@oimdb/browser 0.0.0-stage → 1.1.0

package/llms.txt

@@ -0,0 +1,4103 @@
+# OIMDB
+
+> **For AI assistants: read this file before writing any OIMDB code.**
+>
+> `@oimdb/core` is an in-memory reactive engine. This file is its API reference,
+> written against the current source.
+>
+> **Services hold no data; state lives on slots.** An `OIMDB` owns the clock, the collector slot and
+> its `defaultChannelSlot`. One channel per database; for isolation, a separate `OIMDB` — a write is
+> delivered at its own channel's flush to every effect on the slots it moved, so a second channel on
+> the same clock isolates nothing. A collection service (`OIMSlotCollectionService`) or a single slot service
+> (`OIMSingleSlotService`) is built once per collection type, and `service.createStoreSlot(db)` makes an
+> instance, a `TOIMStoreSlot`, which is NOT a slot (no owner, holds or effects) and carries its
+> `channelSlot`.
+> READS and minting are on the collection service and take the store slot first
+> (`cardService.getSlotByKey(cards, key)`, `holdSlotByKey`, `findSlotByKey`, `getSlots`, `getSlotCount`, the
+> column doors). One WRITE is on the collection and takes a key:
+> `cardService.writeSlotContentByKey(cards, key, entity)`, which mints the slot on a miss and writes the whole
+> value on a hit. Every other write is on `service.slotContentService` and takes a slot
+> (`cardService.slotContentService.updateEntity(slot, patch)`, `writeSlotContent(slot, entity)`,
+> `clearSlotContent(slot)`). There are NO bulk writes and no `keyOf`: the key is always the caller's. A load is a
+> loop of `writeSlotContentByKey` inside `cardService.writeInBatch(cards, () => { … })`, so an index on the
+> collection hears the whole loop in one call.
+> A single — one slot under no key — is an `OIMSingleSlotService`: `writeSingleSlotContent(storeSlot, value)`,
+> `getSingleSlot(storeSlot)`, `holdSingleSlot(storeSlot)`, `findSingleSlot(storeSlot)`,
+> `clearSingleSlotContent(storeSlot)`. No key is `void` or `undefined`: `TKey extends NonNullable<unknown>`.
+>
+> Every collection is `createOIMSlotCollectionService({ slotContentService })` and every single is
+> `createOIMSingleSlotService({ slotContentService })`. The content service decides what the slots hold:
+> `createOIMSlotContentEntityService<TEntity>(…)` for entities, `new OIMSlotContentSetBucketService()`,
+> `new OIMSlotContentPositionalArrayBucketService()` or `new OIMSlotContentSortedArrayBucketService({ … })` for
+> buckets. An index is `createOIMSlotCollectionIndexService({ entityService, keyOf | columns, slotContentService? })`;
+> its `keyOf` is the index's key of an entity, not the collection's. An array key needs a tree store:
+> `slotStoreService` on the collection, `bucketSlotStoreService` on the index.
+> Position reads and writes (`getBucketMemberSlotAt`, `getBucketMemberSlotPosition`, `insertBucketMemberSlotAt`,
+> `removeBucketMemberSlotAt`, `removeBucketMemberSlotRange`, `moveBucketMemberSlotToPosition`,
+> `moveBucketMemberSlotRangeToPosition`) are on `OIMSlotContentPositionalArrayBucketService`, the default bucket
+> content service; the set-driven one has none. A bucket sorts only on the sorted-at-write content service
+> (`createOIMSlotCollectionSortedArrayIndexService`); on every other bucket its order is the caller's. A sorted list
+> over any index is `createOIMSortedComputedService`. The render script is `OIMBucketCommands`.
+> The channel has no class: its operations are on `OIMChannelService.INSTANCE` and take a channel slot.
+> Effects are `OIMEffectService.INSTANCE.createEffect(db, body, sourceSlots?, sourceComputeds?, sourceTrackingComputeds?)`.
+> Every stateless singleton is a static `INSTANCE` on its class. Module-level defaults are on `OIMDefaults`.
+>
+> Check every symbol you write against [the full export list](#full-export-list).
+>
+> Install: `npm install @oimdb/core` (4.x). The 3.x line is the previous engine with a different API.
+>
+> `packages/core/src/index.ts` is the entire public surface.
+
+## Contents
+
+- [The domains](#the-domains)
+- [The doctrine](#the-doctrine) — the four doors, the injected seams, the idle windows, the collectors, forks
+- [The runtime: the channel slot](#the-runtime-the-channel-slot)
+- [`OIMDB` and the three doors](#oimdb-and-the-three-doors)
+- [`OIMDefaults` — where an optional dependency comes from](#oimdefaults--where-an-optional-dependency-comes-from)
+- [Entity services](#entity-services)
+- [Writing](#writing)
+- [Write strategies](#write-strategies)
+- [Single entities](#single-entities)
+- [Buckets](#buckets)
+- [Derivations](#derivations)
+- [Key stores](#key-stores)
+- [Lifetime — the owner protocol](#lifetime--the-owner-protocol)
+- [Ordered lists](#ordered-lists)
+- [Types](#types)
+- [Full export list](#full-export-list)
+- [Known defects](#known-defects)
+- [Other packages](#other-packages)
+- [`@oimdb/persist`](#oimdbpersist)
+- [`@oimdb/exodra`](#oimdbexodra)
+- [Performance](#performance)
+
+---
+
+## The setup the examples share
+
+Every `ts` example in this file compiles against `packages/*/src`, on top of this
+block and the one under [One derivation per key](#one-derivation-per-key). Blocks
+marked `ts signature` are listings of an API and are not compiled.
+
+```ts setup
+import { OIMChannelService, OIMSlotContentChangeListenerService, OIMDB, OIMDefaults, OIMEffectService, OIMSlotContentPositionalArrayBucketService, OIMSlotContentSetBucketService, OIMSlotMapStoreService, OIMSingleSlotStoreService, OIMSlotTreeStoreService, OIMUnusedSlotCollectorService, createOIMBucketMemoComputedService, createOIMComputedService, createOIMSortedComputedService, createOIMInPlaceEntityWriter, createOIMReplacingEntityWriter, createOIMSlotCollectionIndexService, createOIMSlotCollectionSortedArrayIndexService, createOIMSlotCollectionService, createOIMSlotContentEntityService, createOIMSingleSlotService, createOIMSingleComputedService, createOIMUnusedSlotCollectorSlot, oimIsSlotEmpty, oimIsSlotReleased, oimPatchEntityColumn, oimPatchEntityColumns, oimPutEntityColumns, oimSameValueZeroGuard, OIMBucketCommands, OIMSlotEarliestReleasePolicy, OIMSlotAfterWriteReleasePolicy, OIMSlotAfterIdleReleasePolicy, OIMThrowAtOnceErrorPolicy, type TOIMSlotStoreTree, OIMScalarKeyTreeWalk, OIMCompositeKeyTreeWalk } from '@oimdb/core';
+import type {
+    IOIMEntityWriter,
+    TOIMEditable,
+    TOIMBucketSlotsArrayStore,
+    TOIMBucketSlot,
+    TOIMBucketSlotsSetStore,
+    TOIMComputedSlot,
+    TOIMDisposer,
+    TOIMEntityContentSlot,
+    TOIMEntitySlot,
+    TOIMOrderedListCommand,
+    TOIMSingleSlotStore,
+    TOIMStoreKey,
+    TOIMStoreSlot,
+} from '@oimdb/core';
+
+type Card = { id: string; title: string; rank: number; deck: string };
+
+declare function paint(card: Card | undefined): void;
+declare function measureAndScroll(): void;
+declare function poll(): void;
+declare function reindex(slot: TOIMEntitySlot<Card, TOIMStoreKey>): void;
+declare function render(slots: readonly TOIMEntitySlot<Card>[]): void;
+declare function applyToTheRenderedList(commands: readonly TOIMOrderedListCommand[]): void;
+declare const payload: readonly Card[];
+
+const db = new OIMDB();
+const channelSlot = db.defaultChannelSlot;
+const effectService = OIMEffectService.INSTANCE;
+const cardService = createOIMSlotCollectionService({ slotContentService: createOIMSlotContentEntityService<Card>() });
+const cards = cardService.createStoreSlot(db);
+const slot = cardService.writeSlotContentByKey(cards, 'c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' });
+
+const orderedService = createOIMSlotCollectionService({ slotContentService: new OIMSlotContentPositionalArrayBucketService<TOIMEntitySlot<Card>>() });
+const ordered = orderedService.createStoreSlot(db);
+const orderedBucketSlot = orderedService.holdSlotByKey(ordered, 'top');
+
+const pageService = createOIMSlotCollectionService({ slotContentService: new OIMSlotContentPositionalArrayBucketService<TOIMEntitySlot<Card>>({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: undefined }) }) });
+const page = pageService.createStoreSlot(db);
+const todo = pageService.holdSlotByKey(page, 'todo');
+const done = pageService.holdSlotByKey(page, 'done');
+```
+
+---
+
+## The domains
+
+`src/` holds one folder per domain and `index.ts`, the entire public surface; a factory lives in
+the domain of what it builds. Where a file goes is in `packages/core/src/README.md`.
+
+| Domain | Contents |
+|---|---|
+| `slot/` | `OIMSlotOwner`, `OIMSlotOwnerService` (type-only export), `OIMSlotCollectionService`, `OIMWritableSlotCollectionService`, `OIMSingleSlotService`, `OIMWritableSingleSlotService`, `OIMSlotContentChangeListenerService`, `createOIMSlotCollectionService`, `createOIMSingleSlotService`, `TOIMSlot`, `TOIMEditable` |
+| `store/` | `TOIMStoreSlot`, the slot store services |
+| `channel/` | `OIMChannelService`, `TOIMChannelSlot` |
+| `effect/` | `OIMEffectService`, `TOIMEffect` |
+| `computed/` | `OIMComputedValueService`, `OIMComputedService`, `OIMSingleComputedService`, `OIMSortedComputedService`, `OIMBucketMemoComputedService`, the source-tracking computed services, their factories, `TOIMComputedSlot` |
+| `entity/` | `OIMSlotContentEntityService`, `createOIMSlotContentEntityService`, `createOIMInPlaceEntityWriter`, `createOIMReplacingEntityWriter` |
+| `column/` | abstract `OIMColumnSlotOwner` with `OIMPushColumnSlotOwner` and `OIMPullColumnSlotOwner`, `OIMColumnSlotService` |
+| `bucket/` | `OIMSlotContentBucketService` (abstract), `OIMSlotContentSetBucketService`, `OIMSlotContentArrayBucketService` (abstract), `OIMSlotContentPositionalArrayBucketService`, `OIMSlotContentSortedArrayBucketService`, `OIMBucketCommands` |
+| `index/` | `OIMSlotCollectionIndexService`, `OIMSlotCollectionSortedArrayIndexService`, their factories, the index keys services |
+| `key/` | the key tree walks |
+| `collector/` | the release policies, `OIMSlotReleaseWheel`, `OIMSlotRefetchWheel`, `OIMUnusedSlotCollectorService` |
+| `schedule/` | `OIMFlushSchedulerService` |
+| `error/` | the error policies |
+| `db/` | `OIMDB`, `OIMDefaults`, `OIMDefaultValue`, the default constants |
+
+**A service holds no data; state lives on slots.** A collection service is built once per collection type
+and holds only configuration and other services: its slot owner, its store service and its content
+service (`service.slotContentService`). `service.createStoreSlot(db)` makes an instance, a `TOIMStoreSlot`,
+which is NOT a slot (no owner, holds or effects): its `store` is what the store service built, its
+`channelSlot` is the db's channel, its `slotService` is the service that made it, and it carries the per-store
+state (content-change listeners, index key positions, the open batch and its queued changes, column readers).
+Every slot filed in it points back to it through `slot.storeSlot`, which is why a slot door needs no store slot.
+Reads and the keyed write are called on the service (`cardService.getSlotByKey(cards, pk)`,
+`cardService.getSlots(cards)`, `cardService.writeSlotContentByKey(cards, pk, card)`, or through the store slot:
+`cards.slotService.writeSlotContentByKey(cards, pk, card)`); writes on a slot go to its content service
+(`cardService.slotContentService.updateEntity(slot, patch)`), and the column doors to
+`cardService.columnSlotService`. A store slot's `store` is the store service's to read, never the caller's.
+
+---
+
+## The doctrine
+
+### Four doors mint an identity, and nothing else
+
+**Writing a value, subscribing, taking a hold, and reading a key that has
+none.** Each act leaves a **reference** behind on what it produced — a value, an
+effect, a count, or a tracked mint — so nothing can unfile the identity under
+the caller who just got it.
+
+```ts
+cardService.writeSlotContentByKey(cards, 'c2', { id: 'c2', title: 'Two', rank: 2, deck: 'spades' });  // write
+effectService.createEffect(db, () => { paint(slot.entity); }, [slot]);   // subscribe
+cardService.holdSlotByKey(cards, 'c1');                // hold, by key -> the slot, holdCount up by one
+const rankColumn = cardService.columnSlotService.holdColumn(slot, 'rank');   // hold, on a column
+cardService.columnSlotService.unholdColumn(rankColumn);                  // give the column back
+cardService.getSlotByKey(cards, 'c1');                 // read, by key -> the slot, tracked by the collector
+```
+
+**The non-minting lookup leaves no reference.** `findSlotByKey(storeSlot, key)` (and
+`findSingleSlot(storeSlot)` on a single) answers `undefined` on a miss and mints nothing, and the
+slot it does hand back is protected by nothing the caller took; the entity is
+`findSlotByKey(storeSlot, key)?.entity`. The one by-key write is `writeSlotContentByKey`, the write door
+above; to patch or clear an entity by key, find the slot first and write through it. Do not write a helper
+over any of the four doors — it would be a second spelling of a mint, not a fifth door.
+
+**Subscribing leaves BOTH kinds of reference.** `OIMEffectService.INSTANCE.createEffect(db, …)` files
+the effect in `slot.effects` *and* holds each root it subscribed to
+and each computed source it was given (through `owner.subscribeToSlot`); `disposeEffect(effect)` gives both back. That hold
+is why no idle window has to count subscribers — see
+[where an idle window opens](#two-release-markers-one-per-policy). A root reached only
+*through* a computed is subscribed but **not** held by the effect; a computed
+minted by `OIMComputedService` holds its own `sourceSlots` and
+`sourceComputeds` when it is minted and gives them back when its content is released.
+
+**`getSlotByKey(storeSlot, key)` is the fourth door, and the collector is what admits it.** It
+mints what is missing, then hands the slot to the unused-slot collector of the store slot's
+channel (`OIMUnusedSlotCollectorService.INSTANCE` over `storeSlot.channelSlot.collectorSlot.unusedSlotCollectorSlot`),
+which holds it for the caller and gives that hold back at the next `db.flush()`.
+So a `getSlotByKey` inside one turn of work cannot be unfiled under you, and nothing
+is left standing after it.
+
+### A slot goes when nothing refers to it
+
+There is **no release API, no sweep a caller runs, and no owner a caller
+assigns**. Two things ask. The release queue calls
+`slot.owner.releaseSlotIfUnheld(slot)` at a deadline; `slot.owner.unholdSlot(slot)` asks
+on the give-back of the last hold.
+
+`releaseSlotIfUnheld` is PUBLIC on `IOIMSlotOwner`. Public
+does not mean "release on demand" — `releaseSlotIfUnheld` is still a guard, and it
+returns without doing anything unless the slot is unheld, unreferenced, still
+owned by the object asked, and out of grace. Terms, and who gives each back:
+
+| Term | Given back by |
+|---|---|
+| `holdCount` | `slot.owner.unholdSlot(slot)`, or `service.columnSlotService.unholdColumn(columnSlot)` for a column; the unused-slot collector's flush; a slot leaving a bucket; `effectService.disposeEffect(effect)`, for the hold the effect took |
+| `effects` | `effectService.disposeEffect(effect)` |
+| a held column | its last column effect being disposed, through the service's column owner (`unsubscribeFromSlot`) |
+| the value | `service.slotContentService.clearSlotContent(slot)`, on an entity slot or a bucket slot alike; `clearSingleSlotContent(storeSlot)` on a single |
+| a composite-key edge | `OIMCompositeKeyTreeWalk.deleteKey` unlinking that composite key part |
+
+`clearSlotContent(slot)` takes the **value**. Subscribers stay, holds
+stay, and the identity stays with them. Slots you wrote into a bucket are held by
+that bucket until you empty it.
+
+### A service COMPOSES; nothing is overridden
+
+Optional behaviour is added without a branch on the hot path: a collection service is
+built from three stateless parts, wired once at construction, plus the injected seams below.
+
+| Part | Where | What it does |
+|---|---|---|
+| the slot owner, `OIMSlotOwnerService` (type-only export) | `slot.owner`, typed `IOIMSlotOwner` | holds, subscriptions, release, emptiness, `assertWritable`, the column owner; one per collection type |
+| the store service, `IOIMSlotStoreService` | given to the factory (`slotStoreService`, `bucketSlotStoreService`, …) or the Map default | files and finds the slots of each store slot's `store` |
+| the content service | `service.slotContentService` | the writes and reads of one kind of content (`OIMSlotContentEntityService`, the bucket content services, `OIMSlotContentComputedService`) and the answers the owner asks of that kind |
+
+The factory reads what it needs off the content service it is handed, through four small interfaces, never
+through a subclass of the service:
+
+```ts signature
+interface IOIMKeyedSlotCreator<TKey extends NonNullable<unknown>, TSlot> {
+    createSlot(key: TKey, storeSlot: TOIMStoreSlot, slotOwner: IOIMSlotOwner): TSlot;
+}
+interface IOIMSingleSlotCreator<TSlot> {
+    createSingleSlot(storeSlot: TOIMStoreSlot, slotOwner: IOIMSlotOwner): TSlot;
+}
+interface IOIMSlotContentWriter<TSlot, TContent> {
+    insertSlotContent(slot: TSlot, content: TContent, changedSlots?: TSlot[]): void;
+    writeSlotContent(slot: TSlot, content: TContent): boolean;
+    clearSlotContent(slot: TSlot): void;
+}
+interface IOIMSlotContentService<TSlot> {
+    isSlotEmpty(slot: TSlot): boolean;
+    releaseSlotContent(slot: TSlot): void;
+    hasReference(slot: TSlot): boolean;
+}
+```
+
+A content service with `createSlot` goes into `createOIMSlotCollectionService`, one with `createSingleSlot` into
+`createOIMSingleSlotService`; the entity and bucket content services have both. `hasReference` answers whether
+something outside `holdCount` and `effects` keeps the slot (a bucket's members). Every write door asserts the
+identity is still filed (`assertWritable`). `releaseSlotContent` is what the slot owner calls when it releases a
+slot nothing holds, and it throws on a slot that is still held.
+
+### The injected seams
+
+Each is one small interface handed to a constructor, and each answers one
+question that the engine asks but does not decide. There is no flag and no option
+object.
+
+```ts signature
+interface IOIMSlotEmptinessPolicy<TSlot> { isEmpty(slot: TSlot): boolean; }
+
+interface IOIMSlotStamp<TSlot> { stamp(editableSlot: TOIMEditable<TSlot>): void; }
+```
+
+**What a kind of content answers is not a seam.** Mint, write, clear and release
+belong to the content service, which the collection service hands its owner as `slotContentService`.
+"Does this still hold something" no part declares — the owner asks `oimIsSlotEmpty(slot)`,
+`hasReference` and the release policy's `isSlotReleasable` separately.
+
+**`IOIMSlotEmptinessPolicy`** decides what counts as empty, and the answer is written once
+per write into the EMPTY flag of `slot.slotFlags` — never recomputed at a read. The entity content
+service defaults to "the entity is `undefined`" (the `slotEmptinessPolicy` option of
+`createOIMSlotContentEntityService` replaces it); a bucket content service answers "no members"; a
+computed answers `false`, because a derivation always has a value to produce.
+
+**Emptiness decides lifetime, never the write path.** A `writeSlotContent` (or `writeSlotContentByKey` on a
+hit) onto an entity slot that still carries an entity is put over it even when emptiness calls the slot empty
+(a soft delete, a seed planted by `IOIMSlotStamp`): a column the new entity drops is
+woken, an unchanged one is not, and a write that repeats the entity exactly wakes
+nothing. Only an entity slot with no entity at all is filled whole.
+
+**`IOIMSlotStamp`** writes onto the slot at every write, just before emptiness is
+settled. It is a chain, not a single: each stamp takes the `next` one and calls
+it first. It is for stamps that are not about release.
+
+### The release policy
+
+```ts signature
+interface IOIMSlotReleasePolicy {
+    readonly releasesWrittenSlots: boolean;
+    readonly schedulesReleaseOnWrite: boolean;
+    onSlotWritten(slot: TOIMSlot): void;
+    onSlotIdle(slot: TOIMSlot): boolean;
+    onSlotUnheld(slot: TOIMSlot): void;
+    isSlotReleasable(slot: TOIMSlot): boolean;
+    isEmptySlotReleasable(slot: TOIMSlot): boolean;
+    cancelSlotRelease(slot: TOIMSlot): void;
+}
+
+new OIMSlotAfterWriteReleasePolicy({ keepAfterWriteMs: number, slotReleaseDueFramePolicy?: IOIMSlotReleaseDueFramePolicy })
+OIMSlotReleaseAutoDueFramePolicy.INSTANCE
+new OIMSlotReleaseManualDueFramePolicy()   // openSlotReleaseDueFrame() · closeSlotReleaseDueFrame() · writeInSlotReleaseDueFrame(write)
+new OIMSlotAfterIdleReleasePolicy({ keepAfterIdleMs: number })
+new OIMSlotAfterUnholdReleasePolicy({ keepAfterUnholdMs: number })
+OIMSlotAtUnholdReleasePolicy.INSTANCE
+OIMSlotAtEmptyReleasePolicy.INSTANCE
+OIMSlotNeverReleasePolicy.INSTANCE
+new OIMSlotEarliestReleasePolicy(slotReleasePolicies: readonly IOIMSlotReleasePolicy[])
+```
+
+`releasesWrittenSlots` is whether the policy can ever release a slot that holds
+data; a service reads it once at construction and skips the after-write
+release check when it is false (`OIMSlotAtEmptyReleasePolicy`, `OIMSlotNeverReleasePolicy`: false;
+`OIMSlotAtUnholdReleasePolicy` and the timed policies: true; `OIMSlotEarliestReleasePolicy`: true
+when any policy it combines is).
+
+`schedulesReleaseOnWrite` is whether a write can make the policy schedule a release; a service
+reads it once at construction and, when it is false and no `slotStamp` is set, skips `onSlotWritten`
+and the first-fill `onSlotIdle` on every write (`OIMSlotAfterWriteReleasePolicy`, `OIMSlotAfterIdleReleasePolicy`:
+true; `OIMSlotAtEmptyReleasePolicy`, `OIMSlotNeverReleasePolicy`, `OIMSlotAtUnholdReleasePolicy`,
+`OIMSlotAfterUnholdReleasePolicy`: false; `OIMSlotEarliestReleasePolicy`: true when any policy it combines is).
+`onSlotIdle` is still called when the last subscriber leaves.
+
+A policy decides whether and when a slot goes; it does no work itself. A
+factory, and an `OIMDefaults` (whose `slotReleasePolicy` a factory given it as `defaults` reads as its default), takes ONE
+through the option `slotReleasePolicy`. With none, the slot owner is built with
+`OIMSlotAtEmptyReleasePolicy`, so a slot with a value stays for good and an empty
+one with nothing holding it goes; there is no "no policy" branch on any path.
+Computed services default to `OIMSlotAtUnholdReleasePolicy`.
+
+| Policy | A slot goes |
+|---|---|
+| `OIMSlotAfterWriteReleasePolicy` | once its last write is older than `keepAfterWriteMs` |
+| `OIMSlotAfterIdleReleasePolicy` | once nothing has watched it for `keepAfterIdleMs` |
+| `OIMSlotAfterUnholdReleasePolicy` | once `keepAfterUnholdMs` has passed since its LAST unhold; a hold taken again inside the window keeps it |
+| `OIMSlotAtUnholdReleasePolicy` | at the last unhold, even with a value |
+| `OIMSlotAtEmptyReleasePolicy` | once it has no value and nothing holds it; a computed, never empty, stays while its owner lives |
+| `OIMSlotNeverReleasePolicy` | never, empty or not; a deleted key's slot stays filed |
+| `OIMSlotEarliestReleasePolicy` | when the earliest deadline of its members falls due — a `min` over deadlines |
+
+**WHICH WRITES MOVE THE WRITE DEADLINE is a strategy of `OIMSlotAfterWriteReleasePolicy`**,
+`slotReleaseDueFramePolicy`, chosen at construction. `OIMSlotReleaseAutoDueFramePolicy` (the default)
+makes every write its own frame, so every write moves the deadline. `OIMSlotReleaseManualDueFramePolicy`
+moves it only for writes made while one of its frames is open: `openSlotReleaseDueFrame()` and
+`closeSlotReleaseDueFrame()` (which throws by name when no frame is open), or
+`writeInSlotReleaseDueFrame(write)`, which opens, calls `write` and closes in a `finally`. One Manual object
+can be passed to several `OIMSlotAfterWriteReleasePolicy` policies with different windows: one frame then moves each slot's
+deadline by its own collection's window. This is what keeps a local edit or a client-only field from
+extending data that only a server response should refresh. `write` must be synchronous: a frame closes
+when the function returns.
+
+The release wheels live on the db's collector slot, at most one of each per `OIMDB`:
+`db.collectorSlot.afterWriteSlotReleaseWheel`, `afterIdleSlotReleaseWheel` and
+`afterUnholdSlotReleaseWheel`, each an `OIMSlotReleaseWheel` that holds its own slices, timer and clock.
+A wheel is created by the first policy that needs it, through `oimMintAfterWriteSlotReleaseWheel(collectorSlot)`
+(and its after-idle and after-unhold twins), which returns the existing wheel or creates it; until then the field is
+`undefined`, and a db with no timed policy never pulls the wheel code into a bundle. The
+clock and the timer are the db's: pass `new OIMDB({ getNowMs, releaseTimer })` to control time (tests),
+and sweep with `oimMintAfterIdleSlotReleaseWheel(db.collectorSlot).flush()`.
+`OIMSlotAtUnholdReleasePolicy` is the zero window and has no collector.
+
+A zero window never touches a release queue or a timer: when a slot goes idle with
+`onSlotIdle` answering `true`, it is released at once if nothing holds it, and
+a freshly minted slot that is already due goes to the unused-slot collector and
+leaves at the end of the frame. A window above zero is filed in that policy's own
+queue.
+
+**Two writes keep their slot until the unused-slot collector flushes, and this is deliberate.**
+(1) a value that the collection's emptiness policy calls empty, and (2) a write under a zero window
+(`OIMSlotAfterWriteReleasePolicy` / `OIMSlotAfterIdleReleasePolicy` with `0`) on a slot with no subscriber.
+Released at once, the slot `writeSlotContentByKey` returned would be dead on the next line: a second write
+to it throws, and handing it to a bucket throws ("an identity handed to a bucket was released") — which is
+what persist's restore does with the slots `writeInBatch` returns. The collector gives the hold back when it
+flushes — at the end of `db.flush()`, or when a collector scope (`OIMUnusedSlotCollectorService.INSTANCE.run`)
+closes — and the slot is released there.
+
+```ts
+
+const releasingDefaults = new OIMDefaults({
+    slotReleasePolicy: new OIMSlotEarliestReleasePolicy([
+        new OIMSlotAfterWriteReleasePolicy({ keepAfterWriteMs: 60_000 }),
+        new OIMSlotAfterIdleReleasePolicy({ keepAfterIdleMs: 30_000 }),
+    ]),
+});
+```
+
+### Two release markers, one per policy
+
+`TOIMSlot` carries TWO deadlines, and each release policy moves its own and
+no other:
+
+| Marker | Moved by | Not moved by |
+|---|---|---|
+| `releaseDueAfterWriteMs` | every write, under `OIMSlotAfterWriteReleasePolicy` | a subscriber arriving or leaving |
+| `releaseDueAfterIdleMs` | the first content of a slot with no subscriber, and the departure of the last subscriber, under `OIMSlotAfterIdleReleasePolicy` | a later write, and the give-back of a hold |
+| `releaseDueAfterUnholdMs` | every last unhold, under `OIMSlotAfterUnholdReleasePolicy` | a write |
+
+`-1` means unset. A slot goes on the SOONEST of those that are set — each
+marker is an eviction deadline, so whichever says "out" first decides — and a
+hold outranks both, so a subscribed entity slot is never taken for age and goes at the
+give-back.
+
+**ONE NUMBER CANNOT CARRY BOTH POLICIES.** A single field cannot say which event
+is allowed to move it: a write arriving after the subscriber left would push the
+deadline out and destroy the idle policy's verdict, and the last subscriber
+leaving after a write would destroy the write policy's. Both directions are
+pinned by
+`collector/tests/which-release-marker-each-collector-may-move.test.ts`;
+collapse the two markers into one and six of its nine cases go red.
+
+**The release policy's `isSlotReleasable(slot)`** is what the release guard asks
+for a slot that is not empty and has nothing left keeping it. `true` releases it
+now; `false` keeps it, and a policy with a finite deadline has itself filed the
+slot into its release queue (a marker of `-1` is kept with nothing scheduled).
+An **empty** slot is released without asking, and a service given no release
+policy keeps a non-empty slot. `OIMComputedService` defaults its policy to
+`OIMSlotAtUnholdReleasePolicy`, which always answers `true`, so a derivation
+nothing refers to goes at once. `OIMSlotEarliestReleasePolicy` asks every member
+and answers `true` if any does.
+
+**AN IDLE WINDOW OPENS IN EXACTLY TWO PLACES, AND NOWHERE ELSE:**
+
+1. **when the slot first gets content with no subscriber** — the write that takes it
+   from empty to filled, in `settleEmptiness`. A slot minted empty (a `getSlotByKey`
+   miss) is on NO clock and costs the queue nothing;
+2. **when the LAST SUBSCRIBER leaves** — `OIMSlotOwner.unsubscribeFromSlot` empties
+   `slot.effects` and runs the idle step, which opens one.
+
+Both ask the policy's `onSlotIdle(slot)`; under `OIMSlotAfterIdleReleasePolicy`
+it stamps `releaseDueAfterIdleMs` and files the slot into the policy's queue. An
+**empty** slot gets no window, and the release guard takes it without asking a
+clock at all.
+
+**A GIVE-BACK OPENS NONE.** `OIMSlotOwner.unholdSlot` drops `holdCount` and runs
+`releaseSlotIfUnheld`; it stamps no marker. A slot whose window already ran out is
+therefore taken at the give-back and not one window later.
+
+**A HELD SLOT IS OFF THE CLOCK.** A sweep that meets one calls
+`releaseSlotIfUnheld`, which stops at its first guard, `holdCount > 0`, and decides
+nothing — and the queue has taken the slot off its slice, so nothing re-files it.
+The give-back is where the guard is asked again.
+
+### The release wheels
+
+Each of `OIMSlotAfterWriteReleasePolicy`, `OIMSlotAfterIdleReleasePolicy` and
+`OIMSlotAfterUnholdReleasePolicy` files into its own release wheel, and the difference between the wheels
+is WHICH MARKER each reads and writes — injected at construction, so there is no flag and no branch on the
+sweep path. A wheel is an aggregate: its slices, its timer and its clock are fields of the object.
+
+```ts signature
+abstract class OIMSlotWheel {
+    readonly getNowMs: () => number;
+    getNextSliceNumber(): number | undefined;          // the nearest filed slice, or undefined
+    sweepUpToSliceNumber(upToSliceNumber: number): void;
+    flush(): void;                                     // sweeps what is due now and re-arms the timer
+    cancelAllSlots(): void;                            // takes the timer down and drops every filing
+}
+class OIMSlotReleaseWheel extends OIMSlotWheel {
+    constructor(options: TOIMSlotReleaseWheelOptions); // { getNowMs, timer, errorPolicy, getReleaseDueMs, setReleaseDueMs, releaseScheduledSlotFlag }
+    readonly getReleaseDueMs: (slot: TOIMSlot) => number;
+    markSlotReleaseDue(slot, keepMs): number;          // stamps now + keepMs on this marker, returns now
+    markSlotReleaseDueNow(slot): void;                 // the marker is now; an unheld, unwatched slot goes at once
+    scheduleSlotRelease(slot, nowMs): void;            // files the slot at its marker; -1 or already filed files nothing
+    isSlotReleasable(slot): boolean;                   // due now; if not yet, files it on the wheel
+    cancelSlotRelease(slot): void;                     // no-op for a slot whose marker is -1
+    isSlotReleaseScheduled(slot): boolean;
+}
+
+type TOIMCollectorSlot = {
+    readonly unusedSlotCollectorSlot: TOIMUnusedSlotCollectorSlot;
+    readonly slotWheelOptions: TOIMSlotWheelOptions;              // the db's clock, timer and error policy
+    afterIdleSlotReleaseWheel: OIMSlotReleaseWheel | undefined;   // created on first use
+    afterWriteSlotReleaseWheel: OIMSlotReleaseWheel | undefined;
+    afterUnholdSlotReleaseWheel: OIMSlotReleaseWheel | undefined;
+};
+oimMintAfterWriteSlotReleaseWheel(collectorSlot): OIMSlotReleaseWheel   // and …AfterIdle…, …AfterUnhold…
+```
+
+The clock (`getNowMs`, default `Date.now`), the timer (`releaseTimer`, default an unref'd `setTimeout`)
+and the `errorPolicy` (default `OIMLogAndContinueErrorPolicy.INSTANCE`) are `OIMDB` options, shared by the
+channel and every release collector of that db. A release that throws inside a hand-called `flush` throws to
+that caller; one that throws on the collector's own timer tick has no caller and goes to the db's
+`errorPolicy`. So one error policy on the db routes every error through one place:
+
+```ts
+
+const oneSinkDb = new OIMDB({ errorPolicy: new OIMThrowAtOnceErrorPolicy() });
+const idleReleasingDefaults = new OIMDefaults({
+    slotReleasePolicy: new OIMSlotAfterIdleReleasePolicy({ keepAfterIdleMs: 30_000 }),
+});
+```
+
+| Wheel | Reads | What renews it | What does not |
+|---|---|---|---|
+| `afterIdleSlotReleaseWheel` | `releaseDueAfterIdleMs` | the first content of a slot, and the give-back of the last hold | a later write |
+| `afterWriteSlotReleaseWheel` | `releaseDueAfterWriteMs` | every write, under its policy | a subscriber arriving or leaving |
+| `afterUnholdSlotReleaseWheel` | `releaseDueAfterUnholdMs` | every last unhold | a hold taken again inside the window |
+
+**A CONSUMER MAY RUN BOTH, AND THEY SHARE NOTHING.** Each wheel has its own slices and its own
+scheduled run. Whichever deadline falls due first takes the slot, and
+nothing has to be reconciled: `OIMSlotEarliestReleasePolicy` answers a `min`
+over its members' deadlines, so a sweep of either queue reaches the same verdict.
