provident-storeroom 1.6.1 → 1.7.0

package/README.guide.md

@@ -30,7 +30,7 @@ preflight REFUSES when these two lines do not read what it computed** (`scripts/
 one check, read-only). **THE TWO LINES ARE THIS GUIDE'S OPERATIVE FIGURES; every dated paragraph below is the
 reading of its own date and is read through them.**
 
-PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.6.1`.
+PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.7.0`.
 PUBLISH-GUIDE-CUT-STATE: NOT STATED -- this document describes the behaviour at the version line above, and the cut-state is the release's to state, not a shipped document's (`D-57`).
 
 **⟶ AND THE CUT-STATE SENTENCE ABOVE IS WITHDRAWN, 2026-10-28 — THE CUT-STATE IS NOT A DOCUMENT'S TO STATE.** `RCA-8(g)` ANNOTATE-BESIDE, and the architect's ruling verbatim (`strata/decisions.md` · `D-57`): *"Drop the cut-state."* **The two marked lines above stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause — not one byte of either is deleted — and the sentence this clause withdraws is the SECOND of them, the one that claims to say whether the release this guide travels in is cut.** **THE REASON IS MEASURED, THREE TIMES OVER, AND IT IS STRUCTURAL RATHER THAN A MISTAKE: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and the change list's head was stale within minutes of the tag that falsified it. **SO THE CUT-STATE SENTENCE IS DROPPED AS A CLAIM AND THE VERSION LINE STAYS**, because the version line is the ONE figure a tarball can be right about: the manifest knows it and travels beside it. **`scripts/publish.sh --figures` GENERATES AND ASSERTS THE VERSION LINE AND NOTHING ELSE** — the cut-state generation and its assertion are removed in the same act, so a tag set that moves can no longer redden this guide — **and the same one line is asserted in THREE shipped documents: this guide, `README.md` beside it, and the change list** (`DEF-AC`'s remaining demand, *"guard the release notes too"* and *"`README.md` still declares no version at all"*). **THE TAG SET IS NOT DELETED AND NOT DENIED: it is a RECORD OF RELEASES held in the change list, PAST TENSE — a list of what has been cut — and never a claim about the current one.** **AND WHAT THIS CLAUSE DOES NOT SAY, SAID PLAINLY BECAUSE A READER WILL LOOK FOR IT: it does not say whether the version this guide prints is cut.** That is not a document's to state; the record of what has been cut is in `RELEASE-NOTES.md`, and the registry is the registry.
@@ -74,7 +74,7 @@ measurements on a locally packed, installed artefact, and is still not witnessed
 **⟶ AND THE ELEVEN VERSION SITES READ `1.5.0`, 2026-10-29 — THE PREPARED FIGURE, AND EVERY `1.3.0` THIS GUIDE PRINTS READS `1.5.0` FROM HERE ON.** `RCA-8(g)` ANNOTATE-BESIDE: **the nine dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.5.0"`, all five `optionalDependencies` pins are `1.5.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.5.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.5.0` at the built artefact and at a package installed from it.** **AND THE RELEASE THIS CHAIN SKIPPED IS NAMED RATHER THAN SILENTLY ABSORBED: `1.4.0` read `1.4.0` at those same eleven cells and was cut from them — the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to `1.0.0`, `1.0.1`, `1.1.0`, `1.2.0` and `1.3.0` — and §11's manifest table all read `1.5.0`.
 
 **⟶ AND THE ELEVEN SITES READ `1.6.0` FROM THIS PREPARATION, 2026-10-29 — THE BUMP IS MADE HERE AND EVERY `1.5.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause — including its `1.5.0` — because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.0"`, all five `optionalDependencies` pins are `1.6.0` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.0` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`)** — and **`npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.0` at the built artefact and at a package installed from it** (measured this date at `bindings/js/build/Release/storeroom_js_binding.node`, and again at a package installed into a `/tmp` consumer with no repository in its ancestry). **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.0`, **and the one figure this guide can be right about is generated from that manifest and asserted in three shipped documents by `scripts/publish.sh --figures`.** **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0`, `git describe` reads `v1.5.0-11-g8f5454f`, and **no `v1.6.0` is among them** — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above). **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`, and `git describe` reads `v1.4.0-27-ga3312b7` — **so this clause states the version and NOT whether it is cut, because the cut-state is not a document's to state** (`D-57`; the clause above).
-**⟶ AND THE ELEVEN SITES READ `1.6.1` FROM THE DOCUMENTATION RELEASE, 2026-10-30 — EVERY `1.6.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause, because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.1"`, all five `optionalDependencies` pins are `1.6.1` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.1` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.1` at the built artefact and at a package installed from it.** **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.1`. **AND WHAT THIS RELEASE CHANGES FOR YOU IS NO ARM OF THE PACKAGE: the failure form stays four members, a log entry stays five, the status set stays twenty and the kernel's token set stays nine** — the change list's `§1.6.1` states it with its arithmetic. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0` · `v1.6.0`, and `git describe` reads `v1.6.0-4-g674b79e`. (`D-57`; the change list's `§1.6.1`; `scripts/publish.sh --figures`, which asserts the one figure in three shipped documents.)
+**⟶ AND THE ELEVEN SITES READ `1.6.2` FROM THIS PREPARATION, 2026-11-02, AS THEY READ `1.6.1` FROM THE DOCUMENTATION RELEASE BEFORE IT — EVERY `1.6.1` AND `1.6.0` ABOVE IS READ THROUGH THIS CLAUSE.** `RCA-8(g)` ANNOTATE-BESIDE: **every dated paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause, because each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.6.1"`, all five `optionalDependencies` pins are `1.6.1` with it, and the five `bindings/js/platforms/*/package.json` `version` fields read `1.6.1` with them — ELEVEN CELLS, ONE VERSION, moved TOGETHER in this act and never singly (§0 item 1; `PUB-DD-10`) — and `npm run build` stamps the artefact from that manifest, so `version()` answers `1.6.1` at the built artefact and at a package installed from it.** **SO THE SITES ARE RE-READ AGAIN, NOT RE-SPELLED:** this section's version line above, §2.2's five exact pins, §8.1's *"an installed …"* clause and §11's manifest table each read `1.6.1`. **AND WHAT THIS RELEASE CHANGES FOR YOU IS NO ARM OF THE PACKAGE: the failure form stays four members, a log entry stays five, the status set stays twenty and the kernel's token set stays nine** — the change list's `§1.6.1` states it with its arithmetic. **AND THE TAG SET IS A RECORD OF RELEASES AND NOT A CLAIM ABOUT THIS TREE:** `git tag --list` answers `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0` · `v1.5.0` · `v1.6.0`, and `git describe` reads `v1.6.0-4-g674b79e`. (`D-57`; the change list's `§1.6.1`; `scripts/publish.sh --figures`, which asserts the one figure in three shipped documents.)
 
 **AND ONE THING A READER OF THE INSTALLED PACKAGE SHOULD KNOW BEFORE THE CITATIONS: WHEN THIS DOCUMENT IS AT
 `node_modules/provident-storeroom/README.guide.md`, IT IS THIS GUIDE.** **Its ONE authored home is
@@ -891,6 +891,18 @@ instance: at CONSTRUCTION, and at a boot over an existing `filePath`, where the
 the list you supplied** (`native/contract.md §8.1` #16's amended trigger clause). **So a constraint list is code
 your application carries, not state your store stores.**
 
