@oimdb/react 2.2.0 → 3.0.0

package/llms.txt

@@ -0,0 +1,4156 @@
+# OIMDB
+
+> **For AI assistants: read this file before writing any OIMDB code.**
+>
+> `@oimdb/core` is an in-memory reactive engine. This file is its API reference,
+> written against the current source.
+>
+> **Services hold no data; state lives on slots.** An `OIMDB` owns the clock, the collector slot and
+> its `defaultChannelSlot`. A collection service (`OIMSlotCollectionService`) or a single slot service
+> (`OIMSingleSlotService`) is built once per collection type, and `service.createStoreSlot(db)` makes an
+> instance, a `TOIMStoreSlot`, which is NOT a slot (no owner, holds or effects) and carries its
+> `channelSlot`.
+> READS and minting are on the collection service and take the store slot first
+> (`cardService.getSlotByKey(cards, key)`, `holdSlotByKey`, `findSlotByKey`, `getSlots`, `getSlotCount`, the
+> column doors). WRITES are on `service.slotContentService` and take a slot
+> (`cardService.slotContentService.updateEntity(slot, patch)`) or, for a batch, the store slot
+> (`cardService.slotContentService.upsertEntities(cards, entities)`). There are NO by-key write doors:
+> get or find the slot, then write through it.
+> A single — one slot under no key — is an `OIMSingleSlotService`: `getSingleSlot(storeSlot)`,
+> `holdSingleSlot(storeSlot)`, `findSingleSlot(storeSlot)`.
+>
+> For entities the base layer is `createOIMSlotCollectionService({ slotContentService })` /
+> `createOIMSingleSlotService({ slotContentService })` over `createOIMSlotContentEntityService(db, …)`;
+> `createOIMEntityService` and `createOIMSingleEntityService` are convenience wrappers over it. A bucket
+> collection is `createOIMBucketService(db, { slotContentService })` (single:
+> `createOIMSingleBucketService`), where the content service is `new OIMSlotContentBucketServiceSetDriven()`,
+> `new OIMSlotContentBucketServiceArrayDriven()` (the default) or the sorted one; an index is
+> `createOIMIndexService(db, { entityService, keyOf | columns, slotContentService? })`, and
+> `createOIMIndexServiceByCompositeKey` is a convenience wrapper over it.
+> Position reads and writes (`getBucketMemberSlotAt`, `getBucketMemberSlotPosition`, `insertBucketMemberSlotAt`,
+> `removeBucketMemberSlotAt`, `removeBucketMemberSlotRange`, `moveBucketMemberSlotToPosition`,
+> `moveBucketMemberSlotRangeToPosition`) are on `OIMSlotContentBucketServiceArrayDriven`, the default bucket
+> content service; the set-driven one has none. A bucket sorts only on the sorted-at-write content service
+> (`createOIMIndexServiceSortedArrayDriven`); on every other bucket its order is the caller's. A sorted list
+> over any index is `createOIMComputedServiceSorted`. The render script is `OIMBucketCommands`.
+> The channel has no class: its operations are on `OIMChannelService.INSTANCE` and take a channel slot.
+> Effects are `OIMEffectService.INSTANCE.createEffect(db, sourceSlots, sourceComputeds, body)`.
+> Every stateless singleton is a static `INSTANCE` on its class. Module-level defaults are on `OIMDefaults`.
+>
+> Check every symbol you write against [the full export list](#full-export-list).
+>
+> **Nothing in this repository is published to npm and nothing consumes it.**
+> Backwards compatibility, semver and migration paths are not costs here.
+>
+> `packages/core/src/index.ts` is the entire public surface.
+
+## Contents
+
+- [The three layers](#the-three-layers)
+- [The doctrine](#the-doctrine) — the four doors, the injected seams, the idle windows, the collectors, forks
+- [The runtime: the channel slot](#the-runtime-the-channel-slot)
+- [`OIMDB` and the three doors](#oimdb-and-the-three-doors)
+- [`OIMDefaults` — where an optional dependency comes from](#oimdefaults--where-an-optional-dependency-comes-from)
+- [Entity services](#entity-services)
+- [Writing](#writing)
+- [Write strategies](#write-strategies)
+- [Single entities](#single-entities)
+- [Buckets](#buckets)
+- [Derivations](#derivations)
+- [Key stores](#key-stores)
+- [Lifetime — the owner protocol](#lifetime--the-owner-protocol)
+- [Ordered lists](#ordered-lists)
+- [Types](#types)
+- [Full export list](#full-export-list)
+- [Known defects](#known-defects)
+- [Other packages](#other-packages)
+- [`@oimdb/persist`](#oimdbpersist)
+- [`@oimdb/exodra`](#oimdbexodra)
+- [Performance](#performance)
+
+---
+
+## The setup the examples share
+
+Every `ts` example in this file compiles against `packages/*/src`, on top of this
+block and the one under [One derivation per key](#one-derivation-per-key). Blocks
+marked `ts signature` are listings of an API and are not compiled.
+
+```ts setup
+import {
+    OIMChannelService,
+    OIMContentChangeListenerService,
+    OIMDB,
+    OIMDefaults,
+    OIMEffectService,
+    OIMSlotContentBucketServiceArrayDriven,
+    OIMSlotContentBucketServiceSetDriven,
+    OIMSlotStoreServiceMapDriven,
+    OIMSlotStoreServiceSingleSlotDriven,
+    OIMSlotStoreServiceTreeDriven,
+    OIMUnusedSlotCollectorService,
+    createOIMBucketService,
+    createOIMComputedServiceBucketMemo,
+    createOIMComputedService,
+    createOIMComputedServiceSorted,
+    createOIMEntityService,
+    createOIMEntityWriterInPlace,
+    createOIMEntityWriterReplacing,
+    createOIMIndexService,
+    createOIMIndexServiceSortedArrayDriven,
+    createOIMSingleBucketService,
+    createOIMSingleEntityService,
+    createOIMSlotCollectionService,
+    createOIMSlotContentEntityService,
+    createOIMUnusedSlotCollectorSlot,
+    oimIsSlotEmpty,
+    oimIsSlotReleased,
+    oimPatchEntityColumn,
+    oimPatchEntityColumns,
+    oimPutEntityColumns,
+    oimSameValueZeroGuard,
+} from '@oimdb/core';
+import type {
+    IOIMEntityWriter,
+    TOIMSlotEditable,
+    TOIMBucketSlotsArrayStore,
+    TOIMBucketSlot,
+    TOIMBucketSlotsSetStore,
+    TOIMComputedSlot,
+    TOIMDisposer,
+    TOIMEntitySlot,
+    TOIMOrderedListCommand,
+    TOIMSingleSlotStore,
+    TOIMStoreKey,
+    TOIMStoreSlot,
+} from '@oimdb/core';
+
+type Card = { id: string; title: string; rank: number; deck: string };
+
+declare function paint(card: Card | undefined): void;
+declare function measureAndScroll(): void;
+declare function poll(): void;
+declare function reindex(slot: TOIMEntitySlot<Card, TOIMStoreKey>): void;
+declare function render(slots: readonly TOIMEntitySlot<Card>[]): void;
+declare function applyToTheRenderedList(commands: readonly TOIMOrderedListCommand[]): void;
+declare const payload: readonly Card[];
+
+const db = new OIMDB();
+const channelSlot = db.defaultChannelSlot;
+const effectService = OIMEffectService.INSTANCE;
+const cardService = createOIMEntityService<Card>(db, { keyOf: (card) => card.id });
+const cards = cardService.createStoreSlot(db);
+const slot = cardService.slotContentService.upsertEntity(cards, { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' });
+
+const orderedService = createOIMBucketService<TOIMEntitySlot<Card>>(db, {
+    slotContentService: new OIMSlotContentBucketServiceArrayDriven<TOIMEntitySlot<Card>>(),
+});
+const ordered = orderedService.createStoreSlot(db);
+const orderedBucketSlot = orderedService.holdSlotByKey(ordered, 'top');
+
+const pageService = createOIMBucketService<TOIMEntitySlot<Card>>(db);
+const page = pageService.createStoreSlot(db);
+const todo = pageService.holdSlotByKey(page, 'todo');
+const done = pageService.holdSlotByKey(page, 'done');
+```
+
+---
+
+## The three layers
+
+| Layer | Contents |
+|---|---|
+| `src/engine/<domain>/` | the channel (`OIMChannelService`, `TOIMChannelSlot`), the flush scheduler (`OIMFlushSchedulerService`), the slot owner (`OIMSlotOwner`, and `OIMSlotOwnerService`, a type-only export), `OIMContentChangeListenerService`, the entity content service `OIMSlotContentEntityService`, `OIMComputedValueService`, `OIMEffectService`, the column owner (abstract `OIMColumnOwner` with the strategies `OIMColumnOwnerPushDriven` and `OIMColumnOwnerPullDriven`), the key stores and key tree walks, the index keys services, `TOIMStoreSlot`, `TOIMComputedSlot`, `TOIMEffect`, the collector services and slots, and the release policies |
+| `src/facade/<domain>/` | `facade/slot/`: `OIMSlotCollectionService`, `OIMSingleSlotService`; `facade/bucket/`: `OIMSlotContentBucketService` (abstract), `OIMSlotContentBucketServiceSetDriven`, `OIMSlotContentBucketServiceArrayBased` (abstract), `OIMSlotContentBucketServiceArrayDriven`, `OIMSlotContentBucketServiceSortedArrayDriven`, `OIMBucketCommands`; `facade/index/`: `OIMIndexService`, `OIMIndexServiceSortedArrayDriven`; `facade/computed/`: `OIMComputedService`, `OIMComputedServiceSorted`, `OIMComputedServiceBucketMemo` |
+| `src/factories/` | `OIMDB`, `OIMDefaults`, `OIMDefaultValue`; the base factories `createOIMSlotCollectionService`, `createOIMSingleSlotService`, `createOIMSlotContentEntityService`; the convenience wrappers `createOIMEntityService`, `createOIMSingleEntityService`, `createOIMBucketService`, `createOIMSingleBucketService`, `createOIMIndexServiceByCompositeKey`; `createOIMIndexService`, `createOIMIndexServiceSortedArrayDriven`, `createOIMComputedService`, `createOIMComputedServiceSorted`, `createOIMComputedServiceBucketMemo`, `createOIMEntityWriterInPlace`, `createOIMEntityWriterReplacing` |
+
+**No class sits directly in `engine/` or `facade/`.** The directory is the
+domain: `engine/bucket/`, `engine/channel/`, `engine/collector/`, `engine/column/`, `engine/computed/`,
+`engine/entity/`, `engine/error/`, `engine/index/`, `engine/key/`, `engine/schedule/`, `engine/slot/`,
+`engine/store/`, each with its own `constants/`, `interfaces/`, `types/` and `utils/` beside its classes; and
+`facade/bucket/`, `facade/computed/`, `facade/index/`, `facade/slot/`.
+
+**A service holds no data; state lives on slots.** A collection service is built once per collection type
+and holds only configuration and other services: its slot owner, its store service and its content
+service (`service.slotContentService`). `service.createStoreSlot(db)` makes an instance, a `TOIMStoreSlot`,
+which is NOT a slot (no owner, holds or effects): its `store` is what the store service built, its
+`channelSlot` is the db's channel, and it carries the per-store state (content-change listeners, index key
+positions, bucket write queues, column readers). Every slot filed in it points back to it through
+`slot.storeSlot`, which is why a slot door needs no store slot. Reads are called on the service
+(`cardService.getSlotByKey(cards, pk)`, `cardService.getSlots(cards)`); writes on its content service
+(`cardService.slotContentService.updateEntity(slot, patch)`). A store slot's `store` is the store service's
+to read, never the caller's.
+
+---
+
+## The doctrine
+
+### Four doors mint an identity, and nothing else
+
+**Writing a value, subscribing, taking a hold, and reading a key that has
+none.** Each act leaves a **reference** behind on what it produced — a value, an
+effect, a count, or a tracked mint — so nothing can unfile the identity under
+the caller who just got it.