+
+**NEITHER MEANS UNREAD.** No read is seen and no door reports one: an identity a
+consumer subscribed to is in use whatever else is true of it. An effect takes a
+HOLD on each root it was given — `OIMEffectService.INSTANCE.createEffect` calls
+`root.owner.subscribeToSlot(root, …)`, which holds, for every slot in `sourceSlots` and every computed
+source — so the hold is the whole signal, and neither collector reads
+`slot.effects`.
+
+**The deadline is only consulted on a slot that is NOT empty.**
+The slot owner's `releaseSlotIfUnheld` checks `holdCount > 0`, then
+`oimIsSlotReleased(slot)`, then `slot.owner !== this`, then `hasReference(slot)`, and
+only then — on a slot that is not empty — asks the policy's `isSlotReleasable`; an empty slot
+asks `isEmptySlotReleasable` instead, which every policy but
+`OIMSlotNeverReleasePolicy` answers `true`. So only `OIMSlotNeverReleasePolicy`
+keeps an identity that holds nothing.
+
+**A release that falls inside a flush happens at once.** A slot at `holdCount` 0 has no subscriber
+(a subscription is a hold), so clearing its value wakes nobody, and a release notifies no content-change
+listener. When the last hold goes during a frame — an effect body disposing another effect, say — the slot is
+released there, whatever its kind. A later `holdSlotByKey` for the same key in that flush mints a new slot.
+
+*The `owner !== this` line costs no lookup. A KEYLESS slot — a single's, filed in an
+`OIMSingleSlotStoreService` store — goes through the same guard under its service's policy: an
+emptied single bucket nothing holds is released like a keyed one, and the single service's
+`getSingleSlot(storeSlot)` mints a fresh slot on the next read.*
+
+### Two consequences to generate code against
+
+**(a) An entity slot watched through an expired sweep gets a WHOLE window when the
+subscriber leaves, not an immediate release.** The seconds it spent watched were
+not idle ones, so `dispose` on a slot whose deadline passed long ago stamps a
+whole idle window afresh on `releaseDueAfterIdleMs` and the release comes
+one whole window later. **A give-back is NOT that moment**: `unholdSlot` stamps
+nothing, so a slot held through an expired sweep goes at the give-back.
+
+```ts
+const effect = effectService.createEffect(db, () => { paint(slot.entity); }, [slot]);
+// …the window passes, sweeps run, nothing happens to this slot…
+effectService.disposeEffect(effect);
+oimIsSlotReleased(slot); // false — a whole new window starts here
+```
+
+**(b) A cascade is taken in ONE sweep, not one window per level.** The sweep
+releases the stale index, which gives back one reference per entity slot it named, and
+each entity slot whose own window already ran out is taken by the ordinary guard the
+instant that reference departs.
+
+Pinned by `collector/tests/what-a-stale-index-takes-with-it.test.ts`,
+`…/what-an-identity-nobody-subscribed-to-costs-after-a-while.test.ts` and
+`…/what-a-subscribed-row-costs-the-release-clock.test.ts`.
+
+### The release guard, and who fires it
+
+**THE WHEEL DECIDES AT A DEADLINE, NOT THE OWNER.**
+`OIMSlotReleaseWheel.sweepUpToSliceNumber`, per slot in a slice at or below the one due:
+
+1. its bit is clear → a stale entry, skip it; `oimIsSlotReleased(slot)` → skip it;
+2. its own marker, read through `getReleaseDueMs(slot)` — the ONE field this wheel
+   answers for;
+3. `-1` → the slot is dropped from the wheel: this policy does not claim it;
+4. a moment still in the future → the wheel **re-files the slot itself**, into
+   `oimSliceOfMs(getReleaseDueMs)` through its own slice arithmetic;
+5. a moment already passed → `slot.owner.releaseSlotIfUnheld(slot)`, which asks the
+   policy's `isSlotReleasable` and so declines when the other policy still keeps the
+   slot, or when the slot is held.
+
+**INVALIDATING IS MARKING THE DEADLINE NOW.** `wheel.markSlotReleaseDueNow(slot)` sets this wheel's
+marker to now and hands the slot to `slot.owner.releaseSlotIfUnheld(slot)` at once: a slot nothing
+holds or watches goes with its data; a held or watched slot stays, keeps its data, and goes the moment
+its last hold or subscriber leaves, because its deadline is already past. The next marked write moves
+the marker a window ahead again. It writes no content, so it wakes no effect.
+
+The owner files nothing from inside a sweep. It **opens** a window on its own
+events, through the policy's `onSlotIdle` — when a slot first gets content, and
+when the last subscriber leaves — and `onSlotUnheld` on the give-back of the last hold.
+
+**A SLOT ALREADY ON A QUEUE STAYS WHERE IT IS.** `scheduleSlotRelease` of a slot that is
+already filed moves nothing: the sweep re-reads the deadline when that slice comes
+due and re-files the slot then (the timing-wheel lazy re-insertion). So a write to a
+queued entity slot costs the queue one bit test, not an unfile and a refile. A
+deadline only ever moves later — each policy adds a fixed window to a clock that
+does not go back — so the slice a slot already sits in is never later than its deadline.
+
+`releaseSlotIfUnheld(slot)` is the guard, and it releases only when all of
+`holdCount === 0`, `oimIsSlotReleased(slot)` is false, `slot.owner === this`,
+`hasReference(slot)` is false, and the policy's `isSlotReleasable` answers `true`
+(or the slot is empty). **A held slot stops at the first of those** and nothing
+happens to it. On a slot that is not empty with time still owed, `isSlotReleasable`
+answers `false` and the policy files the slot into its queue at its own marker, so a
+filing can neither shorten nor extend a deadline. That is the path from `unholdSlot` and from a write, never from a
+sweep, which had already re-filed at step 4. Releasing hands the slot to the
+content service's `releaseSlotContent` (which gives back what the content held),
+marks the slot empty, calls the policy's `cancelSlotRelease(slot)`, unfiles the key
+through the store service's `remove`, and sets the RELEASED flag in `slot.slotFlags`. The `owner` is NOT cleared — the slot keeps
+pointing at the object that let it go, which is what makes `slot.owner !== this`
+a usable guard afterwards.
+
+The RELEASED flag (`oimIsSlotReleased(slot)`) is the other half of that protocol, and the two sides are
+opposite:
+
+- **Releasing an already-released slot is SILENT.** `releaseSlotIfUnheld` reads
+  `oimIsSlotReleased(slot)` and returns; it does not throw. A sweep meeting a slot
+  something else already let go must not raise.
+- **Trying to WORK with a released slot throws by name.** `assertNotReleased`
+  guards the content services' write doors (`writeSlotContent`, `clearSlotContent`, `updateEntity`, `markEntityChanged`,
+  `addBucketMemberSlot`, `removeBucketMemberSlot`, `markContentChanged`) and the reference doors (`holdSlot`, `unholdSlot`, `subscribeToSlot`,
+  `unsubscribeFromSlot`). The refusal message starts `This identity was released:`.
+
+### The wheels and the unused-slot collector
+
+```ts signature
+oimMintAfterWriteSlotReleaseWheel(db.collectorSlot)   // and …AfterIdle…, …AfterUnhold…
+new OIMSlotRefetchWheel(options: TOIMSlotRefetchWheelOptions)   // { slotRefetchListener, getNowMs?, timer?, errorPolicy? }
+OIMUnusedSlotCollectorService.INSTANCE
+createOIMUnusedSlotCollectorSlot(): TOIMUnusedSlotCollectorSlot
+```
+
+**A wheel is the clock.** `OIMSlotWheel` extends `OIMFlushSchedulerService` and is its own scheduled slot:
+`flush()` sweeps what is due and re-arms the timer to the next deadline. `cancelAllSlots()` takes the timer
+down and drops every filing; the next filing arms it again. The release wheels take the clock (`getNowMs`)
+and the timer from the db, so a test drives them through `new OIMDB({ getNowMs, releaseTimer })`. The default
+timer is a `setTimeout` that calls `unref` where the platform has it, so an idle Node process is not held open.
+
+**A wheel files slots into time slices**, not one entry each. `oimSliceOfMs(ms)` is
+`Math.floor(ms / OIM_SLICE_LENGTH_MS)` and `OIM_SLICE_LENGTH_MS` is `1024`, so every slot due inside the
+same ~1s slice shares one array and one timer.
+
+**WHETHER A SLOT IS ON A RELEASE WHEEL IS A BIT ON THE SLOT, NOT A MAP.** Each of the three release
+wheels of a db owns one bit of `slot.slotFlags` (`releaseScheduledSlotFlag`, `4`, `8`, `16`), so a slot
+can sit on all three at once, once on each. Filing pushes the slot onto its slice's array and sets the
+bit; cancelling clears the bit and leaves the entry, which the sweep skips when its slice comes due. A
+cancelled slot therefore keeps its slice named by `getNextSliceNumber` until that sweep.
+
+A slot re-filed during a sweep cannot land in a slice the same sweep is still walking: the sweep raises a
+floor for its duration, so a re-file — the wheel's own at step 4, or one a release makes — goes to the next
+slice and is looked at next time, not in a loop.
+
+**`OIMSlotRefetchWheel` is a wheel of slots due a refetch at an explicit time.** It computes no deadline,
+keeps no bit and no field on the slot: `scheduleSlotRefetchAt(slot, atMs)` files an entry into the slice
+of `atMs`, every call files one more. Its sweep takes only slices that have fully elapsed, skips released
+slots, drops slots nobody subscribes to, and calls `slotRefetchListener.onSlotsRefetchDue(slots)` ONCE per
+sweep with every watched slot that came due; the array is reused and emptied after the call, so a listener
+does not keep it. Moving a refetch earlier is another `scheduleSlotRefetchAt`; the listener decides from
+its own data whether an entry is current, so an early or duplicate entry is skipped there. The wheel is
+created by whoever needs it, not by the db, and its clock, timer and error policy default to `Date.now`,
+an unref'd `setTimeout` and `OIMLogAndContinueErrorPolicy.INSTANCE`.
+
+**The unused-slot collector** has nothing to do with time. It is the one that makes
+`getSlotByKey(storeSlot, key)` safe: `OIMUnusedSlotCollectorService.INSTANCE.holdSlotUntilFlush(unusedSlotCollectorSlot, slot)`
+takes a hold, `flush(unusedSlotCollectorSlot)` gives every tracked hold back. `open` / `close` nest a scope and
+`run(unusedSlotCollectorSlot, body)` is the `try/finally` form; `flush` does nothing while a scope is
+open, so an outer scope's slots survive an inner one closing. `close` with no open scope throws by name. The
+channel flush flushes the db's unused-slot collector slot (`db.collectorSlot.unusedSlotCollectorSlot`) once the
+frame is delivered, which is why a turn of work that only read through `getSlotByKey` leaves nothing
+standing after `db.flush()`.
+
+**AN ARENA IS AN UNUSED-SLOT COLLECTOR SLOT THAT THE CALLER CREATES.** `createOIMUnusedSlotCollectorSlot()`
+is exported, so a consumer who wants to FORCE-CACHE a derivation makes its own and ends it when it chooses.
+The db's collector slot is the default, not the only one:
+
+```ts
+const unusedSlotCollectorSlot = createOIMUnusedSlotCollectorSlot();
+OIMUnusedSlotCollectorService.INSTANCE.holdSlotUntilFlush(
+    unusedSlotCollectorSlot, rankService.computedCollectionService.getSlotByKey(ranks, 'c1'),
+);                                  // held until this arena says otherwise
+db.flush();                         // the db's collector lets its own go; this one does not
+// … the derivation is still there, and still the same object …
+OIMUnusedSlotCollectorService.INSTANCE.flush(unusedSlotCollectorSlot);   // now it goes, and so does everything only it held
+```
+
+**TRACKING ONE DERIVATION KEEPS ITS WHOLE SUBTREE, and no caller walks a tree to
+get that.** A computed takes a hold on each of its own direct sources at the mint
+and gives them back when it is released, so an arena holds the top and the chain holds itself.
+
+Pinned by `collector/tests/what-a-named-arena-keeps-cached.test.ts`: the
+derivation survives a settle, is the SAME instance on the next read (built once),
+is rebuilt only after the arena is flushed, and `open`/`close` nest so an inner
+scope ending drops nothing an outer one stands on.
+
+`@oimdb/react`'s `useOIMSlotsByKeys(storeSlot, keys)` does not use an arena: it takes a
+plain `holdSlotByKey` per key on commit and gives the same holds back on unmount or when the key list moves.
+
+```ts signature
+type TOIMTimer = (run: () => void, inMs: number) => TOIMDisposer;
+```
+
+`TOIMTimer` is how a host schedules a collector's run. It is given the body
+and a delay and hands back the cancel. `OIMFlushSchedulerService` is the abstract base
+that owns the schedule/cancel around it, on a `TOIMFlushSchedulerSlot` (`timer`, `scheduledCallback`,
+`timerDisposer`): protected `schedule(flushSchedulerSlot, delayMs)` does
+nothing if a scheduled run is already standing, and `cancelSchedule(flushSchedulerSlot)` drops it. **The
+standing run is the callback itself**: the slot keeps the one handed to the
+timer, and a callback that is no longer that one — a run the host could not
+cancel, still queued after a manual flush — returns without touching anything, so
+it neither flushes early nor lets the next request arm a second wake. The channel
+schedules with `0`. The release collectors read the clock once, schedule to the
+next slice, and cancel and re-schedule only when a shorter window arrives; the
+deadline they compare against is reset by `cancelSchedule`.
+Pass a `TOIMTimer` of your own to drive a collector off a
+frame callback, a worker message or a test clock instead of `setTimeout`.
+
+### A fork is a strategy, not a decision
+
+Both strategies ship, chosen at **construction**, so no branch survives onto a hot
+path. There is no `if (inPlace)` anywhere in the engine.
+
+| Fork | Strategies |
+|---|---|
+| how a write lands | `createOIMInPlaceEntityWriter()` / `createOIMReplacingEntityWriter()` |
+| how a bucket holds slots | `OIMSlotContentSetBucketService` / `OIMSlotContentPositionalArrayBucketService` (the positions are the caller's) |
+| what naming a slot records | `bucketMemberSlotsArrayService: OIMBucketMemberSlotsArrayService` (one per mention, the default) / `new OIMBucketUniqueMemberSlotsArrayService<TSlot>()` (one per slot), on either array bucket |
+| which writes re-sort a sorted list | `sortColumns` (only a write changing one of them on a member) / `comparator` alone (any member write), the options of `createOIMSortedComputedService` |
+| how a key is addressed | `OIMScalarKeyTreeWalk.INSTANCE` / `OIMCompositeKeyTreeWalk.INSTANCE` |
+| when a slot may go | `OIMSlotAfterIdleReleasePolicy` / `OIMSlotAfterWriteReleasePolicy`, either or both |
+| who decides a bucket's slots | a bucket collection (`createOIMSlotCollectionService` over a bucket content service, the caller) / an index (`createOIMSlotCollectionIndexService`, filed from the entity's own key) |
+
+**One strategy per kind per app.** A V8 call site is shared by every service
+that runs the same engine code, so mixing strategies of one kind in one process
+shows that site several hidden classes or functions. Up to four is polymorphic:
+V8 still caches each one and can still inline
+(`--max-valid-polymorphic-map-count`, default 4). Five or more is megamorphic: no
+per-site cache and no inlining through it. The kinds that count: release policies
+(the `IOIMSlotReleasePolicy` strategies), set-driven vs array-driven buckets and indexes, entity
+writers (`createOIMInPlaceEntityWriter` / `createOIMReplacingEntityWriter`) and
+`TOIMEntityInserter`, `TOIMSameValueGuard`, `IOIMSlotEmptinessPolicy`, and
+`TOIMChannelScheduler`. Two or three of one kind is fine; five release policies in
+one process is not. The pair
+`alt.slot-shape.three-shapes-against-one-at-the-write` measures three slot shapes
+at one write site against one, and its ratio is close to 1; no pair measures five.
+Generate code with one strategy per kind unless the task names a second.
+
+### Every store slot has a channel — read this before generating code
+
+`createStoreSlot(db)` stamps the db's `defaultChannelSlot` on the store slot, and every write to its slots
+is reported to that channel. No service holds a channel; there is no `channel` option and no
+`unusedSlotCollector` option:
+
+```ts
+const cardContentService = createOIMSlotContentEntityService<Card>();
+const handBuiltCardService = createOIMSlotCollectionService({ slotContentService: cardContentService });
+handBuiltCardService.createStoreSlot(db);
+```
+
+A single entity is `createOIMSingleSlotService({ slotContentService: createOIMSlotContentEntityService<T>() })`,
+and its store slot takes the db's channel too and always reports.
+
+### A bucket's slots are the caller's
+
+A bucket's slots are a fact about the **response** being composed — a search result, a
+page, a window — and **no column can express absence**. So a bucket collection
+is manual, and `entityService.slotContentService.clearSlotContent(slot)` does not take a slot out of any
+bucket. Use an index (`createOIMSlotCollectionIndexService`) when the slots are determined by the entity's key value,
+and an index should maintain buckets only for keys being held.
+
+---
+
+## The runtime: the channel slot
+
+There is no channel class. A channel is the struct `TOIMChannelSlot`; every operation is on the stateless
+`OIMChannelService.INSTANCE` and takes the channel slot first. An `OIMDB` builds its `defaultChannelSlot`
+from its own options, and every store slot created with `createStoreSlot(db)` carries it as
+`storeSlot.channelSlot`. A test that needs a second, independent channel makes a second `new OIMDB()`.
+
+```ts signature
+new OIMDB(options?: TOIMDBOptions)
+
+type TOIMDBOptions = {
+    channelScheduler?: TOIMChannelScheduler;     // absent = you flush by hand
+    errorPolicy?: IOIMErrorPolicy;              // absent = OIMLogAndContinueErrorPolicy.INSTANCE
+    onBeforeFlush?: () => void;                 // start of the flush, before the frame; READ ONLY, a write is refused
+    getNowMs?: () => number;                    // the release collectors' clock; absent = Date.now
+    releaseTimer?: TOIMTimer;                   // the release collectors' timer; absent = an unref'd setTimeout
+};
+
+db.clock               // TOIMChannelClock, the same object as db.defaultChannelSlot.clock
+db.collectorSlot       // TOIMCollectorSlot
+db.defaultChannelSlot  // TOIMChannelSlot
+db.flush()             // OIMChannelService.INSTANCE.flush(db.defaultChannelSlot)
+
+interface IOIMErrorPolicy { onErrorCaught(error: unknown): void }
+OIMLogAndContinueErrorPolicy.INSTANCE                                       // console.error; the flush goes on
+new OIMLogAndContinueErrorPolicy({ onError?: (error: unknown) => void })   // console.error, then onError
+new OIMThrowAtOnceErrorPolicy()                                             // throws the first error out of the flush
+```
+
+**What the error policy covers** — every error with no synchronous caller to
+throw to: effect bodies and their cleanups, `onBeforeFlush`, after-each-frame and
+after-each-flush handlers, the unused-slot sweep at the end of a flush, and a
+release collector's own timer tick. A call that has a caller — a write, a
+hand-called collector `flush` — throws to it. `channelSlot.errorPolicy` is the
+instance the channel reports through; it is the db's `errorPolicy`, which the release collectors share,
+so one policy answers for the whole database. **The default digests and logs**: each throw goes to `console.error`
+and then to `onError` (where Sentry or the devtools registry plugs in), and the
+flush finishes every other effect and handler. `OIMThrowAtOnceErrorPolicy` throws
+the first error out of `flush()` at once; the effects the frame had not reached yet
+stay queued and run at the next flush. **An effect whose body or cleanup threw
+has not taken the change it woke for**: its `ranAtRevision`/`ranAtEpoch` are
+written only after the body returns, so its next wake — any later write to its
+roots, even one through a computed that settles to the same value — sees that
+change as still new and runs it again. It is never re-run inside the frame it
+threw in (each pending effect runs once per frame, and writes are refused during
+a flush), so a body that always throws costs one run and one caught error per
+wake, not a loop. A cleanup that disposes its own effect stops the body that would
+have run after it. **A computed is stamped fresh only after its derive and its
+`sameValueGuard` both returned**: if either threw, the next read derives again.
+A computed with no sources at all derives on its first read. **A computed whose
+value changed is stamped with the revision of its newest source**, not with the
+clock at the moment it was read — so whether an effect over it owes a run depends
+only on its sources, never on an unrelated write that moved the clock. An effect
+born after a computed's source changed is owed nothing for it, as one over the
+root itself. **A throw does not
+stop the channel asking for frames**: the
+request flag is cleared before `onBeforeFlush` runs, and a write that finds
+effects still pending with no frame requested asks for one — so a frame aborted by
+a throw is followed by a frame at the next write, under either policy. **A throw in
+one release of a sweep leaves the rest of that slice on the release clock**; the
+next sweep takes them, and the clock is re-armed even when the sweep threw. Code
+that maintains DERIVED state — an index's `keyOf`, an emptiness check — is not
+under the policy: a throw there leaves the state consistent and is thrown in
+either mode. **An index whose `keyOf` throws on an entity files that entity slot under no
+key** — it leaves the bucket its old key named — and finishes the rest of the write
+or batch before it rethrows the first error; the entity stays in its store slot, and
+the next write the index accepts files it again. A NEW entity refused by a single
+write is withdrawn from the store slot instead. This costs nothing on a write
+where nothing throws. **A bucket minted by a scan of the source moves an entity slot out
+of the bucket its stored key still names** — an entity mutated by hand whose
+`markEntityChanged` has not run yet — so it ends in one bucket, not two; the scan
+pays one read of the stored key per entity slot it files, and the move keeps the entity slot held
+until the next flush so its last hold never goes mid-mint. Inside a flush, where
+writes are refused, the move is skipped.
+
+Every door below is on `OIMChannelService.INSTANCE` and takes the channel slot first.
+
+| Door | Signature |
+|---|---|
+| `flush(channelSlot)` | `void` — the only place anything is delivered; from the TAIL of a flush it returns having done nothing. `db.flush()` is this on the default channel |
+| `scheduleEffectRun(channelSlot, effect)` | `void` — puts the effect on this channel's queue for the next frame, once (the RUN_SCHEDULED bit of `effect.effectFlags` says whether it is there), sets the SOURCE_CHECK_OWED bit (`OIM_EFFECT_FLAG_SOURCE_CHECK_OWED`) and asks for a flush. Effects are made by `OIMEffectService.INSTANCE`, not here; `createEffect` calls this when the open batch already has writes and no frame is running, so an effect created inside a running frame is never queued |
+| `subscribeAfterEachFrame(channelSlot, handler)` | `TOIMDisposer` — after every frame, but still INSIDE the flush: a write from it is refused |
+| `subscribeOnceAfterFrame(channelSlot, handler)` | `TOIMDisposer` — the same phase, told **once**; see below |
+| `subscribeAfterEachFlush(channelSlot, handler)` | `TOIMDisposer` — told once the flush has FULLY ended: after the after-each-frame phase and after the unused-slot collector of the db is flushed. For what may live only one frame — `OIMBucketCommands` empties its render scripts here |
+| `isRefusingWrites(channelSlot)` | `boolean` — `channelSlot.isFlushing`; refusal is per channel |
+| `assertNotFlushing(channelSlot)` | `void` — throws if the channel is flushing or its frame is running, i.e. for the whole of a flush |
+| `write(channelSlot, slot)` | `void` — asks `assertNotFlushing`, then marks and queues |
+| `writeWithoutFlushCheck(channelSlot, slot)` | `void` — the same marking and queueing WITHOUT the guard, for a door that already refused. Who may call it is pinned by `tests/who-may-write-without-asking-the-channel.test.ts`; a caller not on that list fails the suite |
+| `dropChannelSlot(channelSlot)` | `void` — kill the channel whole; see below |
+| `isChangedInCurrentFrame(channelSlot, slot)` | `boolean` — whether the slot was written after the last frame ended, i.e. in the frame being collected now; compares `slot.changedAtRevision`/`changedAtEpoch` with the clock reading the last frame closed at. `OIMBucketCommands` keeps a bucket's render script across a flush only while this is true |
+
+The channel slot's own fields that a caller reads: `frame` (`TOIMChannelFrame`, `{ isRunning, openedAtRevision,
+openedAtEpoch, … }`; a frame carries no number, the clock reading it opened at is its boundary), `clock`
+(`TOIMChannelClock`, the `{revision, epoch}` pair, shared by every channel of one db; an epoch holds
+`OIM_REVISIONS_PER_EPOCH` (2^30) revisions, so the counter stays a V8 small integer under pointer compression; the epoch is an int32 that wraps, compared as `(epoch − sinceEpoch) | 0`),
+`collectorSlot`, `errorPolicy`, `isFlushing`. Everything else on it is engine state.
+
+### A subscription hears only what happens after it
+
+`effectService.createEffect` is told about changes made **after** the call and about nothing
+before them. This holds for every kind of source — an entity slot, a column, a
+bucket, a computed — and a batch does not soften it: writes accumulate until
+`flush()`, and subscribing behind a write of the still-open batch is subscribing
+after it.
+
+```ts
+cardService.writeSlotContentByKey(cards, 'a', { id: 'a', title: 'A', rank: 1, deck: 'spades' });
+const entitySlot = cardService.getSlotByKey(cards, 'a');
+
+effectService.createEffect(db, () => { /* NEVER runs for the upsert above */ }, [entitySlot]);
+db.flush();
+
+// A first value is `createAndRunEffect`'s job, not `createEffect`'s:
+effectService.createAndRunEffect(db, () => { paint(entitySlot.entity); }, [entitySlot]);   // runs now
+```
+
+A later write in that same batch IS delivered — "after I subscribed" is decided
+by the revision (`clock.revision` advances on every write), not by the frame
+number, which is one number for the whole batch and cannot separate the two.
+
+### `subscribeOnceAfterFrame(channelSlot, handler)`
+
+Told after **one** frame — the first that ends after the call — and then gone.
+The place that asks decides which frame that is.
+
+```ts
+effectService.createEffect(db, () => {
+    paint(slot.entity);
+    // the tail of THIS frame, after every other effect of it
+    OIMChannelService.INSTANCE.subscribeOnceAfterFrame(channelSlot, () => { measureAndScroll(); });
+}, [slot]);
+```
+
+- **Registered from inside an effect body it runs in the tail of that very
+  frame**, after every other effect of it. The after-each-frame phase settles who
+  it owes when the phase *begins*, and the drain is before that — so a handler
+  added from the drain falls on the "owed" side. That is the whole reason the
+  method exists: a consumer whose work needs the **settled** screen (a
+  measurement, a scroll to an item that moved, a size written back) asks from
+  inside its effect and is answered at the end of that same frame.
+- Registered from the after-each-frame phase itself, it sits that frame out and
+  is told after the next one — the phase had already settled who it owed.
+- **It is not `subscribeAfterEachFrame` plus a disposal.** The effect runs again
+  next frame and registers again, so a standing handler accumulates one per run:
+  `tests/a-handler-that-wants-one-frame-and-not-every-frame.test.ts` measures the
+  one-shot at 1, 2, 3 calls over three frames against the standing handler's 1,
+  3, 6.
+- It comes off **before** its body runs, so a handler that throws is not left
+  standing for the next frame; the throw is reported by the frame that ran it.
+- One list, not two: it goes into the same set at the same phase, so one-shot and
+  standing handlers are called in registration order among each other.
+
+### Batches: `openBatch` / `closeBatch` / `writeInBatch` on a collection
+
+There are no bulk writes. A load or a sync is a loop of single writes, and a collection
+service wraps it in a batch on its store slot:
+
+```ts
+cardService.writeInBatch(cards, () => {
+    for (const card of payload) cardService.writeSlotContentByKey(cards, card.id, card);
+});
+```
+
+- `openBatch(storeSlot)` / `closeBatch(storeSlot)` nest by a count on the store slot; `closeBatch` with no batch open
+  throws. `writeInBatch` is the `try/finally` form and returns what its function returns.
+- **What the batch changes is who hears the writes, and when.** A content-change listener on the store slot (an
+  index on the collection) hears every write of the batch in ONE call, `onManyContentsChanged`, when the
+  outermost batch closes. Code inside the batch reads the index as it was before the batch.
+- Effects are not batched by it: every write marks its slot on the channel as usual, and the frame delivers each
+  identity once whatever the batch did. A `flush()` inside a batch is allowed; the index catches up when the
+  batch closes.
+- A single write outside a batch tells the index at once, and is not rolled back: the slot is filed first and the
+  index is told after, so an index that throws leaves the write in place and the throw reaches the caller.
+
+### `dropChannelSlot(channelSlot)`
+
+Kills the whole channel on the caller's word that **nothing is subscribed to
+anything in it**. The engine does not verify that: checking would mean asking
+every slot whether its `effects` list is empty, which is exactly the walk the
+method exists to skip — the check IS the cost, which is what the suffix of its name says.
+
+```ts
+// every subscriber disposed, the screen is going away
+OIMChannelService.INSTANCE.dropChannelSlot(db.defaultChannelSlot);
+// drop your own references; every slot, store and derivation goes with them
+```
+
+- It empties the effect queue and the after-each-frame and after-each-flush handlers, cancels the scheduled
+  flush, sets the `dropped` flag, and returns. **Nothing walks a slot to ask who is subscribed to it** —
+  that is the walk the name refuses.
+- **It does flush the unused-slot collector**, which is the channel's own debt
+  and not a walk of your graph: every getter that minted an identity this frame
+  filed a hold there, and a flush was the only thing that ever gave those back. Since `flush` returns on the
+  flag, a drop that skipped this would pin every such identity for as long as the db's collector slot lives.
+  A drop made from INSIDE a flush leaves it to that flush, which still runs it.
+- The flag exists because `TOIMChannelScheduler` gives back no handle, so a frame asked
+  for before the call still arrives; `flush` returns on it.
+- **The flag is read in TWO places.** `flush` returns on it, and so does the
+  private `requestFlush` — which `write` reaches at the end of every
+  write that got past the per-frame coalescing guard with at least one dependent
+  to schedule, and which `scheduleEffectRun` reaches when
+  `OIMEffectService.INSTANCE.createEffect` finds a source that already moved in the open batch outside a running frame. A dropped channel therefore
+  stops asking its host for frames instead of arming a timer whose flush is
+  guaranteed to return on the flag.
+- **A write after the call is not refused, and it is not unnoticed either.** It
+  passes `assertNotFlushing`, advances the clock, stamps the slot and schedules
+  the dependents it finds — and then asks for no frame, so nothing it scheduled is
+  ever delivered. Do not read "not refused" as "still works".
+- Called with subscribers still standing, their bodies simply never run again —
+  no throw and no report. That is the bargain the name states.
+- There is no checked sibling. One would cost the walk this avoids; if a
+  diagnostic is ever wanted it ships under its own name, not as an option here.
+
+### Frame rules
+
+- **Delivery is coalesced per identity per frame.**
+- **Writes during a FLUSH throw — not just during the frame body:**
+  `OIMChannelService: writes are refused for the whole of a flush — onBeforeFlush and every after-each-frame handler included, …` and then tells you to write after `flush` returns.
+  `flush` raises `channelSlot.isFlushing` before `onBeforeFlush` and lowers it in its
+  `finally`; `assertNotFlushing` throws on `isFlushing` or `frame.isRunning`, so
+  all three phases are refused. Refusal is per channel: a flush of one db's channel does not refuse a
+  write to another db's.
+- **Each door asks once, then writes through `writeWithoutFlushCheck`.** A content service
+  door opens with `assertWritable`, which asks the channel, and every write it
+  makes after that asks nothing. The per-entity ask is NOT
+  removable and stays — user code runs inside a door (`index.keyOf`,
+  `slotEmptinessPolicy.isEmpty`, an `IOIMEntityWriter`) and can call
+  `flush()`, so each entity is a new question. What went is the SECOND and THIRD ask
+  of the same entity.
+- **`flush` during a frame throws:** the message says a frame is already running, and a second one
+  inside it would end the first.
+- **`flush()` from the TAIL of a flush** (`onBeforeFlush`, an after-each-frame
+  handler, or anything either called) returns having done nothing. Not a
+  deferral: one flush spends exactly one frame however many handlers ask for
+  another.
+- **There is NO door that writes from inside a flush.** `subscribeAfterEachFrame`,
+  `subscribeOnceAfterFrame` and `onBeforeFlush` all run inside it. To write in
+  response to a change, write after `flush()` has returned — a tail handler
+  hands the work to a microtask or a later callback rather than writing itself.
+- A refusal raised from a tail handler does NOT reach the caller at the call: it
+  goes to the error policy like any handler throw — logged by default, or thrown
+  out of `flush()` under `OIMThrowAtOnceErrorPolicy`.
+- Effects are isolated under the default policy: a throw is logged and handed to
+  `onError`, and the frame finishes every other effect.
+- **A derivation is asked, never woken.** No frame walks to a computed slot.
+
+### Subscribing
+
+```ts
+const effect = effectService.createEffect(db, () => { paint(slot.entity); }, [slot]);
+effectService.disposeEffect(effect);
+```
+
+A `TOIMEffect` is a plain object with no methods; its behaviour lives in the stateless
+`OIMEffectService.INSTANCE`, which takes the channel map (`db`) on every create and files the effect on its
+`defaultChannelSlot` (`effect.channelSlot`). `createEffect` schedules the new effect when
+the current frame already has writes; it still never receives writes made before it was created.
+For a detached function, `effectService.subscribeEffect(db, roots, computeds, body)` creates the
+effect exactly as `createEffect` does and returns its `TOIMDisposer` — `disposers.push(…)` it,
+or return it from a React cleanup. `oimHoldSlots(slots)` takes one hold on each slot of a list,
+through its owner; to give back a list of holds taken around one write,
+`oimUnholdSlotsIfAlive(slots)` unholds each slot that was not released meanwhile.
+
+Two things about how an effect is filed:
+
+- **The derivation list is deduplicated.** Naming one computed slot twice in the
+  second argument gets it one edge, not two. Nothing is allocated for a list of one
+  or none, and a list that turns out to be distinct keeps the caller's array.
+- **`disposeEffect` unfiles by a remembered position, not by scanning.** Each effect
+  records where it sits in every list it is on; removal swaps in the tail and
+  tells the moved effect its new position. The
+  consequence a consumer can observe: **a slot's `effects` is not in
+  subscription order**, and it never was guaranteed to be.
