provident-storeroom 1.6.2 → 1.7.0

package/README.guide.md

@@ -30,7 +30,7 @@ preflight REFUSES when these two lines do not read what it computed** (`scripts/
 one check, read-only). **THE TWO LINES ARE THIS GUIDE'S OPERATIVE FIGURES; every dated paragraph below is the
 reading of its own date and is read through them.**
 
-PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.6.2`.
+PUBLISH-GUIDE-VERSION-LINE: THE VERSION THIS GUIDE DESCRIBES IS `1.7.0`.
 PUBLISH-GUIDE-CUT-STATE: NOT STATED -- this document describes the behaviour at the version line above, and the cut-state is the release's to state, not a shipped document's (`D-57`).
 
 **⟶ AND THE CUT-STATE SENTENCE ABOVE IS WITHDRAWN, 2026-10-28 — THE CUT-STATE IS NOT A DOCUMENT'S TO STATE.** `RCA-8(g)` ANNOTATE-BESIDE, and the architect's ruling verbatim (`strata/decisions.md` · `D-57`): *"Drop the cut-state."* **The two marked lines above stand BYTE-FOR-BYTE as the reading of their own date and are read THROUGH this clause — not one byte of either is deleted — and the sentence this clause withdraws is the SECOND of them, the one that claims to say whether the release this guide travels in is cut.** **THE REASON IS MEASURED, THREE TIMES OVER, AND IT IS STRUCTURAL RATHER THAN A MISTAKE: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and the change list's head was stale within minutes of the tag that falsified it. **SO THE CUT-STATE SENTENCE IS DROPPED AS A CLAIM AND THE VERSION LINE STAYS**, because the version line is the ONE figure a tarball can be right about: the manifest knows it and travels beside it. **`scripts/publish.sh --figures` GENERATES AND ASSERTS THE VERSION LINE AND NOTHING ELSE** — the cut-state generation and its assertion are removed in the same act, so a tag set that moves can no longer redden this guide — **and the same one line is asserted in THREE shipped documents: this guide, `README.md` beside it, and the change list** (`DEF-AC`'s remaining demand, *"guard the release notes too"* and *"`README.md` still declares no version at all"*). **THE TAG SET IS NOT DELETED AND NOT DENIED: it is a RECORD OF RELEASES held in the change list, PAST TENSE — a list of what has been cut — and never a claim about the current one.** **AND WHAT THIS CLAUSE DOES NOT SAY, SAID PLAINLY BECAUSE A READER WILL LOOK FOR IT: it does not say whether the version this guide prints is cut.** That is not a document's to state; the record of what has been cut is in `RELEASE-NOTES.md`, and the registry is the registry.
@@ -917,6 +917,20 @@ adopts — a cross-KIND collision, rejected regardless of kind** (`D-27`, verbat
 batch - regardless of listener/constraint type"*; `index.d.ts`, `StoreConfig.constraints`). **Both are refused
 before any filesystem act, under `ConstraintListInvalid`; the package mints no code.**
 
+**⟶ READ THROUGH THIS CLAUSE FROM 2026-11-01 — THE BATCH'S CROSS-KIND COLLISION IS THE HANDLE, AND THE ADDRESS IS NOT A
+COLLISION AT ALL (`D-98`, `ACTIVE`, 2026-11-01).** `RCA-8(g)` ANNOTATE-BESIDE: **the two construction refusals above stand
+BYTE-FOR-BYTE and are read THROUGH this clause; nothing above is deleted, and this clause is one dated correction and not
+a second site.** **IT IS THE HANDLE RULE AND IT ALWAYS WAS** — `D-27`, verbatim: *"Reject duplicate handles in batch -
+regardless of listener/constraint type"* — **and its sentence is spelled now as the rest of this corpus spells it: *a
+listener and a constraint do not share one handle*** (`bindings/js/README.md:232`–`:233`, the hand-authored page that
+already read this way and that this correction makes the others agree with rather than the file it edits). **AND ONE
+SENTENCE THIS PARAGRAPH OWED ITS READER, THE SHARED ADDRESS BEING THE WHOLE OF WHAT THE RULING MAKES LAWFUL: an element's
+`address` coinciding with an adopted listener's `address` is NOT a collision at all** — a constraint pair and a listener
+MAY stand at ONE address, so the construction refuses the shared HANDLE and admits the shared address (`D-98` clauses
+(i)–(iii); `docs/L1/cross-kind-handle-only.md` §3.4, §4.2). **Its member, its instant and its no-state-moves sentence are
+unmoved**: `ConstraintListInvalid`, in the pre-create walk, before any filesystem act (`docs/L1/surface-deltas.md` §2's
+`B-3` row).
+
 ### §7.3 A cross-kind duplicate is REJECTED, in both directions
 
 **A duplicate handle of the SAME kind is an overwrite. A duplicate handle ACROSS KINDS — a listener where a
@@ -924,12 +938,30 @@ constraint stands, or a constraint where a listener stands — is REJECTED** (`D
 overwrite a listener with a constraint or vice versa is rejected"*; `D-29`: *"Listen cannot overwrite constraint,
 only other listeners"*).
 
-**Measured 2026-10-26, from the constraint-then-listener direction:** with `c1` armed at `['a']`,
-`store.listen('h1', [['a']])` threw the **one plain form** — `Object.keys` `["status","message","log","address"]`, `status`
-`'AddressMalformed'`, `log` `[]` — whose message names BOTH sides and carries the shared rule sentence **"a
-listener and a constraint do not share one"**. **The form is the surface's one thrown form and NOT a `TypeError`**
-(`index.d.ts`, `addConstraint`'s and `register`'s cross-kind clauses). **No state moves: the rejection is taken
-after the positions' class tests and before any store call.**
+**⟶ RE-DERIVED 2026-11-01 — THE RULE SENTENCE READS THE HANDLE, AND THE ADDRESS IT USED TO READ IS LAWFUL (`D-98`,
+`ACTIVE`, 2026-11-01).** `RCA-8(g)` ANNOTATE-BESIDE: **`§7.3`'s heading and its first paragraph stand BYTE-FOR-BYTE and
+are read THROUGH this clause; the paragraph that stood below them measured the DEFECT and has MOVED OUT, and its one
+pointer stands where it stood.** **THE LAW, IN THREE CLAUSES** — `D-98` item 1, the architect, verbatim: *"A constraint and
+a listener can share an address, as can multiple constraints/listeners. The restriction is that a listener and a
+constraint cannot have the same **handle**."* **(i) A CONSTRAINT PAIR AND A LISTENER MAY STAND AT ONE ADDRESS** — different
+handles, one address, both reached by the act: the pair ASKED by the pass, the listener DELIVERED after it. **(ii) MULTIPLE
+CONSTRAINTS at one address, and MULTIPLE LISTENERS at one address, are LAWFUL.** **(iii) THE ONLY CROSS-KIND RESTRICTION IS
+THE HANDLE** — a listener's handle equal to a constraint pair's `id`, and a pair whose `id` equals a live listener's
+handle, are REFUSED, **in both directions**. **AND A `listen` AT A PAIR'S ADDRESS STANDS**: the act is lawful, it answers
+its handle (`D-22`), it purges none of the pair's rows and installs the listener beside it — so an application that moved
+a subscription off a constrained address to work around a refusal may reclaim that address, and whether it does is that
+application's decision and not this guide's.
+
+**THE RULE SENTENCE, RE-DERIVED IN PLACE: *a listener and a constraint do not share one handle*** — one word more than the
+address reading, its spelling `bindings/js/README.md:232`–`:233`'s, and it is the clause half of all four refusal
+messages (`docs/L1/cross-kind-handle-only.md` §3.4, §3.6). **WHAT DOES NOT MOVE:** a duplicate handle of the SAME kind is
+still an OVERWRITE (`D-24`); the cross-kind refusal is still the surface's ONE thrown form `{status, message, log,
+address}` — `status` `'AddressMalformed'` at the three single-registration arms and `'ConstraintListInvalid'` at the batch,
+`log` `[]`, and `address` `null` because the subject is a string in the handle namespace and not a place — and **no state
+moves**: each refusal is taken after the positions' class tests and above every store act and every purge (`index.d.ts`,
+the `register`/`addConstraint`/`StoreConfig.constraints` clauses; `docs/L1/surface-deltas.md` §2).
+
+**⟶ THE 2026-10-26 MEASURED PARAGRAPH THAT STOOD HERE HAS MOVED OUT BYTE-EXACTLY (`RCA-8(g)`, `D-98` item 5).** **the measurement that stood here measured the address refusal this guide's rule no longer makes; its bytes are at `docs/guides/backup/D98-2026-11-01-guide-move-out.md §1`.**
 
 ### §7.4 The toggles, and the read
 

package/README.md

@@ -31,7 +31,7 @@ an edit belongs.
 
 **⟶ AND THE ONE FIGURE THIS PAGE CAN BE RIGHT ABOUT IS GENERATED AND ASSERTED, 2026-10-28 — `DEF-AC`'s third part, and `D-57`'s one surviving figure.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause above stands BYTE-FOR-BYTE and is read THROUGH this one; nothing above moves.** **THE DEFECT THIS CLOSES: THIS PAGE DECLARED NO VERSION AT ALL** — a shipped document a consumer reads first, saying nothing about which release it describes — **so `scripts/publish.sh --figures` now GENERATES the line below from `bindings/js/package.json`'s `version` and REFUSES when it disagrees, exactly as it does at the guide's and the change list's own marked lines: three shipped documents, three version lines, one generator, one assertion.** **AND THE CUT-STATE IS NOT STATED HERE, OR ANYWHERE ELSE IN THIS PACKAGE'S DOCUMENTS** (`D-57`, the architect verbatim: *"Drop the cut-state"*): a document is sealed before the tag that would make its cut-state true, so **the cut-state is not a document's to state**; the record of what has been cut is the change list's, and it is past tense. **EVERY OTHER CLAIM OF THIS PAGE STANDS EXACTLY AS IT STOOD.**
 
-PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.6.2`.
+PUBLISH-README-VERSION-LINE: THE VERSION THIS README DESCRIBES IS `1.7.0`.
 
 ## The one entry
 

package/RELEASE-NOTES.md

@@ -16,7 +16,7 @@ claims to be installable.**
 
 **⟶ AND THE CUT-STATE IS DROPPED FROM THIS FILE, 2026-10-28 — `D-57`, THE ARCHITECT VERBATIM: *"Drop the cut-state."*** `RCA-8(g)` ANNOTATE-BESIDE: **the title line and every dated paragraph of this file stand BYTE-FOR-BYTE as the reading of their own date, THIS clause is the one that reads them, and not one byte is deleted.** **THE REASON IS STRUCTURAL AND IT WAS MEASURED THREE TIMES: A SHIPPED DOCUMENT IS SEALED BEFORE THE TAG THAT MAKES ITS CUT-STATE TRUE**, so every release packed before its tag ships a document denying itself, and a guard running in that release's own preflight can only ever confirm *"not cut"* — `1.2.0` shipped *"NOT CUT"*, `1.3.0` shipped *"`v1.3.0` DOES NOT EXIST"*, and this file's own head was stale within minutes of the tag that falsified it. **SO EVERY SENTENCE BELOW THAT CLAIMS WHETHER SOME VERSION IS OR IS NOT CUT — *"PREPARED — NOT CUT"*, *"no `v1.3.0`"*, *"nothing in this section is cut"*, *"the release is not cut"*, *"what is installed today is still `1.1.0`"*, and each reading printed beside them — IS READ THROUGH THIS CLAUSE: the cut-state is not a document's to state.** **WHAT SURVIVES IS THE ONE FIGURE A SHIPPED DOCUMENT CAN BE RIGHT ABOUT, AND IT IS GENERATED FROM THE MANIFEST AND ASSERTED BY THE PREFLIGHT:**
 
-PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.6.2`.
+PUBLISH-NOTES-VERSION-LINE: THE VERSION THIS CHANGE LIST DESCRIBES IS `1.7.0`.
 
 **AND THE TAG SET SURVIVES AS A RECORD OF RELEASES — PAST TENSE, A LIST OF WHAT HAS BEEN CUT, NEVER A CLAIM ABOUT THE CURRENT ONE** (the record stands in `§1.4.0` below — the section this file's head called `§main` until it was re-cut to name the version it prepares, 2026-10-28 — beside the section for the tree this file describes). (`D-57`; `DEF-AC` (b) — `scripts/publish.sh --figures` generates that line from `bindings/js/package.json`'s `version` and refuses on any disagreement, in this file, in `bindings/js/README.md` and in the shipped guide: three documents, three version lines, one generator, one assertion.)
 
@@ -55,7 +55,44 @@ the value to assert against, not the crate's own `Cargo.toml` version.
 