+
+```ts
+cardService.slotContentService.upsertEntity(cards, { id: 'c2', title: 'Two', rank: 2, deck: 'spades' });  // write
+effectService.createEffect(db, [slot], [], () => { paint(slot.entity); });   // subscribe
+cardService.holdSlotByKey(cards, 'c1');                // hold, by key -> the slot, holdCount up by one
+const rankColumn = cardService.holdColumn(slot, 'rank');   // hold, on a column
+cardService.unholdColumn(rankColumn);                  // give the column back
+cardService.getSlotByKey(cards, 'c1');                 // read, by key -> the slot, tracked by the collector
+```
+
+**The non-minting lookup leaves no reference.** `findSlotByKey(storeSlot, key)` (and
+`findSingleSlot(storeSlot)` on a single) answers `undefined` on a miss and mints nothing, and the
+slot it does hand back is protected by nothing the caller took. `slotContentService.findEntityByKey`
+runs the same lookup. There are no by-key write doors: to change or remove an entity by key, find
+the slot first and write through it. Do not write a helper over any of the four doors — it would be a
+second spelling of a mint, not a fifth door.
+
+**Subscribing leaves BOTH kinds of reference.** `OIMEffectService.INSTANCE.createEffect(db, …)` files
+the effect in `slot.effects` *and* holds each root it subscribed to
+and each computed source it was given (through `owner.subscribeToSlot`); `disposeEffect(effect)` gives both back. That hold
+is why no idle window has to count subscribers — see
+[where an idle window opens](#two-release-markers-one-per-policy). A root reached only
+*through* a computed is subscribed but **not** held by the effect; a computed
+minted by `OIMComputedService` holds its own `sourceSlots` and
+`sourceComputeds` when it is minted and gives them back when its content is released.
+
+**`getSlotByKey(storeSlot, key)` is the fourth door, and the collector is what admits it.** It
+mints what is missing, then hands the slot to the unused-slot collector of the store slot's
+channel (`OIMUnusedSlotCollectorService.INSTANCE` over `storeSlot.channelSlot.collectorSlot.unusedSlotCollectorSlot`),
+which holds it for the caller and gives that hold back at the next `db.flush()`.
+So a `getSlotByKey` inside one turn of work cannot be unfiled under you, and nothing
+is left standing after it.
+
+### A slot goes when nothing refers to it
+
+There is **no release API, no sweep a caller runs, and no owner a caller
+assigns**. Two things ask. The release queue calls
+`slot.owner.releaseSlotIfUnheld(slot)` at a deadline; `slot.owner.unholdSlot(slot)` asks
+on the give-back of the last hold.
+
+`releaseSlotIfUnheld` is PUBLIC on `IOIMSlotOwner`. Public
+does not mean "release on demand" — `releaseSlotIfUnheld` is still a guard, and it
+returns without doing anything unless the slot is unheld, unreferenced, still
+owned by the object asked, and out of grace. Terms, and who gives each back:
+
+| Term | Given back by |
+|---|---|
+| `holdCount` | `slot.owner.unholdSlot(slot)`, or `service.unholdColumn(columnSlot)` for a column; the unused-slot collector's flush; a slot leaving a bucket; `effectService.disposeEffect(effect)`, for the hold the effect took |
+| `effects` | `effectService.disposeEffect(effect)` |
+| a held column | its last column effect being disposed, through the service's column owner (`unsubscribeFromSlot`) |
+| the value | `entityService.slotContentService.deleteEntity(slot)`, or `bucketService.slotContentService.clearBucketMemberSlots(bucketSlot)` |
+| a composite-key edge | `OIMKeyTreeWalkComposite.deleteKey` unlinking that composite key part |
+
+`deleteEntity(slot)` takes the **value**. Subscribers stay, holds
+stay, and the identity stays with them. Slots you wrote into a bucket are held by
+that bucket until you empty it.
+
+### A service COMPOSES; nothing is overridden
+
+Optional behaviour is added without a branch on the hot path: a collection service is
+built from three stateless parts, wired once at construction, plus the injected seams below.
+
+| Part | Where | What it does |
+|---|---|---|
+| the slot owner, `OIMSlotOwnerService` (type-only export) | `slot.owner`, typed `IOIMSlotOwner` | holds, subscriptions, release, emptiness, `assertWritable`, the column owner; one per collection type |
+| the store service, `IOIMSlotStoreService` | given to the factory (`entitySlotStoreService`, `bucketSlotStoreService`, …) or the Map default | files and finds the slots of each store slot's `store` |
+| the content service | `service.slotContentService` | the writes and reads of one kind of content (`OIMSlotContentEntityService`, `OIMSlotContentBucketService*`) and the answers the owner asks of that kind |
+
+The owner asks the content kind through one strategy object handed to it at construction, never
+through a subclass of the service:
+
+```ts signature
+interface IOIMSlotContentStrategy<TSlot, TKey, TSlotOwnerService> {
+    createSlot(key: TKey, storeSlot: TOIMStoreSlot | undefined, slotOwnerService: TSlotOwnerService): TSlot;
+    isSlotEmpty(slot: TSlot): boolean;
+    releaseSlotContent(slot: TSlot, slotOwnerService: TSlotOwnerService): void;
+    hasReference(slot: TSlot): boolean;
+}
+interface IOIMSlotContentFlushStrategy<TSlot, TSlotOwnerService> {
+    onSubframeClosed(storeSlot: TOIMStoreSlot<unknown, TSlot>, slotOwnerService: TSlotOwnerService): void;
+}
+```
+
+`hasReference` answers whether something outside `holdCount` and `effects` keeps the slot (a
+bucket's members); the flush strategy is what a bucket content service delivers at the close of a
+subframe. Every write door asserts the identity is still filed and opens the channel's subframe.
+
+### The injected seams
+
+Each is one small interface handed to a constructor, and each answers one
+question that the engine asks but does not decide. There is no flag and no option
+object.
+
+```ts signature
+interface IOIMSlotEmptiness<TSlot> { isEmpty(slot: TSlot): boolean; }
+
+interface IOIMSlotStamp<TSlot> { stamp(slotEditable: TOIMSlotEditable<TSlot>): void; }
+```
+
+**What a kind of content answers is not a seam.** Mint, write, clear and release
+belong to the content service, which the factory wires into the owner as its content strategy.
+"Does this still hold something" no part declares — the owner asks `oimIsSlotEmpty(slot)`,
+`hasReference` and the release policy's `isSlotReleasable` separately.
+
+**`IOIMSlotEmptiness`** decides what counts as empty, and the answer is written once
+per write into the EMPTY flag of `slot.slotFlags` — never recomputed at a read. The entity content
+service defaults to "the entity is `undefined`" (the `slotEmptiness` option of
+`createOIMSlotContentEntityService` replaces it); a bucket content service answers "no members"; a
+computed answers `false`, because a derivation always has a value to produce.
+
+**Emptiness decides lifetime, never the write path.** An `upsertEntity` onto an entity slot that
+still carries an entity merges into it even when emptiness calls the slot empty (a
+soft delete, a seed planted by `IOIMSlotStamp`): a column the new entity drops is
+woken, an unchanged one is not, and an upsert that repeats the entity exactly wakes
+nothing. Only an entity slot with no entity at all is filled whole.
+
+**`IOIMSlotStamp`** writes onto the slot at every write, just before emptiness is
+settled. It is a chain, not a single: each stamp takes the `next` one and calls
+it first. It is for stamps that are not about release.
+
+### The release policy
+
+```ts signature
+interface IOIMSlotReleasePolicy {
+    readonly releasesWrittenSlots: boolean;
+    readonly schedulesReleaseOnWrite: boolean;
+    onSlotWritten(slot: TOIMSlot): void;
+    onSlotIdle(slot: TOIMSlot): boolean;
+    onSlotUnheld(slot: TOIMSlot): void;
+    isSlotReleasable(slot: TOIMSlot): boolean;
+    isEmptySlotReleasable(slot: TOIMSlot): boolean;
+    cancelSlotRelease(slot: TOIMSlot): void;
+}
+
+new OIMSlotReleasePolicyAfterWrite({ keepAfterWriteMs: number })
+new OIMSlotReleasePolicyAfterIdle({ keepAfterIdleMs: number })
+new OIMSlotReleasePolicyAfterUnhold({ keepAfterUnholdMs: number })
+OIMSlotReleasePolicyAtUnhold.INSTANCE
+OIMSlotReleasePolicyAtEmpty.INSTANCE
+OIMSlotReleasePolicyNever.INSTANCE
+new OIMSlotReleasePolicyEarliest(slotReleasePolicies: readonly IOIMSlotReleasePolicy[])
+```
+
+`releasesWrittenSlots` is whether the policy can ever release a slot that holds
+data; a service reads it once at construction and skips the after-write
+release check when it is false (`OIMSlotReleasePolicyAtEmpty`, `OIMSlotReleasePolicyNever`: false;
+`OIMSlotReleasePolicyAtUnhold` and the timed policies: true; `OIMSlotReleasePolicyEarliest`: true
+when any policy it combines is).
+
+`schedulesReleaseOnWrite` is whether a write can make the policy schedule a release; a service
+reads it once at construction and, when it is false and no `slotStamp` is set, skips `onSlotWritten`
+and the first-fill `onSlotIdle` on every write (`OIMSlotReleasePolicyAfterWrite`, `OIMSlotReleasePolicyAfterIdle`:
+true; `OIMSlotReleasePolicyAtEmpty`, `OIMSlotReleasePolicyNever`, `OIMSlotReleasePolicyAtUnhold`,
+`OIMSlotReleasePolicyAfterUnhold`: false; `OIMSlotReleasePolicyEarliest`: true when any policy it combines is).
+`onSlotIdle` is still called when the last subscriber leaves.
+
+A policy decides whether and when a slot goes; it does no work itself. A
+factory, and `OIMDB` (whose `slotReleasePolicy` option every factory reads as its default), takes ONE
+through the option `slotReleasePolicy`. With none, the slot owner is built with
+`OIMSlotReleasePolicyAtEmpty`, so a slot with a value stays for good and an empty
+one with nothing holding it goes; there is no "no policy" branch on any path.
+Computed services default to `OIMSlotReleasePolicyAtUnhold`.
+
+| Policy | A slot goes |
+|---|---|
+| `OIMSlotReleasePolicyAfterWrite` | once its last write is older than `keepAfterWriteMs` |
+| `OIMSlotReleasePolicyAfterIdle` | once nothing has watched it for `keepAfterIdleMs` |
+| `OIMSlotReleasePolicyAfterUnhold` | once `keepAfterUnholdMs` has passed since its LAST unhold; a hold taken again inside the window keeps it |
+| `OIMSlotReleasePolicyAtUnhold` | at the last unhold, even with a value |
+| `OIMSlotReleasePolicyAtEmpty` | once it has no value and nothing holds it; a computed, never empty, stays while its owner lives |
+| `OIMSlotReleasePolicyNever` | never, empty or not; a deleted key's slot stays filed |
+| `OIMSlotReleasePolicyEarliest` | when the earliest deadline of its members falls due — a `min` over deadlines |
+
+The collectors' state lives on the db's collector slot, one per `OIMDB`:
+`db.collectorSlot.afterWriteReleaseSlotCollectorSlot`, `afterIdleReleaseSlotCollectorSlot` and
+`afterUnholdReleaseSlotCollectorSlot`, swept by the stateless
+`OIMReleaseSlotCollectorServiceAfterWrite.INSTANCE` / `OIMReleaseSlotCollectorServiceAfterIdle.INSTANCE` /
+`OIMReleaseSlotCollectorServiceAfterUnhold.INSTANCE`. The
+clock and the timer are the db's: pass `new OIMDB({ getNowMs, releaseTimer })` to control time (tests),
+and sweep with `OIMReleaseSlotCollectorServiceAfterIdle.INSTANCE.flush(db.collectorSlot.afterIdleReleaseSlotCollectorSlot)`.
+`OIMSlotReleasePolicyAtUnhold` is the zero window and has no collector.
