 
 /** The record a `delete` answers. */
 export interface DeleteRecord {
   readonly address: Address;
   readonly tiers: readonly Tier[];
-  readonly triggered: readonly Handle[];
+  /** **THE TRIGGER'S PAIRS** (`contract.md §2.4` item 1; `PAR-HL-38`; `A43` — a delete fires its own set). */
+  readonly triggered: readonly TriggerPair[];
 }
 
 /**
@@ -315,8 +462,11 @@ export interface RollbackRecord {
  * it as a named kernel-side shape).
  *
  * **IT IS DECLARED HERE FOR ONE POSITION AND NO OTHER**: the `attempt` member of the `CommitRecord` the
- * instance's `settle` member takes (`§2.4` item 9 (f)'s *"each with its argument types"*). **No verb of
- * this entry answers with it and this package mints it nowhere.**
+ * `write` member's `commit` position takes (`§2.4` item 9 (f)'s *"each with its argument types"* read
+ * with item 9 (g) item 1's record-position class test). **⟶ THE POSITION IT IS CITED FOR MOVED WITH
+ * `settle`'s REMOVAL, 2026-10-18**: that member's argument is gone with the member, and the ONE position
+ * that still reads a `CommitRecord` is the `commit` argument above. **No verb of this entry answers with it
+ * and this package mints it nowhere.**
  */
 export interface AttemptRef {
   /** The attempt's identity: a non-empty, kernel-unique token. */
@@ -324,8 +474,11 @@ export interface AttemptRef {
 }
 
 /**
- * **THE ORDERING SEAM'S ONE ARGUMENT — THE KERNEL'S OWN `{ attempt, op, triggered, pending }` RECORD, AND
- * NOT THE STORE'S `WriteRecord`** (`kernel-surface.md §2.1` item 2's return-shape block: *"`CommitRecord`,
+ * **THE WRITE'S COMMIT POSITION IS THIS RECORD — THE KERNEL'S OWN `{ attempt, op, triggered, pending }`, AND
+ * NOT THE STORE'S `WriteRecord`** (**⟶ RE-SPELLED 2026-10-18: this block read *"THE ORDERING SEAM'S ONE
+ * ARGUMENT"*, and the seam `settle` is REMOVED WHOLE from the product — the BYTES stand and are read through
+ * this clause; THE SHAPE IS UNMOVED and takes the ONE position that still reads it, the `write` member's
+ * `commit` argument) (`kernel-surface.md §2.1` item 2's return-shape block: *"`CommitRecord`,
  * a record with exactly FOUR members, the FOURTH added at the `A108` landing pass of 2026-10-13"*; its
  * `§1` item 4 counts it among the kernel's own named shapes).
  *
@@ -354,18 +507,36 @@ export interface CommitRecord {
   readonly attempt: AttemptRef;
   /** The op the store's write returned, VERBATIM (`JournalOp` above; `§2.1` item 2). */
   readonly op: JournalOp;
-  /** The store's own `triggered` member, VERBATIM, read as a SET (`§2.1` item 2). */
-  readonly triggered: readonly Handle[];
-  /** THE WHOLE RETURNED SET OF TRIGGERED CONSTRAINTS, each entry leaving it only by being checked off as it passes (`§2.1` item 2). */
-  readonly pending: readonly Handle[];
+  /** The store's own `triggered` member, VERBATIM, read as a SET (`§2.1` item 2) — now a PAIR LIST. */
+  readonly triggered: readonly TriggerPair[];
+  /**
+   * **THE WHOLE RETURNED SET OF TRIGGERED CONSTRAINTS, each entry leaving it only by being checked off as it
+   * passes — and now a PAIR list, because `pending` is SEEDED AS A CLONE OF `triggered` and therefore
+   * INHERITS ITS SHAPE** (`P: docs/pending.md · P-7`'s `pending` ruling, verbatim: *"Push the pair into
+   * pending. Pending is seeded as a clone of triggered."*; `(AA-7)`: *"Pop from set to check off"*;
+   * `contract.md §2.4` items 3–4; `PAR-HL-22`, `PAR-HL-39`).