+- **The moved effect is told by EDGE, not found by search.** Beside `effects` a slot
+  keeps `effectEdges` — for each effect, which of that effect's sources this slot
+  is — and the swap carries both, so the moved effect updates one number. Taking one
+  of two effects off the same N slots reads the other's source list ZERO times (a
+  search read it N(N+1)/2). Only the slot's owner writes either array.
+
+The body's type is `TOIMEffectBody = () => (() => void) | void`. **A returned
+function is the undo**: it is called before the next run of that body and by
+`disposeEffect`.
+
+```ts
+effectService.createEffect(db, () => {
+    const timer = setInterval(poll, 1000);
+    return () => clearInterval(timer);
+}, [slot]);
+```
+
+The return is checked with `typeof`, not for truthiness — `() => set.add(key)`
+hands back the `Set` — so anything that is not a function is discarded. The undo
+is cleared before it is called, so one that throws is not called again by the
+`disposeEffect` behind it.
+
+**A derivation that finds its sources as it reads:** `createOIMSourceTrackingComputedService<TKey, TValue>({ derive, … })` and
+`createOIMSingleSourceTrackingComputedService<TValue>({ derive, … })`. `derive: TOIMSourceTrackingComputedDerive<TValue, TSlot>` is
+`(computedSlot, sourceTracker: OIMSourceTracker) => TValue`; there is no `createSources`, and `createComputedStoreSlot(db)` takes no
+per-store `derive`. Every derive holds what it read and gives back what it no longer reads (new holds first). The slot
+(`TOIMSourceTrackingComputedSlot<TValue, TKey>` / `TOIMSourceTrackingComputedContentSlot<TValue>`, `sourceTracker` set) is read
+through `sourceTracker.readSourceComputedValue` (in `createSourceTrackingEffect` or another source-tracking derive) or through `createEffect`'s fifth list; `createEffect`'s `sourceComputeds` and
+a `createSources` list refuse it by type, because a declared effect subscribes once to the slots under a derivation. When a derive
+switches sources, a source-tracking effect or derivation over it re-subscribes even when the value held. A body that cannot read
+through a tracker may pass them as the fifth list, `createEffect(db, body, sourceSlots, sourceComputeds, sourceTrackingComputeds)`;
+such an effect derives them at creation and re-subscribes when their root slots are replaced. Prefer `createSourceTrackingEffect`: the
+root check runs after every run of such an effect. An effect with no fifth list pays nothing for it. Options otherwise as
+`createOIMComputedService` / `createOIMSingleComputedService` (`sameValueGuard`, `releaseValue`, `initialValue`, `slotReleasePolicy`,
+column options).
+
+**Sources found at read: `createSourceTrackingEffect(db, body)`.** The second way to build
+an effect takes no source lists. The body receives an `OIMSourceTracker`, and what it
+reads through the tracker is what that run depends on — signal-style tracking.
+
+```ts signature
+createSourceTrackingEffect(channelMap: IOIMChannelMap, body: TOIMSourceTrackingEffectBody): TOIMEffect;
+type TOIMSourceTrackingEffectBody = (sourceTracker: OIMSourceTracker) => (() => void) | void;
+class OIMSourceTracker {              // exported as a type; the service builds it
+    readSourceSlot<TSlot extends TOIMSlot>(slot: TSlot): TSlot;          // files the slot, returns it
+    readSourceComputedValue<TValue>(computedSlot: TOIMComputedSlot<TValue, unknown>): TValue; // files it, returns its value
+}
+```
+
+```ts
+const fallback = cardService.writeSlotContentByKey(cards, 'c2', { id: 'c2', title: 'King', rank: 13, deck: 'hearts' });
+effectService.createSourceTrackingEffect(db, sourceTracker => {
+    const isFirst = sourceTracker.readSourceSlot(slot).entity?.rank === 1;
+    paint(sourceTracker.readSourceSlot(isFirst ? slot : fallback).entity);
+});
+```
+
+- The body runs once at creation: that run is what finds the sources.
+- After every run the effect is subscribed to exactly what the run read: a branch not
+  taken is unsubscribed, a slot read twice is subscribed once.
+- A run that reads the same sources in the same order compares each read with the one
+  before and changes no subscription.
+- `createEffect` with declared sources is unchanged; the choice is made per effect, at
+  creation. A returned function is the undo, exactly as for `TOIMEffectBody`.
+
+```ts
+const onRank = effectService.createEffect(db, () => { paint(slot.entity); }, [cardService.columnSlotService.holdColumn(slot, 'rank')]);
+```
+
+**A column effect takes the `TOIMColumnSlot` as a root, not a slot and a name.** Minting the
+column is the caller's call and it is a separate door, on the collection (or single) service:
+`service.holdColumn(slot, columnName)` mints and HOLDS (`service.unholdColumn(columnSlot)` gives it back),
+and `service.getColumn(slot, columnName)` mints and lets the db's unused-slot collector hold it until the end
+of the next flush. Every collection and single service has them (a single entity's doors take the slot its
+service hands back: `settingsService.getColumn(settingsService.getSingleSlot(settings), 'theme')`), and all go
+through the owner's column owner, which is stateless configuration built at construction; the column state —
+the column slots, the column groups, and which columns are referenced — lives on the store slot. Every
+service also has `getAnyColumn(slot)` / `holdAnyColumn(slot)`, a column slot that wakes on any column write to
+its carrier. An index store slot's buckets have the same doors on the index service, taking the bucket slot.
+`createEffect` returns the **effect**, not the column: a column holds no value; read `slot.entity[name]`.
+
+**The name is compile-time checked only as far as the service's column-name type goes** —
+`holdColumn` takes the service's `TColumnName`, which `createOIMSlotContentEntityService` sets to
+`TOIMEntityColumnName<TEntity>`. `TOIMEntityColumnName<TEntity>` is the type that narrows a name to the
+entity's own columns, and `slotContentService.deleteEntityColumns` is typed on it.
+
+**A column group is one column slot for several columns.** `service.getColumnGroup(['rank', 'label'])`
+returns a `TOIMColumnGroup` — `{ key, columnNames }`, the names deduplicated and sorted, a fresh frozen object
+per call; get it once per view, not per entity. `service.holdColumnGroup(slot, columnGroup)` mints and holds
+the group's column slot on `slot`, and `service.unholdColumn(columnSlot)` gives it back. A write wakes it once
+if it changes any of the group's columns and not at all if it changes only others.
+
+**`columnNames` picks the column slot store.** `createOIMSlotCollectionService({ slotContentService, columnNames: ['rank', 'label'] })`
+— and `columnNames` on any factory's options — files the service's column slots by ordinal: every named column
+gets a number, a group gets one at its first slot, and an entity slot's column slots sit in an array by
+number instead of a `Map` per entity slot, which is cheaper to create and give back. `holdColumn` and
+`getColumnGroup` are typed on those names, and a slot for any other column throws. Without `columnNames` the
+store is the `columnSlotStoreService` option, defaulting to the shared map-driven
+a shared map-driven store, and any name is accepted.
+
+---
+
+## `OIMDB` and the three doors
+
+```ts signature
+new OIMDB(options?: TOIMDBOptions)   // see the runtime section for the option list
+```
+
+It owns the shared `clock`, one `collectorSlot` and one `defaultChannelSlot`, all public, and
+holds `entityWriter`, `slotStamp`, `slotReleasePolicy` and `indexKeysService` as the
+defaults every factory reads — `undefined` when not named. **It builds no service**, and `flush()` is its
+only method: `OIMChannelService.INSTANCE.flush(db.defaultChannelSlot)`, which flushes the db's unused-slot
+collector slot once the frame is delivered. `OIMDB` implements `IOIMChannelMap`
+(`{ readonly defaultChannelSlot }`), so every door typed `channelMap: IOIMChannelMap` takes the db.
+
+**There is no default scheduler, on purpose — do not add one and do not generate
+code that wraps every write in `flush()`.** A test calls `db.flush()` itself. An
+application hands it to its orchestrator: with cnstra the whole wiring is
+`cns.addDrainListener(() => db.flush())`, which runs at the end of every synchronous
+turn of every stimulation. Each turn becomes one frame; an `await` inside a neuron
+ends a turn, so a request delivers its loading state first and its data in a later
+frame, with no further code. Every mutation goes through a domain neuron — a write
+from outside the orchestrator is the mistake, not a case to cover with a fallback.
+Full page: `website/docs/guides/with-cnstra.md`.
+
+The doors are free functions, one module each, so a consumer ships only the one they import. Every factory
+takes ONE options object and no `db`; the `db` goes to `createStoreSlot(db)`. Each builds a SERVICE,
+once per collection type; the store slot is made separately:
+
+| Door | Builds | Store slot |
+|---|---|---|
+| `createOIMSlotContentEntityService<TEntity, TKey?, TColumnName?>({ entityWriter?, slotEmptinessPolicy? }?)` | `OIMSlotContentEntityService<TEntity, TKey, TColumnName>`, the entity content service; it creates keyed and single entity slots alike | — |
+| `createOIMSlotCollectionService({ slotContentService, slotStoreService?, slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService? \| columnNames? })` | `OIMWritableSlotCollectionService` over any keyed content service (entity or bucket): the read doors, `writeSlotContentByKey`, the batch doors and `columnSlotService`. `slotStoreService` defaults to a Map store and is REQUIRED by type for an array key (`OIMSlotTreeStoreService`) | `createStoreSlot(db)` |
+| `createOIMSingleSlotService({ slotContentService, slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService? \| columnNames? })` | `OIMWritableSingleSlotService` over any content service with `createSingleSlot` (entity or bucket) | `createStoreSlot(db)` |
+| `createOIMSlotCollectionIndexService({ entityService, columns? \| keyOf?, slotContentService?, bucketSlotStoreService?, slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService? \| columnNames? })` | `OIMSlotCollectionIndexService`, over the entity collection service whose store slots it will index (it takes a `Pick` of `getSlots`); `slotContentService` defaults to an `OIMSlotContentPositionalArrayBucketService`, pass `new OIMSlotContentSetBucketService()` for an unordered one. A scalar key is inferred from ONE inline column or from `keyOf`'s return; an array key (two or more columns, or an array-returning `keyOf`) needs `bucketSlotStoreService: new OIMSlotTreeStoreService(…)` | `createIndexStoreSlot(entityStoreSlot)` |
+| `createOIMSlotCollectionSortedArrayIndexService({ entityService, columns? \| keyOf?, sortColumns, … })` | `OIMSlotCollectionSortedArrayIndexService`: the index whose buckets are kept in the order of `sortColumns` (`readonly TOIMSortColumn<TEntity>[]`, required) through an `OIMSlotContentSortedArrayBucketService`. See [Sorted at write](#sorted-at-write) | `createIndexStoreSlot(entityStoreSlot)` |
+| `createOIMComputedService({ createSources?, derive?, sameValueGuard?, initialValue?, slotReleasePolicy?, computedSlotStoreService?, columnSlotStoreService?, columnNames? })` | `OIMComputedService<TKey, TValue, TComputedStore>`; its reads are on `computedService.computedCollectionService`; `derive` and `createSources` may instead be given per store slot; `computedSlotStoreService` is REQUIRED for a non-Map store (a single: `OIMSingleSlotStoreService`); see [One derivation per key](#one-derivation-per-key) | `createComputedStoreSlot(db, derive?, createSources?)` |
+| `createOIMSortedComputedService({ indexService, sortColumns?, comparator?, slotReleasePolicy?, columnSlotStoreService?, computedSlotStoreService? })` | `OIMSortedComputedService` — per key, the entity slots of the index bucket under that key, sorted; see [Sorted lists](#sorted-lists) | `createSortedStoreSlot(indexStoreSlot)` |
+| `createOIMBucketMemoComputedService({ bucketCollectionService, slotReleasePolicy?, columnSlotStoreService?, computedSlotStoreService? })` | `OIMBucketMemoComputedService` — per key, the bucket's slots as one array; see [The order of a bucket](#the-order-of-a-bucket-as-one-derivation-per-key) | `createBucketMemoStoreSlot(bucketStoreSlot)` |
+
+`entityWriter` and `slotReleasePolicy` on these doors default to those of the
+`defaults` option, so naming one overrides it for that service alone.
+
+**A store aggregate is the store slot with its store methods, so a call does not pass the store slot.**
+`service.createStoreAggregate(storeSlot)` wraps a store slot you have (the collection, single and index
+services each return their own aggregate); `createOIMSlotCollectionStoreAggregate(db, options)` and
+`createOIMSingleSlotStoreAggregate(db, options)` build service + store slot + aggregate in one call, with the
+options of `createOIMSlotCollectionService` / `createOIMSingleSlotService` (a new service per call: for many
+store slots of one type, build the service once).
+
+```ts
+import { createOIMSlotCollectionStoreAggregate } from '@oimdb/core';
+
+const deckStoreAggregate = createOIMSlotCollectionStoreAggregate(db, { slotContentService: createOIMSlotContentEntityService<Card>() });
+const aceSlot = deckStoreAggregate.writeSlotContentByKey('c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' });   // = service.writeSlotContentByKey(storeSlot, 'c1', …)
+deckStoreAggregate.slotContentService.updateEntity(aceSlot, { rank: 14 });
+deckStoreAggregate.storeSlot;      // for hooks, indexes and computeds
+deckStoreAggregate.slotService;    // the service itself
+```
+
+| Aggregate | Methods (the service's, minus the store slot argument) |
+|---|---|
+| `OIMSlotCollectionStoreAggregate` | `findSlotByKey`, `hasSlotContentByKey`, `getSlotByKey`, `holdSlotByKey`, `getSlots`, `getSlotCount`, `openBatch`, `closeBatch`, `writeInBatch` |
+| `OIMWritableSlotCollectionStoreAggregate` | + `writeSlotContentByKey` |
+| `OIMSingleSlotStoreAggregate` | `findSingleSlot`, `hasSingleSlotContent`, `getSingleSlot`, `holdSingleSlot` |
+| `OIMWritableSingleSlotStoreAggregate` | + `writeSingleSlotContent`, `clearSingleSlotContent` |
+| `OIMSlotCollectionIndexStoreAggregate` | the collection methods + `getEntitiesByKey`, `getSlotsByKeys`, `holdSlotsByKeys`, `get/holdBucketColumnByKey`, `get/holdAnyBucketColumnByKey`, `disposeIndexStoreSlot` |
+
+Every aggregate carries `storeSlot`, `slotService` (typed as the service it came from), `slotContentService`.
+Methods that take a slot stay on their service.
+
+**A DOOR ALWAYS PASSES; IT NEVER LETS A CLASS REACH FOR A GLOBAL.** Every option
+a service would otherwise answer with `?? OIMDefaults.x` is in the object its
+door hands it, so there is one answer to each question and not two. Pinned in
+`src/db/tests/which-answer-a-collection-the-root-mints-gets.test.ts`,
+which also fails when an option arrives on a service and is not forwarded,
+when the root mints anything but the channel and the collector, or when a public
+member appears on the root that is not one of the seven it owns.
+
+**`new OIMSlotContentPositionalArrayBucketService({ bucketCommands })` is the content service for a list whose order is yours.** It is — insertion order, never re-decided — that records an
+`OIMBucketCommands` script per bucket. The recorder holds no subscription: it lists store slots on the channel
+slot, and the script lives for one frame.
+
+```ts
+const freshPageService = createOIMSlotCollectionService({ slotContentService: new OIMSlotContentPositionalArrayBucketService<TOIMEntitySlot<Card>>({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: undefined }) }) });
+const freshPage = freshPageService.createStoreSlot(db);
+const freshBucketSlot = freshPageService.holdSlotByKey(freshPage, 'page-1');
+// freshBucketSlot.commands and freshBucketSlot.isWholeListRecorded carry the script; read them in an effect on the bucket slot
+```
+
+---
+
+## `OIMDefaults` — where an optional dependency comes from
+
+`OIMDefaults` is an instance holding the strategies factories fall back on when their own options leave
+them out. Build one with what you want shared and pass it as `defaults` to every factory that should use
+it; a factory given none uses `OIMDefaults.INSTANCE`, which is empty. A field left undefined falls back to
+the built-in default. Nothing is global and nothing can be replaced after the fact.
+
+```ts signature
+new OIMDefaults({
+    slotStamp?: IOIMSlotStamp<TOIMSlot>;                                       // none
+    slotReleasePolicy?: IOIMSlotReleasePolicy;                                 // none: a slot with a value stays
+    entityWriter?: IOIMEntityWriter;                                           // createOIMInPlaceEntityWriter()
+    entitySlotEmptinessPolicy?: IOIMSlotEmptinessPolicy<TOIMEntityContentSlot>; // "empty means slot.entity === undefined"
+    indexKeysService?: IOIMIndexKeysService;                                   // OIMAppendingIndexKeysService
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>;     // a shared map-driven store
+    computedColumnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>; // a shared map-driven store
+    storeSlotListener?: IOIMStoreSlotListener;                                 // OIMNoStoreSlotListener: hears nothing
+}?)   // TOIMDefaultsOptions
+```
+
+```ts
+const replacingDefaults = new OIMDefaults({ entityWriter: createOIMReplacingEntityWriter() });
+const replacingCardService = createOIMSlotCollectionService({
+    defaults: replacingDefaults,
+    slotContentService: createOIMSlotContentEntityService<Card>({ defaults: replacingDefaults }),
+});
+```
+
+An option given to a factory wins over `defaults`; `defaults` wins over the built-in default. A tool that
+wants to hear every store slot (devtools' `oimDevDefaults`) is a `defaults` with a `storeSlotListener`.
+
+**Each built-in default is its own module, so reaching one retains only its arm.** Every built-in default
+lives in its own file under `packages/core/src/db/constants/` as an `OIMDefaultValue` whose `getValue()`
+builds it on the first call and hands the same instance back after; a factory reads the modules it needs.
+`OIMDefaults` imports none of them, so importing it retains no arm.
+`packages/core/tests/what-an-import-retains.test.ts` pins it — *"a default is one door to its own arm, and
+the defaults class to none of them"*.
+
+---
+
+## Entity services
+
+**An entity collection is two objects: the content service and the collection service.** The entity content
+service (`OIMSlotContentEntityService`) is the writes and reads of entities, built once per collection type
+with its slot owner; the collection service (`OIMSlotCollectionService`) over it is the read and column doors.
+Neither holds an entity: each `createStoreSlot(db)` is one instance of that type's store.
+
+```ts signature
+createOIMSlotContentEntityService<TEntity, TKey?, TColumnName?>({
+    entityWriter?: IOIMEntityWriter;                                   // defaults.entityWriter, then the in-place writer
+    slotEmptinessPolicy?: IOIMSlotEmptinessPolicy<TOIMEntityContentSlot<TEntity>>;  // defaults.entitySlotEmptinessPolicy, then "entity is undefined"
+}?): OIMSlotContentEntityService<TEntity, TKey, TColumnName>
+
+createOIMSlotCollectionService({
+    slotContentService,
+    slotStoreService?: IOIMSlotStoreService<TKey, TSlot, TStore>;      // Map; REQUIRED for an array key
+    slotReleasePolicy?: IOIMSlotReleasePolicy;                         // defaults.slotReleasePolicy, then OIMSlotAtEmptyReleasePolicy
+    slotSubscriptionListener?: IOIMSlotSubscriptionListener;           // OIMNoSlotSubscriptionListener
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>; // defaults.columnSlotStoreService, then a shared map store
+    columnNames?: readonly TColumnName[];                              // the ordinal column store over those names
+}): OIMWritableSlotCollectionService<TKey, TOIMEntitySlot<TEntity, TKey>, TStore, TEntity, …>
+collectionService.createStoreSlot(db): TOIMStoreSlot<TStore, TOIMEntitySlot<TEntity, TKey>, Partial<TEntity>, typeof collectionService>
+```
+
+**Each collection type has its own column owner.** It is stateless configuration built with the slot owner
+over `columnSlotStoreService` (or the ordinal store `columnNames` names); the column state — the column slots,
+the column groups, and which columns are referenced — lives on the store slot. The doors are on the
+collection's `columnSlotService` (`getColumn`, `holdColumn`, `unholdColumn`, `getColumnGroup`, `holdColumnGroup`,
+`getAnyColumn`, `holdAnyColumn`). The column owner has two strategies, chosen by the factory: write-driven
+column slots, woken by the marks a write makes (`OIMPushColumnSlotOwner`, entities and buckets), and
+derive-driven column slots, each a computed slot over its carrier (`OIMPullColumnSlotOwner`, computeds).
+
+Example, over the `db`, `cardService`, `cards` and `slot` of the setup block:
+
+```ts
+const effect = effectService.createEffect(db, () => { console.log(slot.entity?.title); }, [slot]);
+cardService.slotContentService.updateEntity(slot, { title: 'Ace of Spades' });
+db.flush();
+effectService.disposeEffect(effect);
+```
+
+Assembled with a store service of your own:
+
+```ts
+const baseCardService = createOIMSlotCollectionService({
+    slotContentService: createOIMSlotContentEntityService<Card, string>(),
+    slotStoreService: new OIMSlotMapStoreService<TOIMEntitySlot<Card, string>>(),
+});
+const baseCards = baseCardService.createStoreSlot(db);
+```
+
+The writer is omitted because the db and `OIMDefaults` supply it, and so is the column store. The slot stamp
+is not an option of any factory: it is `new OIMDefaults({ slotStamp })`, passed as `defaults`.
+
+### Public properties
+
+| Property | Of | Type |
+|---|---|---|
+| `slotContentService` | the collection service | the content service: the write doors on a slot |
+| `columnSlotService` | the collection service | `OIMColumnSlotService`: the column doors |
+| `slotService` | the store slot | the service that created it |
+
+A store slot is not a slot, so nothing holds, subscribes or wakes it: there is no
+`effectService.createEffect(db, [cards], …)` that hears the population. "Something in this population changed" is an
+index over the store slot and a subscription to its bucket — the bucket's door
+is written when an entity slot joins or leaves it — or a content-change listener on the store slot
+(`OIMSlotContentChangeListenerService.INSTANCE.addContentChangeListener(storeSlot, listener, readColumnNames)`,
+removed by the same listener object). The slot owner is what `slot.owner` points at for every slot the type
+filed, in every one of its store slots; `slot.storeSlot` names which store slot.
+
+**THERE IS NO DOOR THAT HANDS BACK "THE ENTITY SLOTS THAT HOLD A VALUE".** A store slot
+keeps no bucket of its own. To read the whole population, walk `getSlots(storeSlot)` — every
+slot filed in that store slot, in store order — and skip the ones whose
+`oimIsSlotEmpty` says they hold nothing:
+
+```ts
+cardService.getSlotCount(cards);                     // how many ids are filed, empty ones included
+for (const filedSlot of cardService.getSlots(cards)) {
+    if (oimIsSlotEmpty(filedSlot)) continue;
+    paint(filedSlot.entity);
+}
+```
+
+To have that answer MAINTAINED and subscribable instead of walked, declare an
+index keyed on the entity's own id (`keyOf: (card: Card) => card.id`) and hold the key
+you want. An index's bucket is an injected lifetime — a
+`slotReleasePolicy` — so it is the consumer who says how long the
+answer outlives its last reader.
+
+An index maintains buckets only while they are held, filing entity slots from the source
+store slot on every write by the entity's key value. The bucket is created on first
+`holdSlotByKey` by walking the source store slot's slots once, and released on the last give-back.
+
+**`holdColumn(slot, columnName)`** is on the collection's `columnSlotService` and takes a hold on a column slot;
+`service.columnSlotService.unholdColumn(columnSlot)` gives that hold back. **`service.columnSlotService.getColumn(slot, columnName)`**
+returns the same column slot without a hold: a column slot it mints is held by the
+unused-slot collector until the end of the next flush, so `getColumn` is
+the door that does not hold but tracks. `findSlotByKey(storeSlot, key)?.entity` reads the entity
+itself, so it mints nothing: a miss answers `undefined` and leaves no slot behind.
+
+### The doors every service has
+
+**The read doors are the collection service's and take the store slot first; the write doors are the content
+service's.** Every collection service (entity, bucket, index, and a computed's `computedCollectionService`) has
+the read doors below; a single slot service has `getSingleSlot` / `holdSingleSlot` / `findSingleSlot` /
+`hasSingleSlotContent` in their place.
+
+```ts signature
+class OIMSlotCollectionService<TKey, TSlot, TStore, TSlotContentService, TColumnName, …> {
+    readonly slotContentService: TSlotContentService;
+    createStoreSlot(channelMap: IOIMChannelMap): TOIMStoreSlot<TStore, TSlot, TPatch>;
+    createStoreSlotFrom(sourceStoreSlot: TOIMStoreSlot): TOIMStoreSlot<TStore, TSlot, TPatch>;
+    findSlotByKey(storeSlot, key): TSlot | undefined;
+    hasSlotContentByKey(storeSlot, key): boolean;
+    getSlotByKey(storeSlot, key): TSlot;
+    holdSlotByKey(storeSlot, key): TSlot;
+    getSlots(storeSlot): IterableIterator<TSlot>;
+    getSlotCount(storeSlot): number;
+    isSameKey(key, otherKey): boolean;
+    openBatch(storeSlot): void;
+    closeBatch(storeSlot): void;
+    writeInBatch<TResult>(storeSlot, write: () => TResult): TResult;
+    readonly columnSlotService: OIMColumnSlotService;   // getColumn / holdColumn / getAnyColumn / holdAnyColumn / getColumnGroup / holdColumnGroup / unholdColumn
+}
+// createOIMSlotCollectionService returns OIMWritableSlotCollectionService, which adds:
+//     writeSlotContentByKey(storeSlot, key, content, changedSlots?): TSlot
+// createOIMSingleSlotService returns OIMWritableSingleSlotService, which adds:
+//     writeSingleSlotContent(storeSlot, content, changedSlots?): TSlot;  clearSingleSlotContent(storeSlot): void
+```
+
+| Door | Of | Signature | Mints? |
+|---|---|---|---|
+| `getSlotCount(storeSlot)` | collection | `number` | no |
+| `getSlots(storeSlot)` | collection | `IterableIterator<TSlot>` | no |
+| `findSlotByKey(storeSlot, key)` | collection | `TSlot \| undefined` — the store lookup alone; takes no hold and leaves nothing tracked | no |
+| `getSlotByKey(storeSlot, key)` | collection | `TSlot` — never `undefined`; minted if missing, then tracked by the unused-slot collector | **yes** |
+| `holdSlotByKey(storeSlot, key)` | collection | `TSlot` — minted if missing, `holdCount` up by one | **yes** |
+| `hasSlotContentByKey(storeSlot, key)` | collection | `boolean` — **does this key have content right now**, not whether an identity is filed under it: a slot a read or a hold minted and nobody wrote answers `false`. It hands back no slot, which is why it can answer without minting, and it is not a read: the answer is about the past the moment it returns | no |
+| `isSameKey(key, otherKey)` | collection | `boolean` — whether two keys name one slot here, answered by the store service (SameValueZero for a Map store, part by part for a tree store) | no |
+| `writeSlotContentByKey(storeSlot, key, content, changed?)` | collection | `TSlot` — **total; always the identity it resolved or minted**. A hit writes the whole value through `slotContentService.writeSlotContent`, a miss mints and `insertSlotContent`s | **yes** |
+| `writeSlotContent(slot, content)` | content | `boolean` — on a slot you already hold; the boolean is about the CONTENT | no |
+| `clearSlotContent(slot)` | content | `void` — it takes the value, not the identity | no |
+| `markContentChanged(bucketSlot)` | bucket content | `void` — re-settle emptiness and re-ask the guard after a write you made another way; the entity counterpart is `markEntityChanged(slot, changedColumns?)` | no |
+| `slot.owner.holdSlot(slot)` / `slot.owner.unholdSlot(slot)` | `void` — the `IOIMSlotOwner` pair; `unholdSlot` on an unheld slot throws by name | no |
+| `slot.owner.releaseSlotIfUnheld(slot)` | `void` — run the release guard; it releases nothing unless the slot is unheld, unreferenced, still owned here and out of grace | no |
+
+**`releaseSlotIfUnheld` is PUBLIC and it is still not a "release" door.** It is public because the release queue calls it through
+`slot.owner`, and it is a guard, not a command: on a held, referenced, foreign-
+owned or in-grace slot it returns having done nothing, and on an
+already-released one it returns silently rather than throwing.
+
+**`writeSlotContentByKey` does not file a key whose content is refused.** On a MISS it
+mints, writes inside a `try`, and on a throw runs the release guard on what it
+just minted before re-raising — so the caller's error is the only thing that
+leaves. The HIT path looks
+the key up first and never mints, so a refused write on an existing key leaves
+that key exactly as it was.
+
+**REFUSED IS NOT UNCHANGED**, and the two get opposite answers:
+
+| | What happened | What the caller gets |
+|---|---|---|
+| **Refused** | The write threw; **no content ever arrived** | The throw. A key minted for it is unwound — `writeSlotContentByKey` files nothing |
+| **Unchanged** | The write **did** happen and the content was already there | The identity, like any other write. Nothing is unwound |
+
+`writeSlotContentByKey` is **total**: whatever it decides about the content, it hands back
+the identity it resolved or minted. A door that mints must leave a reference
+behind, which is the one test that admits a door at all.
+
+**`changed?` — the verdict, into an array you own.**
+
+```ts
+const changed: TOIMEntitySlot<Card, TOIMStoreKey>[] = [];
+cardService.writeSlotContentByKey(cards, 'c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' }, changed);   // pushed exactly when the content differed
+```
+
+- **Optional, yours, and appended to** — never read by the engine, never cleared.
+  The slot is pushed exactly when the write put in content different from what
+  the slot held.
+- A batch therefore comes out of one loop as the list of entity slots that **actually
+  changed**, which is what a consumer owning a bucket this engine does not
+  maintain needs.
+- It is an out-parameter and not a return because the return is spoken for (see
+  above), and a `{ slot, changed }` record would allocate once per write on the
+  path this exists to make cheaper. What it costs a caller who does not want it
+  is one `undefined` compare per write.
+
+---
+
+## Writing
+
+The keyed write is on the collection; every other write is on its content service, `service.slotContentService`,
+and takes the slot alone. There is no `keyOf`: the caller names the key. There are no bulk writes: a load is a
+loop of single writes inside `service.writeInBatch(storeSlot, () => { … })`.
+
+| Call | Signature |
+|---|---|
+| `service.writeSlotContentByKey(storeSlot, key, entity, changedEntitySlots?)` | `(storeSlot, TKey, TEntity, TOIMEntitySlot<TEntity, TKey>[]?) => TOIMEntitySlot<TEntity, TKey>` — **total**: a miss mints and fills, a hit writes the whole value |
+| `writeSlotContent(slot, entity)` | `(slot, TEntity) => boolean` — the whole value onto a slot you hold; columns it had and `entity` does not, go |
+| `updateEntity(slot, patch)` | `(slot, Partial<TEntity>) => slot` |
+| `updateEntityColumn(slot, columnName, value)` | `<C extends keyof TEntity & string>(slot, C, TEntity[C]) => slot` — one column, no patch object and no walk over it |
+| `clearSlotContent(slot)` | `(slot) => void` — the entity goes; the identity stays while anything refers to it |
+| `markEntityChanged(slot, changedColumns?)` | `(slot, readonly (keyof TEntity & string)[]?) => void` |
+| `deleteEntityColumns(slot, columnNames)` | `(slot, readonly TOIMEntityColumnName<TEntity>[]) => slot` — the named columns go |
+| `service.writeInBatch(storeSlot, write)` | `<TResult>(storeSlot, () => TResult) => TResult` — an index on the collection hears the whole batch in one call |
+| `service.findSlotByKey(storeSlot, key)?.entity` | the entity alone; mints nothing |
+
+- **The store keeps your object by default.** Under the default `oimInsertEntityWithoutCopy` the
+  slot holds the object you hand in, so with the in-place writer a later update edits that
+  same object; pass `entityInserter: oimInsertEntityWithCopy` to store `{ ...entity }`
+  and leave your object untouched. After an insert, change the object only through the
+  content service (`updateEntity`, or `markEntityChanged` after a hand edit): editing it and calling
+  `writeSlotContent` with the same object again wakes nobody, because no column reads as changed. `oimInsertEntityWithSanitizedCopy` also removes an own
+  `__proto__` key: pick it for untrusted JSON.
+- `updateEntity` takes a **patch** — named columns move, unnamed ones stay.
+  `writeSlotContentByKey` and `writeSlotContent` take a **whole value**, and a column the new value does not name
+  is removed from the entity.
+- A write that moves no column wakes nobody.
+- **`writeSlotContentByKey` always hands back the slot**, whatever the write changed.
+- **`changedEntitySlots?`**: optional, yours, appended with the
+  entity slots whose content was different from what they already held. One array reused
+  across a whole batch is the intended use, so a
+  pass over its slots costs the entities that changed rather than the entities that
+  arrived. It is never cleared — you empty it.
+
+```ts
+const changed: TOIMEntitySlot<Card, TOIMStoreKey>[] = [];
+cardService.writeInBatch(cards, () => {
+    for (const card of payload) cardService.writeSlotContentByKey(cards, card.id, card, changed);
+});
+for (const slot of changed) reindex(slot);   // the re-sent entities are not in here
+changed.length = 0;
+```
+
+### `markEntityChanged` — you mutated the entity yourself, now say so
+
+```ts signature
+markEntityChanged(
+    slot: TOIMEntitySlot<TEntity, TKey>,
+    changedColumns?: readonly (keyof TEntity & string)[],
+): void
+```
+
+Every other write door computes what moved: the writer walks the patch
+(`oimPatchEntityColumns`, `oimPutEntityColumns`) and puts each value through `sameValueGuard`. A caller who edited the stored object by hand
+already knows the answer, and this door takes it instead of recomputing it — no
+patch object, no copy, no per-column comparison. The shape is: mutate
+`slot.entity`, then report it.
+
+```ts
+slot.entity!.title = 'two';
+cardService.slotContentService.markEntityChanged(slot, ['title']);
+```
+
+- **The hand mutation already compiles.** `TOIMEntitySlot` declares
+  `readonly entity: TEntity | undefined`, and `readonly` forbids REPLACING the
+  object, not writing its columns — `entity.title = 'two'` needs no cast, only
+  the usual narrowing of `| undefined`. `TOIMEditable<TSlot>` is what strips
+  `readonly` from the field itself, which is what assigning `slot.entity` needs.
+- **With a list, only the named columns wake. Without it, every watched column
+  does** — the column owner walks the slot's whole column store, and a
+  column slot exists there only while something holds it or subscribes to it
+  (the slot owner drops it otherwise, in `releaseSlotIfUnheld`), so "watched" is exactly
+  what the store holds. **Pass the list.** The no-argument form is the convenient
+  one and it gives back the per-column walk this door exists to skip.