+
+A zero window never touches a release queue or a timer: when a slot goes idle with
+`onSlotIdle` answering `true`, it is released at once if nothing holds it, and
+a freshly minted slot that is already due goes to the unused-slot collector and
+leaves at the end of the frame. A window above zero is filed in that policy's own
+queue.
+
+```ts
+import {
+    OIMSlotReleasePolicyAfterIdle,
+    OIMSlotReleasePolicyAfterWrite,
+    OIMSlotReleasePolicyEarliest,
+} from '@oimdb/core';
+
+const releasingDb = new OIMDB({
+    slotReleasePolicy: new OIMSlotReleasePolicyEarliest([
+        new OIMSlotReleasePolicyAfterWrite({ keepAfterWriteMs: 60_000 }),
+        new OIMSlotReleasePolicyAfterIdle({ keepAfterIdleMs: 30_000 }),
+    ]),
+});
+```
+
+### Two release markers, one per policy
+
+`TOIMSlot` carries TWO deadlines, and each release policy moves its own and
+no other:
+
+| Marker | Moved by | Not moved by |
+|---|---|---|
+| `releaseDueAfterWriteMs` | every write, under `OIMSlotReleasePolicyAfterWrite` | a subscriber arriving or leaving |
+| `releaseDueAfterIdleMs` | the first content of a slot with no subscriber, and the departure of the last subscriber, under `OIMSlotReleasePolicyAfterIdle` | a later write, and the give-back of a hold |
+| `releaseDueAfterUnholdMs` | every last unhold, under `OIMSlotReleasePolicyAfterUnhold` | a write |
+
+`-1` means unset. A slot goes on the SOONEST of those that are set — each
+marker is an eviction deadline, so whichever says "out" first decides — and a
+hold outranks both, so a subscribed entity slot is never taken for age and goes at the
+give-back.
+
+**ONE NUMBER CANNOT CARRY BOTH POLICIES.** A single field cannot say which event
+is allowed to move it: a write arriving after the subscriber left would push the
+deadline out and destroy the idle policy's verdict, and the last subscriber
+leaving after a write would destroy the write policy's. Both directions are
+pinned by
+`engine/collector/tests/which-release-marker-each-collector-may-move.test.ts`;
+collapse the two markers into one and six of its nine cases go red.
+
+**The release policy's `isSlotReleasable(slot)`** is what the release guard asks
+for a slot that is not empty and has nothing left keeping it. `true` releases it
+now; `false` keeps it, and a policy with a finite deadline has itself filed the
+slot into its release queue (a marker of `-1` is kept with nothing scheduled).
+An **empty** slot is released without asking, and a service given no release
+policy keeps a non-empty slot. `OIMComputedService` defaults its policy to
+`OIMSlotReleasePolicyAtUnhold`, which always answers `true`, so a derivation
+nothing refers to goes at once. `OIMSlotReleasePolicyEarliest` asks every member
+and answers `true` if any does.
+
+**AN IDLE WINDOW OPENS IN EXACTLY TWO PLACES, AND NOWHERE ELSE:**
+
+1. **when the slot first gets content with no subscriber** — the write that takes it
+   from empty to filled, in `settleEmptiness`. A slot minted empty (a `getSlotByKey`
+   miss) is on NO clock and costs the queue nothing;
+2. **when the LAST SUBSCRIBER leaves** — `OIMSlotOwner.unsubscribeFromSlot` empties
+   `slot.effects` and runs the idle step, which opens one.
+
+Both ask the policy's `onSlotIdle(slot)`; under `OIMSlotReleasePolicyAfterIdle`
+it stamps `releaseDueAfterIdleMs` and files the slot into the policy's queue. An
+**empty** slot gets no window, and the release guard takes it without asking a
+clock at all.
+
+**A GIVE-BACK OPENS NONE.** `OIMSlotOwner.unholdSlot` drops `holdCount` and runs
+`releaseSlotIfUnheld`; it stamps no marker. A slot whose window already ran out is
+therefore taken at the give-back and not one window later.
+
+**A HELD SLOT IS OFF THE CLOCK.** A sweep that meets one calls
+`releaseSlotIfUnheld`, which stops at its first guard, `holdCount > 0`, and decides
+nothing — and the queue has taken the slot off its slice, so nothing re-files it.
+The give-back is where the guard is asked again.
+
+### The two release collectors
+
+Each of `OIMSlotReleasePolicyAfterWrite`, `OIMSlotReleasePolicyAfterIdle` and
+`OIMSlotReleasePolicyAfterUnhold` is swept by its own stateless collector service, and the difference
+between them is WHICH MARKER it reads — there is no flag, and no branch on the sweep path. Their state is
+one release collector slot each, on the db's collector slot.
+
+```ts signature
+abstract class OIMReleaseSlotCollectorService {
+    readonly getReleaseDueMs: (slot: TOIMSlot) => number;
+    getReleaseSlotCollectorSlot(collectorSlot: TOIMCollectorSlot): TOIMReleaseSlotCollectorSlot;
+    getReleaseSlotCollectorSlotOf(slot: TOIMSlot): TOIMReleaseSlotCollectorSlot;
+    markSlotReleaseDue(releaseSlotCollectorSlot, slot, keepMs): number; // stamps now + keepMs on this marker, returns now
+    isSlotReleasable(releaseSlotCollectorSlot, slot): boolean;          // due now; if not yet, files it on the queue
+    cancelSlotRelease(releaseSlotCollectorSlot, slot): void;            // no-op for a slot whose marker is -1
+    flush(releaseSlotCollectorSlot): void;
+    cancelAllSlotReleases(releaseSlotCollectorSlot): void;
+}
+OIMReleaseSlotCollectorServiceAfterIdle.INSTANCE
+OIMReleaseSlotCollectorServiceAfterWrite.INSTANCE
+OIMReleaseSlotCollectorServiceAfterUnhold.INSTANCE
+
+type TOIMCollectorSlot = {
+    readonly unusedSlotCollectorSlot: TOIMUnusedSlotCollectorSlot;
+    readonly afterIdleReleaseSlotCollectorSlot: TOIMReleaseSlotCollectorSlot;
+    readonly afterWriteReleaseSlotCollectorSlot: TOIMReleaseSlotCollectorSlot;
+    readonly afterUnholdReleaseSlotCollectorSlot: TOIMReleaseSlotCollectorSlot;
+};
+```
+
+The clock (`getNowMs`, default `Date.now`), the timer (`releaseTimer`, default an unref'd `setTimeout`)
+and the `errorPolicy` (default `OIMErrorPolicyLogAndContinue.INSTANCE`) are `OIMDB` options, shared by the
+channel and every release collector of that db. A release that throws inside a hand-called `flush` throws to
+that caller; one that throws on the collector's own timer tick has no caller and goes to the db's
+`errorPolicy`. So one error policy on the db routes every error through one place:
+
+```ts
+import { OIMErrorPolicyThrowAtOnce, OIMSlotReleasePolicyAfterIdle } from '@oimdb/core';
+
+const oneSinkDb = new OIMDB({
+    errorPolicy: new OIMErrorPolicyThrowAtOnce(),
+    slotReleasePolicy: new OIMSlotReleasePolicyAfterIdle({ keepAfterIdleMs: 30_000 }),
+});
+```
+
+| Collector service | Reads | What renews it | What does not |
+|---|---|---|---|
+| `OIMReleaseSlotCollectorServiceAfterIdle` | `releaseDueAfterIdleMs` | the first content of a slot, and the give-back of the last hold | a later write |
+| `OIMReleaseSlotCollectorServiceAfterWrite` | `releaseDueAfterWriteMs` | every write, under its policy | a subscriber arriving or leaving |
+| `OIMReleaseSlotCollectorServiceAfterUnhold` | `releaseDueAfterUnholdMs` | every last unhold | a hold taken again inside the window |
+
+**A CONSUMER MAY RUN BOTH, AND THEY SHARE NOTHING.** Each has its own release collector slot with its own
+queue and its own scheduled run. Whichever deadline falls due first takes the slot, and
+nothing has to be reconciled: `OIMSlotReleasePolicyEarliest` answers a `min`
+over its members' deadlines, so a sweep of either queue reaches the same verdict.
+
+**NEITHER MEANS UNREAD.** No read is seen and no door reports one: an identity a
+consumer subscribed to is in use whatever else is true of it. An effect takes a
+HOLD on each root it was given — `OIMEffectService.INSTANCE.createEffect` calls
+`root.owner.subscribeToSlot(root, …)`, which holds, for every slot in `sourceSlots` and every computed
+source — so the hold is the whole signal, and neither collector reads
+`slot.effects`.
+
+**The deadline is only consulted on a slot that is NOT empty.**
+The slot owner's `releaseSlotIfUnheld` checks `holdCount > 0`, then
+`oimIsSlotReleased(slot)`, then `slot.owner !== this`, then `hasReference(slot)`, and
+only then — on a slot that is not empty — asks the policy's `isSlotReleasable`; an empty slot
+asks `isEmptySlotReleasable` instead, which every policy but
+`OIMSlotReleasePolicyNever` answers `true`. So only `OIMSlotReleasePolicyNever`
+keeps an identity that holds nothing.
+
+**A release that falls inside a flush waits for it to end.** Releasing a slot
+with a value clears that value, which is a write, and every service
+refuses writes for the whole of a flush of its channel (`channelSlot.isFlushing`; refusal is per channel). So when the
+last hold goes during a frame — an effect body disposing another effect, say — the
+slot is handed to the unused-slot collector instead, which holds it and gives it
+back once the flush is over; the release then runs. An empty slot needs no write
+and goes at once.
+
+*The `owner !== this` line costs no lookup. A KEYLESS slot — a single's, filed in an
+`OIMSlotStoreServiceSingleSlotDriven` store — goes through the same guard under its service's policy: an
+emptied single bucket nothing holds is released like a keyed one, and the single service's
+`getSingleSlot(storeSlot)` mints a fresh slot on the next read.*
+
+### Two consequences to generate code against
+
+**(a) An entity slot watched through an expired sweep gets a WHOLE window when the
+subscriber leaves, not an immediate release.** The seconds it spent watched were
+not idle ones, so `dispose` on a slot whose deadline passed long ago stamps a
+whole idle window afresh on `releaseDueAfterIdleMs` and the release comes
+one whole window later. **A give-back is NOT that moment**: `unholdSlot` stamps
+nothing, so a slot held through an expired sweep goes at the give-back.
+
+```ts
+const effect = effectService.createEffect(db, [slot], [], () => { paint(slot.entity); });
+// …the window passes, sweeps run, nothing happens to this slot…
+effectService.disposeEffect(effect);
+oimIsSlotReleased(slot); // false — a whole new window starts here
+```
+
+**(b) A cascade is taken in ONE sweep, not one window per level.** The sweep
+releases the stale index, which gives back one reference per entity slot it named, and
+each entity slot whose own window already ran out is taken by the ordinary guard the
+instant that reference departs.
+
+Pinned by `engine/collector/tests/what-a-stale-index-takes-with-it.test.ts`,
+`…/what-an-identity-nobody-subscribed-to-costs-after-a-while.test.ts` and
+`…/what-a-subscribed-row-costs-the-release-clock.test.ts`.
+
+### The release guard, and who fires it
+
+**THE QUEUE DECIDES AT A DEADLINE, NOT THE OWNER.**
+`OIMReleaseSlotQueueService.INSTANCE.releaseDueUpToSliceNumber`, per slot in a slice at or below the one due:
+
+1. `oimIsSlotReleased(slot)` → skip it;
+2. its own marker, read through `getReleaseDueMs(slot)` — the ONE field this queue
+   answers for;
+3. `-1` → the slot is dropped from the queue: this policy does not claim it;
+4. a moment still in the future → the queue **re-files the slot itself**, into
+   `oimSliceOfMs(getReleaseDueMs)` through its own slice arithmetic;
+5. a moment already passed → `slot.owner.releaseSlotIfUnheld(slot)`, which asks the
+   policy's `isSlotReleasable` and so declines when the other policy still keeps
+   the slot.