+   *
+   * **ITS ELEMENT TYPE IS TOTAL — NO BARE HANDLE STANDS IN IT** (`contract.md §2.5` item 2): the bare-handle
+   * union the check-off and the discard once carried has no subject under POP, because the checked-off entry
+   * is REMOVED rather than carried beside.
+   */
+  readonly pending: readonly TriggerPair[];
 }
 
 /**
- * **THE INSTANCE `storeCreate` RETURNS — THE TWELVE OWN MEMBERS OF `surface.md §2.4` item 9 (f)'s `A127`
- * clause, `10 + 1 + 1 = 12` ✓: THE TEN METHODS, `register` AND `settle`.** Each is reached through the
+ * **THE INSTANCE `storeCreate` RETURNS — THE FOURTEEN OWN MEMBERS READ THROUGH `contract.md §2.7` ITEM 9,
+ * `10 + 1 + 1 + 2 = 14` ✓: THE TEN METHODS, `register`, `constraints` AND THE TWO REMOVE MEMBERS
+ * `removeListener(handle)` AND `removeConstraint(pair)`.** Each is reached through the
  * factory's own product alone (`package.md §1.3` item 3) — **NO member below is a named export**, because
  * the module namespace carries ONE name, `storeCreate` (`§2.9` item 1's `A127` clause; `11 → 1` ✓).
  *
+ * **⟶ AND THE OPENING FIGURE ABOVE WAS *"THE TWELVE OWN MEMBERS OF `surface.md §2.4` item 9 (f)'s clause of
+ * 2026-10-18"*, SUPERSEDED HERE 2026-10-19: the operative set is the FOURTEEN of
+ * `docs/specs/storeroom-held-listener-identity/contract.md §2.7` item 9, the withdrawn `12 → 13` figure not
+ * among the readings** (`P: docs/pending.md · (AA-5)`: *"the member set is 14 and the `12 → 13` figure is
+ * withdrawn by name"*). **THE BYTES STAND AS THAT PASS'S READING AND ARE READ THROUGH THIS CLAUSE**
+ * (`DEF-2026-10-02`: no whole-file rewrite).
+ *
  * **THE TEN METHODS ARE THE DECLARED POSITIONS OF `§2.2`, `§2.4`, `§2.10` AND `§2.12` WITH THE LEADING
  * `instance` POSITION DROPPED** (`A127`): `a.read(address, tier?)` is the declared `read`, `a.write(address,
  * tier, value, commit?)` the declared `write`, and so on — **the receiver IS the instance, so the position
@@ -375,7 +546,18 @@ export interface CommitRecord {
  *
  * **THE STATE IS PRIVATE AND NONE OF THE TWELVE IS A RELEASE VERB** (`surface.md §2.1` (e) item 1; `A74`):
  * the instance's own state is released with the instance and by nothing else — no `dispose()`, no `close()`
- * and no finalizer is declared here.
+ * and no finalizer is declared here. **⟶ AND `"THE TWELVE"` IS THE OPERATIVE FIGURE FROM 2026-10-18: the
+ * set read THIRTEEN from 2026-10-17 to that date, and `settle`'s removal brings it BACK TO TWELVE — the ten
+ * methods, `register` and `constraints`** (this interface's own clause for the last one below; the file's
+ * header carries the member-set mark, the architect's rulings and the two still-refused routes).
+ * **⟶ AND `"THE TWELVE"` IS SUPERSEDED IN TURN, 2026-10-19: THE OPERATIVE FIGURE IS `"THE FOURTEEN"` —
+ * `10 + 1 + 1 + 2 = 14` ✓, the ten methods, `register`, `constraints` AND the two remove members
+ * `removeListener(handle)` and `removeConstraint(pair)`** (`docs/specs/storeroom-held-listener-identity/
+ * contract.md §2.7` item 9; the file header's clause of this date names the two members and the arithmetic).