+- **An empty list wakes nothing at all** — not the columns, not the entity slot, not the
+  store slot's listeners. `[]` is the caller saying nothing moved, so it returns before
+  anything is marked: a write that changes nothing wakes nobody here too.
+- **With either of the other two it wakes the entity slot and the store slot's content-change listeners**, so an
+  effect on the slot itself and an index over the store slot both see a hand mutation.
+- **It re-stamps emptiness** whenever emptiness can depend on the mutation — with no column list,
+  on a slot whose `entity` is `undefined`, and on a content service with a `slotEmptinessPolicy` other than
+  "the entity is `undefined`", a release policy that releases written slots, or a db with a
+  `slotStamp` — so a hand mutation that emptied the entity leaves `oimIsSlotEmpty(slot)`
+  true rather than lying, and the release guard can take the identity when it should.
+- **It refuses inside a frame**, through the same `assertWritable` →
+  `OIMChannelService.INSTANCE.assertNotFlushing(channelSlot)` as every other write, and throws on a released
+  identity.
+- **The column names are type-checked**: `keyof TEntity & string` rejects a
+  misspelt name, a bare runtime `string`, and a slot of another entity type.
+
+---
+
+## Write strategies
+
+A **writer** is the operations that move an entity's columns, and nothing
+else: it reaches no channel, takes no holds and knows nothing about lifetime.
+Both strategies ship as factories; the fork is chosen once, as the content service's `entityWriter`
+(or for every factory given it, `new OIMDefaults({ entityWriter })` as `defaults`).
+
+```ts signature
+interface IOIMEntityWriter {
+    readonly fillEntity: (slot: TOIMEntityContentSlot, entity: object) => void;
+    readonly putEntity: (slot: TOIMEntityContentSlot, entity: object, changedColumnNames: string[] | undefined) => boolean;
+    readonly patchEntity: (slot: TOIMEntityContentSlot, patch: object, changedColumnNames: string[] | undefined) => boolean;
+    readonly patchColumn: (
+        slot: TOIMEntityContentSlot, columnName: string, value: unknown, changedColumnNames: string[] | undefined,
+    ) => boolean;
+    readonly deleteColumns: (slot: TOIMEntityContentSlot, names: readonly string[]) => readonly string[];
+    readonly clearEntity: (slot: TOIMEntityContentSlot) => void;
+}
+
+type TOIMEntityWriterOptions = {
+    sameValueGuard?: TOIMSameValueGuard;
+    entityInserter?: TOIMEntityInserter;
+    putEntityColumns?: typeof oimPutEntityColumns;      // oimPutEntityColumns | oimGuardedPutEntityColumns
+    patchEntityColumns?: typeof oimPatchEntityColumns;  // oimPatchEntityColumns | oimGuardedPatchEntityColumns
+    patchEntityColumn?: typeof oimPatchEntityColumn;    // oimPatchEntityColumn | oimGuardedPatchEntityColumn
+};
+
+createOIMInPlaceEntityWriter(options?: TOIMEntityWriterOptions): IOIMEntityWriter    // stored object keeps its identity
+createOIMReplacingEntityWriter(options?: TOIMEntityWriterOptions): IOIMEntityWriter  // a new object per write that changed something
+```
+
+`entityInserter` is the first-write strategy: `oimInsertEntityWithoutCopy` (the default) stores
+your object itself, `oimInsertEntityWithCopy` stores `{ ...entity }`, `oimInsertEntityWithSanitizedCopy`
+stores a copy with an own `__proto__` key removed (for untrusted JSON).
+
+`deleteColumns` hands back **the names that actually moved**, a frozen empty
+array when nothing did — that list is what the entity content service routes to
+column subscribers, and it is why a write that changes nothing wakes nobody.
+**`putEntity` and `patchEntity` answer whether anything moved, and name the moved
+columns only into the array they are handed**: one pass compares and writes (a put
+then walks the stored columns the new value lacks), and with `undefined` they build
+no list at all. The entity content service asks whether the slot has changed-column readers — the slot has
+column slots, or its store slot has a content listener such as an index — and hands
+an array only then, so a write of an entity nobody reads by column allocates no names.
+The list it builds goes on to the listeners: an index wakes a bucket column exactly
+when a member's value of it changed, left, or became `undefined`. The first write
+into an empty slot tells listeners `undefined` ("everything"), not an empty list. `sameValueGuard` defaults to `oimSameValueZeroGuard` and is the
+per-column comparison that decides "moved".
+
+`putEntity` is PUT, `patchEntity` is PATCH (HTTP semantics). PUT makes the stored entity
+the value handed in — changed columns written, columns the value lacks removed — in ONE
+call, returning both sets of names; PATCH writes only the columns named. `writeSlotContentByKey`
+of a key that already has a value and `slotContentService.writeSlotContent(slot, entity)` are PUT: a whole-entity
+write that drops a column is ONE channel write of the slot, and the replacing writer
+builds ONE new object.
+
+Pick `createOIMReplacingEntityWriter` when something downstream compares by
+reference — a React `useSyncExternalStore` snapshot, a memo, a shallow-equal
+selector. Under `createOIMInPlaceEntityWriter` the entity reference never moves,
+so a value comparison never fires and a binding needs a counter bumped inside its
+handler. Replacing allocates one object per changed write; in-place allocates
+none.
+
+Neither writer `delete`s: a column a PUT drops or `deleteColumns` takes away is
+written `undefined` — into the stored object in place, into a spread copy when
+replacing — so the entity keeps its hidden class, and the key stays in
+`Object.keys` and `in`. A column holding `undefined` counts as absent — a later write that
+leaves it out does not report it, and taking the entity away does not wake its
+readers.
+
+**Neither strategy reports anything.** Reporting is `OIMSlotContentEntityService`'s:
+after the writer returns, it marks the slot on the channel and tells the store slot's content-change listeners
+once for the whole write.
+
+**A writer of your own** reuses the column walks both shipped writers run:
+
+```ts signature
+oimPatchEntityColumns(slot, patch: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPatchEntityColumn(slot, columnName: string, value: unknown, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPutEntityColumns(slot, entity: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimGuardedPutEntityColumns(slot, entity: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimGuardedPatchEntityColumns(slot, patch: object, sameValueGuard, changedColumnNames, targetOf)        // same signature as the unguarded walk
+oimGuardedPatchEntityColumn(slot, columnName: string, value: unknown, sameValueGuard, changedColumnNames, targetOf)
+```
+
+Each compares every column through `sameValueGuard`, writes the moved ones into
+the object `targetOf` hands back on the first move (the stored entity in place, a
+copy when replacing), pushes their names into `changedColumnNames` when it is an
+array, and returns that object; `undefined` means nothing moved or the slot holds
+no entity. The put walk also writes `undefined` over every column the new value
+lacks. Each walk is a strategy, an option of the writer factories (`TOIMEntityWriterOptions`), and each
+ships two arms:
+
+| Option | Default (unguarded) | Guarded arm |
+|---|---|---|
+| `putEntityColumns` | `oimPutEntityColumns` — skips neither `__proto__` keys nor inherited stored columns | `oimGuardedPutEntityColumns` — skips both |
+| `patchEntityColumns` | `oimPatchEntityColumns` — every enumerable key of the patch, `__proto__` included | `oimGuardedPatchEntityColumns` — skips a `__proto__` key and a key the patch does not own |
+| `patchEntityColumn` | `oimPatchEntityColumn` | `oimGuardedPatchEntityColumn` — refuses the column name `__proto__` |
+
+Take the guarded arms, at a cost on every write, for values that can carry a `__proto__` key or are class
+instances — `createOIMInPlaceEntityWriter({ putEntityColumns: oimGuardedPutEntityColumns,
+patchEntityColumns: oimGuardedPatchEntityColumns, patchEntityColumn: oimGuardedPatchEntityColumn })`, the
+same options on `createOIMReplacingEntityWriter`. The writer decides only where the result goes — this one
+stores every value frozen:
+
+```ts
+const copyColumns = (entity: Record<string, unknown>): Record<string, unknown> => ({ ...entity });
+
+function storeFrozen(slot: TOIMEntityContentSlot, next: Record<string, unknown> | undefined): boolean {
+    if (next === undefined) return false;
+    (slot as TOIMEditable<TOIMEntityContentSlot>).entity = Object.freeze(next);
+    return true;
+}
+
+const replacingWriter = createOIMReplacingEntityWriter();
+
+const freezingWriter: IOIMEntityWriter = {
+    fillEntity: (slot, entity) => { storeFrozen(slot, copyColumns(entity as Record<string, unknown>)); },
+    clearEntity: replacingWriter.clearEntity,
+    putEntity: (slot, entity, changedColumnNames) =>
+        storeFrozen(slot, oimPutEntityColumns(slot, entity, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    patchEntity: (slot, patch, changedColumnNames) =>
+        storeFrozen(slot, oimPatchEntityColumns(slot, patch, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    patchColumn: (slot, columnName, value, changedColumnNames) =>
+        storeFrozen(slot, oimPatchEntityColumn(slot, columnName, value, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    deleteColumns: (slot, names) => {
+        const deleted = replacingWriter.deleteColumns(slot, names);
+        if (deleted.length !== 0) storeFrozen(slot, slot.entity as Record<string, unknown>);
+        return deleted;
+    },
+};
+```
+
+---
+
+## Single entities
+
+A single entity — one value under no key, such as settings or a session — is a store slot of an
+`OIMSingleSlotService` over an entity content service; its store service is `OIMSingleSlotStoreService.INSTANCE`,
+which files at most one slot per store slot. It has no key and no by-key doors: its doors name the one slot.
+
+```ts signature
+createOIMSingleSlotService({
+    slotContentService: createOIMSlotContentEntityService<TEntity>(),
+    slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService?, columnNames?,
+}): OIMWritableSingleSlotService<TOIMEntityContentSlot<TEntity>, TEntity, …>
+
+class OIMWritableSingleSlotService<TSlot, TContent, TSlotContentService, …> {
+    readonly slotContentService: TSlotContentService;
+    readonly columnSlotService: OIMColumnSlotService;
+    createStoreSlot(channelMap: IOIMChannelMap): TOIMStoreSlot<TOIMSingleSlotStore<TSlot>, TSlot, TPatch, this>;
+    writeSingleSlotContent(storeSlot, content, changedSlots?): TSlot;   // minted if missing
+    clearSingleSlotContent(storeSlot): void;
+    findSingleSlot(storeSlot): TSlot | undefined;     // mints nothing
+    hasSingleSlotContent(storeSlot): boolean;         // mints nothing
+    getSingleSlot(storeSlot): TSlot;                  // minted if missing, tracked until the next flush
+    holdSingleSlot(storeSlot): TSlot;                 // minted if missing, holdCount up by one
+}
+```
+
+One service serves every single entity of that type: each `createStoreSlot(db)` is another one, and starts
+with no value until something writes it. Its store slot is a `TOIMSingleSlotStoreSlot`, which is what
+`@oimdb/persist`'s single-entity source takes.
+
+```ts
+type Settings = { theme: 'light' | 'dark'; zoom: number };
+
+const settingsService = createOIMSingleSlotService({ slotContentService: createOIMSlotContentEntityService<Settings>() });
+const settings = settingsService.createStoreSlot(db);
+settingsService.writeSingleSlotContent(settings, { theme: 'light', zoom: 1 });
+const settingsSlot = settingsService.holdSingleSlot(settings);
+const themeColumn = settingsService.columnSlotService.holdColumn(settingsSlot, 'theme');
+const themeEffect = effectService.createEffect(db, () => { console.log(settingsSlot.entity?.theme); }, [themeColumn]);
+settingsService.slotContentService.updateEntity(settingsSlot, { theme: 'dark' });
+db.flush();
+effectService.disposeEffect(themeEffect);
+settingsService.columnSlotService.unholdColumn(themeColumn);
+settingsSlot.owner.unholdSlot(settingsSlot);
+```
+
+**The slot is reached only through the service.** `getSingleSlot(storeSlot)` hands back the live slot, and
+mints a fresh one — tracked by the unused-slot collector until the next flush — when there is none;
+`holdSingleSlot(storeSlot)` does the same and takes a hold. `writeSingleSlotContent` and `clearSingleSlotContent`
+are the store doors, and every slot door of the content service (`updateEntity`, `updateEntityColumn`,
+`deleteEntityColumns`, `writeSlotContent`, `markEntityChanged`, `clearSlotContent`) takes that slot.
+
+The slot is of the keyed entity slot's literal shape (with `key: undefined` and `indexKeys: undefined`), and its
+`storeSlot` is `settings` — so
+`effectService.createEffect(db, [settingsSlot], [], …)` works and a column of it is a root like any other.
+Its key is `undefined`, and its store is `{ slot }` (`TOIMSingleSlotStore`). Its lifetime is the
+`slotReleasePolicy` (`defaults.slotReleasePolicy`, then `OIMSlotAtEmptyReleasePolicy`), so a single entity that holds a value
+stays; one emptied and unheld is released, and the slot `getSingleSlot` mints next holds no entity. The value
+is stored by the writer's `entityInserter`, which by default keeps the object handed in rather than a copy.
+
+---
+
+## Buckets
+
+A bucket collection is, like an entity collection, a content service and the collection service over it.
+The content service is the strategy — how a bucket keeps its member slots — and it is chosen at the factory:
+
+```ts signature
+createOIMSlotCollectionService({
+    slotContentService: new OIMSlotContentPositionalArrayBucketService<TBucketMemberSlot>(),   // or one of the others below
+    slotStoreService?: IOIMSlotStoreService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore>;      // Map; REQUIRED for an array key
+    slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService?, columnNames?,
+}): OIMWritableSlotCollectionService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore, readonly TBucketMemberSlot[], …>
+
+new OIMSlotContentSetBucketService<TBucketMemberSlot>({ bucketCommands? })
+new OIMSlotContentPositionalArrayBucketService<TBucketMemberSlot>({ bucketCommands?, bucketMemberSlotsArrayService? })
+new OIMSlotContentSortedArrayBucketService<TBucketMemberSlot>({ compareBucketMemberSlots, bucketCommands?, bucketMemberSlotsArrayService? })
+// bucketMemberSlotsArrayService: OIMBucketMemberSlotsArrayService (every mention, the default)
+//                                or new OIMBucketUniqueMemberSlotsArrayService<TBucketMemberSlot>() (each slot once)
+```
+
+A bucket holds bucket member slots of any slot type — entity slots, bucket slots, computeds — and its
+type parameter `TBucketMemberSlot extends TOIMSlot` (default `TOIMEntitySlot`) is that slot type, not the
+entity type. The services hold no bucket: `createStoreSlot(db)` is one keyed set of buckets, the read doors
+of the collection service take that store slot first, and the bucket doors of the content service take the
+bucket slot.
+
+```ts
+const colourService = createOIMSlotCollectionService({ slotContentService: new OIMSlotContentSetBucketService<TOIMEntitySlot<Card>>() });
+const colours = colourService.createStoreSlot(db);
+const red = colourService.holdSlotByKey(colours, 'red');
+colourService.slotContentService.writeSlotContent(red, [slot, cardService.getSlotByKey(cards, 'c2')]);
+db.flush();
+for (const deckSlot of colourService.slotContentService.getBucketMemberSlots(red)) { paint(deckSlot.entity); }
+colourService.slotContentService.clearSlotContent(red);
+red.owner.unholdSlot(red);
+```
+
+Every door below is the bucket content service's and takes the bucket slot:
+
+| Door | Signature |
+|---|---|
+| `writeSlotContent(bucketSlot, bucketMemberSlots)` | `boolean` — states the whole bucket; idempotent; true when anything arrived or departed |
+| `getBucketMemberSlotsMissingFrom(bucketSlot, bucketMemberSlots)` | `TBucketMemberSlot[]` — the members the given list leaves out, so a sync can write into them (clear a group key, set a deleted flag) instead of dropping them |
+| `addBucketMemberSlot(bucketSlot, bucketMemberSlot)` / `addBucketMemberSlots(bucketSlot, bucketMemberSlots)` | joins the named bucket member slots and touches nothing else. REMOVES NOTHING |
+| `removeBucketMemberSlot(bucketSlot, bucketMemberSlot)` / `removeBucketMemberSlots(bucketSlot, bucketMemberSlots)` | takes the named bucket member slots out and touches nothing else |
+| `clearSlotContent(bucketSlot)` | empties it |
+| `getBucketMemberSlots(bucketSlot)` | `Iterable<TBucketMemberSlot>` |
+| `getBucketMemberSlotCount(bucketSlot)` | `number` |
+| `hasBucketMemberSlot(bucketSlot, bucketMemberSlot)` | `boolean` — the content service's own membership test: one `Set.has` on a set bucket; on an array bucket its `bucketMemberSlotsArrayService.hasBucketMemberSlot` (a `Set.has` when unique, `indexOf` otherwise) |
+| `markBucketColumnsChanged(bucketSlot, patch, changedColumns)` | `void` — tell the bucket's column slots which member columns moved |
+| `markContentChanged(bucketSlot)` | `void` — re-settle emptiness and re-ask the release guard after a write made another way |
+| `fillBucketMemberSlots(bucketSlot, bucketMemberSlots)` | `void` — fills a bucket slot nobody was told about yet; it throws on one that was already announced, which `addBucketMemberSlots` / `writeSlotContent` are for |
+
+The entities of a bucket by key are the index's door, `indexService.getEntitiesByKey(indexStoreSlot, key)`
+([The index that fills itself](#the-index-that-fills-itself--oimindexservice)).
+
+### Which door: you hold the answer, or you hold the delta
+
+`writeSlotContent` is for a caller who has THE LIST THAT SHOULD BE THERE and does not
+know what changed — a search result, a page from a server, a filter re-run. One
+call, and the engine works out the arrivals and the departures. Its cost is
+proportional to WHAT THE BUCKET HOLDS, not to the change: the difference builds a
+map over the whole incoming list and walks the standing one, so a batch of ten
+into a bucket of two hundred pays for two hundred and ten.
+
+`addBucketMemberSlots` / `removeBucketMemberSlots` are for a caller who KNOWS THE DELTA — an entity arrived
+over a socket, a card was dragged in, an infinite list appended a page, an entity was
+deleted. The standing slots keep the holds they already have. Adding costs what you
+name. Removing k slots from an ordered bucket of n is ONE pass, n + k, through the content service's
+`removeSlots` (the erase-remove idiom, as in Java's ArrayList.removeAll); k separate
+`removeBucketMemberSlot` calls are up to k·n. The recorded `remove` commands come
+in LIST order, not argument order, each at its position after the earlier ones
+applied, so replaying them draws the same list. A set-driven bucket removes them in
+the order you name them.
+
+**`addBucketMemberSlots` removes nothing.** If the authoritative list SHRANK and you call
+`addBucketMemberSlots`, the entity slots that left stay in the bucket, held. Not knowing what left is
+exactly when `writeSlotContent` is the right door, and its cost is the price of not
+knowing.
+
+The keyed doors are the collection service's and take the store slot first —
+`decksService.getSlotByKey(decks, key)`, `decksService.holdSlotByKey(decks, key)` — and a hold is given back
+with `bucketSlot.owner.unholdSlot(bucketSlot)`. The by-key write is `decksService.writeSlotContentByKey(decks, key, members)`; on a bucket slot you hold it is
+`decksService.slotContentService.writeSlotContent(bucketSlot, members)`.
+
+A bucket's emptiness is the content service's `isSlotEmpty(bucketSlot)`, a member count of zero, so
+an emptied bucket that nothing holds and nothing watches is released by the
+guard on the same call that emptied it.
+
+**A bucket never sorts.** Its order is what the caller put in — `addBucketMemberSlots`
+appends, `insertBucketMemberSlotAt` inserts, a move moves, `writeSlotContent` takes the
+sequence given. A sorted list is a computed over an index:
+[Sorted lists](#sorted-lists); or the bucket of a `createOIMSlotCollectionSortedArrayIndexService` index, which
+orders itself: [Sorted at write](#sorted-at-write).
+
+`writeSlotContent(bucketSlot, members)` runs `assertWritable` — the frame guard
+(`assertNotFlushing`) and the released-identity check — then the reconcile (an empty `arrived` and
+`departed` is an unchanged write, which wakes nobody), the holds taken on arrivals, the holds given back by
+departures and the single channel write of the bucket slot. It is handed a slot, so it hands back a
+`boolean`: true when anything arrived or departed.
+
+`writeSlotContent` **joins before it evicts**, so a slot named by both the old and the
+new list never reaches zero references. It empties with one `drainSlots` rather
+than one removal at a time — per-slot eviction on an array-driven bucket is
+n(n-1)/2 element moves.
+
+The commit itself is the strategy's, through the content service's protected `reconcileSlots` — the
+reconciliation pattern (diff, then patch): bring the bucket to the new list and fill
+two out-queues with one entry per hold taken and one per hold given
+up, so the write links each of the first and unlinks each of the second. Both
+empty means nothing changed. Each content service reconciles its own way:
+
+- **Array-driven**: the caller's sequence IS the slots, so the same sequence is
+  left alone and any other sequence — a reordered one included — is drained and
+  re-added whole.
+- **Set-driven** takes the set difference and never rebuilds: an untouched member
+  keeps its hold.
+
+**NO FRAME NUMBER IS PASSED ON THIS PATH.** `reconcileSlots` and `drainSlots` take none. A render script lives for exactly one frame:
+`OIMBucketCommands` records onto the bucket slot (`bucket.commands`) as the writes land and
+empties it once the flush has fully ended, so a consumer reads it INSIDE the
+frame and what it reads can only describe the writes it was woken for.
+`clearSlotContent` asks whether the bucket is empty **before** it
+touches the store, so an already-empty bucket records nothing for a call that
+reports nothing.
+
+### Bucket content services
+
+| Class | Storage type | One add records |
+|---|---|---|
+| `OIMSlotContentSetBucketService<TBucketMemberSlot>({ bucketCommands? })` | `TOIMBucketSlotsSetStore<TBucketMemberSlot>` = `Set<TBucketMemberSlot>` | one per slot |
+| `OIMSlotContentPositionalArrayBucketService<TBucketMemberSlot>({ bucketCommands?, bucketMemberSlotsArrayService? })` | `TOIMBucketSlotsArrayStore<TBucketMemberSlot>` = `{ bucketMemberSlots, uniqueBucketMemberSlots, sortedCount }` | one per **mention**; one per slot, order kept, with `new OIMBucketUniqueMemberSlotsArrayService()` |
+| `OIMSlotContentSortedArrayBucketService<TBucketMemberSlot>({ compareBucketMemberSlots, bucketMemberSlotsArrayService? })` | `TOIMBucketSlotsArrayStore<TBucketMemberSlot>` | one per mention or per slot, at its sorted place |
+
+The first two are the ones a caller picks between, and neither sorts: the array-driven services keep the
+caller's order. The last is the one the sorted-at-write index builds for itself
+([Sorted at write](#sorted-at-write)); its `repositionBucketMemberSlot(bucketSlot, bucketMemberSlot)` moves one
+member to its place after its sort columns changed.
+
+Which slots an array bucket keeps is its `bucketMemberSlotsArrayService`, the only writer of the list and the
+`Set` beside it: `OIMBucketMemberSlotsArrayService` keeps every mention and no `Set`;
+`OIMBucketUniqueMemberSlotsArrayService` keeps each slot once and the list and its `Set` together, so the two never
+disagree. With the unique one `hasBucketMemberSlot` answers from the `Set` (no array walk); with the default it
+walks the array.
+
+Nothing positional is on the abstract `OIMSlotContentBucketService`: the reads `getBucketMemberSlotAt` and
+`getBucketMemberSlotPosition` are on the array-based services (array-driven and sorted), and the five
+position writes on the array-driven one only. The set-driven service has none — a `Set` has no place to name,
+so asking it does not compile. A content service keeps no per-bucket state.
+
+The protected `removeSlot` answers WHERE the slot was, so the door recording an edit script never asks for a
+position the removal itself had to compute. Two of its answers are not positions, and both are exported as
+named constants:
+
+| returns | means |
+|---|---|
+| `0` and up | the index the slot occupied, now vacated |
+| `OIM_NOTHING_WAS_REMOVED` (`-1`) | the bucket did not hold it; nothing changed |
+| `OIM_REMOVED_WITHOUT_A_POSITION` (`-2`) | removed from a store that keeps no positions, which is the set-driven service |
+
+A removal answering the third is recorded as `recordWholeList(bucketSlot)`: a set has no index to patch,
+so the consumer is told to re-read the bucket rather than handed a fabricated one.
+
+`OIM_NOTHING_WAS_INSERTED` (`-1`) is the insert's answer when nothing was inserted, which is a repeat on an array bucket
+with `OIMBucketUniqueMemberSlotsArrayService`. The recorded insert names the index the slot LANDED on — `at` clamped to the
+ends of the list — and not `getBucketMemberSlotPosition`, because the default ordered list keeps one place per
+**mention**: inserting a slot the bucket already holds gives it a second position, and the position read
+names the FIRST. A command script built from it would tell the consumer to patch at an index the slot is not
+at, and the consumer's list would diverge from the bucket's permanently.
+
+**A bucket's storage is `bucketSlot.bucketSlotsStore`.** The bucket's own type carries it
+(`TOIMBucketSlot<TOIMBucketSlotsArrayStore<TOIMEntitySlot<Card>>>`), so a mismatched pairing is a compile
+error. **One content service instance may serve two bucket collections** — it keeps no per-bucket state.
+
+### Positions the caller decides
+
+A bucket whose positions are the caller's is one over `OIMSlotContentPositionalArrayBucketService`, which is
+the `pageService` of the setup block. The two position reads and the five writes are that content service's, they take the bucket
+slot and no store slot, and an index is valid only until the next write:
+
+| Door | What it does |
+|---|---|
+| `getBucketMemberSlotAt(bucketSlot, index)` | who sits there, `undefined` past the end |
+| `getBucketMemberSlotPosition(bucketSlot, bucketMemberSlot)` | where it sits, `-1` when it does not |
+| `insertBucketMemberSlotAt(bucketSlot, at, bucketMemberSlot)` | puts it at `at`, clamped to the ends of the list |
+| `removeBucketMemberSlotAt(bucketSlot, at)` | takes it out and hands it back, `undefined` past the end |
+| `removeBucketMemberSlotRange(bucketSlot, at, count)` | takes a run out and hands it back |
+| `moveBucketMemberSlotToPosition(bucketSlot, from, to)` | moves one slot; refuses `from === to` and either end out of range |
+| `moveBucketMemberSlotRangeToPosition(bucketSlot, from, count, to)` | moves a run; the landing is read in the list WITHOUT the run in it |
+
+Every position and count must be a whole number: `NaN` or a fraction throws
+(`a position must be a whole number`) before anything moves, because the list
+and `splice` would read it two different ways. `±Infinity` is allowed and clamps
+like any other out-of-range position.
+
+Each wraps a store change in the frame guard, the holds, the report and the
+release question. The default ordered list records one place per MENTION, so
+`insertBucketMemberSlotAt` of a slot the bucket already holds gives it a second position —
+take `bucketMemberSlotsArrayService: new OIMBucketUniqueMemberSlotsArrayService()` when a position must name
+exactly one entity slot.
+
+Per strategy, generating code:
+
+```ts
+const slotContentBucketService = pageService.slotContentService;
+
+// kanban, between columns
+const cardItWasDroppedOn = cardService.getSlotByKey(cards, 'c2');
+slotContentBucketService.removeBucketMemberSlotAt(todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot));
+slotContentBucketService.insertBucketMemberSlotAt(
+    done, slotContentBucketService.getBucketMemberSlotPosition(done, cardItWasDroppedOn) + 1, slot,
+);
+
+// priority queue — raise to the front, then nudge down two
+slotContentBucketService.moveBucketMemberSlotToPosition(todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot), 0);
+slotContentBucketService.moveBucketMemberSlotToPosition(
+    todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot),
+    slotContentBucketService.getBucketMemberSlotPosition(todo, slot) + 2,
+);
+
+// a whole list at once, in the order the server sent
+slotContentBucketService.writeSlotContent(todo, cardService.writeInBatch(cards, () => (payload).map(entity => cardService.writeSlotContentByKey(cards, entity.id, entity))));
+```
+
+### The render script: `OIMBucketCommands`
+
+```ts signature
+new OIMBucketCommands(options: { maxCommandsPerSlot?: number })   // default OIM_MAX_COMMANDS_PER_SLOT
+
+// a bucket content service takes it at construction, once:
+new OIMSlotContentPositionalArrayBucketService({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: Infinity }) });
+```
+
+**Recording is a strategy chosen when the bucket content service is built.** `bucketCommands` is read once
+into a readonly field; left out of a content service built with `new`, it is `OIMNoBucketCommands`, whose
+every method is empty, so a bucket nobody renders positionally pays one empty call per write and allocates no
+command. There is no setter: a content
+service records into the one recorder it was built with. One recorder serves every bucket of every store slot
+and of every db — it is stateless.
+
+It writes the script onto the BUCKET slot itself, and is handed the member count for the cap below. The bucket
+content service already writes the bucket slot on every mutation, so a consumer subscribes to the bucket and
+reads the script inside the effect:
+
+```ts
+effectService.createEffect(db, () => {
+    if (todo.isWholeListRecorded) render(Array.from(pageService.slotContentService.getBucketMemberSlots(todo)));
+    else applyToTheRenderedList(todo.commands ?? []);
+}, [todo]);
+```
+
+`TOIMBucketSlot` carries two fields for it, and a consumer reads both:
+
+| Field | What it says |
+|---|---|
+| `commands` | `readonly TOIMOrderedListCommand[]`, or `undefined` before the first write — what this frame's writes did, in order |
+| `isWholeListRecorded` | the script was given up on; read the bucket's slots and rebuild |
+
+**READ BOTH INSIDE THE FRAME.** They are reset once the flush has FULLY ended —
+after `db.flush()` returns, `commands` is empty and `isWholeListRecorded` is
+`false` — so the only places they exist are an effect body and a
+`OIMChannelService.INSTANCE.subscribeAfterEachFrame(channelSlot, handler)` handler. No frame number is passed
+back: a consumer that did not read this frame's script reads the list instead.
+
+A script is stamped with the clock reading it started at (`commandsStartedAtRevision`/`commandsStartedAtEpoch`),
+and it is stale once a frame has opened after that stamp (`channelSlot.frame.openedAtRevision`/`openedAtEpoch`).
+The recorder clears a stale script before it records into it, as well as in the after-flush reset, so a write
+that lands after a flush but before that reset starts a new script instead of extending one consumers already
+read. The reset is subscribed with `subscribeAfterEachFlush` on the first script a channel slot ever sees, and
+walks only the buckets that recorded.
+
+A positional write is always recorded as a position. `isWholeListRecorded` is set by a write of the whole bucket — `writeSlotContent`,
+`clearSlotContent`, `moveBucketMemberSlotRangeToPosition` — by a removal from a bucket whose
+content service keeps no positions, which has no index to patch, and by the script
+outgrowing the list
+it describes. `maxCommandsPerSlot` is that ratio; it defaults to
+`OIM_MAX_COMMANDS_PER_SLOT`, which is 1, the same ratio
+`oimOrderedListCommandsOfTransition` takes as `maxCommandsPerSlot`. `Infinity` refuses the collapse
+outright, which is what a consumer animating item moves needs: a whole-list answer
+tells it everything changed and costs it every move it meant to animate.
+
+`IOIMBucketCommands` is the interface the bucket content service records through:
+`recordInsert(bucketSlot, index, bucketMemberSlot, bucketMemberSlotCount)`,
+`recordRemove(bucketSlot, index, count, bucketMemberSlotCount)`, `recordMove(bucketSlot, from, to, bucketMemberSlotCount)`
+and `recordWholeList(bucketSlot)`. They take positions, not a command object, so the
+empty strategy is handed nothing to allocate. A consumer does not call the record methods; the
+content service's own write doors do.
+
+### A single bucket
+
+One bucket under no key is a store slot of an `OIMSingleSlotService` over a bucket content service, with
+`OIMSingleSlotStoreService.INSTANCE` as the store service:
+
+```ts signature
+createOIMSingleSlotService({
+    slotContentService: new OIMSlotContentPositionalArrayBucketService<TBucketMemberSlot>(),   // or the set one
+    slotReleasePolicy?, slotSubscriptionListener?, columnSlotStoreService?, columnNames?,
+}): OIMWritableSingleSlotService<TOIMBucketContentSlot<TSlots>, readonly TBucketMemberSlot[], …>
+```
+
+```ts
+const handService = createOIMSingleSlotService({ slotContentService: new OIMSlotContentPositionalArrayBucketService<TOIMEntitySlot<Card>>({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: undefined }) }) });
+const hand = handService.createStoreSlot(db);
+const handSlot = handService.holdSingleSlot(hand);
+handService.slotContentService.writeSlotContent(handSlot, [slot]);
+handService.slotContentService.insertBucketMemberSlotAt(handSlot, 0, cardService.getSlotByKey(cards, 'c2'));
+effectService.disposeEffect(effectService.createEffect(db, () => {
+    render(Array.from(handService.slotContentService.getBucketMemberSlots(handSlot)));
+}, [handSlot]));
+handSlot.owner.unholdSlot(handSlot);
+```
+
+One bucket, no key: the single-slot store files its one bucket slot as the store's `slot`. The bucket slot is a
+`TOIMBucketContentSlot<TSlots>` of the keyed bucket slot's shape (`key: undefined`), what an effect subscribes to and what a reader is handed,
+so the channel's write door still sees three slot shapes. Every door of the bucket content service takes it as
+it takes a keyed bucket slot, and `markBucketColumnsChanged(bucketSlot, patch, changedColumns)` is how the
+caller that changed members says which of their columns moved, as the index does for a keyed bucket. Each
+door writes the bucket slot to the channel once.
+
+**Its lifetime is the `slotReleasePolicy`.** With none named (here or on the db) it is
+`OIMSlotAtEmptyReleasePolicy.INSTANCE`, so an emptied single bucket that nothing holds or watches is
+released, and `getSingleSlot(storeSlot)` mints a fresh, empty one on the next read. Hold the
+slot (`holdSingleSlot(storeSlot)`) for as long as you write into it, or name `OIMSlotNeverReleasePolicy.INSTANCE`.