+
+The owner files nothing from inside a sweep. It **opens** a window on its own
+events, through the policy's `onSlotIdle` — when a slot first gets content, and
+when the last subscriber leaves — and `onSlotUnheld` on the give-back of the last hold.
+
+**A SLOT ALREADY ON A QUEUE STAYS WHERE IT IS.** `scheduleSlotRelease` of a slot filed
+at a slice no later than its new deadline moves nothing: the sweep re-reads the
+deadline when that slice comes due and re-files the slot then (the timing-wheel
+lazy re-insertion). So a write to a queued entity slot costs the queue one `Map.get`, not
+an unfile and a refile.
+
+`releaseSlotIfUnheld(slot)` is the guard, and it releases only when all of
+`holdCount === 0`, `oimIsSlotReleased(slot)` is false, `slot.owner === this`,
+`hasReference(slot)` is false, and the policy's `isSlotReleasable` answers `true`
+(or the slot is empty). **A held slot stops at the first of those** and nothing
+happens to it. On a slot that is not empty with time still owed, `isSlotReleasable`
+answers `false` and the policy files the slot into its queue at its own marker, so a
+filing can neither shorten nor extend a deadline. That is the path from `unholdSlot` and from a write, never from a
+sweep, which had already re-filed at step 4. Releasing hands the slot to the
+content strategy's `releaseSlotContent` (which gives back what the content held),
+marks the slot empty, calls the policy's `cancelSlotRelease(slot)`, unfiles the key
+through the store service's `remove`, and sets the RELEASED flag in `slot.slotFlags`. The `owner` is NOT cleared — the slot keeps
+pointing at the object that let it go, which is what makes `slot.owner !== this`
+a usable guard afterwards.
+
+The RELEASED flag (`oimIsSlotReleased(slot)`) is the other half of that protocol, and the two sides are
+opposite:
+
+- **Releasing an already-released slot is SILENT.** `releaseSlotIfUnheld` reads
+  `oimIsSlotReleased(slot)` and returns; it does not throw. A sweep meeting a slot
+  something else already let go must not raise.
+- **Trying to WORK with a released slot throws by name.** `assertNotReleased`
+  guards the content services' write doors (`writeEntity`, `deleteEntity`, `updateEntity`, `markEntityChanged`,
+  `writeBucketMemberSlots`, `clearBucketMemberSlots`, `markContentChanged`) and the reference doors (`holdSlot`, `unholdSlot`, `subscribeToSlot`,
+  `unsubscribeFromSlot`). The refusal message starts `This identity was released:`.
+
+### The collectors
+
+```ts signature
+OIMReleaseSlotCollectorServiceAfterWrite.INSTANCE   // and …AfterIdle, …AfterUnhold
+OIMReleaseSlotQueueService.INSTANCE
+OIMUnusedSlotCollectorService.INSTANCE
+createOIMUnusedSlotCollectorSlot(): TOIMUnusedSlotCollectorSlot
+```
+
+All are stateless; each works on a slot handed to it. The release collector services extend
+`OIMFlushSchedulerService`.
+
+**A release collector service** is the clock. It sweeps the queue of the release collector slot it is
+given on `flush(releaseSlotCollectorSlot)` and re-schedules itself to the next deadline.
+`cancelAllSlotReleases(releaseSlotCollectorSlot)` cancels and empties the queue; the next scheduled release
+schedules it again. The clock (`getNowMs`) and the timer come from the db, so a test drives them through
+`new OIMDB({ getNowMs, releaseTimer })`. The default timer is a `setTimeout` that calls `unref`
+where the platform has it, so an idle Node process is not held open.
+
+**`OIMReleaseSlotQueueService`** files the slots of one release collector slot into **time slices**, not
+into one entry each; the collector service's `getReleaseDueMs` is the ONE marker it answers for, which is
+what makes two queues over two markers independent. `oimSliceOfMs(ms)` is `Math.floor(ms / OIM_SLICE_LENGTH_MS)` and
+`OIM_SLICE_LENGTH_MS` is `1024`, so every slot due inside the same ~1s slice
+shares one `Set` and one timer. Its doors, each taking the release collector slot first:
+
+| Door | What it does |
+|---|---|
+| `scheduleSlotRelease(releaseSlotCollectorSlot, slot, …)` | read this queue's own marker off the slot and file it into that slice (a marker already past now files at now's slice), then schedule the collector. A marker of `-1` files nothing |
+| `cancelSlotRelease(releaseSlotCollectorSlot, slot)` | take it off |
+| `isSlotReleaseScheduled(releaseSlotCollectorSlot, slot)` | is it filed |
+| `getNextReleaseSliceNumber(releaseSlotCollectorSlot)` | the nearest filed slice number, or `undefined` |
+| `releaseDueUpToSliceNumber(releaseSlotCollectorSlot, …)` | the sweep: for every slice at or below the one due, read the marker and then drop it (`-1`), re-file it itself (still in the future), or call `slot.owner.releaseSlotIfUnheld(slot)` |
+| `cancelAllSlotReleases(releaseSlotCollectorSlot)` | drop every filing |
+
+A slot re-filed during a sweep cannot land in a slice the same sweep is still
+walking: the sweep raises a floor for its duration, so a re-file — the queue's own
+at step 4, or one `releaseSlotIfUnheld` makes — goes to the next slice and is looked
+at next time, not in a loop.
+
+**The unused-slot collector** has nothing to do with time. It is the one that makes
+`getSlotByKey(storeSlot, key)` safe: `OIMUnusedSlotCollectorService.INSTANCE.holdSlotUntilFlush(unusedSlotCollectorSlot, slot)`
+takes a hold, `flush(unusedSlotCollectorSlot)` gives every tracked hold back. `open` / `close` nest a scope and
+`run(unusedSlotCollectorSlot, body)` is the `try/finally` form; `flush` does nothing while a scope is
+open, so an outer scope's slots survive an inner one closing. `close` with no open scope throws by name. The
+channel flush flushes the db's unused-slot collector slot (`db.collectorSlot.unusedSlotCollectorSlot`) once the
+frame is delivered, which is why a turn of work that only read through `getSlotByKey` leaves nothing
+standing after `db.flush()`.
+
+**AN ARENA IS AN UNUSED-SLOT COLLECTOR SLOT THAT THE CALLER CREATES.** `createOIMUnusedSlotCollectorSlot()`
+is exported, so a consumer who wants to FORCE-CACHE a derivation makes its own and ends it when it chooses.
+The db's collector slot is the default, not the only one:
+
+```ts
+const unusedSlotCollectorSlot = createOIMUnusedSlotCollectorSlot();
+OIMUnusedSlotCollectorService.INSTANCE.holdSlotUntilFlush(
+    unusedSlotCollectorSlot, rankService.computedCollectionService.getSlotByKey(ranks, 'c1'),
+);                                  // held until this arena says otherwise
+db.flush();                         // the db's collector lets its own go; this one does not
+// … the derivation is still there, and still the same object …
+OIMUnusedSlotCollectorService.INSTANCE.flush(unusedSlotCollectorSlot);   // now it goes, and so does everything only it held
+```
+
+**TRACKING ONE DERIVATION KEEPS ITS WHOLE SUBTREE, and no caller walks a tree to
+get that.** A computed takes a hold on each of its own direct sources at the mint
+and gives them back when it is released, so an arena holds the top and the chain holds itself.
+
+Pinned by `engine/collector/tests/what-a-named-arena-keeps-cached.test.ts`: the
+derivation survives a settle, is the SAME instance on the next read (built once),
+is rebuilt only after the arena is flushed, and `open`/`close` nest so an inner
+scope ending drops nothing an outer one stands on.
+
+`@oimdb/react`'s `useOIMSlotsByKeys(slotCollectionService, storeSlot, keys)` does not use an arena: it takes a
+plain `holdSlotByKey` per key on commit and gives the same holds back on unmount or when the key list moves.
+
+```ts signature
+type TOIMTimer = (run: () => void, inMs: number) => TOIMDisposer;
+```
+
+`TOIMTimer` is how a host schedules a collector's run. It is given the body
+and a delay and hands back the cancel. `OIMFlushSchedulerService` is the abstract base
+that owns the schedule/cancel around it, on a `TOIMFlushSchedulerSlot` (`timer`, `scheduledCallback`,
+`timerDisposer`): protected `schedule(flushSchedulerSlot, delayMs)` does
+nothing if a scheduled run is already standing, and `cancelSchedule(flushSchedulerSlot)` drops it. **The
+standing run is the callback itself**: the slot keeps the one handed to the
+timer, and a callback that is no longer that one — a run the host could not
+cancel, still queued after a manual flush — returns without touching anything, so
+it neither flushes early nor lets the next request arm a second wake. The channel
+schedules with `0`. The release collectors read the clock once, schedule to the
+next slice, and cancel and re-schedule only when a shorter window arrives; the
+deadline they compare against is reset by `cancelSchedule`.
+Pass a `TOIMTimer` of your own to drive a collector off a
+frame callback, a worker message or a test clock instead of `setTimeout`.
+
+### A fork is a strategy, not a decision
+
+Both strategies ship, chosen at **construction**, so no branch survives onto a hot
+path. There is no `if (inPlace)` anywhere in the engine.
+
+| Fork | Strategies |
+|---|---|
+| how a write lands | `createOIMEntityWriterInPlace()` / `createOIMEntityWriterReplacing()` |
+| how a bucket holds slots | `OIMSlotContentBucketServiceSetDriven` / `OIMSlotContentBucketServiceArrayDriven` (the positions are the caller's) |
+| what naming a slot records | `OIMBucketArrayMembershipNonUnique` / `OIMBucketArrayMembershipUnique`, the `bucketArrayMembership` option of `OIMSlotContentBucketServiceArrayDriven` |
+| which writes re-sort a sorted list | `sortColumns` (only a write changing one of them on a member) / `comparator` alone (any member write), the options of `createOIMComputedServiceSorted` |
+| how a key is addressed | `OIMDefaults.KEY_TREE_WALK_SCALAR` / `OIMDefaults.KEY_TREE_WALK_COMPOSITE` |
+| when a slot may go | `OIMSlotReleasePolicyAfterIdle` / `OIMSlotReleasePolicyAfterWrite`, either or both |
+| who decides a bucket's slots | a bucket collection (`createOIMBucketService`, the caller) / an index (`createOIMIndexService`, filed from the entity's own key) |
+
+**One strategy per kind per app.** A V8 call site is shared by every service
+that runs the same engine code, so mixing strategies of one kind in one process
+shows that site several hidden classes or functions. Up to four is polymorphic:
+V8 still caches each one and can still inline
+(`--max-valid-polymorphic-map-count`, default 4). Five or more is megamorphic: no
+per-site cache and no inlining through it. The kinds that count: release policies
+(the `IOIMSlotReleasePolicy` strategies), set-driven vs array-driven buckets and indexes, entity
+writers (`createOIMEntityWriterInPlace` / `createOIMEntityWriterReplacing`) and
+`TOIMEntityInsertStrategy`, `TOIMSameValueGuard`, `IOIMSlotEmptiness`, and
+`TOIMChannelScheduler`. Two or three of one kind is fine; five release policies in
+one process is not. The pair
+`alt.slot-shape.three-shapes-against-one-at-the-write` measures three slot shapes
+at one write site against one, and its ratio is close to 1; no pair measures five.
+Generate code with one strategy per kind unless the task names a second.
+
+### Every store slot has a channel — read this before generating code
+
+`createStoreSlot(db)` stamps the db's `defaultChannelSlot` on the store slot, and every write to its slots
+is reported to that channel. No service holds a channel; there is no `channel` option and no
+`unusedSlotCollector` option. The base layer and the convenience wrapper build the same thing:
+
+```ts
+const cardContentService = createOIMSlotContentEntityService<Card>(db, { keyOf: (c) => c.id });
+const handBuiltCardService = createOIMSlotCollectionService({ slotContentService: cardContentService });
+handBuiltCardService.createStoreSlot(db);
+
+// THE CONVENIENCE WRAPPER — the same two calls in one:
+createOIMEntityService<Card>(db, { keyOf: (c) => c.id }).createStoreSlot(db);
+```
+
+A single entity is `createOIMSingleEntityService<T>(db)` (or `createOIMSingleSlotService` over
+`createOIMSlotContentEntityService(db, { slotStoreService: OIMSlotStoreServiceSingleSlotDriven.INSTANCE })`),
+and its store slot takes the db's channel too and always reports.