+**⟶ AND THREE CONSEQUENCES THE TWO ROUTES OWE THEIR READER, PLUS THE ONE ROUTE A REPAIR MAY TAKE THERE, PLUS THE ONE SCOPE CLAUSE THE LIST-PERSISTENCE PARAGRAPH OWES — 2026-11-02.** `RCA-8(g)` ANNOTATE-BESIDE: **every byte of `§7.2` above stands BYTE-FOR-BYTE and is read THROUGH this clause; nothing above is deleted, no other section of this guide moves, and this clause is one dated correction and not a second site.** Its ground is two rulings of this date — `strata/decisions.md` · `D-90` and `D-91` (`docs/guides/package-use.md §7.2`'s own subject, read at the positions it names).
+
+**(1) ★ THE BATCH AND THE ADD ROUTE TAKE THE SAME ACT, AND THE BATCH'S ACT IS TAKEN WHILE YOU HOLD NO HANDLE.** `cfg.constraints` is armed INSIDE `storeCreate`, before that call has answered you an instance — so **a function the batch arms cannot reach the store by your own binding: there is not yet a binding to close over.** **What a repair invoked at that instant has is THE RECORD IT IS HANDED, and at a registration instant that record carries the route below.** The add route performs the same act with your binding in hand, and the two answer the same evaluation.
+
+**(2) ★ AND THE SKIP'S THRESHOLD IS ABSENCE ALONE — A PAIR IS CARRIED AND SKIPPED EXACTLY WHEN ITS PARENT DOES NOT RESOLVE, AND IT IS APPLIED WHERE THAT PARENT RESOLVES, WHETHER AS A CONTAINER, AS A LEAF, OR AS THE REGISTER.** The discriminator is the pair's own ADDRESS MINUS ITS LAST SEGMENT, and the parent's ABSENCE is the only skip. **⟶ AND THE LEAF ARM THIS ITEM FIRST PRINTED IS REPLACED HERE, 2026-11-02, AND NOT SCOPED — `D-96` (1)–(2); the architect, verbatim: *"Reject this, the constraint being there implicitly expects `'x'` to be a container"*.** **A LEAF STANDING AT A PAIR'S PARENT DOES NOT SKIP ITS PAIR: the pair's own presence declares that parent a container, so the pair is ASKED (`D-96` (2)) — and a body that REFUSES the state it meets at a resolving parent REFUSES THE REGISTRATION AT RANK `19`, `ConstraintRefusedAtRegistration`, on the arm where the refusing pair is the repaired one.** **A skip is not a refusal:** the function is not asked, nothing is refused for it, no entry is written for it, and **the registration does not fail for it** — the pair is registered, `constraints()` names it, and **it applies at the first later instant its parent resolves and an act of yours reaches its address.** **And the rule is GLOBAL, not batch-only:** it is read at every instant that would apply a pair — the batch at construction, the list at a boot over an existing `filePath`, `addConstraint`, a re-enable, and the pass over a write, a `delete` or a `rollback` (`D-90` (1)–(4); `D-96`). **The line is drawn by the NODE and not by how the value looks:** an object written at the parent makes it a container and a primitive written there makes a leaf — **and a pair under EITHER of them is APPLIED**, because neither of them is an absence.
+
+**(3) ★ AND A PAIR WHOSE OWN KEY IS ABSENT IS APPLIED, AND MAY REPAIR ITSELF.** `['window']` on a store holding no `window` has the REGISTER for a parent, and the register is always a container — so **the absence of its own key is the state that pair judges**, which is the arm a repair can rescue. **It is the only arm a repair can rescue: a pair under an absent parent is never asked, so nothing runs to create that parent and a repair it carries cannot reach the arm** (`D-91` (iv)). **To have a repair create `window`, register the pair at `['window']`** — whose own absence is what is judged — and not at an address beneath it.
+
+**(4) ★ AND THE ROUTE A REPAIR MAY TAKE AT A REGISTRATION INSTANT — `D-91`, THE ARCHITECT, VERBATIM: *"Give the registration instant a lawful write route."*** **A repair invoked at a registration instant — from `cfg.constraints`, from a boot over an existing `filePath`, from `addConstraint`, or from a re-enable — CAN WRITE, THROUGH A `write` FUNCTION ON THE RECORD IT IS HANDED.** **THE CONSTRAINT BODY'S OWN CONTEXT IS UNMOVED AND CARRIES NO SUCH MEMBER** (`D-92`: the route is the repair's alone), **so a body that needs a change returns a repair.** **THE ROUTE'S POSITIONS ARE THE STORE'S OWN THREE — `write(address, tier, value)` — AND THERE IS NO FOURTH: the commit is the registration's own and cannot be named**, and a call supplying one is refused before any store act. **ITS ANSWER IS THE STORE'S OWN WRITE RECORD — the very record the store's `write` answers — and the repair becomes creditable by `§7.6`'s repairable arm returning that record's own `op`**, which is the same rule a write's own repair is judged by, pointed at and not re-spelled here. **THE WRITE RUNS NO PASS OF ITS OWN:** the pair is judged by **THE REGISTRATION'S OWN RE-RUN over the op the repair returned**, so a repair that lands the state its own body admits makes the registration stand — **and a write the route lands before a refusal STANDS, because a registration composes no rollback.** **AND THE ROUTE EXISTS AT A REGISTRATION INSTANT AND NOWHERE ELSE**: at a write's own evaluation you already hold the instance, the repair there is handed the record it always was, and nothing about that instant moves.
+
+**(5) ★ AND THE LIST-PERSISTENCE PARAGRAPH ABOVE — the one that opens *"★ AND THE LIST IS NEVER PERSISTED — not in the file, not as a register key and not in any journal entry"* — IS READ THROUGH THIS ITEM FROM HERE, 2026-11-02, AND THIS ITEM IS THE SCOPE CLAUSE THAT PARAGRAPH OWES.** **THE LOADED STATE IS NOT VALIDATED FOR RESOLVABILITY:** a pair whose parent does not resolve is not refused at CONSTRUCTION and not refused at a boot over an existing `filePath`, **and no list is refused for it — the pair is CARRIED and SKIPPED, which is item (2)'s rule, and a skip is not a refusal of the pair or of the list.** **So at both of those instants `ConstraintListInvalid` — the one status that paragraph declares — answers THE MALFORMED LIST ALONE:** an element whose `address` is not a segment array, an `id` that is not a string, the list's own outside forms, **and the package's own construction-time rejections, which `§7.2` states at its own paragraphs and which this item points at rather than re-spells.** **AND A WELL-FORMED PAIR IS NEVER ANSWERED BY THE SHAPE ARM** — `native/contract.md §8.1` item 3's own sentence, which the withdrawal above makes TRUE of this tree rather than needing an amendment.
+
 **★ AND A REPEATED HANDLE ANSWERS DIFFERENTLY AT THE TWO ROUTES, WHICH IS A DIFFERENCE OF ACT AND NOT AN
 INCONSISTENCY** (`D-27`'s own table):
 
@@ -905,6 +917,20 @@ adopts — a cross-KIND collision, rejected regardless of kind** (`D-27`, verbat
 batch - regardless of listener/constraint type"*; `index.d.ts`, `StoreConfig.constraints`). **Both are refused
 before any filesystem act, under `ConstraintListInvalid`; the package mints no code.**
 
+**⟶ READ THROUGH THIS CLAUSE FROM 2026-11-01 — THE BATCH'S CROSS-KIND COLLISION IS THE HANDLE, AND THE ADDRESS IS NOT A
+COLLISION AT ALL (`D-98`, `ACTIVE`, 2026-11-01).** `RCA-8(g)` ANNOTATE-BESIDE: **the two construction refusals above stand
+BYTE-FOR-BYTE and are read THROUGH this clause; nothing above is deleted, and this clause is one dated correction and not
+a second site.** **IT IS THE HANDLE RULE AND IT ALWAYS WAS** — `D-27`, verbatim: *"Reject duplicate handles in batch -
+regardless of listener/constraint type"* — **and its sentence is spelled now as the rest of this corpus spells it: *a
+listener and a constraint do not share one handle*** (`bindings/js/README.md:232`–`:233`, the hand-authored page that
+already read this way and that this correction makes the others agree with rather than the file it edits). **AND ONE
+SENTENCE THIS PARAGRAPH OWED ITS READER, THE SHARED ADDRESS BEING THE WHOLE OF WHAT THE RULING MAKES LAWFUL: an element's
+`address` coinciding with an adopted listener's `address` is NOT a collision at all** — a constraint pair and a listener
+MAY stand at ONE address, so the construction refuses the shared HANDLE and admits the shared address (`D-98` clauses
+(i)–(iii); `docs/L1/cross-kind-handle-only.md` §3.4, §4.2). **Its member, its instant and its no-state-moves sentence are
+unmoved**: `ConstraintListInvalid`, in the pre-create walk, before any filesystem act (`docs/L1/surface-deltas.md` §2's
+`B-3` row).
+
 ### §7.3 A cross-kind duplicate is REJECTED, in both directions
 
 **A duplicate handle of the SAME kind is an overwrite. A duplicate handle ACROSS KINDS — a listener where a
@@ -912,12 +938,30 @@ constraint stands, or a constraint where a listener stands — is REJECTED** (`D
 overwrite a listener with a constraint or vice versa is rejected"*; `D-29`: *"Listen cannot overwrite constraint,
 only other listeners"*).
 
-**Measured 2026-10-26, from the constraint-then-listener direction:** with `c1` armed at `['a']`,
-`store.listen('h1', [['a']])` threw the **one plain form** — `Object.keys` `["status","message","log","address"]`, `status`
-`'AddressMalformed'`, `log` `[]` — whose message names BOTH sides and carries the shared rule sentence **"a
-listener and a constraint do not share one"**. **The form is the surface's one thrown form and NOT a `TypeError`**
-(`index.d.ts`, `addConstraint`'s and `register`'s cross-kind clauses). **No state moves: the rejection is taken
-after the positions' class tests and before any store call.**
+**⟶ RE-DERIVED 2026-11-01 — THE RULE SENTENCE READS THE HANDLE, AND THE ADDRESS IT USED TO READ IS LAWFUL (`D-98`,
+`ACTIVE`, 2026-11-01).** `RCA-8(g)` ANNOTATE-BESIDE: **`§7.3`'s heading and its first paragraph stand BYTE-FOR-BYTE and
+are read THROUGH this clause; the paragraph that stood below them measured the DEFECT and has MOVED OUT, and its one
+pointer stands where it stood.** **THE LAW, IN THREE CLAUSES** — `D-98` item 1, the architect, verbatim: *"A constraint and
+a listener can share an address, as can multiple constraints/listeners. The restriction is that a listener and a
+constraint cannot have the same **handle**."* **(i) A CONSTRAINT PAIR AND A LISTENER MAY STAND AT ONE ADDRESS** — different
+handles, one address, both reached by the act: the pair ASKED by the pass, the listener DELIVERED after it. **(ii) MULTIPLE
+CONSTRAINTS at one address, and MULTIPLE LISTENERS at one address, are LAWFUL.** **(iii) THE ONLY CROSS-KIND RESTRICTION IS
+THE HANDLE** — a listener's handle equal to a constraint pair's `id`, and a pair whose `id` equals a live listener's
+handle, are REFUSED, **in both directions**. **AND A `listen` AT A PAIR'S ADDRESS STANDS**: the act is lawful, it answers
+its handle (`D-22`), it purges none of the pair's rows and installs the listener beside it — so an application that moved
+a subscription off a constrained address to work around a refusal may reclaim that address, and whether it does is that
+application's decision and not this guide's.
+
+**THE RULE SENTENCE, RE-DERIVED IN PLACE: *a listener and a constraint do not share one handle*** — one word more than the
+address reading, its spelling `bindings/js/README.md:232`–`:233`'s, and it is the clause half of all four refusal
+messages (`docs/L1/cross-kind-handle-only.md` §3.4, §3.6). **WHAT DOES NOT MOVE:** a duplicate handle of the SAME kind is
+still an OVERWRITE (`D-24`); the cross-kind refusal is still the surface's ONE thrown form `{status, message, log,
+address}` — `status` `'AddressMalformed'` at the three single-registration arms and `'ConstraintListInvalid'` at the batch,
+`log` `[]`, and `address` `null` because the subject is a string in the handle namespace and not a place — and **no state
+moves**: each refusal is taken after the positions' class tests and above every store act and every purge (`index.d.ts`,
+the `register`/`addConstraint`/`StoreConfig.constraints` clauses; `docs/L1/surface-deltas.md` §2).
+
+**⟶ THE 2026-10-26 MEASURED PARAGRAPH THAT STOOD HERE HAS MOVED OUT BYTE-EXACTLY (`RCA-8(g)`, `D-98` item 5).** **the measurement that stood here measured the address refusal this guide's rule no longer makes; its bytes are at `docs/guides/backup/D98-2026-11-01-guide-move-out.md §1`.**
 
 ### §7.4 The toggles, and the read
 
@@ -989,6 +1033,62 @@ you already hold, and `store.read(address)` is a published verb. **Measured 2026
 restored — **and the same body without the read passed, answering its record with its own value still standing at
 its address.** **The read is the whole difference.**
 