+
+### The index that fills itself — `OIMSlotCollectionIndexService`
+
+```ts signature
+createOIMSlotCollectionIndexService<TEntity, TSourceKey, TColumns?, TKey?, TSourceStore?, TSlots?, TSlotContentService?>({
+    entityService: Pick<OIMSlotCollectionService<TSourceKey, TOIMEntitySlot<TEntity, TSourceKey>, TSourceStore, unknown>, 'getSlots'>;
+    ...TOIMIndexKeyOptions<TKey, TEntity, TColumns>;          // { columns } | { keyOf } | { keyOf, columns }
+    slotContentService?: OIMSlotContentBucketService<TOIMEntitySlot<TEntity>, TSlots>;  // default: array-driven, no commands
+    bucketSlotStoreService?: IOIMSlotStoreService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore>; // REQUIRED for an array TKey
+    slotReleasePolicy?: IOIMSlotReleasePolicy;
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>;
+    columnNames?: readonly string[];
+}): OIMSlotCollectionIndexService<TKey, TEntity, TSlots, TSourceKey, TSourceStore, TSlotContentService, …>
+
+class OIMSlotCollectionIndexService<…> extends OIMSlotCollectionService<…> {
+    createIndexStoreSlot(sourceStoreSlot: TOIMStoreSlot<TSourceStore, TOIMEntitySlot<TEntity, TSourceKey>, Partial<TEntity>>): TOIMIndexStoreSlot<…>;
+    disposeIndexStoreSlot(indexStoreSlot: TOIMIndexStoreSlot<…>): void;
+    getEntitiesByKey(indexStoreSlot, key): (TEntity | undefined)[];
+    getSlotsByKeys(indexStoreSlot, keys): TBucketSlot[];
+    holdSlotsByKeys(indexStoreSlot, keys): TBucketSlot[];
+    getBucketColumnByKey / holdBucketColumnByKey(indexStoreSlot, key, columnName): TOIMColumnSlot;
+    getAnyBucketColumnByKey / holdAnyBucketColumnByKey(indexStoreSlot, key): TOIMColumnSlot;
+}
+```
+
+`OIMSlotCollectionIndexService` is a collection service of buckets, so it has every read door of one, and its
+`slotContentService` is the bucket content service narrowed by type to its reads (`getBucketMemberSlots`,
+`getBucketMemberSlotCount`, `hasBucketMemberSlot`, and the positional reads where the strategy has them) — the
+index is the only writer of its buckets. The strategy is chosen at the factory:
+`OIMSlotContentPositionalArrayBucketService` by default, `OIMSlotContentSetBucketService` passed as
+`slotContentService`, and the sorted one built by `createOIMSlotCollectionSortedArrayIndexService`. Only the array-based
+content services answer by position: `getBucketMemberSlotAt(bucketSlot, index)` (O(1), `undefined` past the
+end) and `getBucketMemberSlotPosition(bucketSlot, entitySlot)` (walks the array, O(n), `-1` for a non-member).
+The index's default content service records no commands; pass one built with `bucketCommands` for a render
+script.
+
+**One index service per entity collection type; one index store slot per entity store slot.**
+`indexService.createIndexStoreSlot(entityStoreSlot)` registers the index on that entity store slot
+and hands back the index's bucket store slot, a `TOIMIndexStoreSlot` — a store slot of buckets
+that also names its `sourceStoreSlot`. Entity slots are filed into it by a key derived from the entity. You
+read through the index service, passing that store slot; the index is what writes its buckets.
+**No bucket exists for a key until it is minted**: `getSlotByKey`,
+`holdSlotByKey`, `getSlotsByKeys` and `holdSlotsByKeys` mint it and fill it from the source entities
+written before it, without a flush, so minting inside an effect body does not throw.
+`getSlotsByKeys` / `holdSlotsByKeys` fill every new bucket in ONE pass over the source. How long it lives after that is **the
+`slotReleasePolicy`'s ordinary business**, exactly as for a hand-held bucket; the index injects no lifetime of its
+own. With none named it is `OIMSlotAtEmptyReleasePolicy.INSTANCE`: the bucket stands while it has members and is
+maintained on every write.
+
+```ts
+const byDeckService = createOIMSlotCollectionIndexService({
+    entityService: cardService,
+    keyOf: (card: Card) => card.deck,
+});
+const byDeck = byDeckService.createIndexStoreSlot(cards);
+
+const spades = byDeckService.holdSlotByKey(byDeck, 'spades');
+effectService.createEffect(db, () => render(Array.from(byDeckService.slotContentService.getBucketMemberSlots(spades))), [spades]);
+```
+
+A set-driven index names its content service with the bucket member slot type and the index key type spelled
+out — `new OIMSlotContentSetBucketService()` infers `<TOIMSlot, TOIMStoreKey>` and fails to type-check:
+
+```ts
+const bySuitService = createOIMSlotCollectionIndexService({
+    entityService: cardService,
+    columns: ['deck'],
+    slotContentService: new OIMSlotContentSetBucketService<TOIMEntitySlot<Card>, string>(),
+});
+const bySuit = bySuitService.createIndexStoreSlot(cards);
+```
+
+- **Passing the entity store slot to `createIndexStoreSlot` is the whole wiring.** It registers
+  a content-change listener on that store slot (`OIMSlotContentChangeListenerService.INSTANCE.addContentChangeListener`);
+  the entity services know nothing about indexes. Call `createIndexStoreSlot` twice over one entity
+  store slot and it files into both. `entityService` is used only for its `getSlots`, to fill a new bucket
+  from the source.
+- **The key comes from `columns`, `keyOf`, or both** — the same pair as the sorter's
+  `sortColumns` / `comparator` (`TOIMIndexKeyOptions`). `{ columns: ['deck'] }`: the key is
+  the value of that ONE column, typed by `TOIMIndexKey<TEntity, TColumns>` from the
+  column itself. `{ keyOf }`: any function, read again on every write, because a
+  function does not say which columns it reads. `{ keyOf, columns }`: the columns are the
+  ones `keyOf` reads. With `columns`, a patch or put whose changed columns include none of
+  them keeps the entity's key and calls nothing; a write of the whole value (a fill, a
+  clear, `markEntityChanged(slot)` with no names) always reads the key again.
+- **A key of several columns**: `createOIMSlotCollectionIndexService({ entityService, columns: ['deck', 'suit'],
+  bucketSlotStoreService: new OIMSlotTreeStoreService(OIMScalarKeyTreeWalk.INSTANCE) })` makes the key
+  the array of those values in order, typed as a tuple. Only that store knows the key is an array (its
+  `isSameKey`), so a fresh array with the same parts moves nothing. `createOIMSlotCollectionIndexService` takes a scalar key
+  unless it is handed a `bucketSlotStoreService`: two columns or an array `keyOf` without one do not compile.
+  `getSlotsByKeys` / `holdSlotsByKeys` fill array-keyed buckets one pass over the
+  source per key (the cost of `getSlotByKey` each); only a scalar key gets one pass for all.
+- **Entity slots are filed on write**, using the index's key. Writes inside `writeInBatch` on the collection
+  notify once per batch; the index groups the entity slots by key and moves each group with one bucket write.
+- **Reading**, each taking the index store slot first: `getSlotByKey`, `holdSlotByKey`, `findSlotByKey`,
+  `hasSlotContentByKey`, `getSlotsByKeys`, `holdSlotsByKeys`, `getSlots`, `getSlotCount`, `getEntitiesByKey`, and the bucket column
+  slot doors `getAnyBucketColumnByKey`, `holdAnyBucketColumnByKey`,
+  `getBucketColumnByKey`, `holdBucketColumnByKey`; on a bucket slot, `slotContentService.getBucketMemberSlots`,
+  `getBucketMemberSlotCount`, `hasBucketMemberSlot`; and `unholdColumn` (below).
+  `getEntitiesByKey` resolves the bucket with `getSlotByKey`, so a key with no bucket MINTS one — one `keyOf`
+  walk over the source — and an empty unheld bucket is released at the flush, so reading an empty key every
+  frame walks every frame. Hold a key you read repeatedly.
+- **The channel** is the index store slot's `channelSlot`, the source store slot's — what a
+  React hook checks before subscribing.
+- **`disposeIndexStoreSlot(indexStoreSlot)`** unsubscribes from the source store slot, empties that
+  store slot's buckets and gives back every entity slot it held. The minting doors (`getSlotByKey`,
+  `holdSlotByKey`, `getSlotsByKeys`, `holdSlotsByKeys`, `getEntitiesByKey`, the bucket column doors)
+  throw after it, for that store slot;
+  the two give-backs (`slot.owner.unholdSlot`, `indexService.unholdColumn`)
+  still take back a hold given out before it, so a cleanup that runs late does not
+  throw.
+- **A key with no bucket is not maintained at all**, so a write under such a key
+  costs nothing beyond one key read and one comparison — no bucket store, no
+  maintenance nodes. What decides it is the BUCKET, not the hold: a standing bucket
+  is maintained whether anyone holds it or not.
+- **Order is not the bucket's business, unless you pick the strategy that makes it so.**
+  A bucket keeps its arrival order; a sorted list is
+  `createOIMSortedComputedService(db, { indexService, sortColumns?, comparator? })`
+  — see [Sorted lists](#sorted-lists) — or the index is built with
+  `createOIMSlotCollectionSortedArrayIndexService`, whose buckets are already in order — see
+  [Sorted at write](#sorted-at-write). A second computed over the bucket handles
+  projection or filtering.
+- **Members are read through the bucket content service**: `Array.from(indexService.slotContentService.getBucketMemberSlots(bucketSlot))`.
+  There is no `.value`.
+- **Subscription is on the bucket, not a computed.** The bucket is a ROOT slot, so it
+  goes in the FIRST array of `createEffect` — not the second. **The bucket wakes on
+  membership only**: an entity slot joining or leaving. A write to an entity that stays in the
+  bucket does not wake it — subscribe to that entity's own slot for that.
+- **Bucket lifetime is the `slotReleasePolicy` option, not the index's.** Name nothing (here or on the db)
+  and it is `OIMSlotAtEmptyReleasePolicy.INSTANCE`: an unheld bucket stays while it has members and goes
+  once empty; `OIMSlotNeverReleasePolicy.INSTANCE` keeps it for good; pass an `OIMSlotAfterIdleReleasePolicy`
+  and it cools on its queue; pass `OIMSlotAtUnholdReleasePolicy.INSTANCE` and it dies at the last give-back,
+  and the next hold builds a fresh one by walking the source again.
+
+**The bucket's any-column slot exists, but it is not the recommended path.**
+`holdAnyBucketColumnByKey(indexStoreSlot, key)` (and `getAnyBucketColumnByKey(indexStoreSlot, key)`) returns a
+`TOIMColumnSlot` on the bucket slot that wakes when the content of a member changes —
+any write to a member inside. A member joining or leaving is NOT its business: that wakes
+the bucket slot (`getSlotByKey` / `holdSlotByKey`). A reader that wants both subscribes
+to both, and the subscriber picks by which slots it puts in `createEffect`.
+
+```ts
+const deckIndexService = createOIMSlotCollectionIndexService({ entityService: cardService, keyOf: (card: Card) => card.deck });
+const deckIndex = deckIndexService.createIndexStoreSlot(cards);
+const spadesBucket = deckIndexService.holdSlotByKey(deckIndex, 'spades');
+const spadesAnyColumn = deckIndexService.holdAnyBucketColumnByKey(deckIndex, 'spades');
+const entitiesEffect = effectService.createEffect(db, () => {
+    console.log(deckIndexService.getEntitiesByKey(deckIndex, 'spades'));
+}, [spadesBucket, spadesAnyColumn]);
+effectService.disposeEffect(entitiesEffect);
+deckIndexService.columnSlotService.unholdColumn(spadesAnyColumn);
+spadesBucket.owner.unholdSlot(spadesBucket);
+```
+
+A column slot taken with `getAnyBucketColumnByKey` and subscribed to is held by the
+effect, so a plain getter is enough: the slot lives while the effect does and goes at the
+next `flush()` after `disposeEffect`; one nobody kept is gone at the next `flush()`.
+
+**Do not reach for it to render a list.** Every edit of every member wakes whoever
+reads it, so a list bound to it re-renders whole for a one-field change. Subscribe
+the list to the bucket (membership) and each item to its own entity slot — that is the
+path the engine is built for. The any-column slot is for a reader that genuinely
+needs the whole list each time: an export, an aggregate over the entities, a log.
+
+It costs nothing until someone asks for one: a write is checked against it only after
+the index has been asked for the first any-column slot.
+
+**The content-change hook.** `OIMSlotContentChangeListenerService.INSTANCE.addContentChangeListener(storeSlot, listener, readColumnNames): void`
+and `removeContentChangeListener(storeSlot, listener): boolean` file and unfile a listener on that one store
+slot, by the listener object. `addReadColumn` / `removeReadColumn` / `addReadAnyColumn` / `removeReadAnyColumn`
+declare reads without a listener of their own, which is how an index declares its bucket columns.
+**Which columns a listener reads** is declared when it is added: `readColumnNames` lists them, and
+`undefined` means every column. Removing the listener gives its columns back. An
+index store slot declares its key `columns` (all columns when the key is an opaque `keyOf`), and
+adds each column its bucket column slots watch, and all columns once a bucket any-column slot was
+asked for. Column slots on entities are not in it: a write finds them on the entity
+itself. A write whose changed columns no listener reads costs one `Map.has` per name:
+no listener is called, nothing is buffered, and the names array is reused across writes. A write that names no columns
+(a fill, a clear) always reaches the listeners. A listener of your own that must see
+every column write is added with `readColumnNames` `undefined`. **The filter is the union, per store
+slot, not per listener**: once a write touches a column ANY listener of that store reads, every
+listener of that store is called, so a listener that declared a narrower set still checks
+`changedColumns` itself, as `OIMSlotCollectionIndexService` does against its key columns.
+`IOIMSlotContentChangeListener<TSlot, TPatch>` has two methods:
+`onContentChanged(slot, patch, changedColumns)` and
+`onManyContentsChanged(slotChannelQueue, patchChannelQueue, changedColumnsChannelQueue)` — three
+parallel `OIMChannelQueue`s read with `getEntryCount()` / `getEntryAt(i)`, valid only during the
+call, so a listener copies what it keeps — `patch` is what an update
+wrote, `changedColumns` the names `markEntityChanged(slot, columns)` was given, either
+`undefined` when the write carries none. A single write outside a batch delivers one `onContentChanged` as soon as it is filed; inside
+`writeInBatch` (or `openBatch` / `closeBatch`) on the collection the writes are queued on the store slot and
+delivered as ONE `onManyContentsChanged` when the outermost batch closes. Code inside the batch reads the index
+as it was before the batch.
+This hook is the only seam an index uses; an index of your own is a listener.
+
+**Bucket column slots.** An index hands out one column slot per bucket and column:
+`getBucketColumnByKey(indexStoreSlot, key, columnName)`, `holdBucketColumnByKey(indexStoreSlot, key, columnName)`,
+`indexService.unholdColumn(columnSlot)`. It is a `TOIMColumnSlot` whose `carrierSlot` is the
+bucket slot, and it is written when a write changes that column on any member of the
+bucket (the index calls its bucket content service's `markBucketColumnsChanged(bucketSlot, patch, changedColumns)`,
+as the caller does on a single bucket).
+The any-column doors `getAnyBucketColumnByKey(indexStoreSlot, key)` / `holdAnyBucketColumnByKey(indexStoreSlot, key)`
+return the same kind of slot, written when any column of any member changes. A give-back is
+`slot.owner.unholdSlot(slot)`.
+
+```ts
+const decksService = createOIMSlotCollectionIndexService({ entityService: cardService, keyOf: (card: Card) => card.deck });
+const decks = decksService.createIndexStoreSlot(cards);
+const rankOfSpades = decksService.holdBucketColumnByKey(decks, 'spades', 'rank');
+effectService.disposeEffect(effectService.createEffect(db, () => {}, [rankOfSpades]));
+decksService.columnSlotService.unholdColumn(rankOfSpades);
+```
+
+### Sorted lists
+
+```ts signature
+createOIMSortedComputedService<TKey, TEntity extends object, TSlots, TSourceKey, TSourceStore, TComputedStore?>({
+    indexService: OIMSlotCollectionIndexService<TKey, TEntity, TSlots, TSourceKey, TSourceStore>;
+    sortColumns?: readonly TOIMSortColumn<TEntity>[];   // { columnName: TOIMSortableColumnName<TEntity>; direction: 'asc' | 'desc' }
+    comparator?: (left: TEntity, right: TEntity) => number;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;          // default OIMSlotAtUnholdReleasePolicy.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<…>, TComputedStore>;  // Map; REQUIRED for any other store
+}): OIMSortedComputedService<TKey, TEntity, TSlots, TSourceKey, TSourceStore, TComputedStore>
+
+createSortedStoreSlot(indexStoreSlot: TOIMIndexStoreSlot<…>): TOIMStoreSlot<TComputedStore, TOIMSortedComputedSlot<TEntity, TKey>>
+readonly computedCollectionService: OIMSlotCollectionService<TKey, TOIMSortedComputedSlot<TEntity, TKey>, TComputedStore, …>
+```
+
+`slotReleasePolicy` decides whether a key's sorted list outlives its last hold. The
+default lets it go at the unhold, so holding the key again sorts from scratch;
+`OIMSlotNeverReleasePolicy.INSTANCE` keeps every key that was ever read and re-sorts it
+only when a read finds it changed — the arm for a view that switches between groups.
+Pass the same policy to the index the list reads, or its bucket is rebuilt instead.
+
+An `OIMSortedComputedService` takes no db: its store slots run on the channel slot of the index store slot
+they sort. One per index service. `createSortedStoreSlot(indexStoreSlot)` makes one sorted store slot over
+one index store slot, and the read doors of `computedCollectionService` take that store slot first:
+`getSlotByKey`, `holdSlotByKey`, `findSlotByKey`, `getSlots`, `getSlotCount`, and the column doors; per key a
+computed slot whose value, read through `slot.computedValueService.getValueForSlot(slot)`, is that key's entity
+slots sorted. A hold is given back with `slot.owner.unholdSlot(slot)`.
+
+- **`sortColumns` decide which writes re-sort**: only a write that changes one of them on a
+  member. A `TOIMSortableColumnName<TEntity>` is a column whose values are strings,
+  numbers or bigints.
+- **`comparator` decides the order.** Without it the order is `oimColumnsComparator(sortColumns)`:
+  the columns in turn, each by its `direction`, an undefined or null value last. An
+  entity slot with no entity sorts last.
+- **Only `comparator`** → any write to a member re-sorts, since nothing names the
+  columns it reads.
+- **Neither** → a member keeps the place it first took; an arrival is appended.
+- **Both `sortColumns` and `comparator`** → the two split the job: `comparator` orders,
+  `sortColumns` is the list of columns whose change wakes the sort. **List every column
+  the comparator reads**: a change to a column it reads but `sortColumns` omits does not
+  re-sort, and the list stays in its old order until something listed changes. This
+  is the combination to reach for when the order needs a rule `oimColumnsComparator`
+  cannot express — a locale compare, a computed key, a tie-break — and the sort
+  should still wake only for the columns that rule reads, instead of for every write
+  to a member as with `comparator` alone.
+
+  ```ts
+  const cardsInDeckService = createOIMSlotCollectionIndexService({
+      entityService: cardService,
+      keyOf: (card: Card) => card.deck,
+  });
+  createOIMSortedComputedService({
+      indexService: cardsInDeckService,
+      sortColumns: [{ columnName: 'title', direction: 'asc' }, { columnName: 'rank', direction: 'asc' }],
+      comparator: (l, r) => l.title.localeCompare(r.title, 'de') || l.rank - r.rank,
+  }).createSortedStoreSlot(cardsInDeckService.createIndexStoreSlot(cards));
+  // a write to `title` or `rank` re-sorts; a write to `note` does not
+  ```
+
+Its sources are the bucket slot of the key (membership) plus the bucket column slot
+of each column — or the bucket's any-column slot when only a comparator is given. It is
+a pull computed: re-derived on the read that asks; an effect subscribes to it in the
+SECOND array of `createEffect`. A re-sort that yields the same sequence
+(`oimSameSlotSequence`) keeps the previous array, so its identity is stable.
+
+```ts
+const decksService = createOIMSlotCollectionIndexService({ entityService: cardService, keyOf: (card: Card) => card.deck });
+const decks = decksService.createIndexStoreSlot(cards);
+const byRankInDeckService = createOIMSortedComputedService({
+    indexService: decksService,
+    sortColumns: [{ columnName: 'rank', direction: 'asc' }],
+});
+const byRankInDeck = byRankInDeckService.createSortedStoreSlot(decks);
+const spadesByRank = byRankInDeckService.computedCollectionService.holdSlotByKey(byRankInDeck, 'spades');
+const sortedEffect = effectService.createEffect(db, () => {
+    render(spadesByRank.computedValueService.getValueForSlot(spadesByRank));
+}, [], [spadesByRank]);
+effectService.disposeEffect(sortedEffect);
+spadesByRank.owner.unholdSlot(spadesByRank);
+```
+
+### Sorted at write
+
+A second way to get a sorted list. `createOIMSortedComputedService` sorts at read, over any
+index. `createOIMSlotCollectionSortedArrayIndexService` keeps the index's own buckets sorted at write, and
+the user picks one at construction.
+
+```ts signature
+createOIMSlotCollectionSortedArrayIndexService<TEntity extends object, TSourceKey, TColumns?, TKey extends TOIMStoreKey?, TSourceStore?, TStore?>({
+    entityService, ...TOIMIndexKeyOptions<TKey, TEntity, TColumns>,     // as createOIMSlotCollectionIndexService, scalar key
+    sortColumns: readonly TOIMSortColumn<TEntity>[];                   // REQUIRED
+    bucketSlotStoreService?, slotReleasePolicy?, columnSlotStoreService?, columnNames?,
+}): OIMSlotCollectionSortedArrayIndexService<…>   // its slotContentService is an OIMSlotContentSortedArrayBucketService
+```
+
+```ts
+declare const someCardSlot: TOIMEntitySlot<Card, TOIMStoreKey>;
+const cardsByDeckService = createOIMSlotCollectionSortedArrayIndexService({
+    entityService: cardService,
+    columns: ['deck'],
+    sortColumns: [{ columnName: 'rank', direction: 'asc' }, { columnName: 'id', direction: 'desc' }],
+});
+const cardsByDeck = cardsByDeckService.createIndexStoreSlot(cards);
+const spades = cardsByDeckService.holdSlotByKey(cardsByDeck, 'spades');
+for (const cardSlot of cardsByDeckService.slotContentService.getBucketMemberSlots(spades)) { /* in rank order */ }
+cardsByDeckService.slotContentService.getBucketMemberSlotAt(spades, 0);
+cardsByDeckService.slotContentService.getBucketMemberSlotPosition(spades, someCardSlot);
+```
+
+- **Reads come back in order**: `getBucketMemberSlots`, `getBucketMemberSlotAt` and
+  `getBucketMemberSlotPosition` on `OIMSlotContentSortedArrayBucketService` answer in `sortColumns` order,
+  so no sorted computed is needed.
+- **A lazy insertion buffer.** A write appends the arrival to an unsorted tail of the bucket's
+  array (`TOIMBucketSlotsArrayStore`: the array store plus `sortedCount`). The first read
+  settles the tail: binary insertion when the tail is short, one sort of the array when it is
+  long. A bucket nobody reads is never sorted.
+- **The index re-files a member when one of its sort columns changes, and only then.** A write
+  to a column that is neither the key nor a sort column neither reorders the bucket nor wakes it.
+  A re-file wakes the bucket once per frame.
+- **There are no positional writes** on this bucket (`insertBucketMemberSlotAt` and the other
+  position writes belong to `OIMSlotContentPositionalArrayBucketService`): the order is the comparator's,
+  not the caller's.
+- **Bucket commands are always `OIMNoBucketCommands`**: this strategy records no per-flush
+  script.
+- **Parts**: `OIMSlotContentSortedArrayBucketService` (options
+  `TOIMSlotContentSortedArrayBucketServiceOptions`: `compareBucketMemberSlots`; adds
+  `repositionBucketMemberSlot(bucketSlot, bucketMemberSlot)`), `OIMSlotCollectionSortedArrayIndexService`.
+
+**Choosing between the two arms.** Sort-at-write suits point updates: a change to a sort
+column re-files one member. Sort-at-read (`createOIMSortedComputedService` over any index)
+suits bulk loads. Both are shipped; neither is a default.
+
+**`indexKeys` on each entity slot.** Each indexable slot carries, per index store slot, the key the entity is
+filed under now, so a moved entity slot leaves its old bucket in O(1), also under the in-place
+writer. Only the index writes it, through the `IOIMIndexKeysService` (`get(slot, position)`,
+`set(slot, position, indexKey)`), at the position `createIndexStoreSlot` allocated
+(`indexStoreSlot.indexKeysPosition`). Positions are allocated per entity store slot
+(`sourceStoreSlot.indexKeysPositions`). Pick the strategy with `new OIMDefaults({ indexKeysService })` passed as `defaults`
+(default `OIMAppendingIndexKeysService.INSTANCE`):
+
+| strategy | on `disposeIndexStoreSlot` | cost |
+|---|---|---|
+| `OIMAppendingIndexKeysService` (default) | the index's position is never reused; its stale entry stays on each entity slot | an entity slot's `indexKeys` grows to the highest position any index wrote on it (K indexes made and disposed → an array of K on an entity slot the last one filed), and a stale entry keeps its key reachable. Writes pay nothing for a disposed index: only live listeners are kept |
+| `OIMReclaimingIndexKeysService` | wipes that position on every entity slot of the source store slot and reuses it | O(N) per dispose |
+
+Switch to `OIMReclaimingIndexKeysService` only if you create indexes dynamically and often. Creating
+indexes dynamically and often is expensive, so avoid it.
+
+### The channel of a bucket store slot
+
+A bucket store slot takes its channel slot at `createStoreSlot(db)` (an index store slot, from its source
+store slot). The refusal to write during a flush lives inside `OIMChannelService.INSTANCE.write`.
+
+---
+
+## Derivations
+
+```ts signature
+type TOIMComputedSources = {
+    readonly sourceSlots: readonly TOIMSlot[];
+    readonly sourceComputeds: readonly TOIMComputedSlot[];
+};
+```
+
+In a `createSources` result (of `createOIMComputedService`'s options, or of `createStoreSlot`) both `sourceSlots` and `sourceComputeds` are optional; a missing one means none.
+
+```ts signature
+type TOIMComputedSlot<TValue = unknown, TKey = unknown> = TOIMIndexableSlot<TKey> & Readonly<TOIMComputedDerivation> & {
+    readonly owner: IOIMSlotOwner;
+    readonly computedValueService: IOIMComputedValueService<TValue>;
+    readonly value: TValue;
+    readonly checkedAtRevision: number;
+    readonly checkedAtEpoch: number;
+    readonly isDeriving: boolean;
+    readonly allRootSlots: readonly TOIMSlot[] | undefined;
+};
+
+interface IOIMComputedValueService<TValue = unknown> {
+    getValueForSlot(computedSlot: TOIMComputedSlot<TValue>): TValue;
+}
+```
+
+A computed is a SLOT, the plain data type `TOIMComputedSlot`. Its owner is the slot owner of the
+`OIMComputedService` that minted it, and the service is the only writer of the slot. The value service
+(`OIMComputedValueService`, which every computed slot carries as `computedValueService`) holds the
+`sameValueGuard` ONCE, the store slot holds its `derive` and `createSources` and its channel slot's clock,
+and the value service serves the value. Every source list in this engine —
+`createEffect`'s third argument and `sourceComputeds` — is typed
+`readonly TOIMComputedSlot[]`; a source computed is a slot taken from its own
+service, through `computedCollectionService.getSlotByKey(storeSlot, key)` (`undefined` for a single). Inside
+`derive`, `computedSlot.value` is the previous value.
+
+A derivation is **asked, never woken**. A chain short-circuits on "did anything I
+read move?", so `filter → sort → page` over quiet roots is a walk of integer
+comparisons. A cycle cannot be built.
+
+**Creating a service or a store slot takes no hold.** A computed slot is held on every slot in its
+`sourceSlots` and on every entry of its `sourceComputeds`, and the holder is its
+owner: it takes them when it mints the slot and gives them back when the slot's content is released.
+The slot dies when nothing holds it; the store slot lives on and mints a fresh slot on
+the next read or hold.
+
+### One derivation per key
+
+```ts signature
+class OIMComputedService<TKey, TValue, TComputedStore> {
+    constructor(options: TOIMComputedServiceOptions<TKey, TValue, TComputedStore>);
+    readonly computedCollectionService: OIMSlotCollectionService<TKey, TOIMComputedSlot<TValue, TKey>, TComputedStore,
+        OIMComputedValueService<TKey, TValue>, Extract<keyof TValue, string>, TOIMComputedColumnSlot, OIMPullColumnSlotOwner>;
+    createComputedStoreSlot(channelMap: IOIMChannelMap, derive?, createSources?): TOIMComputedStoreSlot<TComputedStore, TValue, TKey>;
+}
+
+createOIMComputedService<TKey, TValue, TComputedStore = Map<TKey, TOIMComputedSlot<TValue, TKey>>>({
+    createSources?: (computedSlot: TOIMComputedSlot<TValue, TKey>) => Partial<TOIMComputedSources>;
+    derive?: (computedSlot: TOIMComputedSlot<TValue, TKey>) => TValue;
+    sameValueGuard?: TOIMSameValueGuard<TValue>;   // default Object.is
+    releaseValue?: TOIMComputedValueReleaser<TValue>;  // default: gives back nothing
+    initialValue?: TValue;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;     // default OIMSlotAtUnholdReleasePolicy.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;  // defaults.computedColumnSlotStoreService, then a shared map store
+    columnNames?: readonly Extract<keyof TValue, string>[];
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<TValue, TKey>, TComputedStore>;  // Map; REQUIRED for any other store
+}): OIMComputedService<TKey, TValue, TComputedStore>
+```
+
+**`releaseValue(value)` gives back what a derived value holds** (a request in flight, a timer). It is called
+with the previous value when `derive` produced one `sameValueGuard` calls different; with a new object the
+guard calls equal (the slot keeps the old one, the new one is dropped); with the current value when the
+computed slot is released; with the value a `derive` returned after its own slot was released (not stored).
+It is not called when `derive` returns the object the slot already holds, and never with `initialValue`.
+`createOIMSingleComputedService` takes it too.
+
+The factory takes no db: a computed service is configuration, and each store slot takes its channel slot at
+`createComputedStoreSlot(db, …)`.
+
+**`derive` and `createSources` come from the store slot or from the service.** Each one a store
+slot is given (`createComputedStoreSlot(db, derive, createSources)`) is used for that store slot; each one it is
+not given comes from the service's options. A store slot that would end up without one of the two throws by name at
+`createComputedStoreSlot`. So one service per value type can serve many derivations, each its own store slot.
+
+Doors of a keyed computed store slot are the read doors of `computedCollectionService`, each taking it first:
+`getSlotByKey(storeSlot, key)`, `holdSlotByKey(storeSlot, key)`, `findSlotByKey(storeSlot, key)`,
+`getSlots(storeSlot)`, `getSlotCount(storeSlot)`, and the column doors; the value is
+`slot.computedValueService.getValueForSlot(slot)`, and a give-back is `slot.owner.unholdSlot(slot)`.
+
+**A single computed is its own service.** `createOIMSingleComputedService<TValue>({ … })` builds an
+`OIMSingleComputedService`, whose store slots each hold at most one computed slot, read through
+`computedSingleSlotService` (`getSingleSlot`, `holdSingleSlot`, `findSingleSlot`). Like a keyed one, a store slot
+outlives every computed slot it mints and mints a fresh one on the next read or hold once the previous one is gone.
+
+```ts
+const topRankService = createOIMSingleComputedService<number>({
+    sameValueGuard: oimSameValueZeroGuard,
+    initialValue: -1,
+});
+const topRank = topRankService.createComputedStoreSlot(
+    db,
+    () => cardService.getSlotByKey(cards, 'c1').entity?.rank ?? -1,
+    () => ({ sourceSlots: [cardService.getSlotByKey(cards, 'c1')] }),
+);
+const heldTopRank = topRankService.computedSingleSlotService.holdSingleSlot(topRank);   // the same slot while anything holds it
+heldTopRank.computedValueService.getValueForSlot(heldTopRank);
+heldTopRank.owner.unholdSlot(heldTopRank);        // gone; the next holdSingleSlot(topRank) mints a new one
+```
+
+A single computed store slot has no key and a store of one slot. `getSingleSlot(storeSlot)` hands a slot without a hold — a fresh one goes to the unused-slot collector and is let go at the
+next flush unless something holds it — and `holdSlotByKey(storeSlot, undefined)` holds the live slot, minting
+one if the previous is gone. A computed slot goes at its last unhold once no effect reads it
+(`OIMSlotAtUnholdReleasePolicy`, the default), and gives back the holds it took on its
+sources. A last unhold during a flush releases it at once, as for every slot. The holds a computed takes on its sources and
+gives back are one stateless service, shared by both shapes.
+
+**`createSources` takes the key and the store slot, and nothing else. There is no `keep`.** A build that
+needs a source resolves it with `holdSlotByKey` or `getSlotByKey` like any other caller,
+and the holds the service itself takes are the ones named in
+`sourceSlots` / `sourceComputeds` — so the source list IS the dependency
+list, and a source a build closes over without naming is a source nothing holds.
+
+**A derivation is never empty.** `OIMComputedService` answers
+"empty" with `false`, so a filed derivation is released only when nothing holds
+it, nothing watches it, and the grace is `0` — which is what
+`OIMSlotAtUnholdReleasePolicy` answers, and the default when no `slotReleasePolicy` is given.
+
+```ts setup
+const rankService = createOIMComputedService<TOIMStoreKey, number>({
+    createSources: ({ key }) => ({ sourceSlots: [cardService.getSlotByKey(cards, key)] }),
+    derive: (computedSlot) => cardService.getSlotByKey(cards, computedSlot.key).entity?.rank ?? -1,
+    sameValueGuard: oimSameValueZeroGuard,
+    initialValue: -1,
+});
+const ranks = rankService.createComputedStoreSlot(db);
+```
+
+```ts
+const rank = rankService.computedCollectionService.holdSlotByKey(ranks, 'c1');
+rank.computedValueService.getValueForSlot(rank);
+rank.owner.unholdSlot(rank);
+```
+
+### Computed columns
+
+A computed's value can be subscribed to by field. `getColumn(slot, columnName)`, `holdColumn(slot, columnName)`,
+`getColumnGroup(names)`, `holdColumnGroup(slot, group)`, `unholdColumn(columnSlot)`, and the
+any-column pair `getAnyColumn(slot)` / `holdAnyColumn(slot)` are on `computedCollectionService`
+(so on the sorted and memo services too), for keyed and single store slots alike; a single one passes
+`getSlotByKey(storeSlot, undefined)` as the slot. Column names are typed as the keys of the value.
+
+A computed service's column owner is the derive-driven strategy: each column slot is a computed slot
+over the carrier computed, its value `carrier.value[column]` (a tuple of the group's fields, ordered by the sorted column names, for a group,
+the whole value for the any-column), compared with `Object.is`. It is a `TOIMComputedColumnSlot`
+(`TOIMComputedSlot<unknown, string>`), so it goes in the SECOND array of `createEffect`, and its value
+is read off `columnSlot.value`. It wakes an effect only when that field of the derived value changes.