+
+### A bucket's slots are the caller's
+
+A bucket's slots are a fact about the **response** being composed — a search result, a
+page, a window — and **no column can express absence**. So a bucket collection
+is manual, and `entityService.slotContentService.deleteEntity(slot)` does not take a slot out of any
+bucket. Use an index (`createOIMIndexService`) when the slots are determined by the entity's key value,
+and an index should maintain buckets only for keys being held.
+
+---
+
+## The runtime: the channel slot
+
+There is no channel class. A channel is the struct `TOIMChannelSlot`; every operation is on the stateless
+`OIMChannelService.INSTANCE` and takes the channel slot first. An `OIMDB` builds its `defaultChannelSlot`
+from its own options, and every store slot created with `createStoreSlot(db)` carries it as
+`storeSlot.channelSlot`. A test that needs a second, independent channel makes a second `new OIMDB()`.
+
+```ts signature
+new OIMDB(options?: TOIMDBOptions)
+
+type TOIMDBOptions = {
+    channelScheduler?: TOIMChannelScheduler;     // absent = you flush by hand
+    errorPolicy?: IOIMErrorPolicy;              // absent = OIMErrorPolicyLogAndContinue.INSTANCE
+    onBeforeFlush?: () => void;                 // start of the flush, before the frame; READ ONLY, a write is refused
+    getNowMs?: () => number;                    // the release collectors' clock; absent = Date.now
+    releaseTimer?: TOIMTimer;                   // the release collectors' timer; absent = an unref'd setTimeout
+    entityWriter?: IOIMEntityWriter;            // default entity writer for every entity factory
+    indexKeysService?: IOIMIndexKeysService;
+    slotStamp?: IOIMSlotStamp<TOIMSlot>;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;  // default release policy for every factory
+};
+
+db.clock               // TOIMChannelClock, the same object as db.defaultChannelSlot.clock
+db.collectorSlot       // TOIMCollectorSlot
+db.defaultChannelSlot  // TOIMChannelSlot
+db.flush()             // OIMChannelService.INSTANCE.flush(db.defaultChannelSlot)
+
+interface IOIMErrorPolicy { onErrorCaught(error: unknown): void }
+OIMErrorPolicyLogAndContinue.INSTANCE                                       // console.error; the flush goes on
+new OIMErrorPolicyLogAndContinue({ onError?: (error: unknown) => void })   // console.error, then onError
+new OIMErrorPolicyThrowAtOnce()                                             // throws the first error out of the flush
+```
+
+**What the error policy covers** — every error with no synchronous caller to
+throw to: effect bodies and their cleanups, `onBeforeFlush`, after-each-frame and
+after-each-flush handlers, the unused-slot sweep at the end of a flush, and a
+release collector's own timer tick. A call that has a caller — a write, a
+hand-called collector `flush` — throws to it. `channelSlot.errorPolicy` is the
+instance the channel reports through; it is the db's `errorPolicy`, which the release collectors share,
+so one policy answers for the whole database. **The default digests and logs**: each throw goes to `console.error`
+and then to `onError` (where Sentry or the devtools registry plugs in), and the
+flush finishes every other effect and handler. `OIMErrorPolicyThrowAtOnce` throws
+the first error out of `flush()` at once; the effects the frame had not reached yet
+stay queued and run at the next flush. **An effect whose body or cleanup threw
+has not taken the change it woke for**: its `ranAtRevision`/`ranAtEpoch` are
+written only after the body returns, so its next wake — any later write to its
+roots, even one through a computed that settles to the same value — sees that
+change as still new and runs it again. It is never re-run inside the frame it
+threw in (each pending effect runs once per frame, and writes are refused during
+a flush), so a body that always throws costs one run and one caught error per
+wake, not a loop. A cleanup that disposes its own effect stops the body that would
+have run after it. **A computed is stamped fresh only after its derive and its
+`sameValueGuard` both returned**: if either threw, the next read derives again.
+A computed with no sources at all derives on its first read. **A computed whose
+value changed is stamped with the revision of its newest source**, not with the
+clock at the moment it was read — so whether an effect over it owes a run depends
+only on its sources, never on an unrelated write that moved the clock. An effect
+born after a computed's source changed is owed nothing for it, as one over the
+root itself. **A throw does not
+stop the channel asking for frames**: the
+request flag is cleared before `onBeforeFlush` runs, and a write that finds
+effects still pending with no frame requested asks for one — so a frame aborted by
+a throw is followed by a frame at the next write, under either policy. **A throw in
+one release of a sweep leaves the rest of that slice on the release clock**; the
+next sweep takes them, and the clock is re-armed even when the sweep threw. Code
+that maintains DERIVED state — an index's `keyOf`, an emptiness check — is not
+under the policy: a throw there leaves the state consistent and is thrown in
+either mode. **An index whose `keyOf` throws on an entity files that entity slot under no
+key** — it leaves the bucket its old key named — and finishes the rest of the write
+or batch before it rethrows the first error; the entity stays in its store slot, and
+the next write the index accepts files it again. A NEW entity refused by a single
+write is withdrawn from the store slot instead. This costs nothing on a write
+where nothing throws. **A bucket minted by a scan of the source moves an entity slot out
+of the bucket its stored key still names** — an entity mutated by hand whose
+`markEntityChanged` has not run yet — so it ends in one bucket, not two; the scan
+pays one read of the stored key per entity slot it files, and the move keeps the entity slot held
+until the next flush so its last hold never goes mid-mint. Inside a flush, where
+writes are refused, the move is skipped.
+
+Every door below is on `OIMChannelService.INSTANCE` and takes the channel slot first.
+
+| Door | Signature |
+|---|---|
+| `flush(channelSlot)` | `void` — the only place anything is delivered; from the TAIL of a flush it returns having done nothing. `db.flush()` is this on the default channel |
+| `scheduleEffectRun(channelSlot, effect)` | `void` — puts the effect on this channel's queue for the next frame, once (the RUN_SCHEDULED bit of `effect.effectFlags` says whether it is there), sets the SOURCE_CHECK_OWED bit (`OIM_EFFECT_FLAG_SOURCE_CHECK_OWED`) and asks for a flush. Effects are made by `OIMEffectService.INSTANCE`, not here; `createEffect` calls this when the open batch already has writes and no frame is running, so an effect created inside a running frame is never queued |
+| `subscribeAfterEachFrame(channelSlot, handler)` | `TOIMDisposer` — after every frame, but still INSIDE the flush: a write from it is refused |
+| `subscribeOnceAfterFrame(channelSlot, handler)` | `TOIMDisposer` — the same phase, told **once**; see below |
+| `subscribeAfterEachFlush(channelSlot, handler)` | `TOIMDisposer` — told once the flush has FULLY ended: after the after-each-frame phase and after the unused-slot collector of the db is flushed. For what may live only one frame — `OIMBucketCommands` empties its render scripts here |
+| `isRefusingWrites(channelSlot)` | `boolean` — `channelSlot.isFlushing`; refusal is per channel |
+| `assertNotFlushing(channelSlot)` | `void` — throws if the channel is flushing or its frame is running, i.e. for the whole of a flush |
+| `write(channelSlot, slot)` | `void` — asks `assertNotFlushing`, then marks and queues |
+| `writeWithoutFlushCheck(channelSlot, slot)` | `void` — the same marking and queueing WITHOUT the guard, for a door that already refused. Who may call it is pinned by `tests/who-may-write-without-asking-the-channel.test.ts`; a caller not on that list fails the suite |
+| `openSubframe(channelSlot)` | `void` — a subframe opens, and the frame cannot close until it closes — `flush` throws meanwhile |
+| `closeSubframe(channelSlot)` | `void` — it closes, delivering what was listed for its close and then asking for the frame it owes |
+| `isSubframeOpen(channelSlot)` | `boolean` — whether a subframe is open right now, so a caller can defer work to its close instead of per write |
+| `listChangedStoreSlot(channelSlot, storeSlot, subframeCloseListener)` | `void` — list a store slot whose changes are delivered when the OUTERMOST subframe closes, by calling `subframeCloseListener.onStoreSlotSubframeClosed(storeSlot)`; see below |
+| `dropChannelSlot(channelSlot)` | `void` — kill the channel whole; see below |
+| `isChangedInCurrentFrame(channelSlot, slot)` | `boolean` — whether the slot was written after the last frame ended, i.e. in the frame being collected now; compares `slot.changedAtRevision`/`changedAtEpoch` with the clock reading the last frame closed at. `OIMBucketCommands` keeps a bucket's render script across a flush only while this is true |
+
+The channel slot's own fields that a caller reads: `frame` (`TOIMChannelFrame`, `{ isRunning, openedAtRevision,
+openedAtEpoch, … }`; a frame carries no number, the clock reading it opened at is its boundary), `clock`
+(`TOIMChannelClock`, the `{revision, epoch}` pair, shared by every channel of one db; an epoch holds
+`OIM_REVISIONS_PER_EPOCH` (2^30) revisions, so the counter stays a V8 small integer under pointer compression),
+`collectorSlot`, `errorPolicy`, `isFlushing`. Everything else on it is engine state.
+
+### A subscription hears only what happens after it
+
+`effectService.createEffect` is told about changes made **after** the call and about nothing
+before them. This holds for every kind of source — an entity slot, a column, a
+bucket, a computed — and a batch does not soften it: writes accumulate until
+`flush()`, and subscribing behind a write of the still-open batch is subscribing
+after it.
+
+```ts
+cardService.slotContentService.upsertEntity(cards, { id: 'a', title: 'A', rank: 1, deck: 'spades' });
+const entitySlot = cardService.getSlotByKey(cards, 'a');
+
+effectService.createEffect(db, [entitySlot], [], () => { /* NEVER runs for the upsert above */ });
+db.flush();
+
+// A first value is `createEffectImmediate`'s job, not `createEffect`'s:
+effectService.createEffectImmediate(db, [entitySlot], [], () => { paint(entitySlot.entity); });   // runs now
+```
+
+A later write in that same batch IS delivered — "after I subscribed" is decided
+by the revision (`clock.revision` advances on every write), not by the frame
+number, which is one number for the whole batch and cannot separate the two.
+
+### `subscribeOnceAfterFrame(channelSlot, handler)`
+
+Told after **one** frame — the first that ends after the call — and then gone.
+The place that asks decides which frame that is.
+
+```ts
+effectService.createEffect(db, [slot], [], () => {
+    paint(slot.entity);
+    // the tail of THIS frame, after every other effect of it
+    OIMChannelService.INSTANCE.subscribeOnceAfterFrame(channelSlot, () => { measureAndScroll(); });
+});
+```
+
+- **Registered from inside an effect body it runs in the tail of that very
+  frame**, after every other effect of it. The after-each-frame phase settles who
+  it owes when the phase *begins*, and the drain is before that — so a handler
+  added from the drain falls on the "owed" side. That is the whole reason the
+  method exists: a consumer whose work needs the **settled** screen (a
+  measurement, a scroll to an item that moved, a size written back) asks from
+  inside its effect and is answered at the end of that same frame.
+- Registered from the after-each-frame phase itself, it sits that frame out and
+  is told after the next one — the phase had already settled who it owed.
+- **It is not `subscribeAfterEachFrame` plus a disposal.** The effect runs again
+  next frame and registers again, so a standing handler accumulates one per run:
+  `tests/a-handler-that-wants-one-frame-and-not-every-frame.test.ts` measures the
+  one-shot at 1, 2, 3 calls over three frames against the standing handler's 1,
+  3, 6.
+- It comes off **before** its body runs, so a handler that throws is not left
+  standing for the next frame; the throw is reported by the frame that ran it.
+- One list, not two: it goes into the same set at the same phase, so one-shot and
+  standing handlers are called in registration order among each other.