 ---
 
-## §1.6.2 · **PREPARED — the release this tree is being cut as** — a BEHAVIOUR release: what the thirty-four commits past the previous tag carry, the one additive member, the workaround it retires, and the four things it does not fix
+## §1.7.0 · a MINOR — the cross-kind correction's landing: the four refusal messages a consumer reads differently, what does not move, and the arithmetic that says how many commits
+
+**⟶ THIS SECTION IS NEW, 2026-11-01, AND IT STATES THE VERSION AND NOT THE CUT-STATE.** `RCA-8(g)` ANNOTATE-BESIDE: **no byte of the sections below moves; this section is added above `§1.6.2`, whose heading is corrected at its own line in the same act.** **AND THIS SECTION DOES NOT STATE WHETHER `1.7.0` HAS BEEN RELEASED: the cut-state is the tag set's to carry and not a document's to state** (`D-57`; the head clause of 2026-10-28 and the authority clause of 2026-10-29 above, which govern every sentence here).
+
+**THE VERSION IS `1.7.0` AND ITS CLASS IS A MINOR — `D-100`, THE ARCHITECT'S RULING OF 2026-11-01 (`strata/decisions.md` `D-100`), VERBATIM: *"Minor — 1.7.0"*.** **THE GROUND IS A MEASUREMENT AND NOT A PREFERENCE: FOUR REFUSAL MESSAGES CHANGE THEIR TEXT ON A PUBLISHED SURFACE**, which is more than this project's own `PUB-DD-9` row allows a PATCH (*"a fix inside the declared surface"*) and less than a break of any member — so the class is the MINOR the number names (`D-100` item (i)).
+
+**THE ELEVEN CELLS MOVE TOGETHER AND NEVER SINGLY** — `bindings/js/package.json`'s `version`, its **five** exact `optionalDependencies` pins, and the **five** `bindings/js/platforms/*/package.json` `version` fields — **and the artefact is stamped from that manifest by `bindings/js/build.rs`, so `version()` answers `1.7.0` at the rebuilt artefact and at a package installed from it**; that, and not the crate's own `Cargo.toml` version, is the value the coupling rule is asserted against (`§1.6.2`'s version clause states the shape and is read through it; `scripts/publish.sh`'s own cell enumeration).
+
+**THE ARITHMETIC, MEASURED AT THIS TREE: `git rev-list --count v1.6.2..HEAD` READS `1`.** **The one commit is `e024195`, *"Land the cross-kind correction: one address is lawful, the handle is the restriction (D-98–D-100)"*, and `git show --stat e024195` reads `33` files changed, `4506` insertions and `355` deletions — a split by what the commits ARE rather than by what they touch, in four kinds:** **the JS entry and its parts** (`index.mjs`, `src/entry/delivery.mjs`, `constraints.mjs`, `frame.mjs`, `kernel-registration.mjs`, `artefact.mjs`); **the addon's facade and the store's own message generator** (`bindings/js/src/facade.rs`, `src/error.rs`); **the declaration** (`bindings/js/index.d.ts`); **and the documents and the batteries** (the L1 declaration, the guide with its landing, the move-out record, two spec parts, three records, and eleven paths under `tests/e2e/`). **AND THE RELEASE'S OWN LANDING IS THIS PASS'S WORKING TREE AND NOT A COMMIT COUNT** — the bump, this section, `§1.6.2`'s heading repair, the two generated landings and the ledger row — **so the figure above is printed with its instrument and is not summed with them.** (`git rev-list --count v1.6.2..HEAD`; `git show --stat e024195`.)
+
+**WHAT A CONSUMER SEES, EACH AN ARM TO DRIVE RATHER THAN A SENTENCE TO TRUST:**
+
+1. **A CONSTRAINT PAIR AND A LISTENER MAY STAND AT ONE ADDRESS.** Before this release a `listen` at an address a carried pair stood at was refused; now the act stands, both actors are carried, and **a write at that address triggers the pair AND delivers the listener** (`D-98` item 1; `docs/L1/cross-kind-handle-only.md` §1 and its `XK-1`). **AND THE ONLY CROSS-KIND RESTRICTION IS THE HANDLE**: a listener's handle and a constraint's `id` are **one string**, and neither kind may claim a handle the other keeps (`D-98` item 1 (iii); `D-99`).
+2. **THE FOUR CROSS-KIND REFUSALS PRINT NEW MESSAGE TEXT, AND THE RULE SENTENCE IS *"a listener and a constraint do not share one handle"*.** `AddressMalformed` stands at **three** arms — `listen` (`B-6`), `register` (`B-5`) and `addConstraint` (`B-4`) — and `ConstraintListInvalid` at **one**, the construction's batch element (`B-3`); the four texts whole are `docs/L1/cross-kind-handle-only.md` §3.6, and they are asserted **whole** at five cell homes, so a pass that edits one word of a message moves five cells. **THE STATUSES DO NOT MOVE; THE SENTENCES DO** — and the half they carried that was false at every arm, the store's segment sentence rendered with an empty container, is gone (`D-98` item 4, verbatim: *"the false half cannot stay"*).
+3. **A DISABLED PAIR'S HANDLE BLOCKS A CALLER EXACTLY AS AN ENABLED ONE'S DOES** — a caller's `listen('<pair id>', …)` and a caller's `register('<pair id>', fn)` are both refused after `constraintOff`, where the second was admitted before (`D-99`; `docs/L1/cross-kind-handle-only.md` §9.4, and `XK-6` is the measurement).
+4. **THE KERNEL REACHES THE STORE THROUGH ITS OWN ROUTE AND NO LONGER THROUGH A CALLER-FACING MEMBER.** That is the correction's one internal restructure (`D-99`'s ANSWERED clause: `listenOn`, the `LISTEN_ROUTE` symbol and `installListenRoute`, §9.2), **it deletes the `state.establishing` marker and its four brackets, and it changes no answer a consumer's own call receives** — which is why it is stated here rather than left to a reader who meets the changed call in a stack.
+
+**WHAT DOES NOT MOVE, ENUMERATED SO THE MINOR IS NOT READ AS WIDER THAN IT IS:**
+
+- **THE CLOSED STATUS SET IS TWENTY, ranked `1`…`20`, and no status is minted.** `AddressMalformed` keeps rank `1` and `ConstraintListInvalid` keeps `16` (`src/error.rs`'s `CODES`; `D-99` item 1; `D-100` item (ii)).
+- **EVERY MEMBER, EVERY TYPE AND EVERY CONSUMER-VISIBLE ARITY.** The instance's fourteen members, the log entry's five, the failure form's four, `KC`'s nine tokens and the module namespace's one name are all unmoved (`D-100` item (ii)).
+- **THE ONE ARITY THAT WIDENS IS THE ADDON'S OWN GENERATOR, AND IT IS ARTEFACT-INTERNAL.** `errorMessage` gains **one optional fourth position** carrying the closed arm token `'handle'`, so the artefact's internal range reads **`2`–`4`** where the census cell read `2`–`3`; **no named export of the module namespace and no subpath reaches it**, so this is a widening of the artefact's own generator and not of a consumer API (`D-100` item (iii); `docs/L1/cross-kind-handle-only.md` §3.7–§3.8).
+- **THE SURFACE MAP IS UNMOVED AT `19` MODULES AND `61` ENDPOINTS** — the correction adds a part to a module and no endpoint (`D-100`; `docs/L1/cross-kind-handle-only.md` §6.3, which is the L2 reading this release declares).
+
+**THE CELLS AND THE RECORDS THE CORRECTION CARRIES, NAMED SO A READER CAN CHECK THE BATTERY AGAINST THEM** (`docs/L1/cross-kind-handle-only.md` §6.1's write set, verbatim: *"§5.1's six rewrites, §5.2's two, §5.3's eight"*):
+
+- **SIX REWRITTEN CELLS**, each one a cell that asserted the address dimension the ruling withdraws — `HLI-11.3` and `HLI-11.3.a`, `G3-22`, the two `constraints-publication` probes with their prose, the `blind-listener-surface` form cell, and `DEF-N`'s constant — beside **two kept cells whose MESSAGES are re-read** rather than weakened (§5.2).
+- **EIGHT `XK` CELLS ADDED**, `XK-1`…`XK-8`, in the file `tests/e2e/cross-kind-handle-only.test.mjs`; **`XK-6` and `XK-8` are re-shaped by `D-99`** (§9.5), and `Q-1`'s residual is retired by name rather than carried.
+- **THE MOVE-OUT RECORD**: the guide's 2026-10-26 measured paragraph left **byte-exactly** to `docs/guides/backup/D98-2026-11-01-guide-move-out.md`, with its source path, its pre-move position, its date, a computed `sha256` and why — and the delivered text states the rule in its place (`docs/L1/cross-kind-handle-only.md` §4.1).
+- **THE CONTRACT'S `§2.2` ITEM 7 POINTER**: a **pure insertion** of 2026-11-01 at `docs/specs/storeroom-held-listener-identity/contract.md` `§2.2` item 7, which *"moves no position, no domain, no fail arm and no other item"* of that section.
+
+**AND WHAT THIS SECTION IS NOT: a restatement of `§1.6.2`.** **That section is the change list of the previous release and stands BYTE-FOR-BYTE beneath this one; what this release carries of it is the version and the arithmetic and nothing else.**
+
+---
+
+## §1.6.2 · **CUT AND PUBLISHED — tag `v1.6.2`** — a BEHAVIOUR release: what the thirty-four commits past the previous tag carry, the one additive member, the workaround it retires, and the four things it does not fix
+
+**⟶ AND THIS HEADING CARRIED THE PRE-RELEASE MARKER UNTIL THE TAG WAS CUT, 2026-11-01 — `DEF-AC` at its fifth iteration, and the one red `D-82`'s ratchet refused on every run before this one.** `RCA-8(g)` ANNOTATE-BESIDE: **the withdrawn heading's bytes stand in the withdrawn record — `docs/guides/backup/D81-2026-10-29-notes-move-out.md` `§6`, which carries the source path, the pre-move line, the date, a computed `sha256` and why they moved — and are read THROUGH this clause; this sentence deliberately does not quote them, for the reason the `§1.6.1` clause above states and `D-80` measured: a quotation of a claim reads as a claim, and the scan cannot tell the two apart.** **AND THE CORRECTED HEADING IS THE PAST-TENSE RECORD THIS FILE'S OWN PRECEDENT USES** — the spelling `§1.6.0`, `§1.6.1`, `§1.5.0` and `§1.4.0` already carry — **because a cut-state belongs to the tag set: `git tag --list` answers `v1.6.2`, so this section names a past act and not a present claim, and `D-82`'s past-tense condition accepts the line for exactly that reason.** **AND WHAT THIS ACT DOES NOT DO: it moves no other byte of `§1.6.2`, whose body and items below stand BYTE-FOR-BYTE as the reading of their own date; it adds no entry to the exemption set, because a line whose bytes change must leave that set rather than join it and the set may only SHRINK; and it changes no figure the withdrawn line carried, which the record names.** (`D-57`; `D-82`; `git tag --list`.)
 
 **THE VERSION: `1.6.2`, AT ELEVEN CELLS THAT MOVE TOGETHER AND NEVER SINGLY** — the main manifest's `version`, its **five** exact `optionalDependencies` pins, and the **five** `platforms/*/package.json` versions — **plus the three shipped documents' one generated version line each.** **The artefact is stamped from the manifest by `bindings/js/build.rs`, so `version()` answers the release figure** and that is the value the coupling rule is asserted against, not the crate's own `Cargo.toml` version.
 