+Pinned by `computed/tests/what-a-computed-column-wakes-on.test.ts`.
+
+```ts
+type Summary = { top: number; count: number };
+const summaryService = createOIMSingleComputedService<Summary>();
+const summary = summaryService.createComputedStoreSlot(
+    db,
+    () => ({ top: slot.entity?.rank ?? -1, count: cardService.getSlotCount(cards) }),
+    () => ({ sourceSlots: [slot] }),
+);
+const summarySingleSlotService = summaryService.computedSingleSlotService;
+const summaryTop = summarySingleSlotService.columnSlotService.holdColumn(summarySingleSlotService.getSingleSlot(summary), 'top');
+const topEffect = effectService.createEffect(db, () => { paint(slot.entity); }, [], [summaryTop]);
+effectService.disposeEffect(topEffect);
+summarySingleSlotService.columnSlotService.unholdColumn(summaryTop);
+```
+
+### The order of a bucket, as one derivation per key
+
+```ts signature
+createOIMBucketMemoComputedService<TKey, TBucketMemberSlot extends TOIMSlot, TSlots, TBucketStore, TComputedStore?>({
+    bucketCollectionService: OIMSlotCollectionService<TKey, TOIMBucketSlot<TSlots, TKey>, TBucketStore, OIMSlotContentBucketService<TBucketMemberSlot, TSlots>, …>;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;      // default OIMSlotAtUnholdReleasePolicy.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<readonly TBucketMemberSlot[], TKey>, TComputedStore>;
+}): OIMBucketMemoComputedService<TKey, TBucketMemberSlot, TSlots, TBucketStore, TComputedStore>
+
+createBucketMemoStoreSlot(bucketStoreSlot: TOIMStoreSlot<TBucketStore, TOIMBucketSlot<TSlots, TKey>, readonly TBucketMemberSlot[]>): TOIMStoreSlot<TComputedStore, TOIMBucketMemoComputedSlot<TBucketMemberSlot, TKey>>
+```
+
+It takes no db: a memo store slot runs on the channel slot of the bucket store slot it reads. The class is
+`new OIMBucketMemoComputedService(options)` (options type `TOIMBucketMemoComputedServiceOptions`), whose
+`computedCollectionService` reads the per-key derivations; `createBucketMemoStoreSlot(bucketStoreSlot)` makes
+one memo store slot over one bucket store slot.
+
+Subscribe to THIS, not to the bucket, when a consumer wants the list as an array
+it can compare by identity. The value is the bucket's slots in the bucket's order;
+it is produced on the read that asks for it and never while nothing reads it, and
+its `changedAtRevision` and `changedAtEpoch` move only when the list a reader would
+see actually changed. The list is handed back by IDENTITY: it is the same array for
+as long as the list holds, so a consumer memoising on identity needs no comparison
+of its own. For a SORTED list use [`createOIMSortedComputedService`](#sorted-lists).
+
+The source list is ONE slot — the bucket — and it never grows: a bucket
+change is a move of the bucket's value, not of the derivation's sources.
+
+```ts
+const orderService = createOIMBucketMemoComputedService({
+    bucketCollectionService: orderedService,
+});
+const order = orderService.createBucketMemoStoreSlot(ordered);
+const deck = orderService.computedCollectionService.holdSlotByKey(order, 'spades');        // mints the bucket too, and holds it
+effectService.createEffect(db, () => render(deck.computedValueService.getValueForSlot(deck)), [], [deck]);
+```
+
+---
+
+## Key stores
+
+```ts signature
+interface IOIMSlotStoreService<TKey, TSlot extends TOIMKeyedSlot = TOIMKeyedSlot, TStore = unknown> {
+    createStore(): TStore;
+    ownKey<TOwnedKey extends TKey>(key: TOwnedKey): TOwnedKey;
+    isSameKey(key: TKey, otherKey: TKey): boolean;
+    get(store: TStore, key: TKey): TSlot | undefined;
+    set(store: TStore, key: TKey, slot: TSlot): void;
+    remove(store: TStore, key: TKey): void;
+    getSlots(store: TStore): IterableIterator<TSlot>;
+    getSlotCount(store: TStore): number;
+}
+```
+
+**The store service is STATELESS and the storage is its first argument.** It
+builds the storage with `createStore()` and the store slot keeps it, as `storeSlot.store`; `getSlotCount` is a
+method taking that storage, not a getter. One store service instance can
+therefore serve every store slot of every service in a process.
+
+**`ownKey(key)` is the key a slot is minted with, and the store never touches a
+slot.** The content service asks it once, before the slot owner's `createSlot`, so the slot's `key` is
+written by its owner and no one else. The map-driven store answers the key itself;
+the tree-driven one answers a copy of the composite key, so a caller reusing the
+array it handed in cannot change the key of a slot already filed.
+
+**`isSameKey(key, otherKey)` is what the store means by one key.** The map-driven
+store answers SameValueZero; the tree-driven one compares length and then every
+part by SameValueZero, so two arrays with the same parts are one key. Every collection
+service answers the same question as `service.isSameKey(key, otherKey)`, asking
+its own store service; an index deciding whether a key moved first checks `===` (the key
+columns did not change) and otherwise asks its bucket store service.
+
+```ts signature
+type TOIMSlotStoreTree<TSlot, TCompositeKeyPart> = {
+    readonly root: TOIMCompositeKeyNode<TSlot, TCompositeKeyPart>;
+    readonly slots: Set<TSlot>;
+};
+
+type TOIMCompositeKeyNode<TAtKey = unknown, TCompositeKeyPart = TOIMEntitySlot> = {
+    childNodes: Map<TCompositeKeyPart, TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>> | undefined;
+    atThisKey: TAtKey | undefined;
+};
+```
+
+`TOIMSlotStoreTree` is what `OIMSlotTreeStoreService.createStore()` builds:
+the tree's root plus a flat `Set` of every filed slot, which makes `getSlots()` and
+`getSlotCount()` O(1) rather than a walk, and keeps `getSlots()` in filing order like every other store.
+`TOIMCompositeKeyNode` is one level of that tree — a `Map` from composite key part to the
+level below, created only when the first longer key is filed under it (a leaf has
+`childNodes: undefined`), and the slot, if any, whose key ends here. Both are exported so a caller can annotate the storage they
+are holding; neither is something you build by hand.
+
+| Store | Key type |
+|---|---|
+| `OIMSlotMapStoreService<TSlot>` | `TOIMStoreKey` = `string \| number` |
+| `OIMSlotTreeStoreService<TOIMStoreKey, TSlot>` built with `OIMScalarKeyTreeWalk.INSTANCE` | `readonly TOIMStoreKey[]` — **a chain of VALUES** |
+| `OIMSlotTreeStoreService<TOIMEntitySlot, TSlot>` built with `OIMCompositeKeyTreeWalk.INSTANCE` | `readonly TOIMEntitySlot[]` — **a chain of entity SLOTS** |
+| `OIMSingleSlotStoreService.INSTANCE` | `void` — one slot per store slot, its store a `TOIMSingleSlotStore` (`{ slot }`); what every single is built on |
+
+Two stores for keys, one per shape of address, and the single-slot store for no key. The chain store descends one `Map`
+lookup per composite key part, keeps `[a]` and `[a, b]` apart, and has **no encoding step**:
+`JSON.stringify` and a NUL-join were both rejected — the latter was not
+injective, so `['a b']` and `['a', 'b']` were one key.
+
+**The two DESCENTS are a fork chosen at construction, and the choice is about
+lifetime.** The store takes an `IOIMKeyTreeWalk<TCompositeKeyPart>` as its only
+constructor argument; there is no runtime branch on what a composite key part is, and the
+first type parameter is the composite key part type. Do not treat the strategies as one store
+with looser typing, and do not expect a class per strategy — there is one store class
+and two walks.
+
+```ts signature
+interface IOIMKeyTreeWalk<TCompositeKeyPart> {
+    mintNodeAt<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>;
+    nodeAt<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart> | undefined;
+    deleteKey<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TAtKey | undefined;
+}
+```
+
+`deleteKey` takes the value filed at the key and hands it back, in one descent:
+one `Map.get` per key part and no array of the path. On the way back up it
+unlinks every node the delete left empty and stops at the first one that still
+holds a value or leads to a longer key, so `['u1', 'p7', 'x']` survives a delete
+of `['u1', 'p7']`. A key that is only a prefix of filed keys, or reaches nothing,
+deletes nothing and returns `undefined`.
+
+| Walk | Class | Shared instance | What a composite key part is | Holds? |
+|---|---|---|---|---|
+| scalar | `OIMScalarKeyTreeWalk` | `OIMScalarKeyTreeWalk.INSTANCE` | `TOIMStoreKey` | no |
+| composite | `OIMCompositeKeyTreeWalk` | `OIMCompositeKeyTreeWalk.INSTANCE` | `TOIMEntitySlot` | **yes — one hold per edge** |
+
+**The hold is the whole difference.** `OIMCompositeKeyTreeWalk.mintNodeAt` calls
+`holdCompositeKeyPart` the first time it creates an edge, which runs
+`entitySlot.owner.holdSlot(entitySlot)`; `deleteKey` calls `unholdCompositeKeyPart` on
+exactly the edges it unlinked, deepest first and only after every unlink is done, which runs `entitySlot.owner.unholdSlot(entitySlot)` unless
+`oimIsSlotReleased(entitySlot)` — so an entity slot stays addressable for
+as long as its composite key parts are, and a composite key part nothing else refers to goes the
+moment the last entity keyed on it does. The scalar walk holds nothing: a value has
+no identity to keep alive. Both throw `an empty key is not a key` on `[]`.
+
+Construct the classes yourself only if you want your own instance; both walks are
+stateless, and the shared one on `OIMDefaults` is what you normally pass.
+
+```ts
+// A CHAIN OF VALUES — `['deck-1', 'red']`.
+type TScalarChain = readonly TOIMStoreKey[];
+type Tally = { deck: string; day: string; count: number };
+type TTallyStore = import('@oimdb/core').TOIMSlotStoreTree<TOIMEntitySlot<Tally, TScalarChain>, TOIMStoreKey>;
+
+const tallyService = createOIMSlotCollectionService<
+    ReturnType<typeof createOIMSlotContentEntityService<Tally, TScalarChain>>, TTallyStore
+>({
+    slotContentService: createOIMSlotContentEntityService<Tally, TScalarChain>(),
+    slotStoreService: new OIMSlotTreeStoreService<TOIMStoreKey, TOIMEntitySlot<Tally, TScalarChain>>(
+        OIMScalarKeyTreeWalk.INSTANCE,
+    ),
+});
+const tallies = tallyService.createStoreSlot(db);
+tallyService.writeSlotContentByKey(tallies, ['spades', 'mon'], { deck: 'spades', day: 'mon', count: 1 });
+tallyService.getSlotByKey(tallies, ['spades', 'mon']);
+```
+
+```ts
+// A CHAIN OF IDENTITIES — each composite key part is a slot, and each edge takes a counted
+// hold on it, so the entity keeps its composite key parts resolvable for as long as it is
+// addressable.
+type User = { id: string };
+type Group = { id: string };
+declare const alice: TOIMEntitySlot<User, TOIMStoreKey>;
+declare const admins: TOIMEntitySlot<Group, TOIMStoreKey>;
+
+type Enrolment = {
+    user: TOIMEntitySlot<User, TOIMStoreKey>;
+    group: TOIMEntitySlot<Group, TOIMStoreKey>;
+    since: number;
+};
+type TChain = readonly TOIMEntitySlot[];
+type TEnrolmentStore = import('@oimdb/core').TOIMSlotStoreTree<TOIMEntitySlot<Enrolment, TChain>, TOIMEntitySlot>;
+
+const enrolmentService = createOIMSlotCollectionService<
+    ReturnType<typeof createOIMSlotContentEntityService<Enrolment, TChain>>, TEnrolmentStore
+>({
+    slotContentService: createOIMSlotContentEntityService<Enrolment, TChain>(),
+    slotStoreService: new OIMSlotTreeStoreService<TOIMEntitySlot, TOIMEntitySlot<Enrolment, TChain>>(
+        OIMCompositeKeyTreeWalk.INSTANCE,
+    ),
+});
+const enrolments = enrolmentService.createStoreSlot(db);
+enrolmentService.writeSlotContentByKey(enrolments, [alice, admins], { user: alice, group: admins, since: 2026 });
+enrolmentService.getSlotByKey(enrolments, [alice, admins]);
+```
+
+**Never put a scalar in a composite-walk key.** It is a type error, and
+past a cast it throws a TypeError inside the mint, setting `holdCount` on a
+string, after the edge is already in the tree. `OIMScalarKeyTreeWalk.INSTANCE` is
+the walk for that key — the same store class, the other strategy.
+
+**Compare a chain with the strategy that matches it**: `oimSameSlotSequence` for identities
+(reference, per composite key part), `oimSameKeySequence` for a chain or list of values.
+`oimSameSlotSequence` over a scalar chain is the `NaN` defect — it answers "a different
+address" for the address the tree is looking at.
+
+---
+
+## Lifetime — the owner protocol
+
+**`slot.owner` is the only reference a slot carries, and it is never
+`undefined`.** Every slot minted anywhere has one: a slot a collection filed carries that collection type's slot owner (an `OIMSlotOwnerService`) — keyed or single alike — and a slot that has been released KEEPS its owner
+and raises the RELEASED flag in `slot.slotFlags` instead, which the doors below read.
+
+```ts signature
+interface IOIMSlotOwner {
+    holdSlot(slot: TOIMSlot): void;
+    unholdSlot(slot: TOIMSlot): void;
+    releaseSlotIfUnheld(slot: TOIMSlot): void;
+    subscribeToSlot(slot: TOIMSlot, effect: TOIMEffect, edge: number): number;
+    unsubscribeFromSlot(slot: TOIMSlot, at: number, effect: TOIMEffect): boolean;
+}
+```
+
+At a deadline the release queue reads its MARKER off the slot, decides, and calls
+`releaseSlotIfUnheld` itself. The owner has no "how long is left" question.
+
+| Door | What it is for |
+|---|---|
+| `holdSlot(slot)` | `holdCount++`. That is all — no handle, no `{ slot, release }` record. **Throws by name** on a released slot |
+| `unholdSlot(slot)` | `holdCount--`, then run `releaseSlotIfUnheld`. **It opens no window** — nothing is stamped here, so a slot whose deadline has passed goes at this call. **Throws by name** on a released slot, and when `holdCount` is already `0`: a second unhold against one hold would release a slot somebody else is reading |
+| `releaseSlotIfUnheld(slot)` | run the release guard. Releases only an unheld, unreferenced, still-owned, out-of-grace slot; **returns silently** on one already released |
+| `subscribeToSlot(slot, effect, edge)` | push the effect onto `slot.effects` and its `edge` (which of the effect's sources this slot is) onto `slot.effectEdges`, and hand back **the position**, which the effect remembers. **It takes a hold** through `holdSlot`, so a subscribed slot is a held one and nothing can subscribe without holding. **Throws by name** on a released slot: a subscriber filed on one would never be woken |
+| `unsubscribeFromSlot(slot, at, effect)` | swap the tail of both arrays into `at`, tell the moved effect its new position at its edge (one write, no search), and **if that emptied the list, `onSlotIdle(slot)` opens a fresh idle window**, then give the subscription's hold back through `unholdSlot`; hand back whether it unfiled. Unfiling by remembered position is why taking N subscribers off one identity is O(N) and not quadratic. **Throws by name** on a released slot |
+
+**`OIMSlotOwner`** is the base class and it is concrete: it implements all five.
+Its `releaseSlotIfUnheld` does nothing, its
+`unsafeMutateSlot(slot, mutateSlot)` hands `mutateSlot` the slot as `TOIMEditable` with no
+guard at all (it exists so a library that adds its own release wheel can keep its own bit in
+`slot.slotFlags`; the engine owns bits `1`, `2`, `4`, `8`, `16` and `32`, so a library starts at `64`;
+it is on the owner so a subclass can hook every such mutation), and a `protected
+onSlotIdle` does nothing; a `protected assertNotReleased` is what every refusing
+door above calls. `OIMSlotOwnerService` overrides `onSlotIdle` and
+`releaseSlotIfUnheld`, asking its release policy and its content service; the clock is the slot's channel slot's.
+A single's slot is owned the same way: its owner is its collection type's slot owner, and that release policy
+applies to it.
+
+### The column owner
+
+**Columns are a module of every collection.** The column slots of a carrier slot live
+in `carrierSlot.columnSlotStore`, a field of the base `TOIMSlot`, so any slot can carry
+them — an entity slot, a bucket slot, a computed slot. `OIMColumnSlotOwner` is abstract, an
+`OIMSlotOwner` subclass, with two strategies:
+`OIMPushColumnSlotOwner` (plain column slots woken by marks on a write; entity and bucket collections,
+keyed and single) and `OIMPullColumnSlotOwner` (each column slot a computed slot over its carrier;
+computed collections, keyed and single). The factory hands the strategy's factory to the slot owner as
+`createColumnSlotOwner`. Each collection type has its own column owner, and every column slot it mints names that
+owner as its `owner`. The owner holds only the column slot store service; the column state — the column
+groups and which columns are referenced — lives on the store slot. The collection exposes it only
+through its column doors: `getColumn(slot, columnName)`, `holdColumn(slot, columnName)`,
+`unholdColumn(columnSlot)`, `getColumnGroup(names)`, `holdColumnGroup(slot, group)` (on
+a single the same doors, with the slot `getSingleSlot(storeSlot)` hands back; the computed ones take a computed slot
+and return a `TOIMComputedColumnSlot`), and `getAnyColumn(slot)` / `holdAnyColumn(slot)`.
+A column slot is released the moment its last effect is disposed and nothing holds it:
+disposing the effect gives its hold back through the column owner, which then runs its own
+`releaseSlotIfUnheld`, which stops on `holdCount > 0` or a non-empty `effects`,
+takes the column out of the carrier slot's column store — dropping that store
+entirely when it empties — sets the RELEASED flag of `columnSlot`, and then runs
+`carrierSlot.owner.releaseSlotIfUnheld(carrierSlot)`, because a carrier kept alive only by
+a watched column is one nothing watches any more. This guard is the one place a store
+lookup survives — it compares `columnSlotStoreService.get(columnSlotStore, columnSlot.key)`
+against the column slot — because a column is filed on its carrier slot, not in the
+store slot that the `owner` check covers.
+`OIMSlotOwnerService`'s release guard refuses while `slot.columnSlotStore` stands,
+so a slot with any live column slot is never released.
+
+---
+
+## Ordered lists
+
+### Disposers
+
+The disposers this package hands back are the unsubscribes `OIMChannelService.INSTANCE.subscribeAfterEachFrame`
+and its siblings return, and the one `effectService.subscribeEffect(db, body, sourceSlots?, sourceComputeds?, sourceTrackingComputeds?)`
+returns. An effect from `createEffect` has none, so the caller writes
+`() => effectService.disposeEffect(effect)`. A hold is given back through its owner, not through a disposer.
+
+```ts
+const effect = effectService.createEffect(db, () => { paint(slot.entity); }, [slot]);
+const disposers: TOIMDisposer[] = [];
+disposers.push(() => { effectService.disposeEffect(effect); });
+disposers.push(() => { slot.owner.unholdSlot(slot); });
+for (let i = disposers.length - 1; i >= 0; i--) disposers[i]();
+```
+
+### `oimOrderedListCommandsOfTransition`
+
+```ts signature
+oimOrderedListCommandsOfTransition(
+    prev: readonly TOIMEntitySlot[],
+    next: readonly TOIMEntitySlot[],
+    maxCommandsPerSlot?: number,   // commands per slot of `next`; left out, it NEVER resets
+): TOIMOrderedListCommand[]
+
+type TOIMOrderedListCommand =
+    | { type: 'insert'; index: number; slot: TOIMEntitySlot }
+    | { type: 'remove'; index: number }
+    | { type: 'move'; from: number; to: number }
+    | { type: 'reset'; slots: readonly TOIMEntitySlot[] };
+```
+
+A free function, not a method on `OIMChannelService`: a class's methods cannot be
+dropped one at a time by a bundler.
+
+`prev` MUST BE A SNAPSHOT TAKEN WHERE YOU RENDERED. Every member read on a bucket
+content service hands back the LIVE list — declared `Iterable`, not an array, so
+`Array.from(bucketService.slotContentService.getBucketMemberSlots(bucketSlot))` is required and is the copy. A `prev` kept
+live is the same array as `next` on the following frame: the diff is empty,
+no reorder is ever drawn, and nothing throws. The other safe `prev` is
+`createOIMBucketMemoComputedService`'s value — a fresh array on every write that
+changed the list, the same array while it did not.
+
+A LIST MAY NAME ONE SLOT TWICE, and then it holds that slot twice.
+`OIMSlotContentPositionalArrayBucketService` records every mention, so an ordered bucket's list is exactly such a list. The
+mentions of one identity are matched in the order they appear, and the script
+reproduces `next` mention for mention. The minimal move count (`common − LIS`)
+is claimed for lists whose identities are distinct: where the two lists name one
+identity a different number of times, which mentions are matched decides how
+long the common subsequence can be, and matching them in order does not always
+leave the longest.
+
+---
+
+## Types
+
+```ts signature
+type TOIMStoreKey = string | number;
+type TOIMDisposer = () => void;
+type TOIMEffectBody = () => (() => void) | void;   // a returned function is the undo
+type TOIMSourceTrackingEffectBody = (sourceTracker: OIMSourceTracker) => (() => void) | void;
+type TOIMSameValueGuard<TValue = unknown> = (prev: TValue, next: TValue) => boolean;
+type TOIMChannelScheduler = (flush: () => void) => void;
+type TOIMSortColumn<TEntity extends object> = { columnName: TOIMSortableColumnName<TEntity>; direction: 'asc' | 'desc' };
+type TOIMSortableColumnName<TEntity extends object> =   // a column whose values are string | number | bigint
+    { [TColumn in keyof TEntity]-?: NonNullable<TEntity[TColumn]> extends string | number | bigint ? TColumn : never }[keyof TEntity] & string;
+
+// EVERY property is `readonly`. A slot is written through its owner and its
+// service, never by assigning to it; `TOIMEditable` is how the engine
+// itself drops that guard where it is the one mutator.
+type TOIMSlot = {
+    readonly effects: TOIMEffect[] | undefined;
+    readonly effectEdges: number[] | undefined; // beside each effect, which of its sources this slot is
+    readonly changedAtRevision: number;
+    readonly changedAtEpoch: number;
+    readonly holdCount: number;
+    readonly releaseDueAfterWriteMs: number; // -1 until a write stamps it
+    readonly releaseDueAfterIdleMs: number;  // -1 until idleness stamps it
+    readonly releaseDueAfterUnholdMs: number; // -1 until the last unhold stamps it
+    readonly slotFlags: number;        // OIM_SLOT_FLAG_EMPTY = 1, OIM_SLOT_FLAG_RELEASED = 2; bits up to 32 are the engine's
+    readonly columnSlotStore: unknown; // the column slots this slot carries; undefined while none
+    readonly storeSlot: TOIMStoreSlot;  // the store slot it belongs to; a column slot's is its carrier's
+    readonly owner: IOIMSlotOwner;     // never undefined, never cleared
+};
+
+// A store slot is NOT a slot: nothing holds, subscribes or wakes it. It is the state of one
+// collection instance — its store, its channel slot, its listeners and column state — and every
+// service that touches it is stateless. Only the fields a consumer reads are shown.
+type TOIMStoreSlot<TStore = unknown, TSlot extends TOIMSlot = TOIMSlot, TPatch = unknown> = {
+    readonly store: TStore;
+    readonly channelSlot: TOIMChannelSlot;
+    readonly contentChangeListeners: IOIMSlotContentChangeListener<TSlot, TPatch>[] | undefined;
+    readonly contentChangeListenerReadColumnNames: (readonly string[] | undefined)[] | undefined;
+    readonly indexKeysPositions: TOIMIndexKeysPositions | undefined;
+    readonly sourceStoreSlot: TOIMStoreSlot | undefined;   // an index store slot's source
+    readonly isDisposed: boolean;                          // an index store slot after disposeIndexStoreSlot
+    readonly slotService: TSlotService;                    // the service that created the store slot
+    readonly batchDepth: number;                           // openBatch / closeBatch nesting
+    // … column-reader counts, column groups, batch queues, bucket write queues: the services' own
+};
+
+type TOIMSingleSlotStore<TSlot> = { slot: TSlot | undefined };
+type TOIMSingleSlotStoreSlot<TSlot extends TOIMSlot, TPatch = unknown> = TOIMStoreSlot<TOIMSingleSlotStore<TSlot>, TSlot, TPatch>;
+
+type TOIMIndexStoreSlot<TStore, TBucketSlot, TBucketPatch, TSourceSlot, TSourcePatch, TKey, TSourceStore> =
+    TOIMStoreSlot<TStore, TBucketSlot, TBucketPatch> & {
+        readonly sourceStoreSlot: TOIMStoreSlot<TSourceStore, TSourceSlot, TSourcePatch>;
+        readonly indexKeysPosition: number;
+        readonly contentChangeListener: IOIMSlotContentChangeListener<TSourceSlot, TSourcePatch>;
+        readonly requestedKeys: readonly TKey[] | undefined;
+        readonly bucketColumnNames: Set<string>;
+        readonly isAnyBucketColumnRead: boolean;
+        readonly isDisposed: boolean;
+    };
+
+type TOIMComputedStoreSlot<TStore = unknown, TValue = unknown, TKey = unknown> =
+    TOIMStoreSlot<TStore, TOIMComputedSlot<TValue, TKey>> & {
+        readonly derive: ((computedSlot: TOIMComputedSlot<TValue, TKey>) => TValue) | undefined;
+        readonly createSources: ((computedSlot: TOIMComputedSlot<TValue, TKey>) => Partial<TOIMComputedSources>) | undefined;
+    };
+
+type TOIMEditable<TSlot> = { -readonly [K in keyof TSlot]: TSlot[K] };
+
+type TOIMKeyedSlot<TKey = unknown> = TOIMSlot & { readonly key: TKey };
+type TOIMIndexableSlot<TKey = unknown> = TOIMKeyedSlot<TKey> & { readonly indexKeys: unknown[] | undefined };
+
+type TOIMEntitySlot<TEntity extends object = object, TKey = unknown> = TOIMIndexableSlot<TKey> & {
+    readonly entity: TEntity | undefined;
+    readonly data: unknown[] | undefined;
+};
+
+// `data` belongs to the consumer: the core never reads or writes it, and clearing or
+// removing the slot (`slotContentService.clearSlotContent(slot)`) does not reset it. Each index keeps its
+// last key for the entity slot in `indexKeys`, through the index's `IOIMIndexKeysService`.
+
+type TOIMColumnSlot = TOIMSlot & {
+    readonly carrierSlot: TOIMSlot;    // the entity slot or bucket slot it hangs off
+    readonly key: string;
+};
+
+type TOIMComputedColumnSlot = TOIMComputedSlot<unknown, string>;   // a computed's getColumn / holdColumn return it; it goes in createEffect's second list
+
+type TOIMBucketContentSlot<TSlots = unknown> = TOIMSlot & {
+    readonly owner: IOIMSlotOwner;
+    readonly storeSlot: TOIMStoreSlot<unknown, TOIMBucketContentSlot<TSlots>>;
+    readonly bucketSlotsStore: TSlots;
+    readonly commands: readonly TOIMOrderedListCommand[] | undefined;   // emptied when the flush has ended
+    readonly isWholeListRecorded: boolean;                               // reset to false with it
+    readonly commandsStartedAtRevision: number;                          // the clock the script started at
+    readonly commandsStartedAtEpoch: number;
+};
+type TOIMBucketSlot<TSlots = unknown, TKey extends NonNullable<unknown> = NonNullable<unknown>> =
+    TOIMBucketContentSlot<TSlots> & TOIMIndexableSlot<TKey>;   // a keyed bucket slot; a single bucket is the content slot alone
+
+// `holdSlotByKey(storeSlot, key)` hands back the slot itself; give the hold back with `slot.owner.unholdSlot(slot)`.
+
+type TOIMBucketSlotsSetStore<TBucketMemberSlot extends TOIMSlot = TOIMSlot> = Set<TBucketMemberSlot>;
+type TOIMBucketSlotsArrayStore<TBucketMemberSlot extends TOIMSlot = TOIMSlot> = {
+    bucketMemberSlots: TBucketMemberSlot[];
+    uniqueBucketMemberSlots: Set<TBucketMemberSlot> | undefined;   // kept by OIMBucketUniqueMemberSlotsArrayService
+    sortedCount: number;
+};
+
+type TOIMEntityColumnName<TEntity extends object> =
+    [TEntity] extends [never] ? never
+        : object extends TEntity ? string : keyof TEntity & string;
+
+type TOIMComputedDerivation = TOIMComputedSources & {   // what a computed slot and a TOIMEffect share
+    ranAtRevision: number; ranAtEpoch: number;
+};
+
+type TOIMTimer = (run: () => void, inMs: number) => TOIMDisposer;
+```
+
+**`TOIMEditable<TSlot>` strips `readonly` from every property.** It is exported
+because the rule "data has one mutator" is enforced by the slot types being
+readonly everywhere else: a class that IS the sole mutator of a slot's property
+casts through this type at the one place it writes, and every other reader is
+stopped by the compiler. `IOIMSlotStamp.stamp` takes one, which is what lets a
+stamp write `releaseDueAfterWriteMs` and nothing else write it. **Do not reach for this to
+work around a compile error** — if you need it and you do not own the property,
+the mutation belongs on whoever does.
+
+Comparison helpers — one per shape of address, plus the value rule. Use the one
+that matches what you are comparing; they are not interchangeable.
+
+| Helper | Compares | Rule |
+|---|---|---|
+| `oimSameValueZeroGuard(prev, next)` | a stored value, or one scalar address | SameValueZero |
+| `oimSameSlotSequence(prev, next)` | `readonly TOIMSlot[]` — a chain of identities | positional, by reference |
+| `oimSameKeySequence(keys, otherKeys)` | `readonly TKey[]` — a list of keys or a chain of values | positional, SameValueZero per key |
+
+---
+
+## Full export list
+
+**237 names, every export of `packages/core/src/index.ts`, grouped by topic.**
+
+*Store aggregates* — `OIMSlotCollectionStoreAggregate` · `OIMWritableSlotCollectionStoreAggregate` ·
+`OIMSingleSlotStoreAggregate` · `OIMWritableSingleSlotStoreAggregate` · `OIMSlotCollectionIndexStoreAggregate` ·
+`createOIMSlotCollectionStoreAggregate` · `createOIMSingleSlotStoreAggregate`
+
+*Channel and database slots* — `OIMChannelService` · `TOIMChannelSlot` · `TOIMChannelSlotOptions` · `createOIMChannelSlot` ·
+`IOIMChannelMap` · `TOIMDBOptions` · `OIMFlushSchedulerService` · `TOIMFlushSchedulerSlot` · `IOIMFlushSchedulerListener`
+
+*Collector services and slots* — `OIMUnusedSlotCollectorService` · `TOIMUnusedSlotCollectorSlot` ·
+`createOIMUnusedSlotCollectorSlot` · `TOIMCollectorSlot` · `TOIMCollectorSlotOptions` · `createOIMCollectorSlot` ·
+`OIMSlotWheel` · `TOIMSlotWheelOptions` · `OIMSlotReleaseWheel` · `TOIMSlotReleaseWheelOptions` ·
+`oimMintAfterWriteSlotReleaseWheel` · `oimMintAfterIdleSlotReleaseWheel` · `oimMintAfterUnholdSlotReleaseWheel` ·
+`OIMSlotRefetchWheel` · `TOIMSlotRefetchWheelOptions` · `IOIMSlotRefetchListener`
+
+*Slot services* — `OIMSlotCollectionService` · `OIMWritableSlotCollectionService` · `TOIMSlotCollectionServiceOptions` ·
+`createOIMSlotCollectionService` · `OIMSingleSlotService` · `OIMWritableSingleSlotService` · `TOIMSingleSlotServiceOptions` ·
+`createOIMSingleSlotService` · `OIMColumnSlotService` (the column doors, `service.columnSlotService`) ·
+`OIMSlotOwnerService` (**type only**) · `TOIMSlotOwnerServiceOptions` · `IOIMSlotContentService` · `IOIMSlotContentWriter` ·
+`IOIMKeyedSlotCreator` · `IOIMSingleSlotCreator` · `IOIMSlotFilingService` · `TOIMSlotContentServiceKey` ·
+`TOIMSlotContentServiceSlot` · `TOIMSlotContentServiceSingleSlot` · `TOIMSlotContentServiceContent` ·
+`TOIMSlotContentServicePatch` · `OIMSlotContentChangeListenerService`
+
+*Content services* — `OIMSlotContentEntityService` · `TOIMSlotContentEntityServiceOptions` ·
+`createOIMSlotContentEntityService` · `TOIMEntitySlotOwnerService` · `TOIMEntityContentSlot` · `OIMSlotContentBucketService` ·
+`OIMSlotContentArrayBucketService` · `OIMSlotContentPositionalArrayBucketService` · `OIMSlotContentSetBucketService` ·
+`OIMSlotContentSortedArrayBucketService` · `TOIMSlotContentBucketServiceOptions` ·
+`TOIMSlotContentArrayBucketServiceOptions` · `TOIMSlotContentSortedArrayBucketServiceOptions` · `TOIMBucketSlotOwnerService` ·
+`TOIMBucketContentSlot` · `OIMSlotContentComputedService` (**type only**) · `TOIMSlotContentComputedServiceOptions` ·
+`TOIMComputedContentSlot`
+
+*Index and computed store slots* — `createOIMSlotCollectionIndexService` · `TOIMSlotCollectionIndexServiceFactoryOptions` ·
+`TOIMSlotCollectionIndexServiceStoreSlot` · `TOIMSortedComputedSlot` · `TOIMBucketMemoComputedSlot`
+
+*Runtime* — `TOIMChannelFrame` · `TOIMChannelClock` ·
+`TOIMChannelScheduler` · `TOIMDisposer` · `IOIMErrorPolicy` · `OIMLogAndContinueErrorPolicy` ·
+`TOIMLogAndContinueErrorPolicyOptions` · `OIMThrowAtOnceErrorPolicy` · `OIMChannelQueue` (**type only**) ·
+`oimIsAnySlotChangedAfter`
+
+`oimIsAnySlotChangedAfter(slots, revision, epoch): boolean` answers whether any of the slots was
+written after that clock reading — `channelSlot.clock` read earlier.