+ * **THIS SENTENCE'S ONWARD CLAIM IS UNMOVED AND IS THE POINT OF THE PASS: none of the fourteen is a RELEASE
+ * VERB** (`surface.md §2.1` (e) item 1; `A74`) — **the two remove members remove a LISTENER and a
+ * CONSTRAINT PAIR, never the instance's own state, and no `dispose()`, `close()` or finalizer stands beside
+ * them.**
  */
 export interface StoreInstance {
   /**
@@ -436,6 +618,16 @@ export interface StoreInstance {
    * RESERVED WORD, so under the superseded module-level spelling the function had to be declared as
    * `deleteOp` and re-exported (`export { deleteOp as delete }`). **A METHOD NAME IS NOT AN IDENTIFIER
    * BINDING, so the member is declared under the one name the surface publishes** (`A127`).
+   *
+   * **⟶ AND THE WORKAROUND THAT SENTENCE DESCRIBES IS HISTORICAL AND NO LONGER EXISTS, 2026-10-19: `deleteOp`
+   * HAS BEEN DELETED FROM THE CODEBASE ENTIRELY** — the `P-8` merge removed the module-level spelling, so
+   * `grep -n "deleteOp" bindings/js/index.mjs` now returns THAT NAME ONLY INSIDE MOVED-POINTER COMMENTS
+   * (the `delete` member's own doc block, whose body was `deleteOp`'s) **and no live binding by that name
+   * stands at any site** (`P: docs/pending.md · P-8`; `archive/p8-merge/2026-10-18/blocks/deleteOp.md`).
+   * **SO `export { deleteOp as delete }` IS NOT A SHAPE THIS PACKAGE ANY LONGER HAS AND MUST NOT BE READ AS
+   * ONE — the module namespace is ONE name, `storeCreate` (`11 → 1` ✓), and `delete` is reached as the
+   * instance's own method alone** (`§2.9` item 1's `A127` clause). **THE DECLARATION BELOW IS UNCHANGED AND
+   * WAS ALWAYS CORRECT: `delete(address, tier?): DeleteRecord`.**
    */
   delete(address: Address, tier?: Tier): DeleteRecord;
   /**
@@ -447,17 +639,50 @@ export interface StoreInstance {
    */
   rollback(opId: string): RollbackRecord;
   /**
-   * Begin watching an address, and answer the fresh opaque handle it is keyed by.
+   * Begin watching the addresses the caller names under the caller's own handle.
+   *
+   * **⟶ THIS BLOCK'S FEATURE SENTENCE READ *"Begin watching an address, and answer the fresh opaque handle
+   * it is keyed by"*, AND BOTH HALVES OF IT ARE SUPERSEDED, 2026-10-19** (`DEF-2026-10-02`: no whole-file
+   * rewrite — the bytes stand above and are read through this clause; `docs/specs/storeroom-held-listener-
+   * identity/contract.md §2.2` items 1, 2 and 10; `listen-verb.md §1` item 1). **THE CALLER SPELLS THE
+   * HANDLE AND `listen` ANSWERS `undefined`** — a DECLARED change of the return shape `Handle → undefined`,
+   * forced because returning the supplied handle would be a second spelling of the caller's own datum
+   * (`contract.md §2.2` item 10) — and **THE ADDRESS POSITION IS A SET**: position `2` is `addresses`, an
+   * ARRAY of addresses with the EMPTY ARRAY in the domain. **(The declaration below already carries both:
+   * `listen(handle: Handle, addresses: readonly Address[]): void` — `listen-verb.md §2.2` item 1's arity
+   * `2`, with no third position.)**
    *
    * **AND IT IS AN ADDRESS SITE THAT DECLARES ITS ARGUMENT POSITION** (`parameter-semantics.md §2.17`'s
    * dated clause; `surface.md §2.5` item 5 (b)'s position half): the address is `1` of `1`, so a CLASS
    * refusal here — a `Proxy` over an array included — carries `a Proxy` AND `first argument` inside the one
-   * failure form's message, and NO trap is run (`NG-JS-I`).
+   * failure form's message, and NO trap is run (`NG-JS-I`). **⟶ READ WITH THE CLAUSE ABOVE, the class test
+   * this sentence describes is the SET POSITION'S: the six outside classes are `listen-verb.md §2.2` item 2's
+   * and the declared answer for every one of them is the surface's one thrown form with the store's
+   * `AddressMalformed` (`§2.2` item 3; the position figure `1` of `1` above is the PRE-2026-10-18 reading —
+   * position `1` is `1` OF TWO, `listen-verb.md §1` item 1's arity `2`).**
    *
    * **A REPEATED CALL AT A HELD ADDRESS MINTS NOTHING AND ANSWERS THE ADDRESS'S EXISTING ENTRY'S HANDLE**
    * (`write-and-read.md §6.5` item 12 (c); `§0.4` clause 2), so the two calls answer ONE opaque value.