+**⟶ AND THE TWO RETURNS YOUR CONSTRAINT AND ITS REPAIR MAY MAKE ARE DECLARED HERE, 2026-10-30 — AND THE SECOND OF THEM IS THE ONE THIS SECTION IS ABOUT.** **EVERY SENTENCE OF THIS CLAUSE — THE ONE THIS MARK OPENS, DATED 2026-10-30 — HOLDS AT THE WRITE'S OWN EVALUATION, THE INSTANT THE KERNEL EVALUATES THE VALUE YOUR FUNCTION RETURNED, AND AT THAT INSTANT ONLY, EXCEPT WHERE A SENTENCE NAMES ITS OWN INSTANT IN ITS OWN WORDS.** **AND §7.6 CARRIES CLAUSES THIS DATED CLAUSE DID NOT WRITE, EACH AT ITS OWN EARLIER DAY — the clauses that state what a READ reads and what a DELETE asks, and the clauses that fix which pairs an act asks — AND A SENTENCE STANDING IN ONE OF THOSE IS OUTSIDE THIS FRAME AND IS READ AT ITS OWN INSTANT BY ITS OWN WORDS.** `RCA-8(g)` ANNOTATE-BESIDE: **every other clause of §7.6 — those standing above this one and those standing below it alike — stands BYTE-FOR-BYTE and is read THROUGH this one; the read rule, the addresses the pass asks, and the membership rule do not move, and this clause MOVES no byte of theirs. What this clause adds is the SHAPE of the two returns, the four ways the repair arm meets you, and ONE EXAMPLE you can drive as written.**
+
+**★ YOUR CONSTRAINT'S ANSWER IS A CLOSED THREE-ARM SET, READ IN THIS ORDER, AND THERE IS NO FOURTH ARM.** **`true` is the ONLY pass value; `{ message, repair }` is a REPAIRABLE violation; `{ message }` is an UNREPAIRABLE violation, whose `message` is the refusal's own sentence.** **A value outside those three is read as the `{ message }` arm and never as an arm of its own**, so a shape you invent beyond them is not distinguished from a bare refusal — the kernel does not ask it a second question.
+
+**AND `message` IS REQUIRED ON THE REPAIR ARM, BECAUSE THE KERNEL READS IT FIRST.** The arm's gate is the `message` member, read before any `repair` is looked for, and a `repair` is looked for only inside that branch: **a return carrying only `repair` is the arm outside the three, and its repair is NEVER SEEN**; **and AT THE WRITE'S OWN EVALUATION a `message` present but not a non-empty string keeps the repair readable while the refusal answers the kernel's own unrecognized sentence** — so write both members, and write `message` as the sentence you want your caller to read. **AT THE WRITE'S OWN EVALUATION — AT THAT INSTANT AND NO OTHER — THE KERNEL READS `message` AND `repair` AS OWN MEMBERS OF THE OBJECT YOUR FUNCTION RETURNED: a pair carried on a prototype is NOT SEEN there, and such a return answers the unrecognized sentence instead** (`bindings/js/src/entry/kernel-attempt.mjs:686-699`, `:690-696`). **THIS IS THE ONLY SENTENCE IN THIS GUIDE THAT STATES THAT RULE, AND IT IS THE LANDING INSTANT'S: the registration act reads the same closed outcome at `bindings/js/src/entry/kernel-registration.mjs:330-332`, where an inherited `repair` IS seen and invoked, so ONE RETURNED SHAPE ANSWERS TWO DIFFERENT THINGS AT THE TWO INSTANTS — a repair at registration and no repair at a write — and that divergence is OWED to a code-bearing unit and is contradicted by no sentence here** (`strata/decisions.md` · `D-35`). **THE EXAMPLE BELOW ESCAPES THE QUESTION BY CONSTRUCTION: it returns ONE OBJECT LITERAL whose two members are own members, so both instants read it alike.**
+
+**THE REPAIR'S OWN RETURN IS A CLOSED TWO-ARM SET.** **`{ ok: true, op }` is the repairable arm: `op` is REQUIRED and is THE STORE'S OWN OPERATION RECORD — `WriteRecord.op`, or `DeleteRecord.op` where that member is non-`null`, a `delete` that removed nothing answering `null` and crediting nothing — the one the verb your repair called returned.** **`{ ok: false, message }` is the failed arm: `ok` and `message`, and `op` ABSENT and never `null`, because an `op` there is read by nothing.** **At the write's own evaluation a return carrying any other identity fails `KC-4`** (`docs/specs/storeroom-constraints/contract.md:552`; the two arms print at `:558`) — **that one sentence covers every outside form of that return and this guide enumerates none of them.** **AND THE OP MUST BE ONE THE ATTEMPT CAN BE SHOWN TO HAVE LANDED: that ground is the kernel's own credit check, declared at `bindings/js/src/entry/kernel-foundations.mjs:1105-1131`, and it is POINTED AT here rather than re-spelled.** **No ordinal ground is claimed at the registration instant, whose credit check runs with no invoked-for op** (`bindings/js/src/entry/kernel-registration.mjs:510-517`).
+
+**THE REPAIR IS HANDED ONE ARGUMENT — ITS OWN RECORD, WHICH IS NOT YOUR CONSTRAINT'S AND IS NOT INTERCHANGEABLE WITH IT: the two records stand apart at THREE PLACES — by COUNT, SIX against FIVE; by `id`, which the repair's record carries where the constraint's carries `attempt`; and by `pending`, which rides the repair's record ALONE** (`bindings/js/src/entry/kernel-attempt.mjs:607-613`, `:756-782`; the kernel's own words at `bindings/js/src/entry/kernel-registration.mjs:373-374`). **AND THE COMMIT YOUR REPAIR IS PART OF RIDES THAT RECORD — its own `pending` member, the `CommitRecord.pending` this package declares at `bindings/js/index.d.ts:772`, POINTED AT and re-declared nowhere: pass it as `write`'s DECLARED FOURTH POSITION and the write you make JOINS the commit you are inside** (`bindings/js/index.d.ts:862`; `strata/decisions.md` · `D-46`). **No member census of either record is printed here, and that position's own class test is not restated.** A repair that names nothing in the fourth place also joins, by the kernel's own name; the fourth position is how YOU name it.
+
+**AND THE FOUR WAYS THIS ARM MEETS YOU, EACH DECLARED BECAUSE SILENCE HIDES A STATE A CONSUMER MEETS:**
+
+1. **(a) A THROW FROM YOUR REPAIR BODY CROSSES TO YOUR OWN CALL UNCONVERTED ON A WRITE**, where the throwable carries no store code: the write hands you back the very value you threw (`bindings/js/src/entry/kernel-attempt.mjs:833-854`).
+2. **(b) AT THE REGISTRATION INSTANT THAT SAME THROW IS CAUGHT AND CONVERTED INTO THE REGISTRATION'S REFUSAL** — `addConstraint` refuses, and no caller meets your body's value on that route (`bindings/js/src/entry/kernel-registration.mjs:498-508`).
+3. **(c) A PAIR'S REPAIR NEVER RUNS TWICE:** an applied repair may not run again, and a second violation of the same pair FAILS the attempt (`docs/specs/storeroom-constraints/contract.md:736`, `P-SM-6`'s row).
+4. **⟶ (d) AND WHAT A FAILED ATTEMPT DOES TO THE EDITS A REPAIR LANDED IS `docs/guides/package-use.md §5.4`'s OWN RULE — CITED BY PATH AND SECTION, STATED THERE AND NOT RE-SPELLED HERE.** **The plan that rule is read against is live code and is read at its own bytes: `bindings/js/src/entry/kernel-terminal.mjs:184-196`, the call site at `:215`, and `floorCallPlan` at `:288-343`; `strata/decisions.md` · `D-40` is the ruling that CLOSES that scope.** **AND ONE SENTENCE FOLLOWS FROM `§5.4`'s RULE, AS THAT RULE'S CONSEQUENCE AND NOTHING MORE: a repair's own writes are part of the attempt.**
+
+**⟶ AND HERE IS THE EXAMPLE THIS SECTION OWES — a repair that lands SOMEWHERE ELSE, which is this section's own subject, self-contained and driveable as written through the package's one export.** It is the shape the package's own e2e drive takes (`tests/e2e/repair-in-commit.test.mjs:95-115`), with the commit named by the repair's own hand:
+
+```js
+const store = storeCreate({ journalLength: 256, listeners: [] });
+
+store.write(['a'], 'mem', 1);
+store.addConstraint({ address: ['a'], id: 'two-goes-elsewhere' }, (context) =>
+  (context.value === 2
+    ? {
+        message: 'the landed value is not one this pair admits, and the repair moves it elsewhere',
+        repair: (repairContext) => {
+          const landed = store.write(['b'], 'mem', 11, repairContext);   // the commit, at write's fourth position
+          return { ok: true, op: landed.op };                            // the store's own record, not a copy
+        },
+      }
+    : true));
+
+const written = store.write(['a'], 'mem', 2);   // the pair refuses 2, its repair writes 11 at ['b'], the re-run passes
+store.read(['a']);   // 2  — the address your pair judges; the repair did not move it
+store.read(['b']);   // 11 — where the repair landed, inside the commit it is part of
+```
+
+**WHAT THE EXAMPLE SHOWS, IN THE ORDER THE MACHINERY RUNS IT.** **Your constraint returns ONE object literal carrying both members** — `message` the refusal's sentence, `repair` a function — so both instants read the same pair. **The repair runs with ITS OWN RECORD, makes its OWN `write` at `['b']` with that record in the fourth position, and RETURNS `{ ok: true, op: landed.op }`: the store's own record of the write it just made, never a number and never a record you assembled yourself.** **And the credit is visible to you:** `written.op` is that same op — in the drive named below, `{"opId":"op-3","kind":"write","address":["b"],"seq":3,…}` — **so the op the repair returned IS the op its own edit produced, which is what makes the re-run come back through that op's own landing and hand your body the value the repair landed (`11`) while the address your pair judges still stands at `2`.** **The write answers its record because that re-run passes; a repair that returned an op it did not land fails `KC-4` instead.** **Note what is NOT in the block: no type annotation, no new symbol, no import the guide does not already publish (`§3`), and no fourth outcome arm.**
+
+**MEASURED 2026-10-30, on this checkout, through the published entry (`bindings/js/index.mjs`), on the block above's exact bytes:** the write's own record carries `op` `{"opId":"op-3","kind":"write","address":["b"],"tier":"mem","before":{"present":false},"after":{"present":true,"value":11},"seq":3,"compacted":false}`, `store.read(['a'])` answers `2` and `store.read(['b'])` answers `11` — **so the repair was READ, its edit LANDED at the beside address, and its op was CREDITED.** **That drive is a measurement of the landing pass and not a committed test**; the package's own suite drives this arm at `tests/e2e/repair-in-commit.test.mjs`.
+
+**(1) WHAT CROSSED.** **A repair's answer that the credit check does not admit FAILS THE ATTEMPT, and what your caller catches is the refusal crossing as the set's rank-`20` member `ConstraintPassRefused`, with the kernel's token `KC-4` riding the TERMINAL entry's `state`** — `KC-4` is the kernel's repair-failed token (`bindings/js/src/entry/kernel-foundations.mjs:62`), the crossing and the token's seat are declared at `docs/specs/storeroom-js/surface.md:2079`, and the repair-body path that answers it prints at `docs/specs/storeroom-constraints/contract.md:557`. **This clause names `KC-4` and declares no member of any set.**
+**(2) WHAT THE REFUSAL SAYS — THREE MESSAGES REACH THE ARM AND THE COPY BELOW IS THE FALL-THROUGH'S ALONE.** **The message a `KC-4` refusal carries is drawn from ONE OF THREE SOURCES, the choice among them standing at `bindings/js/src/entry/kernel-attempt.mjs:878`-`:883`: where `ok` is `true` and the op the return names is defective, the kernel's own OP-IDENTITY SENTENCE, which stands at `bindings/js/src/entry/kernel-foundations.mjs:1139`-`:1150` and which this clause NAMES AND NEVER QUOTES; where `ok` is `false` and the return's `message` is a non-empty string, THE CALLER'S OWN `message`, which is no kernel sentence at all, so a caller holding a `{ok: false, message}` refusal is holding THEIR OWN WORDS and not the copy below; and, on the remaining arm, the `produced no op` template at `bindings/js/src/entry/kernel-attempt.mjs:883`, COPIED ON 2026-11-01 FROM THAT ONE LINE, template literal and interpolations included, character for character:**
+
+```js
+`the repair ${pair.id} produced no op at ${addressSpelling(attempt.address)}`
+```
+
+**and the one thing a reader must not take from it is this: the address in that sentence is the ATTEMPT's, and it is no claim about where the repair wrote** — **the sentence's own text is unedited here, this clause mints no second address, and it claims no correction and no fix of it; and the scope holds at EVERY sentence this arm composes, the op-identity pair interpolating the same `addressSpelling(attempt.address)`, while the caller's own arm composes no sentence to conclude anything from.**
+**(3) WHAT THE LIST IS — THE CENSUS, THE ONE RULE ABOUT IT, AND THE POINTER TO `§8.0a`.** **THE CENSUS IS THIS CLAUSE'S: the `log` a `KC-4` refusal crosses with is the COMMIT's one list and not the attempt's** (`docs/guides/package-use.md:1337`-`:1345`), **and the reading rule about a count of entries and a count of verdicts is `§8.0a`'s alone — this clause SENDS YOU TO THAT SENTENCE, names its home and not its content, and prints no count, no member census and no kind** (`docs/guides/package-use.md:1389`-`:1392`). **THE ONE RULE THIS CLAUSE STATES, AND IT IS A RULE ABOUT THE LIST: THE VERDICT IS THE LAST ENTRY WHOSE `state` IS NOT `null`; the terminal act appends the deciding attempt's `outcome` entry ONCE and it carries the arm's one token (`bindings/js/src/entry/kernel-terminal.mjs:66`-`:72`); it stands last because that attempt appended it LAST, and NEVER because no other entry carries a `state`.** **A CROSSED LIST MAY LAWFULLY CARRY MORE THAN ONE SUCH ENTRY: a constraint body's refused write shows that refusal's own entries VERBATIM before the enclosing `outcome` entry, as `§8.0a`'s nested-write bullet says in its own words, and `tests/e2e/blind-defect-cases.test.mjs:633`-`:646` prints an inner refusal's own `outcome` entry in ONE list beside the enclosing attempt's entries — so AN INNER REFUSAL'S ENTRY IS NOT THE VERDICT, and the LAST such entry is.** **The member the verdict is found by is the one `bindings/js/index.d.ts:357`-`:358` prints, cited for that member alone and for NO per-attempt scope, that scope being this clause's own statement of what a list may hold.** **The instance is cited and not re-taken: `tests/e2e/downstream-claims.test.mjs:1498`-`:1501` prints a `passed` entry inside a refusal's own list.** **The seat that token rides is already printed in this guide, at `§7.8`'s step 3 (`docs/guides/package-use.md:1102`-`:1105`), and this clause cites it there instead of re-deriving it.**
+**(4) WHETHER YOUR REPAIR'S EDIT STANDS — THE ADDRESS GEOMETRY, BOTH CONJUNCTS OF THE SWEEP, AND THE PLAN'S ONE SKIP ARM THAT BEARS ON IT.** **THE TEST IS THE ADDRESS, and it is the credit rule's declared consequence: whether the address the repair wrote IS ONE THE ATTEMPT'S OWN OPS NAMED — AT IT OR UNDER IT — because the floor call's candidates are taken from `attempt.ops` ALONE (`bindings/js/src/entry/kernel-terminal.mjs:288`-`:343`), each call's own scope is the named op's ADDRESSED SUBTREE AT OR AFTER THAT OP'S `seq` (`bindings/js/src/entry/kernel-terminal.mjs:255`-`:256`), and the store's own filter is `is_prefix(address, entry.address) && entry.seq >= floor` (`src/store.rs:2628`), where `address` is the call's named op's own address (`src/store.rs:2617`) and `floor` is that op's own `seq` (`src/store.rs:2622`).** **CREDIT IS THE MECHANISM AND NEVER THE TEST: the refusal returns before the uncredited op ever joins `attempt.ops` (`bindings/js/src/entry/kernel-attempt.mjs:885`-`:892`), and the ground that refused it is the kernel's own credit check (`bindings/js/src/entry/kernel-foundations.mjs:1105`-`:1131`).** **THE SWEEP DECIDES AT BOTH HALVES OF ITS FILTER: an entry must stand AT OR UNDER the address the call named AND ITS ORDINAL AT OR ABOVE THAT CALL'S FLOOR — so a write whose ordinal stands below the call's floor is NOT swept by that call whatever its address, and the prefix half ALONE sweeps nothing.** **AND THE FLOOR CALL'S PLAN DECLARES TWO SKIP CASES AT ITS OWN RANGE AND NAMES THEM, `COVERED` and `UNREACHABLE`, and this clause states those two names and no third case (`bindings/js/src/entry/kernel-terminal.mjs:264`-`:274`): `COVERED`, where every entry was already swept; and `UNREACHABLE`, where an already-issued address is a prefix of the candidate's and that call's floor stands AFTER the candidate's own first owed op while that address still has an owed op at or after that floor — and `UNREACHABLE` is the one that bears on the consequence, because the OUTER CALL IS KEPT AND THE INNER ADDRESS'S EARLIER ENTRIES STAND, so a write at an address the attempt DID name can still stand and *"credited or not"* is no answer at that end either.**
+**(5) WHAT THAT MEANS FOR THE STORE — THE CONSEQUENCE IN THE GEOMETRY'S OWN TERMS, AND `§5.4` READ BY LINE AT BOTH OF ITS SENTENCES.** **The store's answer for the address the repair wrote: a write AT OR UNDER AN ADDRESS THE ATTEMPT'S OWN OPS NAMED IS SWEPT WITH THE ATTEMPT, and a write at an address NO attempt op named STANDS — and it stands too where that address's call is skipped on `UNREACHABLE`, the arm item (4) names at `bindings/js/src/entry/kernel-terminal.mjs:264`-`:274`.** **AND `§5.4` IS READ BY LINE, AT BOTH OF ITS SENTENCES: `docs/guides/package-use.md:469` declares that the floor call restores the address the attempt wrote and that an address a repair landed at BESIDE it is NOT restored — the arm where the address lies OUTSIDE the attempt's own addressed subtree, so it STANDS; `docs/guides/package-use.md:476`(2) declares that A REPAIR'S WRITE GOES WITH THE WRITE — the arm where the repair's write lies INSIDE the attempt's own commit, so it is UNDONE WITH THE WRITE — and that sentence is UNSCOPED BY CREDIT, so it is no statement about credited writes only.** **THE DISCRIMINATOR BETWEEN THE TWO IS THE ADDRESS AND NEVER THE CREDIT, which is what lets both stand at once: this clause sends you to both lines, adjudicates neither, and moves no byte of `§5.4`.**
+**CONSOLIDATED, 2026-11-02 — ONE CLAUSE OF FIVE ITEMS, ONE QUOTE AND THIS MARK.** **What stands above is the five items as ONE clause, consolidated on 2026-11-02 from a first draft whose superseded sentences moved out, and the move is declared at `docs/specs/storeroom-repair-failure-path/contract.md`, the unit's live corpus path.** **The first draft got six things wrong, and here is each in one sentence.** **It presented the copy as the arm's sentence, when the copy is the fall-through's, one of three.** **It put the reading rule at this clause as well as at `§8.0a`, when the rule is `§8.0a`'s alone and this clause keeps the census and the pointer.** **It made the verdict the one entry whose `state` is not `null`, when the verdict is the LAST such entry and a crossed list may lawfully carry more than one.** **It made credit the test, when the axis is the address's membership in the attempt's ops, read at both conjuncts of the filter and at the plan's `UNREACHABLE` arm.** **It named `§5.4` once only, when both of its lines are read here at `docs/guides/package-use.md:469` and `docs/guides/package-use.md:476`(2), with the address as the discriminator and never the credit.** **It stated the store-state consequence by credit, when the consequence is stated in the address geometry.**
+
 **★ AND THE CONSEQUENCE A READER GETS WRONG, IN `D-50`'S OWN WORDS: *"a constraint that reads inside its body is
 caller code entering the surface, so by `D-45` that read opens its own commit"* — **⟶ MEASURED 2026-10-28, AND THAT CLAUSE IS WRONG: A READ BRACKETS NO COMMIT AT ALL.** `read`, `readLiteral` and `constraints` are the surface's **NON-BRACKETING** calls — the count during a constraint body's read is the attempt's own and is left undisturbed, `attempt-opened` does not fire for it, and the same `attempt` is in force. **So the accurate consequence is the shorter one: a read inside a body runs INSIDE the attempt's window, opens nothing, and disturbs nothing.** (The `D-45` quote above is kept as the reading of its own date; this sentence governs.) — AND A READ RUNS NO CHECK, SO
 NOTHING IS JUDGED BY IT.** **No constraint is asked on the value it returns, no pass runs, and the value you
@@ -1330,10 +1430,13 @@ with. **NO OTHER MEMBER, KIND, STATUS, COUNT OR SENTENCE OF THIS GUIDE MOVES** (
   detached member's — and a `TypeError` from a constraint method carries `[]` too. **The list is the COMMIT's
   and there is no commit there.**
 