+
+*Derivations* — `OIMEffectService` · `IOIMEffectService` · `TOIMEffect` (**type only** —
+`OIMEffectService.createEffect` is the constructor) · `TOIMEffectBody` · `TOIMSourceTrackingEffectBody` ·
+`OIMSourceTracker` (**type only** — the service builds it) · `TOIMComputedSlot` · `TOIMComputedSources` · `TOIMComputedValueReleaser` · `OIMSourceTrackingComputedService` · `OIMSingleSourceTrackingComputedService` · `createOIMSourceTrackingComputedService` · `createOIMSingleSourceTrackingComputedService` · `TOIMSourceTrackingComputedSlot` · `TOIMSourceTrackingComputedContentSlot` · `TOIMSourceTrackingComputedDerive` · `OIMSlotContentSourceTrackingComputedService` (**type only**) · `TOIMSourceTrackingComputedDerivationOptions` · `TOIMComputedServiceFactoryOptions` ·
+`OIMComputedValueService` · `IOIMComputedValueService` · `TOIMComputedValueServiceOptions` · `oimRefreshSourceComputeds` · `TOIMComputedDerivation`
+
+`oimRefreshSourceComputeds(sourceComputeds)` brings every computed in the list current. A binding
+read outside an effect (`useOIMValue` in `@oimdb/react`, `exoBinding` in `@oimdb/exodra`) calls it
+on its `sourceComputeds` before `derive`, so the derive never reads a stale computed.
+
+*Slots and their owners* — `TOIMSlot` · `TOIMStoreSlot` · `TOIMSingleSlotStoreSlot` ·`IOIMStoreSlotListener` · `OIMNoStoreSlotListener` · `IOIMSlotSubscriptionListener` · `OIMNoSlotSubscriptionListener` ·`oimIsSlotEmpty` · `oimIsSlotReleased` · `TOIMEditable` · `TOIMKeyedSlot` · `TOIMIndexableSlot` ·
+`TOIMEntitySlot` · `TOIMColumnSlot` · `TOIMComputedColumnSlot` · `TOIMColumnGroup` · `TOIMColumnReaders` · `OIMColumnSlotOwner` ·
+`OIMPushColumnSlotOwner` · `OIMPullColumnSlotOwner` · `TOIMColumnSlotOwnerOptions` · `TOIMBucketSlot` ·
+`TOIMSameValueGuard` · `OIMSlotOwner` ·
+`IOIMSlotOwner` · `IOIMSlotEmptinessPolicy` ·
+`IOIMSlotStamp` · `oimHoldSlots` · `oimUnholdSlotsIfAlive` · `IOIMSlotContentChangeListener`
+
+`oimIsSlotEmpty(slot): boolean` reads the EMPTY bit of `slot.slotFlags`.
+`oimIsSlotReleased(slot): boolean` reads its RELEASED bit.
+
+*Release policies* — `IOIMSlotReleasePolicy` ·
+`OIMSlotAfterWriteReleasePolicy` · `TOIMSlotAfterWriteReleasePolicyOptions` ·
+`IOIMSlotReleaseDueFramePolicy` · `OIMSlotReleaseAutoDueFramePolicy` · `OIMSlotReleaseManualDueFramePolicy` ·
+`OIMSlotAfterIdleReleasePolicy` · `TOIMSlotAfterIdleReleasePolicyOptions` ·
+`OIMSlotAfterUnholdReleasePolicy` · `TOIMSlotAfterUnholdReleasePolicyOptions` ·
+`OIMSlotAtUnholdReleasePolicy` · `OIMSlotAtEmptyReleasePolicy` · `OIMSlotNeverReleasePolicy` · `OIMSlotEarliestReleasePolicy` ·
+`TOIMTimer` · `oimSliceOfMs` · `OIM_SLICE_LENGTH_MS`
+
+*Entity writers* — `IOIMEntityWriter` · `createOIMInPlaceEntityWriter` ·
+`createOIMReplacingEntityWriter` · `TOIMEntityWriterOptions` · `TOIMEntityInserter` ·
+`oimInsertEntityWithCopy` · `oimInsertEntityWithoutCopy` · `oimInsertEntityWithSanitizedCopy` · `oimPatchEntityColumns` · `oimPatchEntityColumn` · `oimGuardedPatchEntityColumns` · `oimGuardedPatchEntityColumn` · `oimPutEntityColumns` · `oimGuardedPutEntityColumns` · `TOIMEntityColumnName` · `TOIMEntityColumnValue`
+
+*Buckets* — `OIMBucketCommands` · `TOIMBucketCommandsOptions` · `IOIMBucketCommands` ·
+`IOIMBucketMemberSlotsArrayService` · `OIMBucketMemberSlotsArrayService` · `OIMBucketUniqueMemberSlotsArrayService` ·
+`TOIMBucketSlotsSetStore` · `TOIMBucketSlotsArrayStore` · `OIM_NOTHING_WAS_INSERTED` ·
+`OIM_NOTHING_WAS_REMOVED` · `OIM_FROZEN_EMPTY_SLOTS` · `OIM_REMOVED_WITHOUT_A_POSITION`
+
+*Index services* — `OIMSlotCollectionIndexService` · `OIMSlotCollectionSortedArrayIndexService` · `TOIMSlotCollectionIndexServiceOptions` · `TOIMIndexStoreSlot` ·
+`createOIMSlotCollectionSortedArrayIndexService` · `TOIMIndexKeyOptions` · `TOIMIndexKey` ·
+`IOIMIndexKeysService` · `TOIMIndexKeysPositions` · `OIMIndexKeysService` ·
+`OIMAppendingIndexKeysService` · `OIMReclaimingIndexKeysService`
+
+*Computed services* — `OIMComputedService` · `TOIMComputedServiceOptions` ·
+`createOIMComputedService` · `TOIMComputedStoreSlot` · `OIMSortedComputedService` · `TOIMSortedComputedServiceOptions` ·
+`createOIMSortedComputedService` · `OIMBucketMemoComputedService` · `TOIMBucketMemoComputedServiceOptions` ·
+`createOIMBucketMemoComputedService` · `OIMSingleComputedService` · `createOIMSingleComputedService` ·
+`TOIMComputedDerivationOptions` · `TOIMSortColumn` · `TOIMSortableColumnName` · `oimColumnsComparator`
+
+*Stores and keys* — `TOIMStoreKey` · `IOIMSlotStoreService` ·
+`OIMSlotMapStoreService` · `OIMSlotTreeStoreService` ·
+`OIMSingleSlotStoreService` · `TOIMSingleSlotStore` · `TOIMDefaultSlotStore` ·
+`TOIMSlotStoreTree` · `IOIMKeyTreeWalk` · `TOIMCompositeKeyNode` ·
+`OIMKeyTreeWalk` · `OIMCompositeKeyTreeWalk` · `OIMScalarKeyTreeWalk`
+
+*Assemblies* — `OIMDB` · `OIMDefaults` · `TOIMDefaultsOptions` · `OIMDefaultValue` · `TOIMFactoryOptions`
+
+*Comparison and diffing* — `oimSameValueZeroGuard` ·
+`oimSameSlotSequence` · `oimSameKeySequence` · `oimOrderedListCommandsOfTransition` · `TOIMOrderedListCommand`
+
+*Shared defaults* — `OIMScalarKeyTreeWalk.INSTANCE` and `OIMCompositeKeyTreeWalk.INSTANCE`.
+
+**Nothing else is exported.** If a symbol is not on this list, it does not exist.
+
+---
+
+## Known defects
+
+### A scalar in a key of the composite key tree walk throws
+
+`OIMSlotTreeStoreService` built with `OIMCompositeKeyTreeWalk.INSTANCE` keys on
+`readonly TOIMEntitySlot[]`, so a string or a number in the key throws
+a TypeError past a cast, setting `holdCount` on a string. The store for a tuple
+of scalars is `OIMSlotTreeStoreService` built with
+`OIMScalarKeyTreeWalk.INSTANCE` —
+see **Key stores** above. The fix is the other walk, never a cast.
+
+### `TOIMEffect` is a type-only export
+
+`effectService.createEffect(...)` and `effectService.createAndRunEffect(...)` are the whole of
+legitimate construction. An object literal typed `TOIMEffect` subscribes to nothing and
+schedules nothing: when one of its sources already moved in the open batch, a
+later write to that source is swallowed by the coalescing guard and the effect
+silently sits out the frame it is owed. Scheduling it is what `createEffect`
+does after constructing it.
+
+### Mixing `import` and `require` of `@oimdb/core` throws at the second load
+
+Every `@oimdb` package ships both formats — `dist/index.js` for `import`,
+`dist/index.cjs` for `require` (with `dist/index.d.cts` under the `require`
+condition so a CommonJS consumer's declarations match its runtime), both named
+in the `exports` map. A runtime loads a package once per format, so a process
+that reaches the core both ways would hold two copies of every class and every
+module-level value — two sets of built-in defaults and two `OIMDefaults` classes,
+so services built by the two copies share nothing.
+
+So `src/index.ts` registers its copy under `Symbol.for('@oimdb/core')` on
+`globalThis`, and the second copy to load throws
+`@oimdb/core is loaded twice in this process`. The same throw fires for two
+installed copies of the package.
+
+`@oimdb/react` loaded twice fails loudly instead: every hook throws
+`useOIMDB: no <OIMDBProvider db={...}> above this component.` with the provider plainly above it, because a React
+context's identity is its lookup key.
+
+Do not generate code that reaches `@oimdb/core` — or any package that passes
+core objects around — through both spellings in one process. Pick one.
+
+---
+
+## Other packages
+
+`@oimdb/react`, `@oimdb/persist` (with its five backends), `@oimdb/exodra` and `@oimdb/browser` build
+on the current core — persist, exodra and browser have sections of their own below. Every
+remaining package imports only names the core exports. Read a package's own
+source before generating code against it.
+
+`@oimdb/react` — `<OIMDBProvider db={db}>` carries the `OIMDB` (`useOIMDB()`) and nothing else: the effect
+service is stateless (`OIMEffectService.INSTANCE`) and every hook subscribes with
+`OIMEffectService.INSTANCE.subscribeEffect(db, …)`. A hook that resolves or takes a slot filed on another `OIMDB`
+throws, since nothing below would wake. Every hook that reads a collection by key takes the store slot alone and
+calls the service it carries, `storeSlot.slotService`, typed as a `Pick` of `OIMSlotCollectionService` with only
+the members it calls (a store aggregate passes its `storeSlot`):
+`useOIMEntity(entityStoreSlot, key)` and
+`useOIMBucketSlotsByKey(bucketStoreSlot, key)` (reads `bucketStoreSlot.slotService.slotContentService.getBucketMemberSlots`;
+an index store slot fits too). The hooks over a slot you already hold take the service and the slot:
+`useOIMField(entityCollectionService, slot, name)` (calls `getColumn(slot, name)`),
+`useOIMBucketSlots(bucketCollectionService, bucketSlot)`, and
+`useOIMValue(binding)`, where a binding is `{ sourceSlots?, sourceComputeds?, derive }` (a missing list means none)
+and must keep its identity across renders.
+`useOIMComputedValue(computedSlot: TOIMComputedSlot<TValue>): TValue` is the one-computed case: it subscribes to
+the slot, settles it and reads `computedSlot.value`, with no binding to memoise.
+`useOIMComputedValueByKey(computedStoreSlot, key)` reads one key of a
+computed store slot (plain, sorted, bucket memo) with the same by-key body as `useOIMEntity` /
+`useOIMBucketSlotsByKey`: resolve on commit with `holdSlotByKey`, effect over that slot, resolve-hold given back,
+a key built inline settled by meaning.
+The computed SERVICE is the caller's, built once at module scope with `createOIMComputedService(options)` (no db).
+`useOIMComputedCollection(computedService, derive, createSources, deps): TOIMComputedStoreSlot` builds only a store
+slot per mount — `computedService.createComputedStoreSlot(db, derive, createSources)` in a `useMemo` on `deps`;
+`derive` / `createSources` may be `undefined` when the service has them.
+`useOIMSingleComputedValue(computedService, derive, createSources, deps): TValue` is the same for a void-keyed
+service built with `createOIMSingleComputedService`, its slot read through the store slot's single slot service,
+so a flush between render and subscribe is safe.
+`useOIMSlotsByKeys(storeSlot, keys)` holds the identities its keys name for as long as the
+component is mounted (a `holdSlotByKey` per key on commit, the same holds given back on unmount or when the list
+moves) and subscribes to nothing; it needs no provider.
+Singles are not keyed collections: `createOIMSingleSlotService({ slotContentService })` returns an
+`OIMWritableSingleSlotService` (`getSingleSlot(storeSlot)`, `holdSingleSlot(storeSlot)`), read by
+`useOIMSingleEntity(singleSlotStoreSlot): TEntity | undefined` and
+`useOIMSingleBucketSlots(singleSlotStoreSlot): readonly TOIMEntitySlot<TEntity>[]` — the by-key
+mechanics without a key (getSingleSlot on render, holdSingleSlot on commit, resolve-hold given back once the
+effect exists; the bucket members are copied per render). See `packages/react/README.md`.
+
+What each imports from `@oimdb/core`, read out of `src/`. The source moves —
+re-read the imports rather than trusting this table.
+
+| Package | Imports from the core | Imports a name the core does not export? |
+|---|---|---|
+| `@oimdb/persist` | `IOIMChannelMap`, `IOIMSlotContentChangeListener`, `IOIMEntityWriter`, `OIMChannelService`, `OIMPushColumnSlotOwner`, `OIMSlotContentChangeListenerService`, `OIMEffectService`, `OIMSingleSlotService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIMSlotContentEntityService`, `TOIMBucketSlot`, `TOIMChannelClock`, `TOIMChannelSlot`, `TOIMColumnSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntitySlot`, `TOIMSingleSlotStore`, `TOIMSingleSlotStoreSlot`, `TOIMSlot`, `TOIMStoreKey`, `TOIMStoreSlot`, `oimHoldSlots`, `oimIsAnySlotChangedAfter`, `oimIsSlotReleased`, `oimSameValueZeroGuard`, `oimUnholdSlotsIfAlive` | no |
+| `@oimdb/redux-adapter` | `IOIMChannelMap`, `IOIMSlotContentChangeListener`, `OIMChannelService`, `OIMPushColumnSlotOwner`, `OIMSlotContentChangeListenerService`, `OIMEffectService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIMSlotContentEntityService`, `TOIMBucketSlot`, `TOIMColumnSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntityColumnName`, `TOIMEntitySlot`, `TOIMStoreKey`, `TOIMStoreSlot` | no |
+| `@oimdb/exodra` | `IOIMChannelMap`, `OIMChannelService`, `OIMEffectService`, `OIMSlotContentBucketService`, `OIM_FROZEN_EMPTY_SLOTS`, `TOIMBucketSlot`, `TOIMComputedSlot`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntitySlot`, `TOIMOrderedListCommand`, `TOIMSlot`, `TOIMStoreKey`, `oimOrderedListCommandsOfTransition`, `oimRefreshSourceComputeds`, `oimSameKeySequence` | no |
+| `@oimdb/react` | `IOIMChannelMap`, `OIMComputedService`, `OIMDB`, `OIMEffectService`, `OIMSingleSlotService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIM_FROZEN_EMPTY_SLOTS`, `TOIMBucketSlot`, `TOIMColumnSlot`, `TOIMComputedSlot`, `TOIMComputedSources`, `TOIMComputedStoreSlot`, `TOIMDisposer`, `TOIMEntityColumnName`, `TOIMEntityColumnValue`, `TOIMEntitySlot`, `TOIMIndexableSlot`, `TOIMKeyedSlot`, `TOIMSingleSlotStore`, `TOIMSlot`, `TOIMStoreKey`, `TOIMStoreSlot`, `oimHoldSlots`, `oimRefreshSourceComputeds`, `oimSameKeySequence`, `oimUnholdSlotsIfAlive` | no |
+| `@oimdb/devtools` | `IOIMChannelMap`, `IOIMStoreSlotListener`, `OIMChannelService`, `OIMComputedService`, `OIMDefaults`, `OIMSlotCollectionService`, `TOIMBucketSlot`, `TOIMComputedStoreSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEntitySlot`, `TOIMKeyedSlot`, `TOIMStoreKey`, `TOIMStoreSlot` | no |
+| `@oimdb/browser` | `IOIMSlotSubscriptionListener`, `OIMChannelService`, `OIMDefaults`, `OIMSingleSlotService`, `OIMSlotContentEntityService`, `TOIMDisposer`, `TOIMEntityContentSlot`, `TOIMSlot`, `createOIMSingleSlotService`, `createOIMSlotContentEntityService`, `oimIsSlotReleased` | no |
+| `@oimdb/async` | — | deprecated stub, `export {}` |
+| `@oimdb/snapshot-manager` | — | empty stub |
+
+Every package in the table has a `type-check` script (`tsc --noEmit`) that CI
+runs on each commit, and `@oimdb/core`, `@oimdb/persist`, `@oimdb/react`,
+`@oimdb/redux-adapter` and `@oimdb/exodra` pass it. Their documentation pages
+name only shipped exports, but the source is still the final word on a signature.
+
+## `@oimdb/persist`
+
+The persistence engine for `@oimdb/core` and its five backend packages. The
+engine names the parts and wires them; a backend package supplies the storage.
+Every constructor in the family takes ONE options object.
+
+| package | exports |
+|---|---|
+| `@oimdb/persist` | the engine, plus the key-value backend `OIMPersistKeyValueBackend` and its strategies; error types `TOIMPersistErrorHandler`, `TOIMPersistErrorContext`, `TOIMPersistOperation` and `TOIMPersistErrorReport` (`{ error, persistErrorContext }`, one failure as `onPersistError` receives it or as it lands in the `AggregateError`) |
+| `@oimdb/persist-memory` | `OIMPersistMemoryBackend`, `OIMPersistMemoryWriteBatch`, `OIMPersistMemoryRecordsService`, `OIMPersistMemorySnapshotService`, `TOIMPersistMemoryServiceOptions` |
+| `@oimdb/persist-json` | `OIMPersistJsonMemoryBackend`, `TOIMPersistJsonMemoryBackendOptions`, `TOIMPersistJsonDump`; depends on `@oimdb/persist-memory` |
+| `@oimdb/persist-idb` | `OIMPersistIndexedDbBackend`, `OIMPersistIndexedDbWriteBatch`, `OIMPersistIndexedDbRecordsService`, `OIMPersistIndexedDbSnapshotService`, `TOIMPersistIndexedDbBackendOptions`, `TOIMPersistIndexedDbRecordsServiceOptions`, `TOIMPersistIndexedDbSnapshotServiceOptions`, `TOIMPersistIndexedDbPrimaryKey`, `TOIMPersistIndexedDbTableRecord` |
+| `@oimdb/persist-localstorage` | `OIMPersistLocalStorageKeyValueBackend`, `TOIMPersistLocalStorageKeyValueBackendOptions` |
+| `@oimdb/persist-async-kv` | `OIMPersistAsyncKVStorage`, `TOIMPersistAsyncKVStorageOptions`, `TOIMPersistAsyncKVMultiStorage` |
+
+### The wiring
+
+A persistor owns one backend, one scheduler and a list of resources. A resource is
+one thing being persisted: a source (the in-memory side), a strategy (where it
+lives in the backend) and what to do on hydrate.
+
+```ts
+import {
+    OIMPersistEntityWriter, OIMPersistCollectionWriteRecordSource, OIMPersistRecordsResource,
+    OIMPersistMicrotaskScheduler, OIMPersistor,
+} from '@oimdb/persist';
+import { OIMPersistMemoryBackend, OIMPersistMemoryRecordsService, OIMPersistMemoryWriteBatch } from '@oimdb/persist-memory';
+
+const persistEntityWriter = new OIMPersistEntityWriter<Card, TOIMStoreKey>({
+    entityWriter: createOIMInPlaceEntityWriter(),
+});
+const persistedCardCollectionService = createOIMSlotCollectionService({ slotContentService: createOIMSlotContentEntityService<Card>({ entityWriter: persistEntityWriter }) });
+const persistedCardEntityStoreSlot = persistedCardCollectionService.createStoreSlot(db);
+
+const persistMemoryBackend = new OIMPersistMemoryBackend();
+const persistor = new OIMPersistor<OIMPersistMemoryBackend, OIMPersistMemoryWriteBatch>({
+    persistBackend: persistMemoryBackend,
+    persistScheduler: new OIMPersistMicrotaskScheduler(),
+    onPersistError: (error, persistErrorContext) => {
+        console.error(persistErrorContext.persistOperation, error);
+    },
+});
+const cardPersistResourceRecords = persistor.addPersistResource(new OIMPersistRecordsResource({
+    persistRecordSource: new OIMPersistCollectionWriteRecordSource({
+        entityCollectionService: persistedCardCollectionService,
+        entityStoreSlot: persistedCardEntityStoreSlot,
+        persistEntityWriter,
+    }),
+    persistRecordsService: new OIMPersistMemoryRecordsService<TOIMStoreKey, Card>({ storageKey: 'cards' }),
+}));
+
+await persistor.hydrate();
+persistor.start();
+persistedCardCollectionService.writeSlotContentByKey(persistedCardEntityStoreSlot, 'c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' });
+await persistor.persist();
+await persistor.unload(cardPersistResourceRecords, ['c1']);
+await persistor.load(cardPersistResourceRecords, ['c1']);
+```
+
+Rules a generator must keep:
+
+- Pass both generics of `OIMPersistor<TPersistBackend, TWriteBatch>`: the backend
+  class and its write batch class (`OIMPersistMemoryWriteBatch`, `OIMPersistIndexedDbWriteBatch`,
+  `OIMPersistKeyValueWriteBatch`; `OIMPersistJsonMemoryBackend` uses `OIMPersistMemoryWriteBatch`,
+  `OIMPersistLocalStorageKeyValueBackend` uses `OIMPersistKeyValueWriteBatch`).
+- Pass the generics of strategies, codecs and `OIMPersistEntityWriter<TEntity, TKey>`
+  explicitly; their options carry no type to infer them from.
+- An entity collection persisted through a collection source is built with the
+  `OIMPersistEntityWriter` as its `entityWriter`, and the same writer goes into the
+  source's `persistEntityWriter`. The source takes the collection service and ONE of its store slots
+  (`entityCollectionService`, `entityStoreSlot`). The writer belongs to the content service, not to the store
+  slot, and the source keeps only the writes whose `entitySlot.storeSlot` is its own store slot; a write to
+  another store slot of the same collection type is ignored by it.
+  `new OIMPersistEntityWriter({ entityWriter })` wraps the `IOIMEntityWriter` that
+  really writes, and reports the entity slot of every fill, put, patch, column patch,
+  column delete and clear that changed something (`subscribeEntitySlotWritten`).
+- The entity collection service a source takes is any collection service with `getSlots`, `findSlotByKey`,
+  `writeSlotContentByKey`, `writeInBatch` and a `slotContentService` with `clearSlotContent`
+  (`TOIMPersistEntityCollectionService`): what `createOIMSlotCollectionService` over an entity content service builds.
+- A source refuses, by name, a store slot on another channel slot than the one it was given (the bucket source
+  checks both the entity and the bucket store slot).
+- Order: `addPersistResource` every resource, `await persistor.hydrate()`, then
+  `persistor.start()`.
+
+### Constructors and option keys
+
+| constructor | options |
+|---|---|
+| `OIMPersistor` | `{ persistBackend, persistScheduler, onPersistError? }` |
+| `OIMPersistRecordsResource` | `{ persistRecordSource, persistRecordsService, persistHydrateReconcile? }` |
+| `OIMPersistSnapshotResource` | `{ persistSnapshotSource, persistSnapshotService, persistCodec, persistHydrateReconcile? }` |
+| `OIMPersistCollectionWriteRecordSource`, `OIMPersistCollectionChangeWriteRecordSource` | `{ entityCollectionService, entityStoreSlot, persistEntityWriter }` (`TOIMPersistRecordSourceCollectionOptions`) |
+| `OIMPersistBucketRecordSource` | `{ channelMap, entityCollectionService, entityStoreSlot, slotContentBucketService, bucketSlot }` — `channelMap` is the db, `slotContentBucketService` the bucket collection's `slotContentService` |
+| `OIMPersistSingleEntitySnapshotSource` | `{ channelMap, singleSlotService, entityStoreSlot }` — a single entity service (`createOIMSingleSlotService` over an entity content service) and one of its store slots (`TOIMSingleSlotStoreSlot`) |
+| `OIMPersistEntityWriter` | `{ entityWriter }` |
+| `OIMPersistMicrotaskScheduler` | none |
+| `OIMPersistFrameScheduler` | `{ channelSlot }` — `db.defaultChannelSlot` |
+| `OIMPersistIdentityCodec` | none |
+| `OIMPersistVersionedCodec` | `{ version, migrations, persistCodec }` |
+| `OIMPersistMemoryBackend` | none |
+| `OIMPersistMemoryRecordsService`, `OIMPersistMemorySnapshotService` | `{ storageKey }` |
+| `OIMPersistJsonMemoryBackend` | `{ initialPersistJsonDump? }`, the object itself optional |
+| `OIMPersistIndexedDbBackend` | `{ databaseName, databaseVersion?, indexedDb? }` |
+| `OIMPersistIndexedDbRecordsService` | `{ tableName }` |
+| `OIMPersistIndexedDbSnapshotService` | `{ tableName, primaryKey }` |
+| `OIMPersistKeyValueBackend` | `{ persistKeyValueStorage, persistKeyValueSerializer? }` |
+| `OIMPersistItemKeyValueStorage` | `{ persistKeyValueItemStorage }` |
+| `OIMPersistKeyValueEntrySnapshotService` | `{ storageKey }` |
+| `OIMPersistKeyValuePathSnapshotService` | `{ storageKey, path }` |
+| `OIMPersistLocalStorageKeyValueBackend` | `{ persistKeyValueItemStorage?, persistKeyValueSerializer? }`, the object itself optional |
+| `OIMPersistSlotSourceChangeMark` | `{ channelClock, slots }` |
+| `OIMPersistSubscriptionSourceChangeMark` | `{ subscribeSourceChanged }` |
+| `OIMPersistAsyncKVStorage` | `{ persistAsyncKVMultiStorage }` |
+
+`onPersistError(error, persistErrorContext)` receives a `TOIMPersistErrorContext`,
+`{ persistResource, persistOperation }`. `TOIMPersistOperation` is
+`'start' | 'persist' | 'hydrate' | 'clear' | 'quarantine'`. `TOIMPersistErrorReport`
+is one failure, `{ error, persistErrorContext }`, as it is handed to `onPersistError`
+or collected into the `AggregateError`.
+
+### Two resource kinds, and when to pick each
+
+| | `OIMPersistRecordsResource` | `OIMPersistSnapshotResource` |
+|---|---|---|
+| source | a record source: entity store slot or bucket | any snapshot source: entity store slot, bucket or single entity |
+| strategy | `OIMPersistMemoryRecordsService`, `OIMPersistIndexedDbRecordsService` | `OIMPersistMemorySnapshotService`, `OIMPersistIndexedDbSnapshotService`, `OIMPersistKeyValueEntrySnapshotService`, `OIMPersistKeyValuePathSnapshotService` |
+| autosave writes | the delta: one upsert or one deletion per entity slot written since the last drain | the whole snapshot, read from the source and encoded |
+| `persist()` writes | every record, replacing what is stored; while any key is unloaded, every in-memory record as an upsert over what is stored, plus the deletions the resource already heard | the whole snapshot |
+| codec | none | `persistCodec`, required |
+| `unload` | yes | no |
+| `load` | yes | no |
+
+Pick records whenever the backend has a records strategy (memory, JSON,
+IndexedDB): autosave then costs one entry per written entity slot, independent of
+the store slot's size. Pick snapshot for a single entity, for the key-value
+backends (localStorage, async KV), which have no records strategy, or when a
+versioned codec must migrate what is stored. A record source is also a snapshot
+source whose snapshot is `TOIMPersistRecords` (`{ records: { key, entity }[] }`),
+so an entity store slot or a bucket goes into either kind.
+
+A records resource keeps its dirty state as a set of entity slots, read through the
+slot with no key lookup; a slot written several times between drains is one entry.
+At the drain each slot becomes an upsert of `{ key, entity }` when it holds an entity
+and is not released, and a deletion of its key otherwise. When a key has both, a
+released slot and a live slot minted again for that key inside one batch, the live
+slot wins: an upsert, not a deletion.
+
+### The sources, and the scheduler each pairs with
+
+| source | reports | scheduler |
+|---|---|---|
+| `OIMPersistCollectionWriteRecordSource` | synchronously, at the write, from `OIMPersistEntityWriter` only | `OIMPersistMicrotaskScheduler` |
+| `OIMPersistCollectionChangeWriteRecordSource` | synchronously, at the write, from `OIMPersistEntityWriter` and from a content-change listener on the entity store slot | `OIMPersistMicrotaskScheduler` |
+| `OIMPersistBucketRecordSource` | from effects (`OIMEffectService`), when the channel runs its frame | `OIMPersistFrameScheduler({ channelSlot })` |
+| `OIMPersistSingleEntitySnapshotSource` | from an effect, when the channel runs its frame | `OIMPersistFrameScheduler({ channelSlot })` |
+
+- **Collection** (an entity collection service and one of its store slots): every entity slot of that store slot that holds an entity. Starting
+  reports nothing; content present before `start()` is written by `persist()` or by
+  its next write. An entity removed for any reason, a slot release policy included,
+  goes through the writer's `clearEntity` and reaches the backend as a deletion;
+  `unload` is the call that removes from memory and keeps the stored value. The two
+  collection sources are one fork, chosen at construction, with the same options:
+
+  | collection source | in-place edit announced with `slotContentService.markEntityChanged(entitySlot, changedColumns?)` | cost while a resource listens | pick it when |
+  |---|---|---|---|
+  | `OIMPersistCollectionWriteRecordSource` | NOT persisted: it hears only the writer | none: every write stays on the core fast path | every change goes through `writeSlotContentByKey`, `writeSlotContent`, `updateEntity` and `clearSlotContent` |
+  | `OIMPersistCollectionChangeWriteRecordSource` | persisted: while subscribed it adds a content-change listener of every column to the store slot | EVERY write to that store slot leaves the core fast path, not only `markEntityChanged`: changed-column bookkeeping and the listener loop per write | the app edits entities in place |
+- **Bucket**: the entities one bucket slot holds. Get the slot with
+  `bucketCollectionService.holdSlotByKey(bucketStoreSlot, key)`. The source watches the
+  bucket slot with one effect and each member entity slot with one effect. An entity
+  that leaves the bucket is deleted from the backend and stays in the entity
+  store slot. The first subscription reports every member, so `start()` writes the
+  current members on the first drain, except members still holding the value a
+  hydrate restored.
+- **Single entity**: the snapshot is the entity itself (a store slot of a single entity service, read through
+  `findSingleSlot(entityStoreSlot)`), so it
+  goes only into `OIMPersistSnapshotResource`. Its first subscription reports the
+  current value unless it is the value a hydrate restored. `readSnapshot` throws when
+  the entity slot holds no value.
+
+The bucket and single-entity sources tell their own restored writes apart from user
+writes by comparing the entity, column by column with SameValueZero (NaN equals NaN, as core's write guard does), against a copy taken when
+it was restored (`OIMPersistRestoredEntities`). A wake is not written while the source
+still holds the restored value. The first time a different value is seen, the memo for
+that key is gone, so an edit and a later revert to the restored value, in another
+frame, are both written.
+
+```ts
+import {
+    OIMPersistBucketRecordSource, OIMPersistRecordsResource, OIMPersistFrameScheduler, OIMPersistor,
+} from '@oimdb/persist';
+import { OIMPersistMemoryBackend, OIMPersistMemoryRecordsService, OIMPersistMemoryWriteBatch } from '@oimdb/persist-memory';
+
+type TDeckCardSlot = TOIMEntitySlot<Card, TOIMStoreKey>;
+const deckCardCollectionService = createOIMSlotCollectionService({ slotContentService: createOIMSlotContentEntityService<Card>() });
+const deckCardEntityStoreSlot = deckCardCollectionService.createStoreSlot(db);
+const deckBucketService = createOIMSlotCollectionService({ slotContentService: new OIMSlotContentPositionalArrayBucketService<TDeckCardSlot>({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: undefined }) }) });
+const deckBucketStoreSlot = deckBucketService.createStoreSlot(db);
+const spadesBucketSlot = deckBucketService.holdSlotByKey(deckBucketStoreSlot, 'spades');
+
+const deckPersistor = new OIMPersistor<OIMPersistMemoryBackend, OIMPersistMemoryWriteBatch>({
+    persistBackend: new OIMPersistMemoryBackend(),
+    persistScheduler: new OIMPersistFrameScheduler({ channelSlot: db.defaultChannelSlot }),
+});
+deckPersistor.addPersistResource(new OIMPersistRecordsResource({
+    persistRecordSource: new OIMPersistBucketRecordSource({
+        channelMap: db,
+        entityCollectionService: deckCardCollectionService,
+        entityStoreSlot: deckCardEntityStoreSlot,
+        slotContentBucketService: deckBucketService.slotContentService,
+        bucketSlot: spadesBucketSlot,
+    }),
+    persistRecordsService: new OIMPersistMemoryRecordsService<TOIMStoreKey, Card>({ storageKey: 'spades' }),
+}));
+await deckPersistor.hydrate();
+deckPersistor.start();
+
+const aceSlot = deckCardCollectionService.writeSlotContentByKey(deckCardEntityStoreSlot, 'c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' });
+deckBucketService.slotContentService.writeSlotContent(spadesBucketSlot, [aceSlot]);
+db.flush();
+await deckPersistor.whenIdle();
+```
+
+### Schedulers
+
+`IOIMPersistScheduler` is `attachDrain(drain)`, `start()`, `stop()`, `requestDrain()`.
+The persistor calls `attachDrain` from its constructor; both shipped schedulers throw
+when a second persistor attaches, so construct one scheduler per persistor.
+
+- `OIMPersistMicrotaskScheduler`: `requestDrain()` queues one microtask; the
+  requests that follow before it runs are absorbed by it. `stop()` makes a queued
+  microtask do nothing.
+- `OIMPersistFrameScheduler({ channelSlot })`: while started it subscribes with
+  `OIMChannelService.INSTANCE.subscribeAfterEachFrame(channelSlot, …)` and drains after a frame only when a drain was
+  requested since the last one; `stop()` unsubscribes and forgets the request. It
+  holds no slot and never asks the channel for a frame: it drains only after a frame
+  the channel runs anyway.