+   * **⟶ SUPERSEDED, 2026-10-19: `listen(h, S2)` AFTER `listen(h, S1)` IS SET-ASSIGNMENT AND NOT UNION —
+   * `S1` IS PURGED WHOLESALE AND `S2` INSTALLED, with no intermediate state observable — AND THE CALL
+   * ANSWERS NOTHING** (`contract.md §2.2` items 3 and 10; `listen-verb.md §3` item 1). **THE SURVIVING HALF
+   * IS THE MINTING HALF: the handle is the CALLER'S, so nothing mints one.** (`P: docs/pending.md · (R1)`,
+   * verbatim: *"`listen(h, S2)` AFTER `listen(h, S1)` IS SET-ASSIGNMENT, NOT UNION"*.)**
+   *
+   * **⟶ AMENDED 2026-10-24 (`strata/decisions.md` `D-22`, verbatim: *"Listen should return the handle on
+   * success, or error message on fail. Discard the noop prefix"*): `listen` ANSWERS THE HANDLE IT WATCHES
+   * UNDER ON SUCCESS — the caller's own spelling, returned as THE IDENTITY THE STORE HOLDS FOR THAT ENTRY —
+   * and EVERY FAILURE REMAINS THE SURFACE'S ONE THROWN FORM (`{status, message, log}`), because this ruling
+   * mints no second failure channel. THE RETURN IS A SUCCESS SIGNAL THAT CARRIES THE IDENTITY AND NOT AN ECHO
+   * TO BE SUPPRESSED**: the ground this block states above — *"returning the supplied handle would be a
+   * second spelling of the caller's own datum"* — is OVERRULED BY NAME, and the sentence stands as text read
+   * THROUGH this clause (`RCA-8(d)` ANNOTATE-BESIDE; `DEF-2026-10-02`: no whole-file rewrite). **What it is
+   * FOR, declared because the return has one consumer:** `K-1` ADOPTS the value, which is what
+   * `kernel-surface.md` declared all along (*"adopted, never minted by the kernel"*) and what the discarded
+   * `constraint@<JSON address>` prefix had replaced. **A caller that ignores the return is unaffected by
+   * widening `void → Handle`.**
    */
-  listen(address: Address): Handle;
+  listen(handle: Handle, addresses: readonly Address[]): Handle;
   /**
    * Withdraw a watching, and answer `undefined` — a no-op success for every value outside the domain.
    *
@@ -483,6 +708,17 @@ export interface StoreInstance {
    *
    * **Every outside form of either position throws ONE `TypeError`, whose `status` member is ABSENT, and
    * nothing is added, enabled, disabled or otherwise changed.**
+   *
+   * **⟶ AMENDED 2026-10-24 (`D-25`, verbatim: *"Attempting to overwrite a listener with a constraint or vice
+   * versa is rejected"*; `D-29`, verbatim: *"Handle becomes the internal ID"*): THE OVERWRITE IS
+   * SAME-KIND ONLY.** The sentence above — *"throws nothing for the mere fact that the pair was held"* — is
+   * TRUE AND UNAFFECTED and is now read **SCOPED BY KIND**: a repeated handle of the SAME kind at this act is
+   * an overwrite (`D-24`), while **a pair whose `id` equals a LIVE LISTENER'S HANDLE is REJECTED** — it does
+   * not overwrite the listener and it does not throw nothing. **The rejection is the surface's one thrown
+   * form `{status, message, log}` with the store's `AddressMalformed`**, its `message` naming BOTH SIDES and
+   * carrying the shared rule sentence *"a listener and a constraint do not share one"*, and it is taken
+   * **after the two positions' class tests and before the held-pair purge and before any store call**, so
+   * **no state moves**. `register`'s own direction of the same rule stands at that member (§its own clause).