package/index.d.ts

@@ -241,6 +241,27 @@ export interface StoreConfig {
    * in the surface's one thrown form `{status, message, log}`, under the store's existing
    * `ConstraintListInvalid` — **the package mints no code**.
    *
+   * **⟶ AND THE CROSS-KIND ARM'S DIMENSION IS THE HANDLE, AND ITS MESSAGE NAMES THREE THINGS — ADDED 2026-11-01
+   * (`D-98` item 4; `docs/L1/cross-kind-handle-only.md` §2, §3.4, §3.6).** **THE ARM IS `adoptedHandles[n] ===
+   * element.id`: a HANDLE, never an address** — so a batch pair and an adopted listener MAY stand at one address,
+   * which is the ruling's clause (i) — and it is compared over the handles `cfg.listeners` adopts, which are the
+   * same set a successful construction adopts (`docs/L1/surface-deltas.md` §3.2). **ITS MESSAGE NAMES:**
+   *   * **THE POSITION**, because two elements may carry one address and the position is what identifies the
+   *     offending element;
+   *   * **THE HANDLE** — the shared string, which is the refusal's SUBJECT and the generated half's first word;
+   *   * **THE ADOPTED LISTENER'S ONE ADDRESS**, which an adopted `cfg.listeners` element carries exactly one of
+   *     (`frame.mjs`), so naming it asserts no order and is exact.
+   *
+   * **AND THE GENERATED HALF IS THE STORE'S OWN QUALIFIED `ConstraintListInvalid` ARM** — *"'<handle>' is already
+   * a handle this instance carries, a batch element's id is its pair's handle and it may not be one this
+   * construction adopts as a listener's"* — which **prints no `<CONTAINER>` slot**: the list's name `constraints`
+   * is named on the package's clause side and never in the generated half, where it would read as the place the
+   * mismatch was found. **The package still mints no code**, the status is still `ConstraintListInvalid`, and the
+   * instant is still before any filesystem act. **AND THE SUBJECT MOVES FROM AN ADDRESS TO THE HANDLE, which
+   * incidentally repairs a second rendering defect**: the address spelling quotes its string segments and the
+   * facade quotes the whole subject again, so the bytes read `''ck''`; **a bare handle renders `'shared-handle'`
+   * and the doubling has no subject at this arm.**
+   *
    * **AND THE NAME'S OTHER TWO READERS NEED NOTHING** (`D-24` items 2–3, both recorded so no pass adds a
    * member): `constraints()` already returns the bare `id`, so its four exclusions stand exactly as written;
    * and `LogEntry` already carries `id`, so **the name's logging role moves no member-set** and no undeclared
@@ -974,10 +995,21 @@ export interface StoreInstance {
    * TRUE AND UNAFFECTED and is now read **SCOPED BY KIND**: a repeated handle of the SAME kind at this act is
    * an overwrite (`D-24`), while **a pair whose `id` equals a LIVE LISTENER'S HANDLE is REJECTED** — it does
    * not overwrite the listener and it does not throw nothing. **The rejection is the surface's one thrown
-   * form `{status, message, log}` with the store's `AddressMalformed`**, its `message` naming BOTH SIDES and
-   * carrying the shared rule sentence *"a listener and a constraint do not share one"*, and it is taken
-   * **after the two positions' class tests and before the held-pair purge and before any store call**, so
-   * **no state moves**. `register`'s own direction of the same rule stands at that member (§its own clause).
+   * form `{status, message, log}` with the store's `AddressMalformed`**, its `message` naming BOTH SIDES, and
+   * it is taken **after the two positions' class tests and before the held-pair purge and before any store
+   * call**, so **no state moves**. `register`'s own direction of the same rule stands at that member (§its own
+   * clause).
+   *
+   * **⟶ AND THE RULE SENTENCE RE-DERIVES BY ONE WORD, 2026-11-01 (`D-98`; `docs/L1/cross-kind-handle-only.md`
+   * §3.4): *"a listener and a constraint do not share one"* READS *"a listener and a constraint do not share one
+   * HANDLE"*.** **THE CONDITION, THE STATUS AND THE INSTANT ARE UNMOVED** — a live listener is
+   * `off === false` **and** a function **and** `kind !== 'constraint'`, so a reserved `listen` with no
+   * `register` is NOT one and a pair may take its handle; and the member is still `AddressMalformed` after the
+   * two class tests and before the held-pair branch. **What moves is the sentence, because the OLD SPELLING READ
+   * THE ADDRESS and `D-98` declares the address LAWFUL.** The missing word is added from the project's own
+   * anchor (`bindings/js/README.md`: *"a listener and a constraint do not share one handle"*), and the
+   * refusal's `address` member is `null`: the subject is the identity, and naming one of a listener's N mirror
+   * addresses would assert a membership no clause supports.
    */
   addConstraint(pair: ConstraintPair, constraint: Constraint): ConstraintIdentity;
   /** **THE ENABLE HALF** (`§2.12` item 2 (a) and item 3's `constraintOn` row): `undefined`. **The
@@ -993,14 +1025,36 @@ export interface StoreInstance {
   constraintOff(pair: ConstraintPair, constraint: Constraint): void;
   /** Register `listener` under the opaque `handle`, and answer `undefined` (`surface.md §2.4` item 5 (b)).
    *
-   *  **⟶ AND IT REFUSES WHERE A CONSTRAINT'S `id` STANDS AT THE ADDRESS** (`D-25`'s *"vice versa"*; `D-29`):
-   *  the cross-kind rule's register-side direction, in the surface's **own** thrown form
-   *  `{status, message, log}` with the store's `AddressMalformed` — **not** the `TypeError` this member's
-   *  conflict arm carried while a reserved `constraint@` prefix existed to be exempted — taken after the
-   *  handle's domain and registry tests and **before the registry write and before the re-install `listen`**,
-   *  so **no state moves**. **The exemption for kernel-prefixed handles is DELETED, not moved**: under `D-22`
-   *  the kernel's handle is no longer a reserved spelling and under `D-25` **the kernel registers nothing**, so
-   *  nothing needs to get past the test. */
+   *  **⟶ AND IT REFUSES WHERE THE HANDLE EQUALS A CARRIED CONSTRAINT PAIR'S `id`** (`D-25`'s *"vice versa"*;
+   *  `D-29`; **⟶ RE-DERIVED 2026-11-01 BY `D-98`'s HANDLE RULE, WHICH IS THE WHOLE OF IT**: *"A constraint and a
+   *  listener can share an address, as can multiple constraints/listeners. The restriction is that a listener
+   *  and a constraint cannot have the same **handle**."*). **THE CLAUSE THAT STOOD HERE READ *"it refuses where a
+   *  constraint's `id` STANDS AT THE ADDRESS"* AND THAT CONDITION IS WITHDRAWN**: an ADDRESS is not a collision
+   *  at all — a pair and a listener MAY stand at one address — so what the member tests is the **HANDLE, and
+   *  nothing else**: a carried pair whose `id` is that string, **disabled pair included** (`D-98` (iii)'s rule is
+   *  unconditional in both directions, and the loss a skipped disabled pair would permit lands at the next
+   *  `constraintOn` with no observable at the instant of the loss).
+   *
+   *  **THE REFUSAL IS THE SURFACE'S OWN THROWN FORM** `{status, message, log}` with the store's
+   *  `AddressMalformed` — **not** the `TypeError` this member's conflict arm carried while a reserved
+   *  `constraint@` prefix existed to be exempted — taken after the handle's domain and registry tests and
+   *  **before the registry write and before the re-install `listen`**, so **no state moves**: no store act, no
+   *  mirror row, no registry entry.
+   *
+   *  **ITS MESSAGE IS TWO PARTS AND BOTH ARE NAMED HERE** (`D-98` item 4; `docs/L1/cross-kind-handle-only.md`
+   *  §3.6's `B-5` text): **the generated half is the STORE'S OWN** — the qualified `AddressMalformed` arm, *"'<id>'
+   *  is already a handle this instance carries, a listener's handle and a constraint's id are one string and one
+   *  string only"*, which **names no address, no segment and no placeholder container** — and **the clause half is
+   *  the package's**, naming the pair that keeps the handle and carrying the shared rule sentence *"a listener and
+   *  a constraint do not share one handle"*. **The refusal's `address` member is `null`**, and that is now correct
+   *  rather than incidental: the subject is a string in the handle namespace and the address is lawful.
+   *
+   *  **The exemption for kernel-prefixed handles is DELETED, not moved**: under `D-22` the kernel's handle is no
+   *  longer a reserved spelling. **⟶ AND THE SENTENCE THAT FOLLOWED IT — *"under `D-25` the kernel registers
+   *  nothing, so nothing needs to get past the test"* — IS RE-DERIVED BY `D-99`'s ANSWERED CLAUSE AND NOT ABSORBED:**
+   *  the kernel **does** register, and it reaches the store through its **own internal route** rather than through
+   *  this member, so **this test is a CALLER's test and the kernel's act never meets it** — which is why there is
+   *  still nothing to get past it. */
   register(handle: Handle, listener: Listener): void;
   /** **`removeListener(handle) -> undefined`** — the entry removed WHOLE and its store entries withdrawn; every arm that is not a real removal THROWS (`contract.md §2.7` item 2; `PAR-HL-14`, `PAR-HL-15`). */
   removeListener(handle: Handle): void;

package/index.mjs

@@ -87,9 +87,11 @@ import { withAddon, boundaryReject, adoptModuleContext } from './src/entry/artef
 import { VALUE_ARGUMENT_POSITION, accessorOrSymbolArm, arrayClass, classSpelling, extendedPath, hasLoneSurrogate, inDomainAddress, isAdmittedArray, isLawfulListenerElement, isPlainObjectValue, protoClass, shapeArmClass, targetSpelling, valueReject, valueTargetSpelling } from './src/entry/class-decision.mjs';
 import { encodeAddress, encodeFilePath, encodeJournalLength, encodeOpId, encodeTier, encodeValue, handleWire, inDomainHandle } from './src/entry/carrier.mjs';
 import { admittedConstraintBatch, constraintAddress, decodeBaseState, decodeJournalOp, decodeSegments, decodeValue, encodeConfig, spellConstraintAddress } from './src/entry/frame.mjs';
-import { addressSpelling } from './src/entry/kernel-foundations.mjs';
-import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, homeAddressKey, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
-import { commitPositionRefusal, constraintOverwrittenByListen, deliver, installRegistrationSeam, listenerStandingAt, registerOn, terminalArm } from './src/entry/delivery.mjs';
+// ⟶ `addressSpelling`'s import is DELETED 2026-11-01 with its last two readers (`B-6`'s and `B-4`'s messages,
+// which now name no address at all — `D-98` §3.4). The function keeps its home and its other readers in the
+// entry's other parts.
+import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
+import { commitPositionRefusal, constraintOverwrittenByListen, deliver, installListenRoute, installRegistrationSeam, listenerStandingAt, listenOn, registerOn, terminalArm } from './src/entry/delivery.mjs';
 import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintDelete, constraintWrite, constraintsKernel, currentRaise, defineDiscardWitness, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, witnessRaise, withdrawStanding } from './src/entry/constraints.mjs';
 const require_ = createRequire(import.meta.url);
 const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release', 'storeroom_js_binding.node');
@@ -97,22 +99,14 @@ const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release
 adoptModuleContext(import.meta.url, require_, ADDON_PATH);
 
 // ---------------------------------------------------------------------------------------------
-// **THE ONE COPY OF A CALLER-SUPPLIED ADDRESS'S SEGMENTS — `D-35`'s READ HALF, CLOSED 2026-10-26.**
-// `listen(handle, addresses)` hands the SET, and each member of it is THE CALLER'S OWN ARRAY, so the two
-// `addresses[i].slice()` sites below took `Array.prototype.slice` OFF A MUTABLE PROTOTYPE at the moment of
-// the call: a caller who deleted `slice` turned a LAWFUL `listen` into the raw host `TypeError`
-// *"addresses[i].slice is not a function"* — a raw host object out of a lawful call, which `surface.md §2.5`
-// item 5 (e) files as a FINDING — and one who forged it made the package's own home mirror record an address
-// the store never received, MEASURED as a wrong value out of a lawful `addConstraint` + `constraints()`.
-// **THE FORM IS THE CONTRACT'S OWN** (`docs/specs/storeroom-json-crossing/contract.md §2.1` item `(1c)(i)` and
-// item `(1)`(c)): a local index loop over the array's own exotic `length` and its own indices, appending by
-// `appendOwn` — the same helper every other append on this file's paths already takes. **NO ANSWER MOVES**: the
-// same segments in the same order, in a FRESH array, exactly as the `slice` produced.
-function copySegments(address) {
-  const copy = [];
-  for (let i = 0; i < address.length; i += 1) appendOwn(copy, address[i]);
-  return copy;
-}
+// **⟶ `copySegments` MOVED WITH ITS ONLY READER, 2026-11-01 (`D-99`'s ANSWERED clause; `C-17`, §9.2).**
+// `D-35`'s READ HALF — the one copy of a caller-supplied address's segments, which replaced the two
+// `addresses[i].slice()` sites a mutable prototype could answer — lived here because `listen`'s body lived
+// here. **THE BODY IS `delivery.mjs`'s `listenOn` NOW, AND THE HELPER MOVED WITH IT, BYTE-FOR-BYTE, INTO THE
+// SAME FILE**: one copy, one home, and no second implementation of one reach. **NOTHING IT DOES MOVES** — the
+// same local index loop over the caller's own exotic `length` and its own indices, appending by `appendOwn`,
+// answering a FRESH segment list — and no member of this module's namespace was ever this function.
+// ---------------------------------------------------------------------------------------------
 