+
+**The pairing is a rule.** A write to an entity slot that nobody holds causes no frame
+(`OIMChannelService.INSTANCE.writeWithoutFlushCheck` returns at once when `holdCount` is `0`), so a
+collection source on the frame scheduler can report changes that no frame ever
+drains. Pair `OIMPersistCollectionWriteRecordSource` and
+`OIMPersistCollectionChangeWriteRecordSource` with
+`OIMPersistMicrotaskScheduler`. The bucket and single-entity sources report from
+effects, which cause the frames they run in, so pair them with
+`OIMPersistFrameScheduler`. Resources of both groups in one persistor share its
+one scheduler; give them two persistors when they need different schedulers.
+
+`whenIdle()` resolves when the work queued at the moment of the call has settled. On
+the frame scheduler the drain runs inside `db.flush()`, so `db.flush(); await
+persistor.whenIdle()` covers the autosave. On the microtask scheduler the autosave
+is queued on the microtask after the write: let one microtask pass before calling
+`whenIdle()`, or call `persist()`.
+
+### Persistor methods
+
+| method | what it does |
+|---|---|
+| `addPersistResource(persistResource)` | registers and returns it; on a started persistor it starts the resource first and registers it only if that start succeeded (a failed start is thrown from `addPersistResource`) |
+| `removePersistResource(persistResource)` | stops it and drops its pending write |
+| `start()` / `stop()` | subscribe / unsubscribe every resource and the scheduler; `start()` skips quarantined resources; pending writes survive `stop()`. A resource whose subscribe throws does not stop the others: each failure goes to `onPersistError` with `persistOperation: 'start'`, or, without a handler, all are thrown as one `AggregateError`. A resource whose start failed stays registered and unsubscribed, with no autosave, until `stop()` and `start()` again; `addPersistResource` on a started persistor does not register a resource whose start throws. A bucket or single-entity source reports its current value at subscribe time (except a hydrate-restored value), so the first drain after `start()` writes it; a collection source reports nothing then |
+| `destroy()` | `stop()`, then forgets every resource |
+| `hydrate()` | reads every resource and writes it into its source; ends the upsert-only mode of an unloaded resource |
+| `persist()` | writes every resource in full, started or not, in one write batch; a records resource with unloaded keys writes its in-memory records as upserts over the stored table instead of replacing it, plus the deletions it already heard |
+| `clearPersisted()` | deletes every resource's stored data in one write batch; memory is untouched; ends the upsert-only mode of an unloaded resource |
+| `unload(persistRecordsResource, keys)` | writes the keys' current values plus the resource's pending change in one write batch, repeated until the keys have no unwritten change (unload holds the keys' entity slots while it writes and compares their revision stamps, a slot's stamp moving only on a real write; it also checks the resource's pending set and whether a key's slot was replaced), then removes the keys from memory only |
+| `load(persistRecordsResource, keys)` | the pair of `unload`: queued after the pending writes, reads only those keys from the backend (`readRecordsOfKeys`) and puts the stored entities back without writing them back; skips a key that holds a value in memory or has a change the resource has not written yet; the keys stop counting as unloaded |
+| `whenIdle()` | resolves when the queued work settles; never rejects |
+
+Every promise-returning call and every autosave runs on one ordered chain, one at a
+time, in request order. A snapshot is read when its work runs, not when it was queued.
+
+### The write batch, retry and quarantine
+
+- **One batch per drain.** A drain takes every dirty resource with a pending write,
+  calls `persistBackend.createWriteBatch()` once, lets each resource write into it,
+  and calls `commit()` once. `persist()` and `clearPersisted()` do the same for every
+  registered resource.
+- **Whole-batch failure.** Every resource in the batch puts its in-flight change back
+  (a records resource returns the failed entity slots to its dirty set; a snapshot
+  resource marks itself pending), then the persistor writes each resource again in a
+  batch of its own, so the healthy ones commit and the failure is attributed to the
+  resource that caused it. A failed batch of N resources costs 1 + N commits.
+- **Retry.** A failed autosave leaves the resource dirty; the next drain writes it.
+  The next drain comes from the next drain request (a change in any resource), a
+  `persist()` or an `unload`. There is no retry timer.
+- **Quarantine.** Three consecutive autosave failures of one resource stop it
+  listening to its source and drop its pending write; it is reported once with
+  `persistOperation: 'quarantine'`, or on `console.error` without `onPersistError`.
+  A successful `persist()` of it lifts the quarantine and, on a started persistor,
+  starts it again; `start()` skips a quarantined resource. Any successful write
+  resets the count, whichever operation committed it (autosave, `persist()`,
+  `clearPersisted()`, `unload`); `persist()` failures do not add to it.
+- **Errors.** With `onPersistError`, each failure is handed over and the promise
+  resolves; a failed autosave below quarantine is reported with `'persist'`, a failed
+  resource subscribe in `start()` with `'start'`. Without it, `start()` (throws),
+  `hydrate()`, `persist()` and `clearPersisted()` attempt every resource, then
+  reject with one `AggregateError` whose `errors` holds every failure; a failed
+  autosave below quarantine is silently retained, and the quarantine logs to the
+  console. `unload` rejects its own promise when its write fails, and then leaves
+  the keys in memory.
+
+### Hydrate: reconcile and refusal
+
+`hydrate()` reads each resource through its strategy. A read that resolves
+`undefined` means nothing is stored, and nothing is applied. Anything else, an empty
+`{ records: [] }` included, is applied: decoded through `persistCodec` on a snapshot
+resource, passed through `persistHydrateReconcile(currentSnapshot, incomingSnapshot)`
+when set, then written into the source. Hydrate's own writes are not reported as
+changes, so `start()` after `hydrate()` writes nothing back.
+
+What the source does with it:
+
+- collection: upserts every record into the entity store slot, then deletes every entity the records do not
+  name; the store slot becomes exactly the stored content;
+- bucket: upserts every record into the entity store slot and sets the bucket's
+  members to exactly the restored entities;
+- single entity: `singleSlotService.writeSingleSlotContent(entityStoreSlot, entity)`.
+
+**Refusal.** If the source changes while the backend read is in flight and the
+resource has no `persistHydrateReconcile`, hydrate throws instead of applying, because
+applying would revert that change. The source keeps its newer state; the error goes
+to `onPersistError` with `'hydrate'`, or into the `AggregateError`. Before the read
+the resource calls `persistSnapshotSource.markSourceChanges()`, which returns an
+`IOIMPersistSourceChangeMark` (`isSourceChangedSinceMark()`, `dispose()`): the
+single-entity and bucket sources return an `OIMPersistSlotSourceChangeMark`
+that holds the slots and compares their revision stamps (`changedAtRevision`, `changedAtEpoch`) with the
+channel clock reading taken at the mark (`oimIsAnySlotChangedAfter`), the
+collection sources an `OIMPersistSubscriptionSourceChangeMark` whose flag their
+own report sets. A change made during the read is seen even when no frame runs, and
+the guard runs whether or not the persistor is started.
+
+**Reconcile.** `oimReconcileByKey<TKey, TEntity>(resolveEntity)` builds a
+`TOIMPersistHydrateReconcile<TOIMPersistRecords<TKey, TEntity>>`.
+`resolveEntity(currentEntity, incomingEntity, key)` runs for every stored key, with
+`currentEntity` `undefined` when memory lacks the key, and returns the entity to keep
+or `undefined` to drop it. Keys only in memory are kept. Order: memory's keys first,
+then the stored keys memory lacked. A snapshot resource over a single entity takes any
+`(currentSnapshot, incomingSnapshot) => snapshot` function.
+
+```ts
+import { oimReconcileByKey } from '@oimdb/persist';
+
+const answerReconcile = oimReconcileByKey<TOIMStoreKey, Card>(
+    (currentEntity, incomingEntity) => currentEntity === undefined
+        ? incomingEntity
+        : { ...currentEntity, rank: incomingEntity.rank },
+);
+```
+
+### unload, load and clearPersisted
+
+`persistor.unload(persistRecordsResource, keys)` takes an `OIMPersistRecordsResource`
+only. It first drains the persistor's dirty resources onto the chain, then, in its
+own turn, writes in one write batch that resource's pending change and the current
+value of every unloaded key (`persistRecordSource.readRecordsDelta(persistRecordSource.findEntitySlotsByKeys(keys))`), so
+an edit no drain had reached, or one made while the persistor was stopped or the
+resource quarantined, is saved. unload holds the keys' entity slots while it writes, and after each commit it
+compares their revision stamps (a slot's stamp moves only on a real write), checks the
+resource's pending set and whether a key's slot was replaced; while any of those moved it
+writes another batch of the same shape, so an edit made during any commit
+(and, on the bucket source, an edit the channel has not flushed yet) reaches the
+backend. Only then does it remove
+the keys from the source with this resource's reporting suppressed, so the removal is
+not written by it. The backend keeps the keys; `load` brings those keys back and the
+next `hydrate()` brings back everything, and a restored entity persists its next edit like any other. A failed write rejects
+the unload and leaves the keys in memory. On a collection source and on the bucket source
+the keys are deleted from the entity store slot.
+Deleting an entity does not take it out of a bucket: the bucket keeps the slot as a
+member until it is refiled. The bucket source remembers the deletion as restored for
+every key that is a member of the bucket at unload time, whether or not the persistor
+is listening.
+
+While any key of a records resource is unloaded, `persist()` writes that resource's
+in-memory records as upserts over the stored table instead of replacing it, plus the
+deletions the resource already heard (its pending deletions), so the unloaded records
+stay on the backend. A deletion it never heard is not written in that mode.
+`hydrate()` and `clearPersisted()` end that mode, and so does a `load` of every
+unloaded key.
+
+`persistor.load(persistRecordsResource, keys)` is the pair of `unload` and takes an
+`OIMPersistRecordsResource` only (a key-value backend has no records strategy, so a
+snapshot resource has no `load`). It drains the dirty resources onto the chain and
+runs after those writes. In its turn it reads only those keys through
+`persistRecordsService.readRecordsOfKeys(persistBackend, keys)`: on IndexedDB one
+`readonly` transaction with one `get` per key, on memory a lookup of each key in the
+stored map; a key the backend does not hold is left out. It skips every key that holds
+a value in memory or has a change the resource has not written yet (pending or in a
+commit), so neither a write nor a heard deletion made during the read is overwritten.
+The rest goes to `persistRecordSource.loadRecords(persistRecords)` with this
+resource's reporting suppressed, so the loaded entities are not written back. A
+collection source upserts them into the entity store slot; the bucket source upserts them
+into the entity store slot, adds the slots back to the bucket
+(`slotContentBucketService.addBucketMemberSlots`) and remembers them as restored. The keys
+stop counting as unloaded, so once none is, `persist()` replaces the stored table
+again. Another resource over the same entity store slot is not suppressed and hears
+the upserts as writes. A failed read rejects the promise `load` returned.
+
+When to unload and when to load (on a screen change, on idle, on a read miss) is the
+application's decision, or an orchestrator's; persist offers the two doors and decides
+neither.
+
+**Limit:** another resource over the same entity store slot is not suppressed. It
+reports the unloaded keys as deletions, and its next autosave deletes them from ITS
+storage. Unload only keys no other resource persists.
+
+**Limit:** a deletion made while the persistor is stopped, or the resource is
+quarantined, is not heard. While any key of the resource is unloaded, `persist()`
+writes no deletion it did not hear, and `unload` writes it only while the entity's slot
+still exists (once the slot was released no slot is found for the key); otherwise the
+record comes back on the next `hydrate()`. Call `persist()` while started, and with no
+key unloaded, to make a deletion the resource never heard durable.
+
+`persistor.clearPersisted()` calls every resource's strategy delete
+(`deleteRecords` / `deleteSnapshot`) inside one write batch with one commit, under the
+same whole-batch split and error rules as `persist()`. Memory is untouched.
+
+### Codecs
+
+A snapshot resource encodes on every write and decodes on hydrate through its
+required `persistCodec`, an `IOIMPersistCodec<TSourceSnapshot, TPersistedSnapshot>`
+(`encode`, `decode`). A records resource has no codec: it stores entities as the
+source holds them.
+
+- `new OIMPersistIdentityCodec<TSnapshot>()`: passes the snapshot through.
+- `new OIMPersistVersionedCodec<TSourceSnapshot, TPersistedSnapshot>({ version, migrations, persistCodec })`:
+  stores a `TOIMPersistVersionedShape`, `{ version, data }`, where `data` is the
+  inner `persistCodec`'s encoding (required; use `OIMPersistIdentityCodec` when
+  nothing transforms). `migrations` is a `Record<number, (data: unknown) => unknown>`
+  keyed by the version each migration produces. On decode it runs, ascending, every
+  migration whose key is above the stored `version` and at most the current one,
+  then decodes with the inner codec. A stored `version` above the codec's own is
+  refused: `decode` throws and the hydrate reports it with `'hydrate'`. The strategy
+  is typed with `TOIMPersistVersionedShape`.
+
+```ts
+import {
+    OIMPersistIdentityCodec, OIMPersistVersionedCodec, OIMPersistKeyValueBackend, OIMPersistKeyValueEntrySnapshotService,
+    OIMPersistItemKeyValueStorage, OIMPersistKeyValueWriteBatch, OIMPersistSnapshotResource,
+    OIMPersistFrameScheduler, OIMPersistSingleEntitySnapshotSource, OIMPersistor,
+} from '@oimdb/persist';
+import type { TOIMPersistVersionedShape } from '@oimdb/persist';
+
+type TSettings = { theme: 'light' | 'dark'; density: 'compact' | 'comfortable' };
+
+const settingsSingleEntityService = createOIMSingleSlotService({ slotContentService: createOIMSlotContentEntityService<TSettings>() });
+const settingsEntityStoreSlot = settingsSingleEntityService.createStoreSlot(db);
+settingsSingleEntityService.writeSingleSlotContent(settingsEntityStoreSlot, { theme: 'light', density: 'compact' });
+const itemByStorageKey = new Map<string, string>();
+const settingsPersistor = new OIMPersistor<OIMPersistKeyValueBackend, OIMPersistKeyValueWriteBatch>({
+    persistBackend: new OIMPersistKeyValueBackend({
+        persistKeyValueStorage: new OIMPersistItemKeyValueStorage({
+            persistKeyValueItemStorage: {
+                getItem: storageKey => itemByStorageKey.get(storageKey) ?? null,
+                setItem: (storageKey, item) => { itemByStorageKey.set(storageKey, item); },
+                removeItem: storageKey => { itemByStorageKey.delete(storageKey); },
+            },
+        }),
+    }),
+    persistScheduler: new OIMPersistFrameScheduler({ channelSlot: db.defaultChannelSlot }),
+});
+settingsPersistor.addPersistResource(new OIMPersistSnapshotResource({
+    persistSnapshotSource: new OIMPersistSingleEntitySnapshotSource({
+        channelMap: db, singleSlotService: settingsSingleEntityService, entityStoreSlot: settingsEntityStoreSlot,
+    }),
+    persistSnapshotService: new OIMPersistKeyValueEntrySnapshotService<TOIMPersistVersionedShape>({ storageKey: 'settings' }),
+    persistCodec: new OIMPersistVersionedCodec<TSettings, TSettings>({
+        version: 2,
+        migrations: { 2: data => ({ density: 'comfortable', ...(data as object) }) },
+        persistCodec: new OIMPersistIdentityCodec<TSettings>(),
+    }),
+}));
+await settingsPersistor.hydrate();
+settingsPersistor.start();
+
+settingsSingleEntityService.slotContentService.updateEntity(
+    settingsSingleEntityService.getSingleSlot(settingsEntityStoreSlot), { theme: 'dark' },
+);
+db.flush();
+await settingsPersistor.whenIdle();
+```
+
+### Backends and their strategies
+
+**Memory** (`@oimdb/persist-memory`). `new OIMPersistMemoryBackend()`. Snapshot values
+and records live in two separate maps, so a snapshot and a records resource may share
+a `storageKey`. `OIMPersistMemoryRecordsService<TKey, TEntity>({ storageKey })` keeps one
+`Map` of key to entity per `storageKey`: autosave sets and deletes keys, `persist()`
+replaces the map (while the resource has unloaded keys, sets keys and deletes only the deletions the resource already heard), `clearPersisted()` deletes it, and a `load` looks each of its keys up in the map through `readRecordsOfKeys`. `OIMPersistMemorySnapshotService<TSnapshot>({ storageKey })`
+keeps one value. `readRecords(storageKey)` and `readSnapshotValue(storageKey)` read
+what was committed. `OIMPersistMemoryWriteBatch` queues every change and applies them in
+order on `commit()`.
+
+**JSON** (`@oimdb/persist-json`, depends on `@oimdb/persist-memory`).
+`OIMPersistJsonMemoryBackend` extends `OIMPersistMemoryBackend` and takes the memory
+strategies. `dehydrate()` returns a `TOIMPersistJsonDump`,
+`{ snapshotValues: Record<storageKey, value>, recordsByStorageKey: Record<storageKey, { key, entity }[]> }`;
+`new OIMPersistJsonMemoryBackend({ initialPersistJsonDump })` writes such a dump straight into
+its maps. The SSR flow: on the server, `await persistor.persist()` and then
+`JSON.stringify(persistJsonMemoryBackend.dehydrate())`; on the client,
+`new OIMPersistJsonMemoryBackend({ initialPersistJsonDump: JSON.parse(jsonText) })`, register
+the same resources under the same `storageKey`s, `await persistor.hydrate()`. To merge
+a durable cache over the server's content, hydrate the JSON persistor first, then the
+durable persistor with `persistHydrateReconcile`, then `start()` the durable one.
+
+**IndexedDB** (`@oimdb/persist-idb`). `new OIMPersistIndexedDbBackend({ databaseName, databaseVersion?, indexedDb? })`;
+`indexedDb` defaults to `globalThis.indexedDB` and the constructor throws without
+either. `OIMPersistIndexedDbRecordsService<TKey, TEntity>({ tableName })` stores one value
+per entity key in an object store: autosave puts and deletes per key, `persist()`
+clears the table and puts every entity (while the resource has unloaded keys, only
+puts plus a delete per deletion the resource already heard), `clearPersisted()` clears it,
+and a `load` reads its keys through `readRecordsOfKeys` in one `readonly` transaction,
+one `get` per key.
+`OIMPersistIndexedDbSnapshotService<TSnapshot>({ tableName, primaryKey })` stores one value
+at `primaryKey`. One commit is one `readwrite` transaction over every table the batch
+touches. A commit opens the database and creates missing tables by a version upgrade
+(retried when another connection upgrades first, up to five attempts; an upgrade
+blocked for five seconds rejects); a read never creates a table, and a missing table
+reads as `undefined`. A `TOIMPersistIndexedDbPrimaryKey` is an `IDBValidKey` or a plain
+object; a plain object is encoded as the string `oimdb:object:` plus its JSON with
+sorted property names, and is read back as that string.
+
+**Key-value** (`@oimdb/persist`). `new OIMPersistKeyValueBackend({ persistKeyValueStorage, persistKeyValueSerializer? })`
+stores serialized strings under string keys. `persistKeyValueStorage` is an
+`IOIMPersistKeyValueStorage` (`readItems(storageKeys)`, `writeItems(itemByStorageKey)`,
+`removeItems(storageKeys)`); `OIMPersistItemKeyValueStorage({ persistKeyValueItemStorage })`
+adapts any `TOIMPersistKeyValueItemStorage` (`getItem`, `setItem`, `removeItem`,
+synchronous or returning promises) with one call per key. The serializer is a
+`TOIMPersistKeyValueSerializer` (`serialize`, `deserialize`) and defaults to
+`OIM_PERSIST_KEY_VALUE_JSON_SERIALIZER`. Strategies, both snapshot strategies:
+
+| strategy | stored as |
+|---|---|
+| `OIMPersistKeyValueEntrySnapshotService<TSnapshot>({ storageKey })` | the whole snapshot under `storageKey` |
+| `OIMPersistKeyValuePathSnapshotService<TSnapshot>({ storageKey, path })` | the snapshot at `path` (a `string[]`) inside an object under `storageKey`; several resources may share the key; the constructor throws on an empty `path` |
+
+`OIMPersistKeyValueWriteBatch` commits with at most one `readItems` (keys with path
+writes or path deletions and no whole-value write in the batch), one `writeItems` and
+one `removeItems`; it serializes every value before writing any. Path segments are
+own properties, so a stored `__proto__` is data.
+
+- **localStorage** (`@oimdb/persist-localstorage`): `OIMPersistLocalStorageKeyValueBackend`
+  extends `OIMPersistKeyValueBackend` over a `TOIMPersistKeyValueItemStorage`
+  (`getItem`, `setItem`, `removeItem`) given as `persistKeyValueItemStorage`, which
+  defaults to `globalThis.localStorage`; the constructor throws without either. One `setItem` per written key.
+- **async KV** (`@oimdb/persist-async-kv`): no backend class. Use
+  `new OIMPersistKeyValueBackend({ persistKeyValueStorage: new OIMPersistAsyncKVStorage({ persistAsyncKVMultiStorage }) })`,
+  where `persistAsyncKVMultiStorage` is a `TOIMPersistAsyncKVMultiStorage` (`multiGet`, `multiSet`,
+  `multiRemove`, each returning a promise), the shape of React Native's
+  `AsyncStorage`. One `multiGet`, one `multiSet` and one `multiRemove` per commit at
+  most.
+
+### Writing a backend, a strategy, a source
+
+- Backend: `IOIMPersistBackend<TWriteBatch>` with `createWriteBatch()`; its batch is an
+  `IOIMPersistWriteBatch` with `commit(): Promise<void>`, collecting changes and
+  applying them in `commit`. `OIMPersistWriteBatchChanges<TWriteBatchTarget>` is the list a
+  batch keeps them in: `addWriteBatchChange(change)`, `hasWriteBatchChanges`,
+  `applyWriteBatchChanges(target)`. `oimWritePersistRecordsDelta(delta, putRecord, deleteRecord)`
+  walks a `TOIMPersistRecordsDelta` in the one order every backend uses: upserts, then deletions.
+- Snapshot strategy: `IOIMPersistSnapshotService<TPersistBackend, TWriteBatch, TSnapshot>`
+  with `readSnapshot(persistBackend)`, `writeSnapshot(writeBatch, snapshot)`,
+  `deleteSnapshot(writeBatch)`. Records strategy:
+  `IOIMPersistRecordsService<TPersistBackend, TWriteBatch, TKey, TEntity>` with
+  `readRecords(persistBackend)`, `readRecordsOfKeys(persistBackend, keys)`,
+  `writeRecords(writeBatch, persistRecords)`,
+  `writeRecordsDelta(writeBatch, persistRecordsDelta)` (a `TOIMPersistRecordsDelta`,
+  `{ upserts, deletedKeys }`), `deleteRecords(writeBatch)`. A read resolves
+  `undefined` only when nothing is stored; `readRecordsOfKeys` resolves the records of
+  the keys the backend holds and leaves out the rest.
+- Source: `IOIMPersistSnapshotSource<TSnapshot>` (`readSnapshot`, `writeSnapshot`,
+  `subscribeSnapshotChanged`, `markSourceChanges`) or
+  `IOIMPersistRecordSource<TKey, TEntity>`, which adds `subscribeEntitySlotChanged`,
+  `readRecordsDelta(entitySlots)`, `findEntitySlotsByKeys(keys)`, `markEntitySlotChanges(entitySlots)`,
+  `loadRecords(persistRecords)`, `unloadKeys(keys)`.
+  `markSourceChanges()` is required and returns an `IOIMPersistSourceChangeMark`
+  (`isSourceChangedSinceMark()`, `dispose()`); build it with
+  `new OIMPersistSlotSourceChangeMark({ channelClock, slots })` or
+  `new OIMPersistSubscriptionSourceChangeMark({ subscribeSourceChanged })`.
+  It must accept more than one subscription, each with its own `TOIMDisposer`.
+- Scheduler: `IOIMPersistScheduler`, above.
+
+### Limits
+
+- **No key-value records strategy.** Over `OIMPersistKeyValueBackend` (localStorage,
+  async KV) an entity store slot or a bucket goes through `OIMPersistSnapshotResource`: every
+  autosave walks every entity slot of the source and serializes the whole snapshot
+  under one key.
+- **A bucket membership change walks the bucket.** Each change of the bucket slot
+  re-reads every member and every watched slot, and the source keeps one effect per
+  member entity slot.
+- **The memory and JSON backends keep values by reference.** With
+  `createOIMInPlaceEntityWriter()` the stored entity is the live entity object, so an
+  in-place write moves the stored value before any commit, and `dehydrate()` returns
+  the live objects. Use `createOIMReplacingEntityWriter()` with
+  `entityInserter: oimInsertEntityWithCopy` where the stored value must stay
+  what was committed, and serialize a dump at once.
+- **Hydrate without a reconcile replaces.** The collection source deletes every
+  entity the stored records do not name, and an existing but empty records table
+  (IndexedDB after `clearPersisted()`) reads as an empty list and empties the
+  entity store slot.
+- **A key-value commit is not atomic across keys**: `writeItems` and `removeItems` are
+  separate calls, and the item-driven storage calls `setItem` once per key.
+- **One backend and one scheduler per persistor.** Sources needing different
+  schedulers, or two backends, take two persistors.
+
+---
+
+## `@oimdb/exodra`
+
+Turns a core read into an Exodra `TExoBindable` or `TExoBindableList`. It depends
+only on the type-only `@exodra/reactivity-types`.
+
+### One door: `exoBinding(channelMap, binding)`
+
+A subscription here is one call — `OIMEffectService.INSTANCE.subscribeEffect(channelMap, onChange, sourceSlots, sourceComputeds)` —
+and the value is read off the slots afterwards. So one adapter covers an entity, a
+column, a bucket's slots and a derivation:
+
+```ts
+import { exoBinding } from '@oimdb/exodra';
+
+const rank = rankService.computedCollectionService.holdSlotByKey(ranks, 'c1');
+
+exoBinding(db, { sourceSlots: [slot], derive: () => slot.entity });
+exoBinding(db, { sourceSlots: [todo], derive: () => Array.from(pageService.slotContentService.getBucketMemberSlots(todo)) });
+exoBinding(db, { sourceComputeds: [rank], derive: () => rank.computedValueService.getValueForSlot(rank) });
+```
+
+`TOIMExoBinding<TValue>` is `{ sourceSlots?, sourceComputeds?, derive }`; both source keys are optional and default to none. `sourceSlots` is typed
+`readonly TOIMSlot[]` and `sourceComputeds` `readonly TOIMComputedSlot[]`.
+
+What `exoBinding` owns, each failing silently if a caller writes the pair by hand:
+it **settles every derivation before the read** (a derivation is asked and never
+woken); and it
+arms **one effect** however many downstream subscribers there are, and none while
+nobody listens.
+
+**There is no observable wrapper on either side of this bridge**, and there must
+not be one: the core hands over no object carrying a value and a subscribe, so an
+intermediate type would have one producer and one consumer, both inside this
+package. Build the binding directly.
+
+### Lifetime is the caller's
+
+`exoBinding` **holds nothing**, and that is deliberate: a bindable is lazy, so it
+outlives its own subscriptions, and a hold scoped to one of them buys nothing —
+a hold's give-back ends in the owner's release guard, so returning it at teardown
+leaves exactly the state the teardown would have left. Whoever resolved the
+identity holds it, and says so with `TOIMExoDisposable<TValue>` =
+`TExoBindable<TValue> & { readonly dispose: TOIMDisposer }`:
+
+```ts
+import { exoBinding } from '@oimdb/exodra';
+
+const rankFor = (id: TOIMStoreKey) => {
+    const held = rankService.computedCollectionService.holdSlotByKey(ranks, id);
+    return Object.assign(
+        exoBinding(db, { sourceComputeds: [held], derive: () => held.computedValueService.getValueForSlot(held) }),
+        { dispose: () => { held.owner.unholdSlot(held); } },
+    );
+};
+```
+
+Only a valueless identity is exposed by getting this wrong: an empty bucket, a key
+resolved before its entity arrived, an entity since removed.
+
+### The views
+
+- `exoSource(read, subscribe)` — the lazy, ref-counted base. For sources that are
+  **not** this engine's.
+- `exoCombine(fn, sources)` — fan-in across any `TOIMExoReadable`. Not glitch-free;
+  keep heavy fan-in inside one computed.
+- `exoFollowKey(key, makeBindable)` — repoints as a selection moves. The factory
+  must return a `TOIMExoDisposable`.
+- `exoRows(keys, render)` — identity-stable children keyed by primary key. `render`
+  returns `TOIMExoRenderedRow<TSchema>` = `{ schema, dispose }`.
+
+### Lists are a fork, and both arms ship
+
+Who decided the order is the difference, and the core already forks on it.
+
+| | `exoDerivedList(channelMap, computedSlot, render, maxCommandsPerSlot?)` | `exoPositionalList(channelMap, slotContentBucketService, bucketSlot, render)` |
+|---|---|---|
+| takes | a `TOIMComputedSlot<readonly TOIMEntitySlot[]>` | a bucket content service built with an `OIMBucketCommands` and one of its bucket slots, from any of its store slots |
+| the script | **derived**, by `oimOrderedListCommandsOfTransition` | **recorded**, by `OIMBucketCommands`, read inside the frame |
+| per changed frame | one diff: two passes plus an LIS pass, `common − LIS` moves | one pass over the frame's own script |
+
+Both hand back `TOIMExoList<TSchema>` = `TExoBindableList<TSchema> & { dispose }`,
+and both are **attached from construction**, not from their first subscriber —
+that is what lets `snapshot()` promise the list every later op is measured
+against. Each item's schema is memoised in a `WeakMap` inside the bridge, so a
+`reset` hands back the objects the previous snapshot did.
+
+The derived script comes from `oimOrderedListCommandsOfTransition`. Items are
+memoised per list, so two lists showing one entity slot render it twice.
+
+### Full export list
+
+`exoBinding`, `exoSource`, `exoCombine`, `exoFollowKey`, `exoRows`,
+`exoDerivedList`, `exoPositionalList`; `TOIMExoBinding`, `TOIMExoReadable`,
+`TOIMExoDisposable`, `TOIMExoRenderedRow`, `TOIMExoList`.
+
+---
+
+## `@oimdb/browser`
+
+Browser state as single slots. Each factory returns an `OIMSingleSlotService` (`TOIMBrowserSingleSlotService<TEntity>`)
+built with a slot subscription listener: the browser listener is added when the slot gets its first
+subscriber (directly or through a computed that reads it) and removed when the last one goes; the current
+value is written at the first subscription, and a write that would land during a flush is made right after it.
+
+```ts signature
+createOIMBrowserOnlineSingleSlotService(options?: { defaults?: OIMDefaults }): TOIMBrowserSingleSlotService<TOIMBrowserOnlineEntity>         // { isOnline }
+createOIMBrowserFocusSingleSlotService(options?): TOIMBrowserSingleSlotService<TOIMBrowserFocusEntity>          // { isFocused }: document.hasFocus()
+createOIMBrowserVisibilitySingleSlotService(options?): TOIMBrowserSingleSlotService<TOIMBrowserVisibilityEntity> // { isVisible }
+createOIMBrowserLocationSingleSlotService(options?): TOIMBrowserSingleSlotService<TOIMBrowserLocationEntity>    // { href, pathname, search, hash }
+```
+
+Read it like any single: `const onlineSlot = onlineService.getSingleSlot(onlineService.createStoreSlot(db))`, then
+an effect over `[onlineSlot]`, or `useOIMSingleEntity(online)` in React. `isOnline` is
+`navigator.onLine` (a network interface exists, not a reachable internet); the location follows the
+Navigation API's `currententrychange` where it exists and `popstate` + `hashchange` otherwise, so without it a
+`history.pushState` is not seen until the next of those events. Without the API a sensor needs, the slot holds
+`true` (or an empty location). `OIMBrowserSlotSubscriptionListener` is the base class of the four listeners.
+
+---
+
+## Performance
+
+**No figure may be quoted for this engine, and none is quoted anywhere in this
+file.**
+
+Every artifact under `packages/bench/measurements/` predates the surface
+documented in this file, so none of its
+figures prices what is described here. Such figures are **struck, not updated** — a
+stale number with a real-looking artifact path attached is worse than none.
+
+`packages/bench/results/` holds a timing series
+that is still in flight: fifty-five timing artifacts beside one memory artifact,
+of which eleven scenarios — `readByKey`, `scrollWindow`, `filterTwoAxes`,
+`consumerFloor`, `patchColumn`, `patchOutsideWindow`, `churnChain`,
+`churnShared`, `churnSharedDeep`, `churnWide`, `mountFloor` — carry all three
+points. Two things bound
+what it may be quoted for, and both are recorded in the artifacts themselves:
+the series is **incomplete**, and every run in it was taken with the load gate
+raised — to **3.5** foreign runnable processes on the 22 `small`/`wide` pieces,
+and to **25** on the 34 `default`-point ones — against the harness's own
+default of **0.5** (`packages/bench/src/harness/load.ts`,
+`DEFAULT_MAX_FOREIGN_LOAD`). Read `packages/bench/measurements/README.md` for what
+a raised gate does to a comparison before quoting anything out of that directory.
+
+Everything outside that series has **no number at all**. No strategy of any shipped
+fork has a measured price, so no consumer can pick with the numbers in front of
+them.
+
+The one quantity that needs no measurement, because it is arithmetic rather than
+a reading: emptying a bucket one slot at a time on an array-driven bucket costs
+n(n-1)/2 element moves — **499 500** for a thousand — which is why a bucket content service's `writeSlotContent`
+and `clearSlotContent` go through one `drainSlots`. Counted, not timed, in
+`packages/core/src/bucket/array/tests/everyone-out-at-once-and-not-one-at-a-time.test.ts`, which
+also pins `drainSlots` at zero element writes.
+
+Fast properties are checked, not timed. Every slot kind is one object literal with
+every field present at birth; per-index state lives in the `indexKeys` array;
+nothing adds a field to a slot later or deletes one; neither entity writer
+`delete`s a column — it writes `undefined`, in place or into a spread copy. So every slot of a kind keeps one V8
+hidden class through holds, effects, moves between buckets, patches and release
+deadlines, and an entity keeps its own when a column leaves or arrives —
+`packages/core/tests/what-v8-keeps-on-fast-properties.test.ts` asks V8 directly
+through its own natives for fast properties and a shared map, and
+`packages/core/tests/how-many-shapes-reach-the-write-door.test.ts` pins three slot
+shapes at the write door, one below V8's polymorphic ceiling, and four at `holdSlot`,
+at it, a computed column slot among them as a computed slot. What that saves per read is not measured. An
+entity handed in with a few hundred fields is in dictionary mode before it
+arrives.
+
+The goal the measurement work serves: prove that **for every typical task there
+is a combination of shipped strategies whose cost is at or below the hand-written
+floor**, on the same tasks every framework in `packages/bench` is measured on. A
+ratio above 1.00 is a loss only when no strategy combination reaches the floor.