    */
   addConstraint(pair: ConstraintPair, constraint: Constraint): ConstraintIdentity;
   /** **THE ENABLE HALF** (`§2.12` item 2 (a) and item 3's `constraintOn` row): `undefined`. **The
@@ -496,55 +732,96 @@ export interface StoreInstance {
    *  refused is ACCEPTED**. The `constraint` position's rule is `constraintOn`'s, clause for clause.
    *  **Idempotent success where the pair already stands DISABLED.** */
   constraintOff(pair: ConstraintPair, constraint: Constraint): void;
-  /** Register `listener` under the opaque `handle`, and answer `undefined` (`surface.md §2.4` item 5 (b)). */
+  /** Register `listener` under the opaque `handle`, and answer `undefined` (`surface.md §2.4` item 5 (b)).
+   *
+   *  **⟶ AND IT REFUSES WHERE A CONSTRAINT'S `id` STANDS AT THE ADDRESS** (`D-25`'s *"vice versa"*; `D-29`):
+   *  the cross-kind rule's register-side direction, in the surface's **own** thrown form
+   *  `{status, message, log}` with the store's `AddressMalformed` — **not** the `TypeError` this member's
+   *  conflict arm carried while a reserved `constraint@` prefix existed to be exempted — taken after the
+   *  handle's domain and registry tests and **before the registry write and before the re-install `listen`**,
+   *  so **no state moves**. **The exemption for kernel-prefixed handles is DELETED, not moved**: under `D-22`
+   *  the kernel's handle is no longer a reserved spelling and under `D-25` **the kernel registers nothing**, so
+   *  nothing needs to get past the test. */
   register(handle: Handle, listener: Listener): void;
+  /** **`removeListener(handle) -> undefined`** — the entry removed WHOLE and its store entries withdrawn; every arm that is not a real removal THROWS (`contract.md §2.7` item 2; `PAR-HL-14`, `PAR-HL-15`). */
+  removeListener(handle: Handle): void;
+  /** **`removeConstraint(pair) -> undefined`** — the pair, its N address rows, the kernel's registration and the store's home entry all gone; it is the ONE act that deletes an identity (`contract.md §2.7` item 3; `PAR-HL-16`, `PAR-HL-17`). */
+  removeConstraint(pair: ConstraintPair): void;
   /**
-   * **THE ORDERING SEAM — `settle(record) -> undefined`** (`surface.md §2.4` item 9; `A116` (D1)–(D2);
-   * `PAR-JS-19`): the one member THE KERNEL CALLS and the entry implements, at the two instants of a
-   * kernel-driven write — **the adoption at the first call for a record identity**, taken before the write
-   * verb (the write in flight is withheld: the in-window invocation set is empty), **and the delivery at
-   * the second call for that identity**, taken at the pass's terminal arm (the residue standing in the
-   * record's own `pending` member is delivered through this instance's own registry, one invocation per
-   * handle, each with the triggering address as its single argument). **Every other form at the record
-   * position — absent, `undefined`, `null`, a primitive, a function, a `Proxy`, an identity this instance
-   * never adopted — throws THE ORDERING SEAM'S OWN `TypeError`, whose `status` member is ABSENT and whose
-   * STRING `message` member is REQUIRED, and changes nothing.**
+   * **THE REGISTERED-PAIR READ — `constraints() -> ConstraintPair[]`** (`surface.md §2.4` item 9 (f)'s
+   * `constraints` clause of 2026-10-17, items 2–9; `§2.12` item 2-bis; `parameter-semantics.md §2.27` =
+   * `PAR-JS-27`**) — **one of the FOURTEEN own members, `10 + 1 + 1 + 2 = 14` ✓, the SECOND of the two
+   * remaining singles** (`docs/specs/storeroom-held-listener-identity/contract.md §2.7` item 9 — the
+   * member-set clause of 2026-10-19, which moves the figure `12 → 14`). **⟶ AND THE FIGURE THAT STOOD HERE WAS
+   * *"THE TWELVE own members, `10 + 1 + 1 = 12`"*, read from `surface.md §2.4` item 9 (f)'s clause of
+   * 2026-10-18, `13 → 12`: THAT READING IS SUPERSEDED — the two remove members `removeListener(handle)` and
+   * `removeConstraint(pair)` are the `+ 2`** (`P: docs/pending.md · (AA-5)`, verbatim: *"the member set is 14
+   * and the `12 → 13` figure is withdrawn by name"*; `DEF-2026-10-02`: no whole-file rewrite). **AND THIS
+   * MEMBER'S OWN SIBLING AMONG THE NON-STORE-REACHING MEMBERS IS `register` ALONE FROM THAT DATE
+   * (2026-10-18)**: the sentence that read *"beside `register` and `settle`"* is re-spelled at its own bytes,
+   * and this is the operative reading — **and it is NOT read as a count of the fourteen-member set's
+   * classes, because no clause of this file asserts which members make up that class** (`contract.md §2.7`
+   * items 2–5 for the two new members' own clauses; `§2.7` item 9).