 // ---------------------------------------------------------------------------------------------
 // THE SURFACE — `surface.md §2.9` item 1: the EIGHT verbs, and NOTHING else. `findAddress` is NOT exposed
@@ -232,15 +226,19 @@ export function storeCreate(cfg) {
   // else. There is no `token` property"*). **`state.home` SURVIVES AS THE MIRROR** — its column is now the
   // CALLER'S OWN HANDLE and not a token (`identity-and-domain.md §1` item 2 (ii)) — **and `state.constraints`
   // stays the read model.**
-  // **⟶ AND `establishing` IS ADDED 2026-10-24 (`D-29`) — THE `id` OF THE PAIR THE KERNEL IS RIGHT NOW
-  // REGISTERING, AND NOTHING ELSE.** `K-1` calls `store.listen(id, set)` BEFORE `carryConstraint` has written
-  // the read-model row, so at that instant the handle names no pair the instance yet carries; **this marker is
-  // how `B-6`'s cross-kind test still knows the act is a CONSTRAINT's own registration and not a listener's**
-  // (`D-25` rejects a CROSS-KIND overwrite, and a constraint registering itself is same-kind). It holds one
-  // `id` at a time because a construction and every add are sequential, is cleared in a `finally`, and is not
-  // a member of the product.
+  // **⟶ AND `establishing` IS DELETED 2026-11-01 (`D-99`'s ANSWERED clause; `C-18`, §9.3), SO THIS MEMBER'S
+  // OWN SEVEN-OCCURRENCE CENSUS CLOSES AT ZERO.** The clause that stood here declared a marker — *"the `id` of
+  // the pair the kernel is right now registering, and nothing else"* — and named its purpose as *"how `B-6`'s
+  // cross-kind test still knows the act is a CONSTRAINT's own registration and not a listener's"*. **BOTH
+  // SENTENCES ARE WITHDRAWN, AND THEY STAND AS TEXT READ THROUGH THIS ONE:** the act that needed the exemption
+  // **does not pass the test at all** any more, because the kernel's registration reaches the store through its
+  // OWN ROUTE (`LISTEN_ROUTE`, `delivery.mjs`'s `listenOn`) and the cross-kind test lives on the CALLER's
+  // members and nowhere else. **SO: NO MARKER LANDS, NO BRACKET LANDS AT ANY OF THE FOUR SITES, AND `Q-1`'S
+  // RESIDUAL (`docs/L1/cross-kind-handle-only.md` §7) DISAPPEARS WITH THE MARKER RATHER THAN BEING ACCEPTED OR
+  // TIGHTENED** — a constraint body that calls `listen('<its own pair id>', …)` during its own registration is
+  // now refused at `B-6` exactly as any caller's act is.
   const state = {
-    home: [], registry: new Map(), constraints: new Map(), leg: null, receiver: null, establishing: null,
+    home: [], registry: new Map(), constraints: new Map(), leg: null, receiver: null,
     // **⟶ AND THE RESIDUE'S DELIVERER, ADDED 2026-10-29 — A PRIVATE FACT ABOUT WHICH ACT OWNS A LEG'S
     // DELIVERY.** The terminal arm performs `surface.md §2.7` item 7's delivery for a kernel-driven WRITE
     // (`delivery.mjs`'s `terminalArm`), and it is the delete's OWN member that performs it (`D-49` declared that
@@ -775,92 +773,50 @@ export function storeCreate(cfg) {
           );
         }
       }
-      // ── `B-6` — THE CROSS-KIND REJECTION, AND ITS INSTANT IS THE ONE THAT MATTERS ─────────────────────────
-      // **⟶ THE SIXTH REFUSAL ARM, ADDED 2026-10-24 (`D-29`, verbatim: *"Listen cannot overwrite constraint,
-      // only other listeners"*).** Its instant is declared and load-bearing: **AFTER the handle's class test
-      // and the set's domain test, and BEFORE the purge — the act must not destroy what it may not
-      // overwrite.** **Its member follows the principle `docs/L1/surface-deltas.md` already declared — the
-      // member follows the ACT'S SUBJECT: `listen` is a SINGLE REGISTRATION, so it takes the handle domain's
-      // member `AddressMalformed`, exactly as `B-5` (`register`) does.** **NO STATE MOVES**: no store act, no
-      // mirror row, no registry write, and the entries the purge would have reached all still stand.
+      // ── `B-6` — THE CROSS-KIND REJECTION: THE HANDLE, AND NOTHING ELSE (`D-98`) ──────────────────────────
+      // **⟶ RE-DERIVED 2026-11-01 (`D-98`, verbatim: *"A constraint and a listener can share an address … The
+      // restriction is that a listener and a constraint cannot have the same *handle*"*).** **THE ADDRESS-SET
+      // DIMENSION IS DELETED**: its ground — `D-29`'s *"the address dimension is NECESSARY, because the purge is
+      // address-reaching"* — is FALSE at this build and `D-98` item 3 withdraws it: the purge is BY HANDLE
+      // (`src/store.rs:476`–`:494`, `:2594`) and the mirror's is too (this file's own purge, in
+      // `delivery.mjs`'s `listenOn`), so an act under a different handle cannot reach a pair's rows. **What the
+      // dimension admitted was the defect.**
+      // **THE HANDLE DIMENSION IS THE WHOLE TEST**, and it is the SAME read `B-5` takes — one helper, one rule
+      // (§1.1). **NO STATE MOVES**: no store act, no mirror row, no registry write.
       //
-      // **BOTH DIMENSIONS ARE TESTED** (`D-29`'s stated reading: *"both, because under `D-29` the handle and
-      // the `id` are one string and an identity collision names the same entry an address collision does"*):
-      // **the handle equalling a standing constraint's `id`**, and **the set naming an address a standing
-      // constraint's home entry occupies**. **AND THE ONE ACT BOTH DIMENSIONS MUST ALLOW IS THE KERNEL'S OWN
-      // RE-LISTING OF A PAIR** — `K-1` calls `store.listen(id, set)` with exactly that pair's own `id` and its
-      // own accumulated set, and `constraintOn`'s enable arm and `restoreHeldPair`'s wake re-list a pair whose
-      // registration stood a moment earlier. That act **destroys nothing**: the set covers every address the
-      // pair stands at and the handle IS the pair's own, so it is a same-kind re-assignment and not a
-      // cross-kind overwrite. The exemption is therefore the PURGE's own test — *would this act destroy an
-      // entry it may not overwrite?* — and not a reserved namespace.
-      const overwritten = constraintOverwrittenByListen(state, handle, addresses);
+      // **AND THE ONE ACT THE OLD TEST ALLOWED WENT WITH ITS INSTRUMENT** (`D-99`'s ANSWERED clause, `C-18`):
+      // the kernel's own re-listing is not exempted here — **it does not pass this test at all**, because `K-1`
+      // reaches the store through its own route (`LISTEN_ROUTE`, `delivery.mjs`'s `listenOn`) and this member is
+      // a CALLER's door. **THERE IS NO MARKER, NO BRACKET AND NO `state.establishing` LEFT TO READ**; a
+      // constraint body that calls `listen('<its own pair id>', …)` during its own registration is refused here
+      // exactly as any caller's act is.
+      //
+      // **AND THE MESSAGE'S GENERATED HALF IS THE STORE'S OWN QUALIFIED ARM, NOT THE SEGMENT TEMPLATE**
+      // (`D-98` item 4; `C-7`–`C-11`, §3.3 and §3.6): the `'handle'` arm token is supplied at
+      // `boundaryReject`'s appended FIFTH position and reaches the generator's fourth — so the sentence reads
+      // *"'<id>' is already a handle this instance carries, a listener's handle and a constraint's id are one
+      // string and one string only"* and **names no address and no placeholder container at all** (the
+      // fourth position is `undefined` ON PURPOSE: this arm passes NO container, §3.4).
+      const overwritten = constraintOverwrittenByListen(state, handle);
       if (overwritten !== null) {
         boundaryReject(
           'AddressMalformed',
-          addressSpelling(overwritten.address),
-          `the listener '${handle}' cannot be installed at ${addressSpelling(overwritten.address)}: the constraint `
-            + `'${overwritten.id}' stands there, and a listener and a constraint do not share one`,
+          overwritten.id,
+          `listen refuses: the constraint pair '${overwritten.id}' keeps that handle, and a listener and a `
+            + 'constraint do not share one handle',
+          undefined,
+          'handle',
         );
       }
-      // ── THE ONE STORE ACT: PURGE, THEN INSTALL, INSIDE THE STORE'S OWN VERB ───────────────────────────────
-      // The set crosses AS ENCODED ADDRESSES, one per member, in the caller's own order (`PAR-HL-2`'s referent:
-      // the whole set and never a delta).
-      const encoded = [];
-      for (let i = 0; i < addresses.length; i += 1) {
-        appendOwn(encoded, encodeAddress(addresses[i], 'second argument', 'second argument'));
-      }
-      carryRefusal(() => entryOf().listen.call(this, handleWire(handle), encoded), [handleWire(handle)]);
-      // ── THE PACKAGE'S OWN HOME MIRROR ────────────────────────────────────────────────────────────────────
-      // **THE MIRROR'S COLUMN IS THE CALLER'S OWN HANDLE AND NOT A TOKEN** (`identity-and-domain.md §1` item 2
-      // (ii)), and **THE PURGE REACHES IT**: every row the handle named is dropped before the set's own rows are
-      // recorded, which is the same wholesale assignment the store performed (`listen-verb.md §3` item 1's four
-      // structures). **THE `some(key)` GUARD IS GONE WITH `first_at`** (`P: docs/pending.md · R-B1`, deletion
-      // part (b)): with the idempotence deleted the mirror records one row per address in the act's own set, so
-      // N addresses answer N rows for ONE handle (`listen-verb.md §6` item 4 (iv)).
-      state.home = state.home.filter((row) => row.handle !== handle);
-      for (let i = 0; i < addresses.length; i += 1) {
-        // **⟶ AND THE MIRROR'S COPY IS `copySegments`, NOT `addresses[i].slice()`** (`D-35`'s read half,
-        // 2026-10-26 — see the function's own clause above; the caller's array is the receiver either way and
-        // the answer is the same fresh segment list).
-        appendOwn(state.home, { key: homeAddressKey(addresses[i]), address: copySegments(addresses[i]), handle });
-      }
-      // ── THE ENTRY'S FIRST STATE: RESERVED ────────────────────────────────────────────────────────────────
-      // ***"`listen` WRITES THE ENTRY WITH `off` SET — the reservation"*** (`P: docs/pending.md · P-5`, the
-      // entry-shape ruling; `contract.md §2.2` item 5 (a); `identity-and-domain.md §2` item 5). **AN ENTRY WITH
-      // NO FUNCTION IS NOT A LAWFUL VALUE, so the state `listen` creates is an entry that EXISTS AND IS OFF** —
-      // which is exactly what the ruling provides. **AND A REPEATED `listen` RE-RESERVES THE ENTRY**: it is a
-      // purge then a fresh reservation, never a fast path (`P: docs/pending.md · (R1)`, its own closing
-      // sentence; `contract.md §2.2` item 3).
-      // **⟶ AND THE SET'S COPY IS A LOCAL INDEX LOOP, NOT `Array.prototype.map` — 2026-10-24 (`contract.md §2.1`'s
-      // clause of that date on `F8-2`, items `(2a)`–`(2c)`, arm `(xix)`, cell `JC-TC-65`).** This position is the
-      // one `store.listen(id, set)` reaches from `carryConstraint`'s arming walk, so the `.map` that stood here
-      // threw `TypeError: addresses.map is not a function` OUT OF A LAWFUL `storeCreate` under a caller's
-      // `delete Array.prototype.map` — a raw host object crossing the boundary, which `§2.5` item `5 (e)` files as
-      // a FINDING. **IT IS THE SAME PRECEDENT `encodeConstraints` ALREADY FOLLOWS** (the fourth key's own walk:
-      // *"a LOCAL INDEX LOOP, NOT `Array.prototype.map`"*), and the bytes, the order and the fresh-array-per-member
-      // copy are unmoved. **THE `slice` IS THE ELEMENT'S AND NOT THE SET'S**: it copies one ADDRESS's segments, so
-      // the registry row's set is the fresh list this loop builds.
-      const standingSet = [];
-      for (let i = 0; i < addresses.length; i += 1) {
-        // **⟶ THE REGISTRY ROW'S SET TAKES THE SAME `copySegments`** (`D-35`'s read half, 2026-10-26): the
-        // element is the caller's address array, so its `slice` was a mutable prototype's member.
-        appendOwn(standingSet, copySegments(addresses[i]));
-      }
-      state.registry.set(handle, {
-        fn: undefined,
-        off: true,
-        // **THE SET THE LAST `listen` GAVE THE HANDLE** — the referent `PAR-HL-2` names (*"the set of addresses the
-        // handle stands at after this act — the whole set, never a delta"*), and the one datum `register` reads to
-        // re-install a reserved entry's store side.
-        addresses: standingSet,
-      });
-      // **⟶ AND IT ANSWERS THE HANDLE IT WATCHES UNDER — `D-22`'s `void → Handle`, 2026-10-24.** *"Listen should
-      // return the handle on success, or error message on fail."* **A SUCCESS SIGNAL THAT CARRIES THE
-      // IDENTITY, AND NOT AN ECHO TO BE SUPPRESSED**: the value the caller spelled is the identity the store
-      // holds for that entry, and it is what `K-1` ADOPTS (`const adopted = store.listen(id, set)`), which is
-      // what `kernel-surface.md` declared all along — *"adopted, never minted by the kernel"*.
-      return handle;
+      // ── THE POST-TEST BODY, EXTRACTED BY NAME — `D-99`'S ANSWERED CLAUSE, 2026-11-01 ──────────────────────
+      // **⟶ THE BYTES ABOVE ARE A CALL NOW** (`C-17`, §9.2): the address encode, the ONE store act, the home
+      // mirror's purge-and-install, the entry's registry reservation and the returned handle all moved
+      // BYTE-FOR-BYTE into `delivery.mjs`'s `listenOn`, which the kernel's own registration calls too. **THE
+      // MEMBER KEEPS WHAT IS THE MEMBER'S**: the commit bracket (`openCommit`/`closeCommit`), the two position
+      // class tests and `B-6` above — **so `listen` is a CALLER's door and the kernel's act is the kernel's own**,
+      // which is the whole of `D-99`'s route reading. **NO ANSWER MOVES**: the same handle, the same store act,
+      // the same mirror rows and the same registry entry, because it is the same function.
+      return listenOn(this, state, handle, addresses);
       } finally {
         closeCommit(instance, opened);
       }
@@ -984,13 +940,26 @@ export function storeCreate(cfg) {
       // listener is outside this instance's handle domain for a constraint.** It is also the status the
       // register-side sibling answers for the adjacent fact, **so one namespace question does not print two
       // codes.** **NO STATE MOVES.**
+      //
+      // **⟶ AND ITS MESSAGE RE-DERIVES 2026-11-01 (`D-98` item 4; `C-9`, `C-11`; §3.4, §3.6), WHILE ITS
+      // CONDITION, ITS STATUS AND ITS INSTANT ARE UNMOVED.** **`listenerStandingAt` ANSWERS `true`/`false` NOW**
+      // (its address loop existed for the message alone and the message names no address — §2's one deletion),
+      // and the refusal's subject is the HANDLE: the generated half is the store's own QUALIFIED
+      // `AddressMalformed` arm under the appended `'handle'` token, and the clause names the listener and the
+      // rule's re-spelt sentence. **NO ADDRESS APPEARS ANYWHERE IN IT** — the pair's own address belongs to the
+      // caller, and a listener's mirror address asserted which of its N rows "kept" the identity (§3.4) — so the
+      // refusal's `address` member stays `null` by construction. **The rule's sentence moves by ONE WORD, and its
+      // spelling is the anchor `bindings/js/README.md:233` already carries: *"a listener and a constraint do not
+      // share one HANDLE"*.**
       const collided = listenerStandingAt(site.state, site.id);
-      if (collided !== null) {
+      if (collided === true) {
         boundaryReject(
           'AddressMalformed',
-          addressSpelling(collided.address),
-          `the listener '${site.id}' cannot share its handle with the constraint '${site.id}' at `
-            + `${addressSpelling(collided.address)}: a listener and a constraint do not share one`,
+          site.id,
+          `addConstraint refuses: the listener '${site.id}' keeps that handle, and a listener and a `
+            + 'constraint do not share one handle',
+          undefined,
+          'handle',
         );
       }
       const held = site.state.constraints.get(constraintPairKey(site.addresses, site.id));
@@ -1565,6 +1534,24 @@ export function storeCreate(cfg) {
   STORE_RETIREMENT.register(instance, () => {
     INSTANCES.delete(instance);
   });
+  // ═════════════════════════════════════════════════════════════════════════════════════════════════════
+  // **⟶ AND `D-99`'S INTERNAL ROUTE, INSTALLED HERE AND NOT WITH THE OTHER TWO CHANNELS — 2026-11-01
+  // (`C-17` (iv), §9.2).** **THE INSTALL SITE IS `state.receiver = instance`'S NEIGHBOURHOOD AND NOT `:1693`'S,
+  // AND THE REASON IS A BYTE: THE CONSTRUCTION'S BATCH ARMING WALK BELOW REACHES `K-1` BEFORE
+  // `installRegistrationSeam` RUNS**, so a channel installed there would leave the construction's own arming walk
+  // as **the one kernel registration still passing through the caller's wrapper** — i.e. still through `B-6`,
+  // which is the test `D-99`'s ANSWERED clause says the kernel's act does not pass at all.
+  //
+  // **THE LATER SITE'S PRINTED REASON DOES NOT REACH THIS CHANNEL**: `installAttemptSeam` is installed after the
+  // batch *"so a `listen` the construction itself performs is not counted as a commit the caller opened"* — **a
+  // fact about the ATTEMPT COUNT, and this route opens no commit** (`C-17` (v)).
+  //
+  // **IT CHANGES NO ORDER OF ACTS**: the batch still arms `cfg.constraints` first and `cfg.listeners` are still
+  // applied afterwards through `listen` (`C-15`, unmoved), because installing a channel is not an act. **AND THE
+  // CHANNEL ADDS NO MEMBER** — `Symbol.for`-keyed and `enumerable: false`, so the product's declared FOURTEEN own
+  // members are unmoved (`A117` (D6)), exactly as the six channels beside it.
+  // ═════════════════════════════════════════════════════════════════════════════════════════════════════
+  installListenRoute(instance, state);
   // **⟶ `docs/specs/storeroom-js/surface.md §2.12` ITEM 1 CLAUSE (b): `storeCreate` REGISTERS EACH OF `cfg.constraints`' ELEMENTS THAT CARRIES
   // ITS OWN FUNCTION AT `K-1`, AT THE INSTANCE IT IS CONSTRUCTING** — the SAME call the ADD route makes, so
   // a batch-populated pair is a pair the entry carries on the same footing (`docs/specs/storeroom-js/surface.md §2.12` item 3's preamble clause