+
+### `openSubframe(channelSlot)` / `closeSubframe(channelSlot)`
+
+A **frame** is everything delivered together: the writes collected since the
+last delivery, handed to effects and after-each-frame handlers in one go. A
+**subframe** is one logical change inside it — a write that has begun and not yet
+ended. **The frame cannot close while a subframe is open**, however many writes
+ask for one: the debt is recorded and paid by the `closeSubframe` that brings the
+count to zero. A subframe delivers nothing of its own; it only keeps the frame
+open.
+
+- **`flush()` throws while a subframe is open**, with a message containing
+  "a subframe is open": code a write runs (a `keyOf`, a content
+  listener) called `flush`, or the caller opened a subframe and has not closed it. Nothing is delivered and the write in progress stays whole; flush
+  after the write returns.
+- Counted, not a flag: a subframe is routinely inside another one, and the inner
+  close delivers nothing.
+- Not `assertNotFlushing` from the other side. That refuses a **write** made
+  while a frame closes; this refuses a **frame** asked for while a subframe is open.
+- A subframe is bigger than any single write, which is why the span is the
+  service's and not the writer's: a write moves the entity's columns and *then*
+  settles emptiness, which is what puts the entity slot into the index's
+  bucket. Under a synchronous scheduler that gap used to flush — an auto-index
+  settled over a bucket the entity slot had not joined yet, stamped itself past the
+  entity slot's revision, and the entity was invisible to that index forever with nothing
+  thrown.
+- `closeSubframe` is called from a `finally` by every opener, so a subframe that
+  threw part-way still closes and still delivers what it managed to write.
+- **The span belongs to the DOOR, and exactly one door opens it.** The entity content service's
+  `writeEntity`, `deleteEntity`, `deleteEntities`, `fillEntities`, `updateEntity` and `markEntityChanged` each
+  open one — except a write that is exactly one channel write, which opens none — one write cannot be seen
+  half-done, and there is nobody to batch for: `updateEntity`/`updateEntityColumn` and `deleteEntity` when
+  the store slot has no content listener, no column of the entity is referenced and emptiness is not
+  recomputed on a column write; the entity writer's `fillEntity`, `putEntity`, `patchEntity`, `deleteColumns`
+  and `clearEntity` open none. One `upsertEntity` therefore opens one span, and one `insertEntities` opens one
+  however many entities it carries. The one exception is the content strategy's `releaseSlotContent`, which
+  keeps its own: `releaseSlotIfUnheld` reaches it when a release deadline has passed, and that call arrives
+  from the release queue through no door at all — so a removal opens two and an eviction opens one.
+- Every write door of a content service is wrapped in the channel's `openSubframe` / `closeSubframe` on
+  `storeSlot.channelSlot`.
+- **Every bucket door wakes the bucket the same way.** Each door of a bucket content service that changed
+  the bucket — `addBucketMemberSlot(s)`, `removeBucketMemberSlot(s)`,
+  `insertBucketMemberSlotAt`, `removeBucketMemberSlotAt` / `…Range`, both moves,
+  `writeBucketMemberSlots`, `clearBucketMemberSlots` — lists the bucket's store slot on the channel
+  (`listChangedStoreSlot`) and sets the bucket's EMPTY flag there and then; the outermost `closeSubframe`
+  stamps each changed bucket once, tells its release policy `onSlotWritten` once, and only then asks
+  whether it may go. So `hasSlotContentByKey` answers right inside an open batch, a
+  batch that mixes doors stamps the bucket once, a move renews a write deadline,
+  and a door that changed nothing stamps nothing and tells the policy nothing.
+  Commands are still recorded at the door, because a position is true only when it
+  is written. A release asked for while the bucket has a pending change waits for
+  the close.
+- **A content listener that throws on one bucket does not strand the others.**
+  The close stamps every filed bucket and settles it before its listeners run,
+  goes on to the next bucket when one listener throws, and rethrows the first error
+  once every bucket is through — costing nothing when nothing throws.
+- **A released identity is refused before the bucket changes.** Every door that
+  takes a member — the add doors, the doors by key, `insertBucketMemberSlotAt`,
+  a whole-list `writeBucketMemberSlots`, and the fill of a minted bucket — checks what it was
+  handed with `oimIsSlotReleased` first and throws, so a refused door leaves the members,
+  their holds and the EMPTY flag exactly as they were. It costs one field read per
+  member handed in.
+
+### `isSubframeOpen(channelSlot)` / `listChangedStoreSlot(channelSlot, storeSlot, subframeCloseListener)`
+
+**What a batch does once instead of per entity.** A subframe is the unit a
+service can defer work to the end of: `listChangedStoreSlot` lists a store slot together with the
+`IOIMSubframeCloseListener` (`onStoreSlotSubframeClosed(storeSlot)`) that delivers its changes, and the
+outermost `closeSubframe` calls each listed listener with its store slot. `isSubframeOpen` says whether there
+is a subframe to defer into at all — with none, the caller does the work immediately.
+
+- **The drain runs before the count drops**, so a listener that writes is still inside the subframe and
+  still cannot close the frame. A store slot listed by a listener during the drain is picked up by the same
+  drain.
+- **Every listed entry runs.** A listener that throws loses its own work for that batch and nothing retries
+  it; the entries after it still run, the list is emptied, the count still drops, the frame the subframe
+  owed is still asked for, and then the FIRST throw leaves `closeSubframe`.
+- **What uses it**: the bucket content services. A join or a leave records the bucket slot on its store
+  slot's write queues and lists that store slot; the drain then writes the channel, settles emptiness and
+  asks `releaseSlotIfUnheld` **once per bucket per batch** rather than once per member. Filing 10 000 entity
+  slots into 100 buckets pays 100 of each tail instead of 10 000. Nothing is delivered before the flush either
+  way, so the two are behaviourally the same.
+
+### `dropChannelSlot(channelSlot)`
+
+Kills the whole channel on the caller's word that **nothing is subscribed to
+anything in it**. The engine does not verify that: checking would mean asking
+every slot whether its `effects` list is empty, which is exactly the walk the
+method exists to skip — the check IS the cost, which is what the suffix of its name says.
+
+```ts
+// every subscriber disposed, the screen is going away
+OIMChannelService.INSTANCE.dropChannelSlot(db.defaultChannelSlot);
+// drop your own references; every slot, store and derivation goes with them
+```
+
+- It empties the effect queue and the after-each-frame and after-each-flush handlers, cancels the scheduled
+  flush, sets the `dropped` flag, and returns. **Nothing walks a slot to ask who is subscribed to it** —
+  that is the walk the name refuses.
+- **It does flush the unused-slot collector**, which is the channel's own debt
+  and not a walk of your graph: every getter that minted an identity this frame
+  filed a hold there, and a flush was the only thing that ever gave those back. Since `flush` returns on the
+  flag, a drop that skipped this would pin every such identity for as long as the db's collector slot lives.
+  A drop made from INSIDE a flush leaves it to that flush, which still runs it.
+- The flag exists because `TOIMChannelScheduler` gives back no handle, so a frame asked
+  for before the call still arrives; `flush` returns on it.
+- **The flag is read in TWO places.** `flush` returns on it, and so does the
+  private `requestFlush` — which `write` reaches at the end of every
+  write that got past the per-frame coalescing guard with at least one dependent
+  to schedule, and which `scheduleEffectRun` reaches when
+  `OIMEffectService.INSTANCE.createEffect` finds a source that already moved in the open batch outside a running frame. A dropped channel therefore
+  stops asking its host for frames instead of arming a timer whose flush is
+  guaranteed to return on the flag.
+- **A write after the call is not refused, and it is not unnoticed either.** It
+  passes `assertNotFlushing`, advances the clock, stamps the slot and schedules
+  the dependents it finds — and then asks for no frame, so nothing it scheduled is
+  ever delivered. Do not read "not refused" as "still works".
+- Called with subscribers still standing, their bodies simply never run again —
+  no throw and no report. That is the bargain the name states.
+- There is no checked sibling. One would cost the walk this avoids; if a
+  diagnostic is ever wanted it ships under its own name, not as an option here.
+
+### Frame rules
+
+- **Delivery is coalesced per identity per frame.**
+- **Writes during a FLUSH throw — not just during the frame body:**
+  `OIMChannelService: writes are refused for the whole of a flush — onBeforeFlush and every after-each-frame handler included, …` and then tells you to write after `flush` returns.
+  `flush` raises `channelSlot.isFlushing` before `onBeforeFlush` and lowers it in its
+  `finally`; `assertNotFlushing` throws on `isFlushing` or `frame.isRunning`, so
+  all three phases are refused. Refusal is per channel: a flush of one db's channel does not refuse a
+  write to another db's.
+- **A refused write keeps its change pending — it is never dropped.** A bucket
+  carries a change `addBucketMemberSlots`/`removeBucketMemberSlots` recorded inside an outer open batch
+  until that batch closes. If something delivers it mid-flush — a member's
+  subscriber giving the list back, so `unholdSlot` reaches `releaseSlotIfUnheld` —
+  the write is refused and the bucket's store slot stays listed, so the next
+  subframe close delivers it.
+- **Each door asks once, then writes through `writeWithoutFlushCheck`.** A content service
+  door opens with `assertWritable`, which asks the channel, and every write it
+  makes after that asks nothing: the guard was three field reads and a branch
+  per write, and `upsertEntities` of 100 entities into one ordered bucket asked it 302
+  times where 201 of those were the door's own re-asking. The per-entity ask is NOT
+  removable and stays — user code runs inside a door (`keyOf`, `index.keyOf`,
+  `slotEmptiness.isEmpty`, an `IOIMEntityWriter`) and can call
+  `flush()`, so each entity is a new question. What went is the SECOND and THIRD ask
+  of the same entity.
+- **`flush` during a frame throws:** the message says a frame is already running, and a second one
+  inside it would end the first.
+- **`flush()` from the TAIL of a flush** (`onBeforeFlush`, an after-each-frame
+  handler, or anything either called) returns having done nothing. Not a
+  deferral: one flush spends exactly one frame however many handlers ask for
+  another.
+- **There is NO door that writes from inside a flush.** `subscribeAfterEachFrame`,
+  `subscribeOnceAfterFrame` and `onBeforeFlush` all run inside it. To write in
+  response to a change, write after `flush()` has returned — a tail handler
+  hands the work to a microtask or a later callback rather than writing itself.
+- A refusal raised from a tail handler does NOT reach the caller at the call: it
+  goes to the error policy like any handler throw — logged by default, or thrown
+  out of `flush()` under `OIMErrorPolicyThrowAtOnce`.
+- Effects are isolated under the default policy: a throw is logged and handed to
+  `onError`, and the frame finishes every other effect.
+- **A derivation is asked, never woken.** No frame walks to a computed slot.
+
+### Subscribing
+
+```ts
+const effect = effectService.createEffect(db, [slot], [], () => { paint(slot.entity); });
+effectService.disposeEffect(effect);
+```
+
+A `TOIMEffect` is a plain object with no methods; its behaviour lives in the stateless
+`OIMEffectService.INSTANCE`, which takes the channel map (`db`) on every create and files the effect on its
+`defaultChannelSlot` (`effect.channelSlot`). `createEffect` schedules the new effect when
+the current frame already has writes; it still never receives writes made before it was created.
+For a detached function, `effectService.subscribeEffect(db, roots, computeds, body)` creates the
+effect exactly as `createEffect` does and returns its `TOIMDisposer` — `disposers.push(…)` it,
+or return it from a React cleanup. `oimHoldSlots(slots)` takes one hold on each slot of a list,
+through its owner; to give back a list of holds taken around one write,
+`oimUnholdSlotsIfAlive(slots)` unholds each slot that was not released meanwhile.
+
+Two things about how an effect is filed:
+
+- **The derivation list is deduplicated.** Naming one computed slot twice in the
+  second argument gets it one edge, not two. Nothing is allocated for a list of one
+  or none, and a list that turns out to be distinct keeps the caller's array.