    *
-   * **⟶ CORRECTED 2026-10-17 — THIS CELL ATTRIBUTED THAT `TypeError` TO *"the registration site's own"*
-   * FORM AND THAT ATTRIBUTION WAS FALSE** (`DEF-2026-10-16-Q`; `surface.md` §2.5 item 5 (g), the operative
-   * reading of the registration site; `§2.4` item 9 (b), landed 2026-10-15 on `A116` (D1), which re-spells
-   * the re-spelling this position takes). **THE REGISTRATION SITE ANSWERS A PLAIN `{status, message}` with
-   * `status` `AddressMalformed` — a `TypeError` there is a FAILURE** (`register.test.mjs`'s
-   * `isRegistrationRefusal`), and **the seam's own form is declared at `§2.4` item 9 (b) and not at item
-   * 5**: *"a `TypeError` with its `status` member ABSENT and a STRING `message` member REQUIRED AND NOT
-   * FORBIDDEN"* (`§2.5` item 5 (g)'s own record of that re-spelling, whose two dated readings of one
-   * phrase it reports and settles by no clause). **SO THE TWO SITES' FORMS ARE NOT ONE FORM, and this
-   * member's is the seam's.**
-   *
-   * **THE RECORD POSITION TAKES THE KERNEL'S OWN `CommitRecord` — `{ attempt, op, triggered, pending }`,
-   * FOUR MEMBERS — AND NOT THE STORE'S `WriteRecord`** (`surface.md` `§2.4` item 9 (f)'s *"each with its
-   * argument types"* read with item 9's own two-instant table; `PAR-JS-19`'s `supplier` cell; `A116` (D4):
-   * *"the carrier `CommitRecord.pending` and its two removal rules unchanged"*). **THE INSTANTS' OWN TABLE
-   * NAMES IT: the record is *"the `CommitRecord` `commit` is building"* at instant (a) and *"the SAME record
-   * identity"* at instant (b)** (`surface.md` `§2.4` item 9 (a)–(b)). **AND THE STORE'S RECORD IS NOT ONE:
-   * `WriteRecord` above is the three-member `{op, watched, triggered}` the `write` member answers with and
-   * carries NO `pending` member, `PAR-JS-13` is that record's returned `op` field (`parameter-semantics.md
-   * §2.13`) and not the record's own shape, and the kernel's record carries TWO of the store's members
-   * VERBATIM beside its own `attempt` identity and its own `pending` member** (`kernel-surface.md §2.1` item
-   * 2's *"WHAT IT IS NOT"* clause: *"the `CommitRecord` is the KERNEL'S OWN record and is NOT the store's
-   * `WriteResult`"*).
-   *
-   * **`CommitRecord` IS THE KERNEL'S DECLARED SHAPE AND IS NOT MINTED HERE** (`surface.md` `§2.4` item 9
-   * (f) forbids *"a `pending`-shaped record type this unit does not declare"*, and this unit declares none):
-   * the type is declared above with the kernel's own four members and cited from its own unit's declaration
-   * — `kernel-surface.md §1` item 4's closed record enumeration, `§2.1` item 2 for the record, and
-   * `attempt-lifecycle.md §2.4` item 1 for its `AttemptRef` — **and NO named export is added for it or for
-   * `settle`.**
+   * **THE RECEIVER IS THE STORE, THE CALL TAKES NO ARGUMENT (arity `0`) AND IT THROWS NOTHING**: there is no
+   * outside argument for the class test to refuse, and the call makes NO STORE CALL, MINTS NO CODE, APPENDS
+   * NO JOURNAL ENTRY AND CHANGES NO NODE — so this member is one of the product's NON-STORE-REACHING members
+   * and `§2.4` item 9 (f)'s rule (ii) has no subject at it.