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -41,11 +41,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.6.2",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.6.2",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.6.2",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.6.2",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.6.2"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.7.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.7.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.7.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.7.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.7.0"
   },
   "publishConfig": {
     "access": "public"

package/src/entry/artefact.mjs

@@ -357,7 +357,23 @@ function spellDottedContainer(container) {
   return spelled;
 }
 
-export function boundaryReject(status, subject, clause, container) {
+/// **⟶ AND ONE APPENDED FIFTH PARAMETER IS THE ARM TOKEN, ADDED 2026-11-01 (`D-98` item 4; `C-7`/`C-12`;
+/// §3.2, §3.7).** `boundaryReject(status, subject, clause, container, token)` — **POSITIONS 1–4 ARE UNMOVED, so
+/// every one of the `27` existing call sites is BYTE-IDENTICAL**, and the token is supplied by the four
+/// cross-kind arms alone.
+///
+/// **WHAT IT IS, EXACTLY: A CLOSED ARM TOKEN AND NEVER TEXT.** The one token this correction requires is
+/// `'handle'`. It is **not** a message, a clause, a spelling or a member name the store will print: the store
+/// renders ITS OWN WORDS from the flag the token sets (`src/error.rs`'s two qualified branches, §3.3), and **an
+/// unknown token leaves the slot absent, so the ordinary rendering stands — which is the two-argument call's
+/// bytes.** **NO CALLER-SUPPLIED TEXT CAN ENTER A GENERATED SENTENCE** (`surface.md §2.5` item 2, `DD-52`).
+///
+/// **WHY A TOKEN AND NOT A BETTER CONTAINER** (§3.2 (e)–(f), refused there on two measured grounds): no container
+/// repairs a DOMAIN claim, `Some('')` is already occupied by genuine register-level refusals, and a sentinel
+/// spelling would be **an identity carried by a spelling** — exactly the seam `D-22` deleted by name. **The
+/// qualified arm prints NO `<CONTAINER>` slot at all**, which is why the fourth position is passed `undefined`
+/// ON PURPOSE at those four sites: it is a DECLARATION and not an omission (§3.4).
+export function boundaryReject(status, subject, clause, container, token) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') {
     // An artefact that LOADED but does not carry the generator is not the declared artefact: the state is
@@ -368,9 +384,13 @@ export function boundaryReject(status, subject, clause, container) {
   // `dotted_address`: a key bare, an index bare, joined by `.`) — the same reading the store's own
   // `malformed_segment` triggers take, where the container is the segment the mismatch was found in.
   const where = container === undefined ? undefined : spellDottedContainer(container);
-  const generated = where === undefined
-    ? addon_.errorMessage(status, subject)
-    : addon_.errorMessage(status, subject, where);
+  // **THE TOKEN REACHES THE GENERATOR'S APPENDED FOURTH POSITION, AND THE THREE-POSITION AND TWO-POSITION CALLS
+  // ARE THE BYTES THEY WERE**: a call that supplies no token takes the branch it always took, so **not one byte
+  // of the generator's output moves where no token is supplied** (`facade.rs`'s own `..Default::default()`
+  // device, reused at this site).
+  const generated = token === undefined
+    ? (where === undefined ? addon_.errorMessage(status, subject) : addon_.errorMessage(status, subject, where))
+    : addon_.errorMessage(status, subject, where, token);
   fail({ status, message: `${generated}, ${clause}` });
 }
 

package/src/entry/constraints.mjs

@@ -414,10 +414,24 @@ export function carryConstraint(state, instance, addresses, id, constraint) {
   // removal clears all N"*). **THE KERNEL'S OWN REGISTRY KEEPS ITS `(address, id)` KEY SHAPE** — one pair over
   // N addresses IS N `(address, id)` rows sharing one id (`P: docs/pending.md · P-7`'s keying ruling, item (v);
   // `AB-6`) — so N registrations stand behind the ONE element this entry carries.
-  // **⟶ `B-6`'S ONE EXEMPTION, DECLARED HERE AT ITS PRODUCER:** while this loop runs, `listen` is being
-  // called by the KERNEL for the pair whose `id` is `id`, so the act is a CONSTRAINT's own registration and
-  // the cross-kind test has no subject. It is cleared on every arm, so a caller's later `listen` at a
-  // constraint's address is tested with no marker standing.
+  // **⟶ AND THE `B-6` EXEMPTION THIS COMMENT DECLARED IS DELETED, NOT MOVED — 2026-11-01 (`D-99`'s ANSWERED
+  // clause; `C-18`, §9.3).** The clause that stood here read *"`B-6`'s ONE EXEMPTION, DECLARED HERE AT ITS
+  // PRODUCER: while this loop runs, `listen` is being called by the KERNEL for the pair whose `id` is `id`, so
+  // the act is a CONSTRAINT's own registration and the cross-kind test has no subject. It is cleared on every
+  // arm, so a caller's later `listen` at a constraint's address is tested with no marker standing."* **THE
+  // EXEMPTION HAS NO SUBJECT, NO PURPOSE AND NO INSTRUMENT LEFT, AND THAT IS NOT A REVERSAL OF THE RULE ABOVE IT
+  // — IT IS THE `D-99` ROUTE READING ARRIVING AT ITS OWN SITE.** The kernel's registration **does not pass the
+  // cross-kind test at all** any more: `K-1` reaches the store through its own route (`LISTEN_ROUTE`,
+  // `delivery.mjs`'s `listenOn`), so the test lives on the CALLER's members `listen` and `register` and on
+  // nothing else — **there is nothing here to exempt, and no marker to set, clear or clear "on every arm"**. The
+  // sentence *"it is cleared on every arm"* is withdrawn with the `finally` it described, and `Q-1`'s residual (a
+  // constraint body borrowing the bracket) disappears with the marker it borrowed. **THE KERNEL'S FOUR
+  // RE-LISTINGS ARE LAWFUL BECAUSE THEY ARE NOT TESTED, NOT BECAUSE AN INSTRUMENT ADMITTED THEM** — which is what
+  // `XK-6` measures: the construction's arming walk, a held-pair extension, a disable→enable cycle and
+  // `restoreHeldPair`'s wake, each at N = 1 and N = 3, and a caller's `listen('<pair id>', …)` refused at both.
+  // **AND THE LATENT DEFECT THE MARKER WAS ORDERED TO CLOSE IS CLOSED BY THE ROUTE AND NOT BY A BRACKET**:
+  // `restoreHeldPair`'s wake runs with the pair's own polarity, and no number of addresses and no polarity can
+  // produce that refusal any more because the wake's registration passes no test.
   // **⟶ AND THE PAIR'S N REGISTRATIONS ARE A LOCAL INDEX LOOP, NOT `for … of` — 2026-10-24**
   // (`contract.md §2.1`'s clause of that date on `F8-2`, items `(2a)`–`(2c)`, arm `(xix)`, cell `JC-TC-65`;
   // `F8-8`'s items `(2a)`/`(2e)`, which count a GOVERNED site's take of `Array.prototype[Symbol.iterator]` as
@@ -427,19 +441,14 @@ export function carryConstraint(state, instance, addresses, id, constraint) {
   // performs.** **IT IS THE SAME PRECEDENT `encodeConstraints` ALREADY FOLLOWS** (the fourth key's own walk:
   // *"a LOCAL INDEX LOOP, NOT `Array.prototype.map`"*, arm `(xix)`), and it is the same shape `storeCreate`'s own
   // batch-arming walk takes. **ONE MEMBER PER ITERATION, IN THE SET'S OWN ORDER, AND NOTHING ELSE MOVES**: the
-  // three-state act, the one refusal crossing per arm, and the `B-6` marker's bracket are unchanged.
-  const outerEstablishing = state.establishing;
-  state.establishing = id;
-  try {
-    for (let position = 0; position < addresses.length; position += 1) {
-      try {
-        constraintsKernel().register(instance, addresses[position], id, constraint);
-      } catch (refusal) {
-        registrationCrossing(refusal, addresses[position]);
-      }
+  // three-state act, the one refusal crossing per arm, and the `B-6` marker's bracket is DELETED; the act is the
+  // kernel's own route.
+  for (let position = 0; position < addresses.length; position += 1) {
+    try {
+      constraintsKernel().register(instance, addresses[position], id, constraint);
+    } catch (refusal) {
+      registrationCrossing(refusal, addresses[position]);
     }
-  } finally {
-    state.establishing = outerEstablishing;
   }
   // **THE STORE'S PAIR RECORD CARRIES THE IDENTITY, AND `addConstraint` AT A HELD PAIR ANSWERS THE STORE'S
   // IDENTITY FOR THAT PAIR** (`P: docs/pending.md · (AA-2)`, its own obligation; `contract.md §2.6` item 2;

package/src/entry/delivery.mjs

@@ -285,6 +285,159 @@ export function installRegistrationSeam(instance, state) {
   });
 }
 