+**⟶ AND THAT BULLET IS SCOPED TO THE STATE IT IS TRUE OF — 2026-11-02.** `RCA-8(g)` ANNOTATE-BESIDE: **the bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause.** **A CONSTRUCTION REFUSAL CARRIES `[]` WHERE THE ELEMENT THAT REFUSED CARRIED NO REPAIR** — **and where that element DID carry one, and its pair was asked, the refusal carries the entries that element's own `constraint-check` and `repair-run` appended**, because a repair is invoked at that instant and its invocation is part of the judgement. **So the two states are told apart by THE ELEMENT YOU SUPPLIED and by nothing about the route**: no repair on the element, no entries; a repair on it, that element's own. **And where the element's pair is SKIPPED — its parent does not resolve — there is nothing to refuse and nothing to carry: `§7.2`'s own clause states what a skip is.** **The counting caution below and the verdict rule it sends you to are UNMOVED by this sentence and neither is restated here.**
+
 **READ THIS BEFORE YOU LOG-COUNT.** `log.length` is **not** *"how many constraints were evaluated"* and not
 *"how many attempts this write made"*: it is **every entry of the commit**, in append order, from every attempt
 the commit held. Count entries by `kind` and `id` (and by `opId` where you need the iteration) rather than
 assuming a shape, because **a repair or a body's own write legitimately adds entries to the list you caught.**
+**And what the count above cannot tell you: where the refusal you caught carries a commit's list, several entries in it may lawfully read *passed*, so a count of entries is not a count of verdicts, and `§7.6`'s clause names the one entry that decides — while on the other arm, where a refusal names no attempt and still carries `[]`, nothing above promises a list to count.**
 