+   *
+   * **WHAT IS RETURNED, EXACTLY — THE PAIRS AND NOT THE FUNCTIONS:** a **FRESH JS ARRAY on every call**,
+   * whose **every element is a FRESH plain object carrying EXACTLY TWO MEMBERS** — `address` (a fresh array of
+   * the store's own segments) and `id` (the constraint's own BARE `id`, a `string`) — the same two data the
+   * kernel's own registry is keyed by. **The empty array `[]` is the declared value where the instance carries
+   * no pair at all** (`PAR-JS-27`'s `domain` cell).
+   *
+   * **THE FOUR DECLARED EXCLUSIONS, EACH STATED SO A DECLARATION THAT VIOLATED ONE WOULD BE VISIBLE AT ITS OWN
+   * BYTES:**
+   * 1. **NO CONSTRAINT FUNCTION IS RETURNED** (item 3, four named grounds — the operative one being the
+   *    anti-pattern rulings' *do not hand out a value whose later use the contract cannot bound*). The
+   *    `Constraint` type below is that function and **NO MEMBER OF THIS RETURN CARRIES ONE**; a disabled pair
+   *    makes the hazard sharp, since `constraintOff` parks a stub in the kernel while the caller's function is
+   *    kept in the entry.
+   * 2. **NO OPAQUE IDENTITY IS EXPOSED** (item 4): `ConstraintIdentity` is NOT reachable through this return —
+   *    `PAR-JS-25`'s opacity would break the moment a consumer read one out of the array. **The pair is the
+   *    caller's own datum; the identity is this unit's opaque handle for it, and the two are NOT the same
+   *    datum.**
+   * 3. **NO ORDER IS PROMISED** (item 6): the returned array's order is **UNDECLARED** and a consumer compares
+   *    the pairs **as a SET and never as a sequence** (`DD-22`; `§2.7` item 3). **Nothing in this declaration
+   *    may be read as a registration order, an address order or a `seq`-like ordinal.**
+   * 4. **A DISABLED PAIR DOES APPEAR** (item 5): `constraintOff` is a TOGGLE and NOT A REMOVAL, so a pair it
+   *    disabled is STILL REGISTERED and still enumerated — **and therefore there is NO `enabled` member on an
+   *    element and NO way to read a pair's state off this return**; the state is read at the toggles' own
+   *    clauses. **No removal route exists**, so an absence here means nothing was ever registered.
+   *
+   * **THE COVERAGE, BOTH POPULATION ROUTES ON ONE FOOTING** (item 7): a pair the batch registered at
+   * `storeCreate` (`cfg.constraints`) and a pair `addConstraint` registered appear alike, because *"the entry
+   * carries a pair if and only if a function stands registered at that pair in the kernel's own pair-keyed
+   * registry"*. **The two declared exclusions are therefore structural**: a well-formed `cfg.constraints`
+   * element that carried no function is **not** a carried pair and does not appear, and a REFUSED
+   * registration — at the batch loop or at `addConstraint` — leaves the entry exactly as it stood and does not
+   * appear. **An overwrite changes no membership**: a second `addConstraint` at a held pair replaces the
+   * function at the SAME pair and returns the SAME identity, so the pair is carried ONCE before and after.
+   * **⟶ AMENDED 2026-10-24 (`D-26` item 4; `D-27` item 1): THE BATCH HALF OF THAT EXCLUSION HAS NO PRODUCER
+   * AND IS READ THROUGH THIS CLAUSE.** A `cfg.constraints` element **must** carry its function, and the batch
+   * **arms** it (`D-27`: *"Functions are armed"*), so *"a well-formed `cfg.constraints` element that carried no
+   * function"* is an element the construction now REFUSES under `ConstraintListInvalid` **before any
+   * filesystem act** — and the exclusion above stands for **the add route's refused registration alone**, and
+   * for a pair whose function was never supplied by any route.