+// ═════════════════════════════════════════════════════════════════════════════════════════════════════════
+// **⟶ ADDED 2026-11-01 — THE INTERNAL ROUTE: THE MEMBER'S POST-TEST BODY, ITS ONE SYMBOL-KEYED CHANNEL, AND
+// THE `D-99` ANSWERED CLAUSE'S *"THE KERNEL'S ACT IS ITS OWN"* SPELLED AT THE BYTES (`C-17`, §9.2).**
+// ═════════════════════════════════════════════════════════════════════════════════════════════════════════
+//
+// **`D-99`'S ANSWERED CLAUSE, VERBATIM: *"Route reading — the kernel's act is its own (Recommended)"*.** So
+// **the kernel's own store-side registration DOES NOT PASS THROUGH THE CALLER-FACING TEST AT ALL**: the
+// cross-kind test (`B-6`) lives on the CALLER's member `listen` and on the caller's member `register` (`B-5`),
+// and what the kernel reaches is the member's POST-TEST body, extracted here by name and called by both sides.
+// **THE STORE'S ONE VERB IS UNMOVED AND IS REACHED ONCE, BY BOTH CALLERS** (`entryOf().listen`, the same entry
+// call at the same two positions with the same encoded set and the same `carryRefusal` wrapper), so **the store
+// gains no verb, no arm, no kind and no test** (`D-99` item 1, honoured by construction rather than by
+// restraint), and **what the route SKIPS is the CALLER's tests over the CALLER's arguments** — the handle's
+// class test and the set's member/domain walk, which `K-1` has already taken at its own channel (i)
+// (`inDomainAddress`, `inDomainId`, `typeof constraint === 'function'`). **The tree already contains this exact
+// shape and declares it lawful at a neighbouring site** (`registerOn`'s re-install reaches `entryOf().listen.call`
+// directly, and its own clause states *"no second route installs a store entry"*); **the internal route is that
+// sentence generalised from one act to the kernel's.**
+
+const LISTEN_ROUTE = Symbol.for('provident-storeroom.listen-route');
+
+/// **THE ONE COPY OF A CALLER-SUPPLIED ADDRESS'S SEGMENTS — `D-35`'s READ HALF, MOVED HERE 2026-11-01 WITH THE
+/// BODY THAT IS ITS ONLY READER.** `listen(handle, addresses)` hands the SET, and each member of it is THE
+/// CALLER'S OWN ARRAY, so the two `addresses[i].slice()` sites the extracted body carries took
+/// `Array.prototype.slice` OFF A MUTABLE PROTOTYPE at the moment of the call: a caller who deleted `slice`
+/// turned a LAWFUL `listen` into the raw host `TypeError` *"addresses[i].slice is not a function"* — a raw host
+/// object out of a lawful call, which `surface.md §2.5` item 5 (e) files as a FINDING — and one who forged it
+/// made the package's own home mirror record an address the store never received, MEASURED as a wrong value out
+/// of a lawful `addConstraint` + `constraints()`. **THE FORM IS THE CONTRACT'S OWN**
+/// (`docs/specs/storeroom-json-crossing/contract.md §2.1` item `(1c)(i)` and item `(1)`(c)): a local index loop
+/// over the array's own exotic `length` and its own indices, appending by `appendOwn` — the same helper every
+/// other append on these paths already takes. **NO ANSWER MOVES**: the same segments in the same order, in a
+/// FRESH array, exactly as the `slice` produced.
+function copySegments(address) {
+  const copy = [];
+  for (let i = 0; i < address.length; i += 1) appendOwn(copy, address[i]);
+  return copy;
+}
+
+/// **THE MEMBER'S POST-TEST BODY, EXTRACTED BY NAME — `index.mjs:806`–`:863`'s bytes, moved here with no logic
+/// changed** (`C-17` (i)). **THE CALLER'S `listen` AND THE KERNEL'S REGISTRATION BOTH CALL THIS FUNCTION, AND
+/// THE TWO DIFFER BY EXACTLY THE TESTS THE CALLER OWES.**
+///
+/// **EACH OF ITS FIVE STEPS IS A FACT ANOTHER MEMBER READS, WHICH IS WHY "BESIDES THE STORE CALL" IS NOT
+/// DECORATION** (§9.2 (iii)):
+///   1. **THE ADDRESS ENCODE**, in the caller's own order — one encoded address per set member, the whole set
+///      and never a delta (`PAR-HL-2`).
+///   2. **THE ONE STORE ACT**, through the SAME `carryRefusal` wrapper, so the store's own refusal crosses
+///      unconverted exactly as it does today.
+///   3. **THE PACKAGE'S HOME MIRROR** — the purge by handle and the N-row install. `unlisten` reads these rows
+///      to find the row it withdraws, `removeListener` likewise.
+///   4. **THE ENTRY'S REGISTRY RESERVATION** — `{fn: undefined, off: true, addresses}`, each address copied by
+///      `copySegments`. **IT IS LOAD-BEARING THREE TIMES**: `installRegistrationSeam` leaves an entry the handle
+///      names nothing for UNTOUCHED, so a route that skipped the reservation would STRAND every pair's body;
+///      `register`'s entry-membership test is what makes `register('<pair id>', fn)` reach `B-5`'s cross-kind arm
+///      rather than the *"this instance holds no listener entry"* arm; and `unlisten('<pair id>')` would answer
+///      the no-op success instead of withdrawing.
+///   5. **THE ANSWER** — `return handle`, which `D-22` makes `listen` answer and which `K-1` ADOPTS, so the
+///      adoption point (`store.listen(addr) === K-1` by reference equality) is byte-unmoved.
+///
+/// **THE RECEIVER IS PASSED AND IS NEVER INVENTED**: for a member call `receiver === this`; for the kernel's
+/// route `receiver === instance === state.receiver`, the one object `isStoreReceiver` compares against — so the
+/// store act reaches the store the caller names and no second store is addressed. **A DETACHED `listen` IS
+/// UNMOVED**: it passes its own `undefined` receiver through exactly as today, because this extraction adds
+/// **no class test** (`listen` is not one of the members that takes the receiver arm).
+///
+/// **AND THE ROUTE TAKES NO COMMIT** (`C-17` (v), DECIDED): the member's `openCommit`/`closeCommit` bracket
+/// stays with the MEMBER, and every path the kernel's route runs is inside a surface act whose window is
+/// already open — `addConstraint`, `constraintOn` and the construction's own `storeCreate` — where a nested
+/// `openCommit` today JOINS and takes no observable action. **The kernel's act is not a surface act and the
+/// window belongs to the caller's act.**
+export function listenOn(receiver, state, handle, addresses) {
+  // ── THE ONE STORE ACT: PURGE, THEN INSTALL, INSIDE THE STORE'S OWN VERB ───────────────────────────────
+  // The set crosses AS ENCODED ADDRESSES, one per member, in the caller's own order (`PAR-HL-2`'s referent:
+  // the whole set and never a delta).
+  const encoded = [];
+  for (let i = 0; i < addresses.length; i += 1) {
+    appendOwn(encoded, encodeAddress(addresses[i], 'second argument', 'second argument'));
+  }
+  carryRefusal(() => entryOf().listen.call(receiver, handleWire(handle), encoded), [handleWire(handle)]);
+  // ── THE PACKAGE'S OWN HOME MIRROR ────────────────────────────────────────────────────────────────────
+  // **THE MIRROR'S COLUMN IS THE CALLER'S OWN HANDLE AND NOT A TOKEN** (`identity-and-domain.md §1` item 2
+  // (ii)), and **THE PURGE REACHES IT**: every row the handle named is dropped before the set's own rows are
+  // recorded, which is the same wholesale assignment the store performed (`listen-verb.md §3` item 1's four
+  // structures). **THE `some(key)` GUARD IS GONE WITH `first_at`** (`P: docs/pending.md · R-B1`, deletion
+  // part (b)): with the idempotence deleted the mirror records one row per address in the act's own set, so
+  // N addresses answer N rows for ONE handle (`listen-verb.md §6` item 4 (iv)).
+  state.home = state.home.filter((row) => row.handle !== handle);
+  for (let i = 0; i < addresses.length; i += 1) {
+    // **⟶ AND THE MIRROR'S COPY IS `copySegments`, NOT `addresses[i].slice()`** (`D-35`'s read half,
+    // 2026-10-26 — see the function's own clause above; the caller's array is the receiver either way and
+    // the answer is the same fresh segment list).
+    appendOwn(state.home, { key: homeAddressKey(addresses[i]), address: copySegments(addresses[i]), handle });
+  }
+  // ── THE ENTRY'S FIRST STATE: RESERVED ────────────────────────────────────────────────────────────────
+  // ***"`listen` WRITES THE ENTRY WITH `off` SET — the reservation"*** (`P: docs/pending.md · P-5`, the
+  // entry-shape ruling; `contract.md §2.2` item 5 (a); `identity-and-domain.md §2` item 5). **AN ENTRY WITH
+  // NO FUNCTION IS NOT A LAWFUL VALUE, so the state `listen` creates is an entry that EXISTS AND IS OFF** —
+  // which is exactly what the ruling provides. **AND A REPEATED `listen` RE-RESERVES THE ENTRY**: it is a
+  // purge then a fresh reservation, never a fast path (`P: docs/pending.md · (R1)`, its own closing
+  // sentence; `contract.md §2.2` item 3).
+  // **⟶ AND THE SET'S COPY IS A LOCAL INDEX LOOP, NOT `Array.prototype.map` — 2026-10-24 (`contract.md §2.1`'s
+  // clause of that date on `F8-2`, items `(2a)`–`(2c)`, arm `(xix)`, cell `JC-TC-65`).** This position is the
+  // one the kernel's registration reaches, so the `.map` that stood here
+  // threw `TypeError: addresses.map is not a function` OUT OF A LAWFUL `storeCreate` under a caller's
+  // `delete Array.prototype.map` — a raw host object crossing the boundary, which `§2.5` item `5 (e)` files as
+  // a FINDING. **IT IS THE SAME PRECEDENT `encodeConstraints` ALREADY FOLLOWS** (the fourth key's own walk:
+  // *"a LOCAL INDEX LOOP, NOT `Array.prototype.map`"*), and the bytes, the order and the fresh-array-per-member
+  // copy are unmoved. **THE `slice` IS THE ELEMENT'S AND NOT THE SET'S**: it copies one ADDRESS's segments, so
+  // the registry row's set is the fresh list this loop builds.
+  const standingSet = [];
+  for (let i = 0; i < addresses.length; i += 1) {
+    // **⟶ THE REGISTRY ROW'S SET TAKES THE SAME `copySegments`** (`D-35`'s read half, 2026-10-26): the
+    // element is the caller's address array, so its `slice` was a mutable prototype's member.
+    appendOwn(standingSet, copySegments(addresses[i]));
+  }
+  state.registry.set(handle, {
+    fn: undefined,
+    off: true,
+    // **THE SET THE LAST `listen` GAVE THE HANDLE** — the referent `PAR-HL-2` names (*"the set of addresses the
+    // handle stands at after this act — the whole set, never a delta"*), and the one datum `register` reads to
+    // re-install a reserved entry's store side.
+    addresses: standingSet,
+  });
+  // **⟶ AND IT ANSWERS THE HANDLE IT WATCHES UNDER — `D-22`'s `void → Handle`, 2026-10-24.** *"Listen should
+  // return the handle on success, or error message on fail."* **A SUCCESS SIGNAL THAT CARRIES THE
+  // IDENTITY, AND NOT AN ECHO TO BE SUPPRESSED**: the value the caller spelled is the identity the store
+  // holds for that entry, and it is what `K-1` ADOPTS (`store[LISTEN_ROUTE](id, set)`), which is
+  // what `kernel-surface.md` declared all along — *"adopted, never minted by the kernel"*.
+  return handle;
+}
+
+/// **THE INSTALL, CALLED ONCE BY `storeCreate`** — the channel `K-1` reaches instead of the caller's member.
+/// **IT TAKES THE `Symbol.for` KEY AND THE INSTANCE'S OWN STATE, AND IT MINTS NOTHING**: no member of the
+/// product (`Object.defineProperty` at `enumerable: false` is invisible to `Object.keys` and to
+/// `Object.getOwnPropertyNames` — `A117` (D6)), no kernel item, no record member.
+///
+/// **WHERE IT IS INSTALLED IS DECLARED AND IT IS NOT WHERE THE OTHER CHANNEL IS** (`C-17` (iv)): at
+/// `index.mjs`'s `state.receiver = instance` neighbourhood, **BEFORE the construction's batch arming walk**, so
+/// a pair armed by `cfg.constraints` is not the one kernel registration still passing through the caller's
+/// wrapper. **An instance that carries no such channel answers nothing and is told nothing** (the family's own
+/// absent arm, printed at `kernel-registration.mjs` for the body channel): **`storeCreate` installs it on every
+/// instance it returns and installs it before the batch walk, so no drive in this tree reaches that arm.**
+export function installListenRoute(instance, state) {
+  if (typeof instance[LISTEN_ROUTE] === 'function') return;
+  Object.defineProperty(instance, LISTEN_ROUTE, {
+    value: (handle, addresses) => listenOn(instance, state, handle, addresses),
+    writable: true,
+    enumerable: false,
+    configurable: true,
+  });
+}
+
 /// **THE REGISTRY'S OWN SITE AT THE PACKAGE'S BOUNDARY** (`surface.md §2.4` item 5): the caller's FUNCTION
 /// for a handle, held by the package (`DD-15`) and invoked after the verb has returned (`docs/specs/storeroom-js/surface.md §2.7` item 2).
 /// **`register` REPLACES, never fans out** (rule 2); a non-function `listener`, a `handle` THIS INSTANCE
@@ -366,13 +519,34 @@ export function registerOn(state, handle, listener) {
   // `D-22` the kernel's handle is no longer a reserved spelling — it is the caller's own `id` — and under
   // `D-25` the kernel REGISTERS NOTHING (*"so nothing needs to get past the test"*), so the exemption and its
   // `KERNEL_HANDLE_PREFIX` constant have no subject and `Q2`'s hazard dissolves with its cause.**
-  const conflicted = constraintAtAnyAddress(state, handle);
+  //
+  // **⟶ AND TWO SENTENCES OF THIS BLOCK ARE RE-DERIVED 2026-11-01 (`D-98`; `D-99`'s ANSWERED clause), in the
+  // project's annotate-beside spelling — they stand above and are read THROUGH this clause.** ***"the message
+  // unchanged in content"* IS WITHDRAWN:** the generated half is now the store's own QUALIFIED
+  // `AddressMalformed` arm, selected by the closed `'handle'` token (§3.3, §3.6), and the clause half names the
+  // pair's `id` and the rule's re-spelt sentence — *"a listener and a constraint do not share one handle"*
+  // (§3.4) — with **no address anywhere in it**. ***"under `D-25` the kernel REGISTERS NOTHING"* IS WITHDRAWN
+  // TOO:** the kernel does register, and it registers through its OWN ROUTE (`LISTEN_ROUTE`, §9.2), which never
+  // reaches this test — so the paragraph's point (the prefix was a seam and it is DELETED rather than moved)
+  // stands, and what replaced the exemption is a route and not a narrower exemption.
+  //
+  // **⟶ RE-DERIVED 2026-11-01 (`D-98`, verbatim: *"A constraint and a listener can share an address, as can
+  // multiple constraints/listeners. The restriction is that a listener and a constraint cannot have the same
+  // *handle*."*).** **THE ADDRESS ARM IS DELETED, AND `constraintAtAnyAddress` IS DELETED WITH IT** (§1.1): its
+  // subject was the ADDRESS-SET MEMBERSHIP, which `D-98` (i) declares LAWFUL, and its only caller was this one
+  // line. **WHAT STANDS IS THE HANDLE**, read by the SAME helper `B-6` reads so the two arms cannot disagree
+  // again (`C-1`, `C-16`): a carried pair whose `id` equals the handle, and nothing else. **NO EXEMPTION IS
+  // REACHABLE HERE** (`C-2` is deleted with `D-99`'s ANSWERED clause): `B-5` is a caller's act, and the kernel's
+  // own re-listing does not pass this test at all because it does not come through this member (§9.2).
+  const conflicted = constraintOverwrittenByListen(state, handle);
   if (conflicted !== null) {
     boundaryReject(
       'AddressMalformed',
-      addressSpelling(conflicted.address),
-      `the listener '${handle}' cannot be registered at ${addressSpelling(conflicted.address)}: the constraint `
-        + `'${conflicted.id}' stands at that address, and a listener and a constraint do not share one`,
+      conflicted.id,
+      `register refuses: the constraint pair '${conflicted.id}' keeps that handle, and a listener and a `
+        + 'constraint do not share one handle',
+      undefined,
+      'handle',
     );
   }
   // **⟶ AND A RESERVED ENTRY IS RE-ARMED BY RE-INSTALLING ITS STORE SIDE** — *"the entry EXISTS with `off`
@@ -437,58 +611,14 @@ export function registerOn(state, handle, listener) {
   return undefined;
 }
 