 **AND THE ONE PLACE THE INVARIANT IS NOT REACHED, SAID PLAINLY RATHER THAN LEFT TO A MEASUREMENT: a pair body
 invoked at a REVERSAL's judgement has no commit record standing beside it to name**, so a write such a body
@@ -2175,3 +2278,5 @@ quietly.**
   the instrument that decides between them.**
 
 **⟶ CORRECTED 2026-10-28 — THE BULLET ABOVE'S *"the two of 2026-10-26"* NO LONGER COUNTS THIS FILE, AND THE FIGURE IS MOVED RATHER THAN THE RULE.** `RCA-8(g)` ANNOTATE-BESIDE: **the bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause.** **This file now names FOUR measurements of its own — the two of 2026-10-26 the bullet carries, §7.6's two-address `b1` drive and §7.7's 60/40-reversal restart-budget drive, both taken 2026-10-28 on this checkout through the published entry — and each is named where it stands rather than gathered here.** **WHAT DOES NOT MOVE IS THE BULLET'S RULE AND THE DOCUMENT'S OWN STANDING: this guide is a consumer document and not a test report; a figure it states is either declared and cited or measured and marked; and the declared documents and the driven batteries remain the instruments for questions of semantics and of behaviour respectively.** **A reader who wants the measurements re-run finds their drives named at their sites, and no figure of this file is offered as a green.**
+
+**⟶ CORRECTED 2026-10-30 — THE COUNT IN THE CLAUSE ABOVE NO LONGER COUNTS THIS FILE EITHER, AND THE FIGURE IS MOVED RATHER THAN THE RULE.** `RCA-8(g)` ANNOTATE-BESIDE: **that clause stands BYTE-FOR-BYTE and is read THROUGH this one.** **This file now names FIVE measurements of its own — the FOUR that clause counts, and `§7.6`'s landing drive of 2026-10-30, taken on this checkout through the published entry on its block's exact bytes — and each is named where it stands rather than gathered here.** **WHAT DOES NOT MOVE IS THE BULLET'S RULE AND THE DOCUMENT'S OWN STANDING: this guide is a consumer document and not a test report; a figure it states is either declared and cited or measured and marked; and the declared documents and the driven batteries remain the instruments for questions of semantics and of behaviour respectively.**

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.6.1`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.7.0`.
 
 ## The one entry
 

package/RELEASE-NOTES.md

@@ -16,7 +16,7 @@ claims to be installable.**
 
 **⟶ AND THE CUT-STATE IS DROPPED FROM THIS FILE, 2026-10-28 — `D-57`, THE ARCHITECT VERBATIM: *"Drop the cut-state."*** `RCA-8(g)` ANNOTATE-BESIDE: **the title line and every dated paragraph of this file stand BYTE-FOR-BYTE as the reading of their own date, THIS clause is the one that reads them, and not one byte is deleted.** **THE REASON IS STRUCTURAL AND IT WAS MEASURED THREE TIMES: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and this file's own head was stale within minutes of the tag that falsified it. **SO EVERY SENTENCE BELOW THAT CLAIMS WHETHER SOME VERSION IS OR IS NOT CUT — *"PREPARED — NOT CUT"*, *"no `v1.3.0`"*, *"nothing in this section is cut"*, *"the release is not cut"*, *"what is installed today is still `1.1.0`"*, and each reading printed beside them — IS READ THROUGH THIS CLAUSE: the cut-state is not a document's to state.** **WHAT SURVIVES IS THE ONE FIGURE A SHIPPED DOCUMENT CAN BE RIGHT ABOUT, AND IT IS GENERATED FROM THE MANIFEST AND ASSERTED BY THE PREFLIGHT:**
 
-PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.6.1`.
+PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.7.0`.
 
 **AND THE TAG SET SURVIVES AS A RECORD OF RELEASES — PAST TENSE, A LIST OF WHAT HAS BEEN CUT, NEVER A CLAIM ABOUT THE CURRENT ONE** (the record stands in `§1.4.0` below — the section this file's head called `§main` until it was re-cut to name the version it prepares, 2026-10-28 — beside the section for the tree this file describes). (`D-57`; `DEF-AC` (b) — `scripts/publish.sh --figures` generates that line from `bindings/js/package.json`'s `version` and refuses on any disagreement, in this file, in `bindings/js/README.md` and in the shipped guide: three documents, three version lines, one generator, one assertion.)
 