+- **`disposeEffect` unfiles by a remembered position, not by scanning.** Each effect
+  records where it sits in every list it is on; removal swaps in the tail and
+  tells the moved effect its new position. The
+  consequence a consumer can observe: **a slot's `effects` is not in
+  subscription order**, and it never was guaranteed to be.
+- **The moved effect is told by EDGE, not found by search.** Beside `effects` a slot
+  keeps `effectEdges` — for each effect, which of that effect's sources this slot
+  is — and the swap carries both, so the moved effect updates one number. Taking one
+  of two effects off the same N slots reads the other's source list ZERO times (a
+  search read it N(N+1)/2). Only the slot's owner writes either array.
+
+The body's type is `TOIMEffectBody = () => (() => void) | void`. **A returned
+function is the undo**: it is called before the next run of that body and by
+`disposeEffect`.
+
+```ts
+effectService.createEffect(db, [slot], [], () => {
+    const timer = setInterval(poll, 1000);
+    return () => clearInterval(timer);
+});
+```
+
+The return is checked with `typeof`, not for truthiness — `() => set.add(key)`
+hands back the `Set` — so anything that is not a function is discarded. The undo
+is cleared before it is called, so one that throws is not called again by the
+`disposeEffect` behind it.
+
+**Sources found at read: `createEffectWithSourceTracking(db, body)`.** The second way to build
+an effect takes no source lists. The body receives an `OIMEffectSourceTracker`, and what it
+reads through the tracker is what that run depends on — signal-style tracking.
+
+```ts signature
+createEffectWithSourceTracking(channelMap: IOIMChannelMap, body: TOIMEffectBodyWithSourceTracking): TOIMEffect;
+type TOIMEffectBodyWithSourceTracking = (effectSourceTracker: OIMEffectSourceTracker) => (() => void) | void;
+class OIMEffectSourceTracker {              // exported as a type; the service builds it
+    readSourceSlot<TSlot extends TOIMSlot>(slot: TSlot): TSlot;          // files the slot, returns it
+    readSourceComputedValue<TValue>(computedSlot: TOIMComputedSlot<TValue, unknown>): TValue; // files it, returns its value
+}
+```
+
+```ts
+const fallback = cardService.slotContentService.upsertEntity(cards, { id: 'c2', title: 'King', rank: 13, deck: 'hearts' });
+effectService.createEffectWithSourceTracking(db, effectSourceTracker => {
+    const isFirst = effectSourceTracker.readSourceSlot(slot).entity?.rank === 1;
+    paint(effectSourceTracker.readSourceSlot(isFirst ? slot : fallback).entity);
+});
+```
+
+- The body runs once at creation: that run is what finds the sources.
+- After every run the effect is subscribed to exactly what the run read: a branch not
+  taken is unsubscribed, a slot read twice is subscribed once.
+- A run that reads the same sources in the same order compares each read with the one
+  before and changes no subscription.
+- `createEffect` with declared sources is unchanged; the choice is made per effect, at
+  creation. A returned function is the undo, exactly as for `TOIMEffectBody`.
+
+```ts
+const onRank = effectService.createEffect(db, [cardService.holdColumn(slot, 'rank')], [], () => { paint(slot.entity); });
+```
+
+**A column effect takes the `TOIMColumnSlot` as a root, not a slot and a name.** Minting the
+column is the caller's call and it is a separate door, on the collection (or single) service:
+`service.holdColumn(slot, columnName)` mints and HOLDS (`service.unholdColumn(columnSlot)` gives it back),
+and `service.getColumn(slot, columnName)` mints and lets the db's unused-slot collector hold it until the end
+of the next flush. Every collection and single service has them (a single entity's doors take the slot its
+service hands back: `settingsService.getColumn(settingsService.getSingleSlot(settings), 'theme')`), and all go
+through the owner's column owner, which is stateless configuration built at construction; the column state —
+the column slots, the column groups, and which columns are referenced — lives on the store slot. Every
+service also has `getAnyColumn(slot)` / `holdAnyColumn(slot)`, a column slot that wakes on any column write to
+its carrier. An index store slot's buckets have the same doors on the index service, taking the bucket slot.
+`createEffect` returns the **effect**, not the column: a column holds no value; read `slot.entity[name]`.
+
+**The name is compile-time checked only as far as the service's column-name type goes** —
+`holdColumn` takes the service's `TColumnName`, which `createOIMEntityService` sets to
+`TOIMEntityColumnName<TEntity>`. `TOIMEntityColumnName<TEntity>` is the type that narrows a name to the
+entity's own columns, and `slotContentService.deleteEntityColumns` is typed on it.
+
+**A column group is one column slot for several columns.** `service.getColumnGroup(['rank', 'label'])`
+returns a `TOIMColumnGroup` — `{ key, columnNames }`, the names deduplicated and sorted, a fresh frozen object
+per call; get it once per view, not per entity. `service.holdColumnGroup(slot, columnGroup)` mints and holds
+the group's column slot on `slot`, and `service.unholdColumn(columnSlot)` gives it back. A write wakes it once
+if it changes any of the group's columns and not at all if it changes only others.
+
+**`columnNames` picks the column slot store.** `createOIMEntityService<TCard, 'rank' | 'label'>(db, { keyOf, columnNames: ['rank', 'label'] })`
+— and `columnNames` on any factory's options — files the service's column slots by ordinal: every named column
+gets a number, a group gets one at its first slot, and an entity slot's column slots sit in an array by
+number instead of a `Map` per entity slot, which is cheaper to create and give back. `holdColumn` and
+`getColumnGroup` are typed on those names, and a slot for any other column throws. Without `columnNames` the
+store is the `columnSlotStoreService` option, defaulting to the shared map-driven
+`OIMDefaults.COLUMN_SLOT_STORE_SERVICE.getValue()`, and any name is accepted.
+
+---
+
+## `OIMDB` and the three doors
+
+```ts signature
+new OIMDB(options?: TOIMDBOptions)   // see the runtime section for the option list
+```
+
+It owns the shared `clock`, one `collectorSlot` and one `defaultChannelSlot`, all public, and
+holds `entityWriter`, `slotStamp`, `slotReleasePolicy` and `indexKeysService` as the
+defaults every factory reads — `undefined` when not named. **It builds no service**, and `flush()` is its
+only method: `OIMChannelService.INSTANCE.flush(db.defaultChannelSlot)`, which flushes the db's unused-slot
+collector slot once the frame is delivered. `OIMDB` implements `IOIMChannelMap`
+(`{ readonly defaultChannelSlot }`), so every door typed `channelMap: IOIMChannelMap` takes the db.
+
+**There is no default scheduler, on purpose — do not add one and do not generate
+code that wraps every write in `flush()`.** A test calls `db.flush()` itself. An
+application hands it to its orchestrator: with cnstra the whole wiring is
+`cns.addDrainListener(() => db.flush())`, which runs at the end of every synchronous
+turn of every stimulation. Each turn becomes one frame; an `await` inside a neuron
+ends a turn, so a request delivers its loading state first and its data in a later
+frame, with no further code. Every mutation goes through a domain neuron — a write
+from outside the orchestrator is the mistake, not a case to cover with a fallback.
+Full page: `website/docs/guides/with-cnstra.md`.
+
+The doors are free functions, one module each, so a consumer ships only the one they import. The entity,
+bucket and index factories take `db` first and ONE options object second (optional on the bucket doors); the
+base collection factories and the computed factories take only the options object. Each builds a SERVICE,
+once per collection type; the store slot is made separately:
+
+| Door | Builds | Store slot |
+|---|---|---|
+| `createOIMSlotContentEntityService(db, { keyOf, entityWriter?, slotEmptiness?, slotStoreService?, slotReleasePolicy?, columnSlotStoreService? \| columnNames? })` | `OIMSlotContentEntityService<TEntity, TKey, TStore, TColumnName>`, the entity content service with its slot owner; `slotStoreService` defaults to a Map store for a key and is REQUIRED for any other store (a tree store, or `OIMSlotStoreServiceSingleSlotDriven` for a single, which takes no `keyOf`) | — |
+| `createOIMSlotCollectionService({ slotContentService })` | `OIMSlotCollectionService` over an entity content service: the read doors and the column doors | `createStoreSlot(db)` |
+| `createOIMSingleSlotService({ slotContentService })` | `OIMSingleSlotService` over a single entity content service | `createStoreSlot(db)` |
+| `createOIMEntityService(db, { keyOf, entityWriter?, slotEmptiness?, slotReleasePolicy?, columnSlotStoreService? \| columnNames? })` | convenience wrapper: the two calls above for a Map store; `TColumnName` is `TOIMEntityColumnName<TEntity>` | `createStoreSlot(db)` |
+| `createOIMSingleEntityService(db, { … }?)` | convenience wrapper for a single entity | `createStoreSlot(db)` |
+| `createOIMBucketService<TBucketMemberSlot, TKey?, TSlots?, TSlotContentService?, TStore?>(db, { slotContentService?, bucketSlotStoreService?, maxCommandsPerSlot?, slotReleasePolicy?, columnSlotStoreService? \| columnNames? }?)` | `OIMSlotCollectionService` of bucket slots; `slotContentService` defaults to an `OIMSlotContentBucketServiceArrayDriven` that records `OIMBucketCommands` (`maxCommandsPerSlot` caps it). An array `TKey` makes `bucketSlotStoreService` REQUIRED by type — pass `OIMSlotStoreServiceTreeDriven`, since a Map store compares arrays by reference | `createStoreSlot(db)` |
+| `createOIMSingleBucketService(db, { … }?)` | `OIMSingleSlotService` of one bucket slot | `createStoreSlot(db)` |
+| `createOIMIndexService(db, { entityService, columns? \| keyOf?, slotContentService?, slotReleasePolicy?, columnSlotStoreService? \| columnNames? })` | `OIMIndexService`, over the entity collection service whose store slots it will index (it takes a `Pick` of `getSlots`); `slotContentService` defaults to array-driven, pass `new OIMSlotContentBucketServiceSetDriven()` for an unordered one. Generics `<TEntity, TSourceKey, const TColumns, TKey extends TOIMStoreKey>`: a scalar key, inferred from ONE inline column or from `keyOf`'s return | `createIndexStoreSlot(entityStoreSlot)` |
+| `createOIMIndexServiceSortedArrayDriven(db, { entityService, columns? \| keyOf?, sortColumns, … })` | `OIMIndexServiceSortedArrayDriven`: the index whose buckets are kept in the order of `sortColumns` (`readonly TOIMSortColumn<TEntity>[]`, required) through an `OIMSlotContentBucketServiceSortedArrayDriven`. See [Sorted at write](#sorted-at-write) | `createIndexStoreSlot(entityStoreSlot)` |
+| `createOIMIndexServiceByCompositeKey(db, { entityService, columns? \| keyOf?, … })` | convenience wrapper: the index keyed by an array, `TKey extends readonly TOIMStoreKey[]`, inferred as a tuple from two or more inline columns or from an array-returning `keyOf`, over a tree store | `createIndexStoreSlot(entityStoreSlot)` |
+| `createOIMComputedService({ createSources?, derive?, sameValueGuard?, initialValue?, slotReleasePolicy?, computedSlotStoreService?, columnSlotStoreService?, columnNames? })` | `OIMComputedService<TKey, TValue, TComputedStore>`; its reads are on `computedService.computedCollectionService`; `derive` and `createSources` may instead be given per store slot; `computedSlotStoreService` is REQUIRED for a non-Map store (a single: `OIMSlotStoreServiceSingleSlotDriven`); see [One derivation per key](#one-derivation-per-key) | `createComputedStoreSlot(db, derive?, createSources?)` |
+| `createOIMComputedServiceSorted({ indexService, sortColumns?, comparator?, slotReleasePolicy?, columnSlotStoreService?, computedSlotStoreService? })` | `OIMComputedServiceSorted` — per key, the entity slots of the index bucket under that key, sorted; see [Sorted lists](#sorted-lists) | `createSortedStoreSlot(indexStoreSlot)` |
+| `createOIMComputedServiceBucketMemo({ bucketCollectionService, slotReleasePolicy?, columnSlotStoreService?, computedSlotStoreService? })` | `OIMComputedServiceBucketMemo` — per key, the bucket's slots as one array; see [The order of a bucket](#the-order-of-a-bucket-as-one-derivation-per-key) | `createBucketMemoStoreSlot(bucketStoreSlot)` |
+
+`entityWriter` and `slotReleasePolicy` on these doors default to the
+db's, so naming one overrides it for that service alone.