-/// **THE CONSTRAINT A HANDLE'S OWN ADDRESSES STAND AT, WHERE THE ENTRY CARRIES ONE** — the conflict test's one
-/// read (`constraint-sites.md §5` items 1–2).
+/// **`B-4`'S ONE READ — WHETHER A **LIVE LISTENER** STANDS UNDER `handle`.**
 ///
-/// **IT READS THE PACKAGE'S OWN CACHES AND NOT THE STORE** (`P: docs/pending.md · (Y-2)`, verbatim: *"SO
-/// `O-4`'S CHECK — AND C-2'S CONFLICT TEST — READ THE CACHES, NOT THE STORE, AND NEITHER NEEDS A STORE ACT TO
-/// ANSWER"*): the mirror's listener rows and `state.constraints`' pairs, both readable before any store act.
-///
-/// **AND THE TEST IS THE ADDRESS-SET MEMBERSHIP, NOT AN EQUALITY**: a pair standing over N addresses occupies
-/// N rows and ONE identity, so the gate answers TRUE where ANY of the pair's addresses matches
-/// (`contract.md §2.6` item 4; `P: docs/pending.md · P-7`'s keying ruling, item (iv)).
-function constraintAtAnyAddress(state, handle) {
-  if (state.constraints.size === 0) return null;
-  const standing = state.home.filter((row) => row.handle === handle);
-  if (standing.length === 0) return null;
-  for (const entry of state.constraints.values()) {
-    for (const key of standing) {
-      for (const address of entry.addresses) {
-        if (homeAddressKey(address) === key.key) return { address, id: entry.id };
-      }
-    }
-  }
-  return null;
-}
-
-/// **`B-6`'S ONE READ — WHAT INSTALLING `handle` AT `addresses` WOULD DESTROY THAT IT MAY NOT OVERWRITE**
-/// (`D-29`, verbatim: *"Listen cannot overwrite constraint, only other listeners"*).
-///
-/// **THE SUBJECT IS `listen`'S PURGE, STATED AS THE DECLARED INSTANT STATES IT: *"the act must not destroy
-/// what it may not overwrite"*.** So the test is taken over the constraint pairs **whose home entry STANDS** —
-/// `entry.enabled === true`, the very predicate `withdrawStanding` already reads (*"`enabled === true` ⟺ the
-/// pair stands a registration"*), because **a pair the disable left standing none has no entry for the purge
-/// to reach and no entry for a refusal to protect.**
-///
-/// **THE TWO DIMENSIONS, BOTH TESTED** (`D-29`'s stated reading: *"both, because under `D-29` the handle and
-/// the `id` are one string"*):
-///   1. **IDENTITY** — the handle equals the pair's `id`, so the same string names a listener entry and a
-///      constraint pair. Under `D-29` that is one namespace and a cross-kind overwrite.
-///   2. **ADDRESS** — the set names an address the pair's home entry occupies, so the caller's act reaches
-///      the address the constraint is registered at.
-///
-/// **AND ONE ACT IS LAWFUL UNDER BOTH: THE KERNEL'S OWN RE-LISTING OF A PAIR.** `K-1` calls
-/// `store.listen(id, set)` with **the pair's own `id` and the pair's own accumulated set**; `constraintOn`'s
-/// enable arm re-registers a pair whose registration the disable purged; `restoreHeldPair`'s wake re-registers
-/// a pair after a refused re-registration. **Each is a SAME-KIND re-assignment that destroys nothing** — the
-/// set covers every address the pair stands at and the handle IS the pair's own word for it — so the test
-/// exempts exactly `handle === entry.id` **and** a set that covers **all** of `entry.addresses`. **That is not
-/// a reserved namespace and not a second rule: it is the purge's own test read literally** (`D-22` discarded
-/// the prefix, and `D-29` discards the namespace with it, so what distinguishes the kernel's act is the ACT
-/// and not a spelling).
-///
-/// **NO STORE ACT IS TAKEN HERE**: both dimensions read `state.constraints`, the package's own read model.
-/// **`B-4`'S ONE READ — THE ADDRESS AT WHICH A **LIVE LISTENER** STANDS UNDER `handle`, OR `null`.**
+/// **⟶ RE-DERIVED 2026-11-01 (`D-98` §3.4): THE FUNCTION ANSWERS `true`/`false` AND THE ADDRESS LOOP IS
+/// DELETED.** That loop existed for **the MESSAGE alone** — its own clause below said so — and it answered the
+/// LISTENER's mirror address (`state.home[i].address`, one of that handle's N rows) and never the pair's.
+/// **`B-4`'s corrected clause names NO address at all** (§3.4: the refusal's subject is the identity, and
+/// `D-98` makes the address lawful), so the loop has no reader and goes with it; the refusal's `address` member
+/// stays `null` at `boundaryReject`'s own call (`refusal.mjs`), which is now correct rather than incidental.
 ///
 /// **"LIVE LISTENER" IS THE EXACT PREDICATE AND IT IS NOT A SHORTHAND.** The package's own registry holds an
 /// entry for EVERY handle the store knows, **including a constraint pair's** — under `D-22`/`D-29` the kernel's
@@ -497,62 +627,73 @@ function constraintAtAnyAddress(state, handle) {
 /// `register` sets and what nothing else sets, **and it is what keeps a constraint pair's own reservation from
 /// reading as a listener at its own `id`** (`D-24`'s same-kind overwrite must stay lawful at a held pair).
 ///
-/// **THE ADDRESS ANSWERED IS THE MIRROR'S** (`state.home`, the package's own copy of the store's entries), and
-/// it is read for the MESSAGE alone — the refusal's subject is the identity, not the address.
+/// **THE ANSWER IS A BOOLEAN AND NOT AN ADDRESS** (re-derived above, 2026-11-01): `true` where a live
+/// listener's registration stands under the handle, `false` everywhere else. **NO MIRROR ROW IS READ AT ALL**,
+/// so `B-4`'s refusal carries `address: null` by construction and not by an omission.
 export function listenerStandingAt(state, handle) {
   const entry = state.registry.get(handle);
-  if (entry === undefined || entry.off !== false || typeof entry.fn !== 'function') return null;
+  if (entry === undefined || entry.off !== false || typeof entry.fn !== 'function') return false;
   // **⟶ AND A CONSTRAINT'S OWN ENTRY IS NOT A LISTENER'S — `D-69`, 2026-10-29.** The clause above reads
   // *"a LISTENER stands exactly where `off === false` AND `fn` is a function"* and that pair of facts now also
   // holds of a pair's registration, because `K-1` installs the pair's own constraint function in that slot. **THE
   // KIND IS THE THIRD FACT AND IT IS WHAT KEEPS `D-25`'s CROSS-KIND REFUSAL POINTED AT A LISTENER**: a pair's `id`
   // is its own handle, and a re-add at a held pair must stay LAWFUL (`D-24`) while a listener claiming a pair's
   // `id`, or a pair claiming a listener's, must still be refused.
-  if (entry.kind === 'constraint') return null;
-  for (let i = 0; i < state.home.length; i += 1) {
-    if (state.home[i].handle === handle) return { address: state.home[i].address };
-  }
-  return null;
+  if (entry.kind === 'constraint') return false;
+  return true;
 }
 
-export function constraintOverwrittenByListen(state, handle, addresses) {
+/// **`B-6`'S AND `B-5`'S ONE READ — THE CARRIED CONSTRAINT PAIR WHOSE `id` IS `handle`, OR `null`.**
+///
+/// **⟶ RE-DERIVED 2026-11-01 (`D-98`, `D-99` and its ANSWERED clause; `C-1`/`C-16`): ONE HELPER, ONE RULE, AND
+/// THE RULE IS THE HANDLE.** **`constraintAtAnyAddress` IS DELETED, NOT RE-POINTED** (§1.1's precedent: *"a
+/// helper whose one caller is deleted has no subject"*): its subject was ADDRESS-SET MEMBERSHIP, which `D-98`
+/// (i) declares **LAWFUL** — a pair and a listener MAY stand at one address, as may multiple pairs and multiple
+/// listeners — and its ground, `D-29`'s *"the address dimension is NECESSARY, because the purge is
+/// address-reaching"*, is **FALSE at this build**: the purge is BY HANDLE and unconditional
+/// (`src/store.rs:476`–`:494`, `:2594`) and this package's mirror purge is by handle too (`index.mjs:821`), so
+/// an act under a different handle cannot reach a pair's rows (`D-98` item 3). **What the dimension admitted
+/// was the defect.**
+///
+/// **THE ONE PREDICATE THIS FUNCTION NOW TAKES IS `handle === entry.id`**, over the instance's carried pairs, in
+/// ONE pass — and **it answers the pair row itself** (`{ addresses, addressKey, id, fn, enabled, identity,
+/// registrationSeq }`, the record `carryConstraint` writes, `constraints.mjs`), or `null`. The `id` is read for
+/// the message and nothing else is read at all.
+///
+/// **WHAT IT LOSES, ONE BY ONE, SO ITS NEW SHAPE IS NOT AN ACCIDENT OF EDITING** (§9.1): the third parameter
+/// (`addresses`) and with it every use of the act's set; the `covers` computation; the `covers && handle ===
+/// entry.id` continue; **the `entry.enabled !== true` skip** — `C-3`/`C-19` decide that **a DISABLED pair's
+/// handle blocks a listener's claim exactly as an enabled one's**, because the loss the skip permitted is
+/// FORWARD and not instant: the next `constraintOn` re-lists the pair at the same handle, `K-1`'s store act
+/// purges by handle, and `installRegistrationSeam` overwrites the entry — the listener stops being delivered
+/// with no observable at the instant of the loss (`D-25`, `D-98` (iii), `D-29`'s *"the act must not destroy
+/// what it may not overwrite"*); and **the dimension-2 arm with its guard**, `state.establishing`'s read
+/// included — **there is no marker any more** (`D-99`'s ANSWERED clause deletes it, and its readers with it).
+///
+/// **THE SOURCE IS `state.constraints` AND NOT THE KERNEL'S ROWS, WHICH IS `D-99` ITEM (b) TAKEN (§9.1): the
+/// map is the one the kernel's own rows are keyed with, one row per pair, written by exactly the four places a
+/// pair's standing is written and enumerated by `constraints()`, so *"this handle is a pair's"* and *"this
+/// instance carries that pair"* are ONE fact here. `kernel.pairs`/`kernel.handles` are unreachable from the
+/// entry (no export answers *"is this handle a pair's"*), and they are EMPTIED when a pair is disabled (`K-6`'s
+/// `FORGET_PAIR`) while the pair stays carried — the one state where the two sources disagree, decided at
+/// `C-19` in favour of the carried pair.**
+///
+/// **AND NO EXEMPTION IS REACHABLE FROM EITHER OF ITS TWO CALLERS** (`C-2` is deleted with `D-99`'s ANSWERED
+/// clause): `B-6` (`listen`) and `B-5` (`register`) are CALLERS' acts, and the kernel's own re-listing does not
+/// pass this test at all — its store-side act is its own route (`LISTEN_ROUTE`, `§9.2`), and the test lives on
+/// the caller's members and nowhere else. **THE ONE ACT THE OLD TEST ALLOWED — THE KERNEL'S RE-LISTING, TOLD BY
+/// ITS MARKER — HAS NO SUBJECT LEFT: there is no marker, nothing is bracketed, and a constraint body that calls
+/// `listen('<its own pair id>', …)` during its own registration is REFUSED here like any caller's act.**
+///
+/// **NO STORE ACT IS TAKEN HERE**: the read is `state.constraints`, the package's own model of the pairs it
+/// carries.
+
+export function constraintOverwrittenByListen(state, handle) {
   if (state.constraints.size === 0) return null;
-  const actKeys = [];
-  for (let i = 0; i < addresses.length; i += 1) appendOwn(actKeys, homeAddressKey(addresses[i]));
+  // ONE PASS, ONE COMPARISON, AND THE PAIR ROW ITSELF IS THE ANSWER — see this helper's own clause above for
+  // every computation `D-98`, `C-1`, `C-3`/`C-19` and `C-16` took out of this loop and why.
   for (const entry of state.constraints.values()) {
-    if (entry.enabled !== true) continue;
-    // IS THIS THE PAIR'S OWN RE-LISTING? the handle is its word and the set covers every address it stands at.
-    let covers = entry.addresses.length > 0;
-    for (let i = 0; i < entry.addresses.length; i += 1) {
-      const heldKey = homeAddressKey(entry.addresses[i]);
-      let found = false;
-      for (let k = 0; k < actKeys.length; k += 1) {
-        if (actKeys[k] === heldKey) {
-          found = true;
-          break;
-        }
-      }
-      if (!found) {
-        covers = false;
-        break;
-      }
-    }
-    if (covers === true && handle === entry.id) continue;
-    // DIMENSION 1 — THE HANDLE EQUALS THE PAIR'S `id`.
-    if (handle === entry.id) return { address: entry.addresses[0], id: entry.id };
-    // DIMENSION 2 — THE SET NAMES AN ADDRESS THE PAIR'S HOME ENTRY OCCUPIES.
-    // **AND THIS DIMENSION'S SUBJECT IS A *LISTENER'S* ACT, WHICH IS WHY IT IS READ LAST AND BEHIND THE
-    // CROSS-KIND QUALIFIER.** A handle that names a constraint pair this instance carries — or the one the
-    // kernel is establishing this instant — is a CONSTRAINT's word, so the act is same-kind and `D-25`'s
-    // overwrite rule governs it, not this refusal. **A LISTENER's handle names no pair, and that is exactly the
-    // act `D-29` closes:** `listen('listener-a', [a])` where a constraint stands at `a`.
-    if (state.constraints.has(handle) || state.establishing === handle) continue;
-    for (let i = 0; i < entry.addresses.length; i += 1) {
-      const heldKey = homeAddressKey(entry.addresses[i]);
-      for (let k = 0; k < actKeys.length; k += 1) {
-        if (actKeys[k] === heldKey) return { address: entry.addresses[i], id: entry.id };
-      }
-    }
+    if (handle === entry.id) return entry;
   }
   return null;
 }