@@ -55,6 +55,72 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
+## §1.7.0 · a MINOR — the cross-kind correction's landing: the four refusal messages a consumer reads differently, what does not move, and the arithmetic that says how many commits
+
+**⟶ THIS SECTION IS NEW, 2026-11-01, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.6.2`, whose heading is corrected at its own line in the same act.** **AND THIS SECTION DOES NOT STATE WHETHER `1.7.0` HAS BEEN RELEASED: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 and the authority clause of 2026-10-29 above, which govern every sentence here).
+
+**THE VERSION IS `1.7.0` AND ITS CLASS IS A MINOR — `D-100`, THE ARCHITECT'S RULING OF 2026-11-01 (`strata/decisions.md` `D-100`), VERBATIM: *"Minor — 1.7.0"*.** **THE GROUND IS A MEASUREMENT AND NOT A PREFERENCE: FOUR REFUSAL MESSAGES CHANGE THEIR TEXT ON A PUBLISHED SURFACE**, which is more than this project's own `PUB-DD-9` row allows a PATCH (*"a fix inside the declared surface"*) and less than a break of any member — so the class is the MINOR the number names (`D-100` item (i)).
+
+**THE ELEVEN CELLS MOVE TOGETHER AND NEVER SINGLY** — `bindings/js/package.json`'s `version`, its **five** exact `optionalDependencies` pins, and the **five** `bindings/js/platforms/*/package.json` `version` fields — **and the artefact is stamped from that manifest by `bindings/js/build.rs`, so `version()` answers `1.7.0` at the rebuilt artefact and at a package installed from it**; that, and not the crate's own `Cargo.toml` version, is the value the coupling rule is asserted against (`§1.6.2`'s version clause states the shape and is read through it; `scripts/publish.sh`'s own cell enumeration).
+
+**THE ARITHMETIC, MEASURED AT THIS TREE: `git rev-list --count v1.6.2..HEAD` READS `1`.** **The one commit is `e024195`, *"Land the cross-kind correction: one address is lawful, the handle is the restriction (D-98–D-100)"*, and `git show --stat e024195` reads `33` files changed, `4506` insertions and `355` deletions — a split by what the commits ARE rather than by what they touch, in four kinds:** **the JS entry and its parts** (`index.mjs`, `src/entry/delivery.mjs`, `constraints.mjs`, `frame.mjs`, `kernel-registration.mjs`, `artefact.mjs`); **the addon's facade and the store's own message generator** (`bindings/js/src/facade.rs`, `src/error.rs`); **the declaration** (`bindings/js/index.d.ts`); **and the documents and the batteries** (the L1 declaration, the guide with its landing, the move-out record, two spec parts, three records, and eleven paths under `tests/e2e/`). **AND THE RELEASE'S OWN LANDING IS THIS PASS'S WORKING TREE AND NOT A COMMIT COUNT** — the bump, this section, `§1.6.2`'s heading repair, the two generated landings and the ledger row — **so the figure above is printed with its instrument and is not summed with them.** (`git rev-list --count v1.6.2..HEAD`; `git show --stat e024195`.)
+
+**WHAT A CONSUMER SEES, EACH AN ARM TO DRIVE RATHER THAN A SENTENCE TO TRUST:**
+
+1. **A CONSTRAINT PAIR AND A LISTENER MAY STAND AT ONE ADDRESS.** Before this release a `listen` at an address a carried pair stood at was refused; now the act stands, both actors are carried, and **a write at that address triggers the pair AND delivers the listener** (`D-98` item 1; `docs/L1/cross-kind-handle-only.md` §1 and its `XK-1`). **AND THE ONLY CROSS-KIND RESTRICTION IS THE HANDLE**: a listener's handle and a constraint's `id` are **one string**, and neither kind may claim a handle the other keeps (`D-98` item 1 (iii); `D-99`).
+2. **THE FOUR CROSS-KIND REFUSALS PRINT NEW MESSAGE TEXT, AND THE RULE SENTENCE IS *"a listener and a constraint do not share one handle"*.** `AddressMalformed` stands at **three** arms — `listen` (`B-6`), `register` (`B-5`) and `addConstraint` (`B-4`) — and `ConstraintListInvalid` at **one**, the construction's batch element (`B-3`); the four texts whole are `docs/L1/cross-kind-handle-only.md` §3.6, and they are asserted **whole** at five cell homes, so a pass that edits one word of a message moves five cells. **THE STATUSES DO NOT MOVE; THE SENTENCES DO** — and the half they carried that was false at every arm, the store's segment sentence rendered with an empty container, is gone (`D-98` item 4, verbatim: *"the false half cannot stay"*).
+3. **A DISABLED PAIR'S HANDLE BLOCKS A CALLER EXACTLY AS AN ENABLED ONE'S DOES** — a caller's `listen('<pair id>', …)` and a caller's `register('<pair id>', fn)` are both refused after `constraintOff`, where the second was admitted before (`D-99`; `docs/L1/cross-kind-handle-only.md` §9.4, and `XK-6` is the measurement).
+4. **THE KERNEL REACHES THE STORE THROUGH ITS OWN ROUTE AND NO LONGER THROUGH A CALLER-FACING MEMBER.** That is the correction's one internal restructure (`D-99`'s ANSWERED clause: `listenOn`, the `LISTEN_ROUTE` symbol and `installListenRoute`, §9.2), **it deletes the `state.establishing` marker and its four brackets, and it changes no answer a consumer's own call receives** — which is why it is stated here rather than left to a reader who meets the changed call in a stack.
+
+**WHAT DOES NOT MOVE, ENUMERATED SO THE MINOR IS NOT READ AS WIDER THAN IT IS:**
+
+- **THE CLOSED STATUS SET IS TWENTY, ranked `1`…`20`, and no status is minted.** `AddressMalformed` keeps rank `1` and `ConstraintListInvalid` keeps `16` (`src/error.rs`'s `CODES`; `D-99` item 1; `D-100` item (ii)).
+- **EVERY MEMBER, EVERY TYPE AND EVERY CONSUMER-VISIBLE ARITY.** The instance's fourteen members, the log entry's five, the failure form's four, `KC`'s nine tokens and the module namespace's one name are all unmoved (`D-100` item (ii)).
+- **THE ONE ARITY THAT WIDENS IS THE ADDON'S OWN GENERATOR, AND IT IS ARTEFACT-INTERNAL.** `errorMessage` gains **one optional fourth position** carrying the closed arm token `'handle'`, so the artefact's internal range reads **`2`–`4`** where the census cell read `2`–`3`; **no named export of the module namespace and no subpath reaches it**, so this is a widening of the artefact's own generator and not of a consumer API (`D-100` item (iii); `docs/L1/cross-kind-handle-only.md` §3.7–§3.8).
+- **THE SURFACE MAP IS UNMOVED AT `19` MODULES AND `61` ENDPOINTS** — the correction adds a part to a module and no endpoint (`D-100`; `docs/L1/cross-kind-handle-only.md` §6.3, which is the L2 reading this release declares).
+
+**THE CELLS AND THE RECORDS THE CORRECTION CARRIES, NAMED SO A READER CAN CHECK THE BATTERY AGAINST THEM** (`docs/L1/cross-kind-handle-only.md` §6.1's write set, verbatim: *"§5.1's six rewrites, §5.2's two, §5.3's eight"*):
+
+- **SIX REWRITTEN CELLS**, each one a cell that asserted the address dimension the ruling withdraws — `HLI-11.3` and `HLI-11.3.a`, `G3-22`, the two `constraints-publication` probes with their prose, the `blind-listener-surface` form cell, and `DEF-N`'s constant — beside **two kept cells whose MESSAGES are re-read** rather than weakened (§5.2).
+- **EIGHT `XK` CELLS ADDED**, `XK-1`…`XK-8`, in the file `tests/e2e/cross-kind-handle-only.test.mjs`; **`XK-6` and `XK-8` are re-shaped by `D-99`** (§9.5), and `Q-1`'s residual is retired by name rather than carried.
+- **THE MOVE-OUT RECORD**: the guide's 2026-10-26 measured paragraph left **byte-exactly** to `docs/guides/backup/D98-2026-11-01-guide-move-out.md`, with its source path, its pre-move position, its date, a computed `sha256` and why — and the delivered text states the rule in its place (`docs/L1/cross-kind-handle-only.md` §4.1).
+- **THE CONTRACT'S `§2.2` ITEM 7 POINTER**: a **pure insertion** of 2026-11-01 at `docs/specs/storeroom-held-listener-identity/contract.md` `§2.2` item 7, which *"moves no position, no domain, no fail arm and no other item"* of that section.
+
+**AND WHAT THIS SECTION IS NOT: a restatement of `§1.6.2`.** **That section is the change list of the previous release and stands BYTE-FOR-BYTE beneath this one; what this release carries of it is the version and the arithmetic and nothing else.**
+
+---
+
+## §1.6.2 · **CUT AND PUBLISHED — tag `v1.6.2`** — a BEHAVIOUR release: what the thirty-four commits past the previous tag carry, the one additive member, the workaround it retires, and the four things it does not fix
+
+**⟶ AND THIS HEADING CARRIED THE PRE-RELEASE MARKER UNTIL THE TAG WAS CUT, 2026-11-01 — `DEF-AC` at its fifth iteration, and the one red `D-82`'s ratchet refused on every run before this one.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn heading's bytes stand in the withdrawn record — `docs/guides/backup/D81-2026-10-29-notes-move-out.md` `§6`, which carries the source path, the pre-move line, the date, a computed `sha256` and why they moved — and are read THROUGH this clause; this sentence deliberately does not quote them, for the reason the `§1.6.1` clause above states and `D-80` measured: a quotation of a claim reads as a claim, and the scan cannot tell the two apart.** **AND THE CORRECTED HEADING IS THE PAST-TENSE RECORD THIS FILE'S OWN PRECEDENT USES** — the spelling `§1.6.0`, `§1.6.1`, `§1.5.0` and `§1.4.0` already carry — **because a cut-state belongs to the tag set: `git tag --list` answers `v1.6.2`, so this section names a past act and not a present claim, and `D-82`'s past-tense condition accepts the line for exactly that reason.** **AND WHAT THIS ACT DOES NOT DO: it moves no other byte of `§1.6.2`, whose body and items below stand BYTE-FOR-BYTE as the reading of their own date; it adds no entry to the exemption set, because a line whose bytes change must leave that set rather than join it and the set may only SHRINK; and it changes no figure the withdrawn line carried, which the record names.** (`D-57`; `D-82`; `git tag --list`.)
+
+**THE VERSION: `1.6.2`, AT ELEVEN CELLS THAT MOVE TOGETHER AND NEVER SINGLY** — the main manifest's `version`, its **five** exact `optionalDependencies` pins, and the **five** `platforms/*/package.json` versions — **plus the three shipped documents' one generated version line each.** **The artefact is stamped from the manifest by `bindings/js/build.rs`, so `version()` answers the release figure** and that is the value the coupling rule is asserted against, not the crate's own `Cargo.toml` version.
+
+**THE ARITHMETIC, MEASURED AT THIS TREE: `git rev-list --count v1.6.1..HEAD` READS `34`.** The release's own work is `U-STOREROOM-CONSTRAINT-REGISTRATION-INSTANT` — the constraint registration instant — and the guide and corpus corrections it carried.
+
+**WHAT A CONSUMER SEES CHANGE, EACH A RULING OF 2026-11-02 AND EACH IN THE SHIPPED GUIDE:**
+
+1. **A pair whose PARENT address does not resolve is SKIPPED, not asked** (`D-90`). Before, it was asked with `undefined` and could refuse a construction; now the pair is **carried**, the registration stands, and it is applied at the first instant its parent resolves.
+2. **A pair whose parent RESOLVES is applied — including where the parent holds a LEAF** (`D-96`). **The pair's presence declares that parent a container**, so a leaf standing there is the state the pair judges: the body is asked, and a body that refuses refuses the registration at rank `19`.
+3. **A boot no longer refuses a constraint list for an unresolvable address** (`D-90` (5)). The list-wide walk is gone; `ConstraintListInvalid` now answers **the malformed list alone**, and a well-formed pair is never answered by the shape arm.
+4. **A repair invoked at a registration instant can WRITE** (`D-91`). The repair's own record carries a `write` function taking exactly the store write's first three positions; it joins the registration's own commit, and the repair is credited by returning the op it landed.
+5. **The re-run after a repair always runs, and reads the pair-application rule** (`D-94`).
+6. **`value` on a registration record is read once, and a write does not refresh it** (`D-95`).
+7. **A `rollback`'s own judgement reads the same rule** (`D-97`).
+
+**AND ONE MEMBER IS ADDED, WHICH IS WHY THIS IS A PATCH AND NOT A FEATURE** — **the package's own policy, `PUB-DD-9`: a PATCH is *"a fix inside the declared surface"*.** `write` exists **on the repair's record at a REGISTRATION instant only**: the landing instant's record still has six members, the constraint body's context still has five, **no status, verb, config key, `KC` token or other member moves**, and the closed status set stays twenty ranked `1`…`20`. A consumer that enumerates the registration repair record sees seven; one that enumerates either of the other two sees what it saw before.
+
+**THE WORKAROUND THIS RELEASE RETIRES, MEASURED ON THIS TREE.** Until now a "must exist, with a repair" pair could not travel in `cfg.constraints`, and this project's own register told a consumer to add it after construction instead. **That is no longer true:** with a `cfg.constraints` element whose body refuses on `ctx.value === undefined` and whose repair writes through the route, the construction **stands**, the body is asked **twice**, the repair's record carries `write` as a function, the object lands, and the pair stands. **The `addConstraint`-after-construction advice is withdrawn by this release.**
+
+**TWO CHANGES WITH A MIGRATION COST, SAID PLAINLY RATHER THAN LEFT TO A BUG REPORT:**
+
+- **A pair registered at a deep address no longer guards its ancestor's removal.** A `delete` of `['window']` reaches a pair at `['window','tabs']` and **skips it**, so the delete lands. **To guard a container, register the pair AT the container** — its parent is the register, which always resolves.
+- **A construction that refused for a well-formed pair whose parent was absent now stands.** A consumer who relied on that refusal to catch a stale list gets an instance with the pairs carried instead.
+
+**WHAT THIS RELEASE DOES NOT FIX**, recorded with owners in the unit's tracker entry and the live ledger: the refusal sentence's address at `kernel-attempt.mjs` (a recorded defect row, no successor queued); `§5.4`'s beside-write sentence, a named adjacent tension read through and edited by no pass; a body's direct write, now **declared unsupported** while the capability stays (`D-92`/`D-93`); and four corpus residuals — two property rows' wording, a `KC` token that no registration refusal prints, and a re-run arm unreachable through this route.
+
+---
+
 ## §1.4.0 · **CUT AND PUBLISHED — tag `v1.4.0`** — what that release carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states
 