+   *
+   * **IT ADDS NO POPULATION ROUTE** (`§2.12` item 2-bis): the two routes stand at TWO, and a read closes none
+   * and opens none. **It is NOT a `pending()` reader, NOT an `attempts()` enumerator and NOT a live view of a
+   * running commit**; it announces no identity, no function and no order.
+   *
+   * **AND IT MOVES NO OTHER FIGURE**: the module namespace keeps its ONE name `storeCreate` (`§2.9` item 1's
+   * `A127` clause, `11 → 1` ✓), the kernel's extent stays FIVE with no `K-6` proposed (`§2.4` item 9 (f),
+   * item 8 — the pairs are read from the entry's OWN registry, which is keyed exactly as the kernel's is), the
+   * store's closed `17`-member set is not reached, the kernel's `KC` set stands closed at `8`, and the register
+   * keeps its `8` rows.
    *
    * **It is NOT a named export of this entry** (`package.md §1.3` item 3): it is reached through
    * `storeCreate`'s own product alone.
    */
-  settle(record: CommitRecord): void;
+  constraints(): ConstraintPair[];
 }
 
 /**
@@ -565,9 +842,32 @@ export function storeCreate(cfg: StoreConfig): StoreInstance;
  * `string`** — **and NOT the whole of a batch element**, which is this pair PLUS its constraint function.
  * **Every outside form of the pair throws the three methods' one `TypeError`**, and **a well-formed pair
  * the entry does not carry is outside the two toggles' domain**: it is NOT a third population route.
+ *
+ * **⟶ AND THIS SHAPE IS ALSO THE ELEMENT OF THE FOURTH MEMBER'S RETURN, ADDED 2026-10-17**
+ * (`surface.md §2.4` item 9 (f)'s `constraints` clause; `parameter-semantics.md §2.27` = `PAR-JS-27`,
+ * `return-field`): `a.constraints()`'s every element carries **exactly these TWO members and no third** —
+ * the `address` a pair was registered under and its bare `id` — **and NEITHER the constraint function nor the
+ * opaque identity** (`PAR-JS-25`'s opacity, unmoved). **THE TWO ROLES ARE ONE SHAPE AND NOT TWO**: this is the
+ * caller's own datum entering at `addConstraint` (and at `cfg.constraints`' elements, which are this pair
+ * PLUS a `constraint`) and coming back out at the read. **`Row 27`'s `alt` cell refuses an `enabled` member on
+ * the element**, so no third member is declared here and this interface is left exactly as it stood.
  */
 export interface ConstraintPair {
-  readonly address: Address;
+  /**
+   * **THE ADDRESS MEMBER'S TYPE MOVES.** At the CREATION act it is a single address (`constraint-identity.md
+   * §6`'s pair table: *"and, at the REGISTRATION act, a single address"*); on the READ and at the REMOVAL it
+   * is the pair's own SET (`P: docs/pending.md · P-7`'s answer clause: *"1. (one id, N addresses)"*;
+   * `contract.md §2.6` item 5; `PAR-HL-13`).
+   */
+  readonly address: Address | readonly Address[];
+  /**
+   * **THE PAIR'S `id` — WHICH IS ITS HANDLE, ONE `id` NAMING ONE PAIR, ONE IDENTITY AND ONE HANDLE**
+   * (`D-23`/`D-24`, and `D-29`'s *"Handle becomes the internal ID"*, verbatim). **⟶ AND THE SENTENCE THE PAIR
+   * HAS CARRIED SINCE 2026-10-17 — *"two pairs at two addresses are TWO pairs"* — IS READ THROUGH THIS
+   * CLAUSE: the pair-local reuse of one `id` at two addresses is NO LONGER LAWFUL**, because a handle is
+   * INSTANCE-SCOPED and a repeated handle is REJECTED in one supplied list (`cfg.constraints`, `D-27`) and an
+   * OVERWRITE at the add route (`D-24`). **THE SHAPE IS UNCHANGED — NO FIELD IS ADDED** (`D-24` item 1).
+   */
   readonly id: string;
 }