package/src/entry/frame.mjs

@@ -298,6 +298,21 @@ export function admittedConstraintBatch(cfg) {
       );
     }
     // ── `B-3` — A BATCH `id` EQUAL TO AN ADOPTED LISTENER'S `handle`: THE CROSS-KIND COLLISION ───────────
+    // **⟶ RE-DERIVED 2026-11-01 (`D-98` item 4; `C-9`, `C-11`; §2, §3.4, §3.6), AND THE DIMENSION IS UNMOVED.**
+    // The arm compares a listener's **HANDLE** to a pair's **`id`** — the only cross-kind restriction `D-98`
+    // keeps, in the direction the ruling names second — so **its condition, its status (`ConstraintListInvalid`,
+    // `D-27`) and its instant are exactly what they were.** **TWO THINGS RE-DERIVE, AND BOTH ARE THE MESSAGE'S:**
+    //   * **THE SUBJECT IS THE HANDLE AND NOT THE ADDRESS.** It was `spellConstraintAddress(element.address.s)` —
+    //     an address whose string segments are ALREADY single-quoted here, and which the facade quotes again, so
+    //     the rendered bytes read `''ck''` (`research.md` §5.3). **A BARE HANDLE RENDERS `'shared-handle'` and
+    //     that doubling has no subject at this arm** (`B-1`/`B-2` keep it, and that residual is `Q-3`).
+    //   * **ITS CLAUSE NAMES THE POSITION AND THE ADOPTED LISTENER'S ONE ADDRESS** (§3.4): an adopted
+    //     `cfg.listeners` element carries exactly ONE `address`, so naming it asserts no order and is exact —
+    //     where the POSITION names the element, whose address could not (two elements may carry one address).
+    // **AND THE CONTAINER IS `undefined` ON PURPOSE**: the generated half is the store's own QUALIFIED
+    // `ConstraintListInvalid` arm under the appended `'handle'` token, and **that arm prints NO `<CONTAINER>`
+    // slot at all** — the list's name `constraints` is named on the clause's side and not in the generated half,
+    // where it would read as the place the mismatch was found (§3.3).
     let adoptedAt = -1;
     for (let n = 0; n < adoptedHandles.length; n += 1) {
       if (adoptedHandles[n] === element.id) {
@@ -308,11 +323,11 @@ export function admittedConstraintBatch(cfg) {
     if (adoptedAt !== -1) {
       boundaryReject(
         'ConstraintListInvalid',
-        segment,
-        `the batch element at position ${position} names the handle '${element.id}', and this construction `
-          + `adopts a listener under that handle at ${addressSpelling(adoptedAddresses[adoptedAt])}: a listener `
-          + 'and a constraint do not share one',
-        ['constraints'],
+        element.id,
+        `the batch element at position ${position} names that handle, and this construction adopts a `
+          + `listener under it at ${addressSpelling(adoptedAddresses[adoptedAt])}`,
+        undefined,
+        'handle',
       );
     }
     appendOwn(namedHandles, element.id);

package/src/entry/kernel-registration.mjs

@@ -31,6 +31,15 @@ const EXTERNAL_CALL = Symbol.for('provident-storeroom.external-call');
 /// seventh name, `§1` item 2), no member on any record, no store act.
 const REGISTER_BODY = Symbol.for('provident-storeroom.register-body');
 
+/// **⟶ AND `D-99`'S INTERNAL LISTEN ROUTE, SPELLED ON THIS SIDE TOO — 2026-11-01 (`C-17`, §9.2).**
+/// `delivery.mjs`'s `installListenRoute` installs it and this module reaches it, **and neither side imports the
+/// other**: the same `Symbol.for` device `EXTERNAL_CALL`, `REGISTER_BODY`, `TERMINAL_ARM`, `COMMIT_SCOPE` and
+/// `FORGET_PAIR` already cross by (`kernel-surface.md §1` item 1's empty import footprint; `A110`). **IT TAKES
+/// THE HANDLE AND THE PAIR'S ADDRESS SET AND ANSWERS THE ADOPTED HANDLE** — the caller's `listen` member's
+/// post-test body, and not the member. **IT MINTS NOTHING**: no kernel item (`K-1`…`K-6` and no seventh name,
+/// `§1` item 2), no member on any record, no store verb, no store act of its own.
+const LISTEN_ROUTE = Symbol.for('provident-storeroom.listen-route');
+
 /// **THE INVOCATION OF A REPAIR BODY, WITH THE SYNTHETIC ATTEMPT'S COMMIT NAMED ON ITS ENTRY** — one call, its
 /// answer the body's own, and a throwable crosses unchanged. **THE SECOND COPY OF THE FIVE-LINE FORM
 /// `kernel-attempt.mjs` DECLARES**, because the two part files share no import and neither may reach the entry
@@ -83,12 +92,18 @@ export function register(store, address, id, constraint) {
   // route read (`write-and-read.md §6.5` item 12 (c)): a repeat at an address the home already holds mints
   // nothing and answers the entry's own handle.
   //
-  // **⟶ AND THE CALLER-SPELLED HANDLE IS A STRING THE KERNEL ITSELF SPELLS**, because the kernel IS a caller
-  // of the app's own verbs (`contract.md §2.9` item 2's route: *"the kernel already reaches a store verb … so
-  // `K-6` withdraws through the same route rather than inventing a second one"*). **ONE ADDRESS HOLDS ONE
-  // KERNEL-OWNED REGISTRATION**, and the address's own spelling is the handle's own spelling — so two pairs at
-  // ONE address share ONE store entry, which is the declared consequence `(Y-1)` carries (`contract.md §2.2`
-  // item 7; `listen-verb.md §5` item 4).
+  // **⟶ AND THE CALLER-SPELLED HANDLE IS A STRING THE KERNEL ITSELF SPELLS**, because the kernel reaches **the
+  // app's own ROUTE** (`contract.md §2.9` item 2's route: *"the kernel already reaches a store verb … so
+  // `K-6` withdraws through the same route rather than inventing a second one"*). **⟶ RE-DERIVED 2026-11-01
+  // (`D-99`'s ANSWERED clause, *"Route reading — the kernel's act is its own"*): THE SENTENCE READ *"the kernel IS
+  // a caller of the app's own VERBS"*, AND THE VERBS ARE NOW THE ROUTE.** The kernel reaches no published member:
+  // it reaches `LISTEN_ROUTE`'s one function (`delivery.mjs`'s `listenOn`), which is the `listen` member's
+  // POST-TEST body — the same address encode, the same `entryOf().listen` act, the same mirror and the same
+  // registry reservation — so **the caller-facing cross-kind test (`B-6`) is skipped BY BEING SOMEWHERE ELSE**,
+  // not by an exemption. **THE STORE'S ONE VERB IS UNMOVED AND IS REACHED ONCE** (`D-99` item 1). **ONE ADDRESS
+  // HOLDS ONE KERNEL-OWNED REGISTRATION**, and the address's own spelling is the handle's own spelling — so two
+  // pairs at ONE address share ONE store entry, which is the declared consequence `(Y-1)` carries
+  // (`contract.md §2.2` item 7; `listen-verb.md §5` item 4).
   // **⟶ `listen` ANSWERS `undefined` AND THE KERNEL ALREADY KNOWS THE HANDLE IT SPELLED** — the caller
   // supplied it, so there is nothing to return (`contract.md §2.2` item 10; `PAR-HL-3`). **SO THE KERNEL SPELLS
   // THE HANDLE ONCE AND USES IT AT BOTH VERBS**, which is exactly the *"handle replaces token in all cases"*
@@ -129,7 +144,15 @@ export function register(store, address, id, constraint) {
   // accepted-but-never-delivered registration** (`Q2`'s hazard).
   //
   // **WHAT STANDS NOW, IN FOUR DECLARED PROPERTIES:**
-  //   1. **WHAT IT CALLS: `store.listen(id, set)` — the published member, two positions, the handle first.**
+  //   1. **WHAT IT CALLS: `store[LISTEN_ROUTE](id, set)` — the app's own ROUTE, two positions, the handle
+  //      first.** **⟶ RE-DERIVED 2026-11-01 (`D-99`'s ANSWERED clause; `C-17`, §9.2): THIS PROPERTY READ
+  //      *"`store.listen(id, set)` — the published member, two positions, the handle first"*, AND THE MEMBER IS
+  //      NOW THE ROUTE.** `LISTEN_ROUTE` is `Symbol.for('provident-storeroom.listen-route')`, installed once per
+  //      instance by `storeCreate` before the batch walk, and its one function is `listenOn` — **the `listen`
+  //      member's POST-TEST body and not the member**, so no caller-facing test stands between this call and the
+  //      store's one verb. **THE STORE'S ONE VERB IS UNMOVED AND IS REACHED ONCE**, and what the route skips is
+  //      the CALLER's tests over the CALLER's arguments, which this function has already taken at its own
+  //      channel (i) (`inDomainAddress`, `inDomainId`, `typeof constraint === 'function'`).
   //      **THE CALLER'S OWN `id` IS THE HANDLE** (`D-23`: *"Setting a constraint should expect a handle name to
   //      be used for handle and process/error logging purposes"*; `D-24`: *"The handle becomes the id"*), so the
   //      kernel neither mints a spelling nor derives one from the address: **no kernel-authored identity is
@@ -164,7 +187,7 @@ export function register(store, address, id, constraint) {
   // CARRIES NO SUCH CHANNEL ANSWERS NOTHING AND NOTHING IS TOLD** (the device's own absent arm, `state.mjs`'s
   // fallback read at `externalCall`/`bumpMark`): such a store is not this package's product, and its kernel is not
   // this kernel's pass.
-  const adopted = store.listen(id, set);
+  const adopted = store[LISTEN_ROUTE](id, set);
   const install = store[REGISTER_BODY];
   if (typeof install === 'function') install.call(store, id, constraint, 'constraint');
   // **THE PAIR'S OWN IDEMPOTENCE: a second registration under the SAME pair keeps the replaced registration's