 **⟶ THE HEADING THAT STOOD HERE WAS *"`## §1.4.0 · **PREPARED** — what `1.4.0` carries: the seven commits on `main` past `v1.3.0`, and the one figure this section states`"*, AND IT IS CORRECTED AT ITS OWN LINE, 2026-10-28.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn bytes are quoted above, every paragraph of this section below stands BYTE-FOR-BYTE as the reading of its own date, and nothing is deleted.** **THE DEFECT IS THE `DEF-AC` CLASS AT ITS THIRD ITERATION AND AT ITS SHARPEST: A HEADING THAT DENIED THE RELEASE ITS OWN TAG NAMES.** The tag set at this date reads `v1.0.0` · `v1.0.1` · `v1.1.0` · `v1.2.0` · `v1.3.0` · `v1.4.0`; **the tag `v1.4.0` names a tree whose `bindings/js/package.json` reads `"version": "1.4.0"` at its own bytes**, its five `optionalDependencies` pins read `1.4.0` with it, and the five platform manifests' `version` fields read `1.4.0` with them; and **a reader opening this file met *"PREPARED"* over a version the registry carries.** **SO THE HEADING NOW READS `CUT AND PUBLISHED — tag `v1.4.0``, which is a PAST-TENSE RECORD OF A RELEASE AND NOT A CLAIM ABOUT THE TREE YOU ARE READING** — the tag set is the record of what has been cut, and the state of the current tree's version is not a document's to state (`D-57`, and the head clause of this file, which stands). **AND WHAT THE SECTION BELOW DECLARES IS UNMOVED BY THE CORRECTION: the ancestor set (`D-56`), the `delete`'s own attempt and its `CommitRecord` (`D-57`), the five smaller items of `D-55`, and the one shipped sentence that all of it falsified — those are `1.4.0`'s content, they travelled in its tarball, and a consumer who installed `1.4.0` has them.** (`D-57`; the head clause of 2026-10-28 above; `git tag --list` and `bindings/js/package.json` read at their own bytes this date.)
@@ -77,7 +143,14 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
-## §1.6.1 · **PREPARED** — a DOCUMENTATION release: what `1.6.1` carries, and the arithmetic that says how many commits
+## §1.6.1 · **CUT AND PUBLISHED — tag `v1.6.1`** — a DOCUMENTATION release: what `1.6.1` carries, and the arithmetic that says how many commits
+
+**⟶ AND THIS HEADING CARRIED THE PRE-RELEASE MARKER UNTIL THE TAG WAS CUT, 2026-10-30 — `D-83`.** `RCA-8(g)`
+ANNOTATE-BESIDE: **the withdrawn heading's bytes stand in the withdrawn record and are read THROUGH this clause; this
+sentence deliberately does not quote them, because a quotation of a claim reads as a claim and the scan cannot tell
+them apart — which is `D-80`'s own finding.** **A cut-state is the tag set's to answer: the tag exists, so this section
+names a past act and not a present claim — and it is the one new cut-claim `D-82`'s ratchet could not admit until
+`D-83` gave it the arm.**
 
 **⟶ THIS SECTION IS NEW, 2026-10-30, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.6.0`, and that section's heading is corrected at its own line in the same act.** **AND THIS SECTION DOES NOT STATE WHETHER `1.6.1` HAS BEEN CUT: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 above, which governs every sentence here).
 

package/index.d.ts

@@ -241,6 +241,27 @@ export interface StoreConfig {
    * in the surface's one thrown form `{status, message, log}`, under the store's existing
    * `ConstraintListInvalid` — **the package mints no code**.
    *
+   * **⟶ AND THE CROSS-KIND ARM'S DIMENSION IS THE HANDLE, AND ITS MESSAGE NAMES THREE THINGS — ADDED 2026-11-01
+   * (`D-98` item 4; `docs/L1/cross-kind-handle-only.md` §2, §3.4, §3.6).** **THE ARM IS `adoptedHandles[n] ===
+   * element.id`: a HANDLE, never an address** — so a batch pair and an adopted listener MAY stand at one address,
+   * which is the ruling's clause (i) — and it is compared over the handles `cfg.listeners` adopts, which are the
+   * same set a successful construction adopts (`docs/L1/surface-deltas.md` §3.2). **ITS MESSAGE NAMES:**
+   *   * **THE POSITION**, because two elements may carry one address and the position is what identifies the
+   *     offending element;
+   *   * **THE HANDLE** — the shared string, which is the refusal's SUBJECT and the generated half's first word;
+   *   * **THE ADOPTED LISTENER'S ONE ADDRESS**, which an adopted `cfg.listeners` element carries exactly one of
+   *     (`frame.mjs`), so naming it asserts no order and is exact.
+   *
+   * **AND THE GENERATED HALF IS THE STORE'S OWN QUALIFIED `ConstraintListInvalid` ARM** — *"'<handle>' is already
+   * a handle this instance carries, a batch element's id is its pair's handle and it may not be one this
+   * construction adopts as a listener's"* — which **prints no `<CONTAINER>` slot**: the list's name `constraints`
+   * is named on the package's clause side and never in the generated half, where it would read as the place the
+   * mismatch was found. **The package still mints no code**, the status is still `ConstraintListInvalid`, and the
+   * instant is still before any filesystem act. **AND THE SUBJECT MOVES FROM AN ADDRESS TO THE HANDLE, which
+   * incidentally repairs a second rendering defect**: the address spelling quotes its string segments and the
+   * facade quotes the whole subject again, so the bytes read `''ck''`; **a bare handle renders `'shared-handle'`
+   * and the doubling has no subject at this arm.**
+   *
    * **AND THE NAME'S OTHER TWO READERS NEED NOTHING** (`D-24` items 2–3, both recorded so no pass adds a
    * member): `constraints()` already returns the bare `id`, so its four exclusions stand exactly as written;
    * and `LogEntry` already carries `id`, so **the name's logging role moves no member-set** and no undeclared
@@ -974,10 +995,21 @@ export interface StoreInstance {
    * TRUE AND UNAFFECTED and is now read **SCOPED BY KIND**: a repeated handle of the SAME kind at this act is
    * an overwrite (`D-24`), while **a pair whose `id` equals a LIVE LISTENER'S HANDLE is REJECTED** — it does
    * not overwrite the listener and it does not throw nothing. **The rejection is the surface's one thrown
-   * form `{status, message, log}` with the store's `AddressMalformed`**, its `message` naming BOTH SIDES and
-   * carrying the shared rule sentence *"a listener and a constraint do not share one"*, and it is taken
-   * **after the two positions' class tests and before the held-pair purge and before any store call**, so
-   * **no state moves**. `register`'s own direction of the same rule stands at that member (§its own clause).
+   * form `{status, message, log}` with the store's `AddressMalformed`**, its `message` naming BOTH SIDES, and
+   * it is taken **after the two positions' class tests and before the held-pair purge and before any store
+   * call**, so **no state moves**. `register`'s own direction of the same rule stands at that member (§its own
+   * clause).
+   *
+   * **⟶ AND THE RULE SENTENCE RE-DERIVES BY ONE WORD, 2026-11-01 (`D-98`; `docs/L1/cross-kind-handle-only.md`
+   * §3.4): *"a listener and a constraint do not share one"* READS *"a listener and a constraint do not share one
+   * HANDLE"*.** **THE CONDITION, THE STATUS AND THE INSTANT ARE UNMOVED** — a live listener is
+   * `off === false` **and** a function **and** `kind !== 'constraint'`, so a reserved `listen` with no
+   * `register` is NOT one and a pair may take its handle; and the member is still `AddressMalformed` after the
+   * two class tests and before the held-pair branch. **What moves is the sentence, because the OLD SPELLING READ
+   * THE ADDRESS and `D-98` declares the address LAWFUL.** The missing word is added from the project's own
+   * anchor (`bindings/js/README.md`: *"a listener and a constraint do not share one handle"*), and the
+   * refusal's `address` member is `null`: the subject is the identity, and naming one of a listener's N mirror
+   * addresses would assert a membership no clause supports.
    */
   addConstraint(pair: ConstraintPair, constraint: Constraint): ConstraintIdentity;
   /** **THE ENABLE HALF** (`§2.12` item 2 (a) and item 3's `constraintOn` row): `undefined`. **The
@@ -993,14 +1025,36 @@ export interface StoreInstance {
   constraintOff(pair: ConstraintPair, constraint: Constraint): void;
   /** Register `listener` under the opaque `handle`, and answer `undefined` (`surface.md §2.4` item 5 (b)).
    *
-   *  **⟶ AND IT REFUSES WHERE A CONSTRAINT'S `id` STANDS AT THE ADDRESS** (`D-25`'s *"vice versa"*; `D-29`):
-   *  the cross-kind rule's register-side direction, in the surface's **own** thrown form
-   *  `{status, message, log}` with the store's `AddressMalformed` — **not** the `TypeError` this member's
-   *  conflict arm carried while a reserved `constraint@` prefix existed to be exempted — taken after the
-   *  handle's domain and registry tests and **before the registry write and before the re-install `listen`**,
-   *  so **no state moves**. **The exemption for kernel-prefixed handles is DELETED, not moved**: under `D-22`
-   *  the kernel's handle is no longer a reserved spelling and under `D-25` **the kernel registers nothing**, so
-   *  nothing needs to get past the test. */
+   *  **⟶ AND IT REFUSES WHERE THE HANDLE EQUALS A CARRIED CONSTRAINT PAIR'S `id`** (`D-25`'s *"vice versa"*;
+   *  `D-29`; **⟶ RE-DERIVED 2026-11-01 BY `D-98`'s HANDLE RULE, WHICH IS THE WHOLE OF IT**: *"A constraint and a
+   *  listener can share an address, as can multiple constraints/listeners. The restriction is that a listener
+   *  and a constraint cannot have the same **handle**."*). **THE CLAUSE THAT STOOD HERE READ *"it refuses where a
+   *  constraint's `id` STANDS AT THE ADDRESS"* AND THAT CONDITION IS WITHDRAWN**: an ADDRESS is not a collision
+   *  at all — a pair and a listener MAY stand at one address — so what the member tests is the **HANDLE, and
+   *  nothing else**: a carried pair whose `id` is that string, **disabled pair included** (`D-98` (iii)'s rule is
+   *  unconditional in both directions, and the loss a skipped disabled pair would permit lands at the next
+   *  `constraintOn` with no observable at the instant of the loss).
+   *
+   *  **THE REFUSAL IS THE SURFACE'S OWN THROWN FORM** `{status, message, log}` with the store's
+   *  `AddressMalformed` — **not** the `TypeError` this member's conflict arm carried while a reserved
+   *  `constraint@` prefix existed to be exempted — taken after the handle's domain and registry tests and
+   *  **before the registry write and before the re-install `listen`**, so **no state moves**: no store act, no
+   *  mirror row, no registry entry.
+   *
+   *  **ITS MESSAGE IS TWO PARTS AND BOTH ARE NAMED HERE** (`D-98` item 4; `docs/L1/cross-kind-handle-only.md`
+   *  §3.6's `B-5` text): **the generated half is the STORE'S OWN** — the qualified `AddressMalformed` arm, *"'<id>'
+   *  is already a handle this instance carries, a listener's handle and a constraint's id are one string and one
+   *  string only"*, which **names no address, no segment and no placeholder container** — and **the clause half is
+   *  the package's**, naming the pair that keeps the handle and carrying the shared rule sentence *"a listener and
+   *  a constraint do not share one handle"*. **The refusal's `address` member is `null`**, and that is now correct
+   *  rather than incidental: the subject is a string in the handle namespace and the address is lawful.
+   *
+   *  **The exemption for kernel-prefixed handles is DELETED, not moved**: under `D-22` the kernel's handle is no
+   *  longer a reserved spelling. **⟶ AND THE SENTENCE THAT FOLLOWED IT — *"under `D-25` the kernel registers
+   *  nothing, so nothing needs to get past the test"* — IS RE-DERIVED BY `D-99`'s ANSWERED CLAUSE AND NOT ABSORBED:**
+   *  the kernel **does** register, and it reaches the store through its **own internal route** rather than through
+   *  this member, so **this test is a CALLER's test and the kernel's act never meets it** — which is why there is
+   *  still nothing to get past it. */
   register(handle: Handle, listener: Listener): void;
   /** **`removeListener(handle) -> undefined`** — the entry removed WHOLE and its store entries withdrawn; every arm that is not a real removal THROWS (`contract.md §2.7` item 2; `PAR-HL-14`, `PAR-HL-15`). */
   removeListener(handle: Handle): void;
@@ -1173,6 +1227,75 @@ export interface ConstraintPair {
  * item 1: `true` is the only pass value). **Every non-function is outside the position AT EVERY ONE OF THE
  * THREE METHODS**, and a non-function at the toggle's position is refused on the ARGUMENT's ground and
  * never on the pair's.
+ *
+ * **⟶ AND THE TWO RETURNS THIS POSITION ADMITS ARE DECLARED HERE, ADDED 2026-10-30 — WHAT YOUR
+ * CONSTRAINT MAY RETURN, AND WHAT ITS REPAIR MAY RETURN.** **EVERY SENTENCE OF THIS CLAUSE — THE ONE THIS MARK
+ * OPENS, ADDED 2026-10-30 — HOLDS AT THE WRITE'S OWN EVALUATION, THE INSTANT THE KERNEL EVALUATES THE VALUE
+ * YOUR FUNCTION RETURNED, AND AT THAT INSTANT ONLY, EXCEPT WHERE A SENTENCE NAMES ITS OWN INSTANT IN ITS OWN
+ * WORDS.** **AND A SENTENCE STANDING ABOVE THIS CLAUSE IS OUTSIDE THIS FRAME AND IS READ AT ITS OWN INSTANTS
+ * BY ITS OWN WORDS — this clause moves none of it.** The clause above prints the answer's PASS value;
+ * this one declares the rest of the closed set IN ITS OWN WORDS, so a reader holding this package reads the
+ * rule and needs no second document for it.
+ *
+ * **THE OUTCOME IS A CLOSED THREE-ARM SET, READ IN THIS ORDER: `true` — THE ONLY PASS VALUE;
+ * `{ message, repair }` — A REPAIRABLE VIOLATION; `{ message }` — AN UNREPAIRABLE VIOLATION, ITS `message`
+ * THE REFUSAL'S OWN SENTENCE. A VALUE OUTSIDE THE THREE IS READ AS THE `{ message }` ARM AND NEVER AS A
+ * FOURTH ARM OF ITS OWN**, so a return you invent beyond them declares an outcome this kernel does not
+ * distinguish.
+ *
+ * **AND `message` IS REQUIRED ON THE REPAIR ARM AND IS READ FIRST**: the gate is the `message` member,
+ * read before any `repair` is looked for, and a `repair` is looked for only inside that branch — **so a
+ * return carrying only `repair` is the arm outside the three and ITS REPAIR IS NEVER SEEN**, and **AT THE
+ * WRITE'S OWN EVALUATION a `message` that is not a NON-EMPTY STRING keeps the repair readable while the
+ * refusal answers the kernel's own unrecognized sentence** (the closed set, its order and this read stand at
+ * `bindings/js/src/entry/kernel-attempt.mjs:686-699`).
+ *
+ * **THE ATTACH: the `repair` your function returns IS A FUNCTION TAKING ONE ARGUMENT — ITS OWN RECORD,
+ * WHICH IS NOT YOUR CONSTRAINT'S AND IS NOT INTERCHANGEABLE WITH IT.** **The two records stand apart at
+ * THREE PLACES: by COUNT, SIX against FIVE; by `id`, which the repair's record carries where the
+ * constraint's carries `attempt`; and by `pending`, which rides the repair's record ALONE**
+ * (`bindings/js/src/entry/kernel-attempt.mjs:607-613`, `:756-782`; the kernel's own words at
+ * `bindings/js/src/entry/kernel-registration.mjs:373-374`). **No member census of either record is
+ * printed here.**
+ *
+ * **AT THE WRITE'S OWN EVALUATION — AT THAT INSTANT AND NO OTHER — THE KERNEL READS `message` AND
+ * `repair` AS OWN MEMBERS OF THE OBJECT YOUR FUNCTION RETURNED: a pair carried on a prototype is NOT SEEN
+ * there, and such a return answers the kernel's unrecognized sentence instead**
+ * (`bindings/js/src/entry/kernel-attempt.mjs:690-696`). **THIS IS THE ONLY SENTENCE IN THIS FILE THAT
+ * STATES THAT RULE, AND IT IS THE LANDING INSTANT'S**: the registration act reads the same
+ * closed outcome at `bindings/js/src/entry/kernel-registration.mjs:330-332`, where an inherited `repair`
+ * IS seen and invoked — **ONE RETURNED SHAPE ANSWERING TWO DIFFERENT THINGS AT THE TWO INSTANTS, a repair
+ * at registration and no repair at a write — and that divergence is OWED to a code-bearing unit and is
+ * CONTRADICTED BY NO SENTENCE HERE** (`strata/decisions.md` · `D-35`, whose parameter-access rule the
+ * registration read does not yet hold).
+ *
+ * **THE REPAIR'S OWN RETURN IS A CLOSED TWO-ARM SET: `{ ok: true, op }` — the repairable arm, `op`
+ * REQUIRED and BEING THE OPERATION RECORD THE STORE'S OWN VERB RETURNED (`WriteRecord.op`, or
+ * `DeleteRecord.op` where that member is non-`null` — a `delete` that removed nothing answers `null` and
+ * credits nothing) — and `{ ok: false, message }` — the failed arm. WHERE `ok` IS FALSE THE RETURNED
+ * OBJECT'S MEMBERS ARE `ok` AND `message`, AND `op` IS ABSENT AND NEVER `null`, BECAUSE AN `op` THERE IS
+ * READ BY NOTHING. **AT THE WRITE'S OWN EVALUATION A RETURN CARRYING ANY OTHER IDENTITY FAILS `KC-4`**
+ * (`KC-4`'s token and the repair-body path print at `docs/specs/storeroom-constraints/contract.md:552`,
+ * and the two arms print at `:558`). **That one sentence covers every outside form of that return, and
+ * this file enumerates none of them.**
+ *
+ * **AND THE OP MUST BE ONE THE ATTEMPT CAN BE SHOWN TO HAVE LANDED: that ground is the kernel's own credit
+ * check, and it is POINTED AT here and never re-spelled** —
+ * `bindings/js/src/entry/kernel-foundations.mjs:1105-1131` — **and NO ORDINAL GROUND IS CLAIMED AT THE
+ * REGISTRATION INSTANT, whose credit check runs with no invoked-for op**
+ * (`bindings/js/src/entry/kernel-registration.mjs:510-517`).
+ *
+ * **AND THE COMMIT YOUR REPAIR IS PART OF RIDES THAT ONE ARGUMENT: supply it at `write`'s DECLARED FOURTH
+ * POSITION and the write your repair makes JOINS the commit it is part of**
+ * (`bindings/js/index.d.ts:862`) — **the record the repair is handed carries that commit at its `pending`
+ * member, the `CommitRecord.pending` this file declares at `bindings/js/index.d.ts:772`, POINTED AT here
+ * and re-declared nowhere.** **That position's own class test is not restated.**
+ *
+ * **AND NOTHING HERE MINTS A TYPE, A SYMBOL, AN ALIAS, A SEAM, A RECORD MEMBER OR AN EXPORT**: this clause
+ * DOCUMENTS the pair your function returns and a two-arm result the kernel already reads, and DECLARES
+ * nothing — `Constraint` below is unmoved, one `unknown` in and one `unknown` out. **Nor does it name an
+ * archived part as the place its rule is to be read: the rule IS the sentences above, and every point they
+ * cite is a live print of the kept contract or a live source range on this branch.**
  */
 export type Constraint = (context: unknown) => unknown;