+
+**A DOOR ALWAYS PASSES; IT NEVER LETS A CLASS REACH FOR A GLOBAL.** Every option
+a service would otherwise answer with `?? OIMDefaults.x` is in the object its
+door hands it, so there is one answer to each question and not two. Pinned in
+`src/factories/tests/which-answer-a-collection-the-root-mints-gets.test.ts`,
+which also fails when an option arrives on a service and is not forwarded,
+when the root mints anything but the channel and the collector, or when a public
+member appears on the root that is not one of the seven it owns.
+
+**`createOIMBucketService` with no content service is the door for a list whose order is yours.** It builds
+an `OIMSlotContentBucketServiceArrayDriven` — insertion order, never re-decided — that records an
+`OIMBucketCommands` script per bucket. The recorder holds no subscription: it lists store slots on the channel
+slot, and the script lives for one frame.
+
+```ts
+const freshPageService = createOIMBucketService<TOIMEntitySlot<Card>>(db);
+const freshPage = freshPageService.createStoreSlot(db);
+const freshBucketSlot = freshPageService.holdSlotByKey(freshPage, 'page-1');
+// freshBucketSlot.commands and freshBucketSlot.isWholeListRecorded carry the script; read them in an effect on the bucket slot
+```
+
+---
+
+## `OIMDefaults` — where an optional dependency comes from
+
+Every optional property of the factories falls back to an entry
+on `OIMDefaults`. It is a class of static `OIMDefaultValue` fields and nothing else — never
+construct one, never subclass it.
+
+| Accessor | Type | What it hands back |
+|---|---|---|
+| `OIMDefaults.COLUMN_SLOT_STORE_SERVICE` | `IOIMSlotStoreService<string, TOIMColumnSlot>` | a map-driven store service for column slots; the factories pass it to every service they build without `columnNames` |
+| `OIMDefaults.COMPUTED_COLUMN_SLOT_STORE_SERVICE` | `IOIMSlotStoreService<string, TOIMComputedColumnSlot>` | a map-driven store service for the column slots of computed services, keyed or single; the computed factories pass it to every one they build without `columnNames` |
+| `OIMDefaults.INDEX_KEYS_SERVICE` | `IOIMIndexKeysService` | `OIMIndexKeysServiceAppending`; the factories pass it when `db.indexKeysService` is not set |
+| `OIMDefaults.KEY_TREE_WALK_SCALAR` | `OIMKeyTreeWalkScalar` | the chain-of-values walk |
+| `OIMDefaults.KEY_TREE_WALK_COMPOSITE` | `OIMKeyTreeWalkComposite` | the chain-of-identities walk |
+| `OIMDefaults.STANDALONE_SLOT_OWNER` | `OIMSlotOwner` | the owner of a slot nobody filed |
+| `OIMDefaults.ENTITY_WRITER` | `IOIMEntityWriter` | `createOIMEntityWriterInPlace()` |
+| `OIMDefaults.ENTITY_SLOT_EMPTINESS` | `IOIMSlotEmptiness<TOIMEntitySlot>` | "empty means `slot.entity === undefined`" |
+| `OIMDefaults.STORE_SLOT_LISTENER` | `IOIMStoreSlotListener` | `OIMStoreSlotListenerNone`: hears nothing. Not a constructor option: every service reads it when it is built and calls `onStoreSlotCreated(storeSlot)` for each store slot it creates. A tool that wants to see every store slot sets its own with `setValue` before the first service is built; once one has been built, `setValue` throws |
+
+**NOTHING IS CONSTRUCTED AT MODULE LOAD.** Every entry is an `OIMDefaultValue`
+whose `getValue()` mints on its first call (`??=`) and hands the same instance back
+for the rest of the process. A consumer that never reaches for a key tree walk never
+builds one.
+
+Each has a matching `setValue(value)`, which is how a process replaces a default
+everywhere at once:
+
+```ts
+OIMDefaults.ENTITY_WRITER.setValue(createOIMEntityWriterReplacing());
+```
+
+**`setValue` THROWS ONCE `getValue` HAS HANDED THE FIRST ONE OUT.** `getValue`
+marks the entry as handed out; `setValue` refuses after that, by name —
+`OIMDefaults.ENTITY_WRITER has already been handed out, and whoever took it keeps
+it …`, the name in the message being the field's upper-case name. Whoever took it keeps
+it, so replacing it then would leave two implementations live in one process,
+the older one inside every object built before the call, and the second half of
+the program would disagree with the first about what a write does.
+
+Setting it before anything reads it works, and so does setting it twice before
+the first read. Each property is tracked on its own, so calling
+`OIMDefaults.COLUMN_SLOT_STORE_SERVICE.getValue()` does not close
+`OIMDefaults.KEY_TREE_WALK_SCALAR`. **Set every default you intend to replace at
+startup**, before you construct an `OIMDB` or a service. Pinned by
+`packages/core/src/factories/tests/what-a-default-replaced-too-late-does.test.ts`.
+
+**Each default is its own module, so reaching one retains only its arm.** Every
+default lives in its own file under `packages/core/src/factories/defaults/` with its
+own `OIMDefaultValue`; a service reads the modules it needs and
+neither key tree walk enters its bundle. `OIMDefaults` itself delegates to all of
+them, so importing `OIMDefaults` retains every arm.
+`packages/core/tests/what-an-import-retains.test.ts` pins it — *"a default is one
+door to its own arm, and the defaults class to all of them"*.
+
+---
+
+## Entity services
+
+**An entity collection is two objects: the content service and the collection service.** The entity content
+service (`OIMSlotContentEntityService`) is the writes and reads of entities, built once per collection type
+with its slot owner; the collection service (`OIMSlotCollectionService`) over it is the read and column doors.
+Neither holds an entity: each `createStoreSlot(db)` is one instance of that type's store.
+
+```ts signature
+createOIMSlotContentEntityService<TEntity, TColumnName?, TKey?, TStore?>(db, {
+    keyOf: (entity: TEntity) => TKey;                                  // REQUIRED for a key; absent for a single
+    entityWriter?: IOIMEntityWriter;                                   // db.entityWriter, then OIMDefaults.ENTITY_WRITER
+    slotEmptiness?: IOIMSlotEmptiness<TOIMEntitySlot<TEntity, TKey>>;  // OIMDefaults.ENTITY_SLOT_EMPTINESS
+    slotStoreService?: IOIMSlotStoreService<TKey, TOIMEntitySlot<TEntity, TKey>, TStore>; // Map; REQUIRED for any other store
+                                                                       // and for a single (OIMSlotStoreServiceSingleSlotDriven)
+    slotReleasePolicy?: IOIMSlotReleasePolicy;                         // db.slotReleasePolicy, then OIMSlotReleasePolicyAtEmpty
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>; // OIMDefaults.COLUMN_SLOT_STORE_SERVICE
+    columnNames?: readonly TColumnName[];                              // the ordinal column store over those names
+}): OIMSlotContentEntityService<TEntity, TKey, TStore, TColumnName>
+
+createOIMSlotCollectionService({ slotContentService }): OIMSlotCollectionService<TKey, TOIMEntitySlot<TEntity, TKey>, TStore, …>
+collectionService.createStoreSlot(db): TOIMStoreSlot<TStore, TOIMEntitySlot<TEntity, TKey>, Partial<TEntity>>
+
+createOIMEntityService<TEntity, TColumnName?, TKey?>(db, { keyOf, … })   // convenience: both calls, Map store
+```
+
+**Each collection type has its own column owner.** It is stateless configuration built with the slot owner
+over `columnSlotStoreService` (or the ordinal store `columnNames` names); the column state — the column slots,
+the column groups, and which columns are referenced — lives on the store slot. The doors are on the
+collection service (`getColumn`, `holdColumn`, `unholdColumn`, `getColumnGroup`, `holdColumnGroup`,
+`getAnyColumn`, `holdAnyColumn`). The column owner has two strategies, chosen by the factory: write-driven
+column slots, woken by the marks a write makes (`OIMColumnOwnerPushDriven`, entities and buckets), and
+derive-driven column slots, each a computed slot over its carrier (`OIMColumnOwnerPullDriven`, computeds).
+
+Example, over the `db`, `cardService`, `cards` and `slot` of the setup block:
+
+```ts
+const effect = effectService.createEffect(db, [slot], [], () => { console.log(slot.entity?.title); });
+cardService.slotContentService.updateEntity(slot, { title: 'Ace of Spades' });
+db.flush();
+effectService.disposeEffect(effect);
+```
+
+Assembled from the base layer, which is what `createOIMEntityService` does:
+
+```ts
+const baseCardService = createOIMSlotCollectionService({
+    slotContentService: createOIMSlotContentEntityService<Card>(db, { keyOf: (card) => card.id }),
+});
+const baseCards = baseCardService.createStoreSlot(db);
+```
+
+The writer is omitted because the db and `OIMDefaults` supply it, and so is the column store. The slot stamp
+is not an option of the content service: it is `new OIMDB({ slotStamp })`, for every collection of that db.
+
+### Public properties
+
+| Property | Of | Type |
+|---|---|---|
+| `slotContentService` | the collection service | the content service: the write doors |
+| `keyOf` | the entity content service | `(entity: TEntity) => TKey` |
+| `slotOwner` | the entity content service | `IOIMSlotOwner` — the owner of every slot the collection type files |
+| `slotStoreService` | the entity content service | the store service |
+
+A store slot is not a slot, so nothing holds, subscribes or wakes it: there is no
+`effectService.createEffect(db, [cards], …)` that hears the population. "Something in this population changed" is an
+index over the store slot and a subscription to its bucket — the bucket's door
+is written when an entity slot joins or leaves it — or a content-change listener on the store slot
+(`OIMContentChangeListenerService.INSTANCE.addContentChangeListener(storeSlot, listener, readColumnNames)`,
+removed by the same listener object). The slot owner is what `slot.owner` points at for every slot the type
+filed, in every one of its store slots; `slot.storeSlot` names which store slot.
+
+**THERE IS NO DOOR THAT HANDS BACK "THE ENTITY SLOTS THAT HOLD A VALUE".** A store slot
+keeps no bucket of its own. To read the whole population, walk `getSlots(storeSlot)` — every
+slot filed in that store slot, in store order — and skip the ones whose
+`oimIsSlotEmpty` says they hold nothing:
+
+```ts
+cardService.getSlotCount(cards);                     // how many ids are filed, empty ones included
+for (const filedSlot of cardService.getSlots(cards)) {
+    if (oimIsSlotEmpty(filedSlot)) continue;
+    paint(filedSlot.entity);
+}
+```
+
+To have that answer MAINTAINED and subscribable instead of walked, declare an
+index keyed on the entity's own id (`keyOf: card => card.id`) and hold the key
+you want. An index's bucket is an injected lifetime — a
+`slotReleasePolicy` — so it is the consumer who says how long the
+answer outlives its last reader.
+
+An index maintains buckets only while they are held, filing entity slots from the source
+store slot on every write by the entity's key value. The bucket is created on first
+`holdSlotByKey` by walking the source store slot's slots once, and released on the last give-back.
+
+**`holdColumn(slot, columnName)`** is on the collection service and takes a hold on a column slot;
+`service.unholdColumn(columnSlot)` gives that hold back. **`service.getColumn(slot, columnName)`**
+returns the same column slot without a hold: a column slot it mints is held by the
+unused-slot collector until the end of the next flush, so `getColumn` is
+the door that does not hold but tracks. `slotContentService.findEntityByKey(storeSlot, key)` reads the entity
+itself through the store lookup `findSlotByKey` runs, so it mints nothing: a miss answers `undefined`
+and leaves no slot behind.
+
+### The doors every service has
+
+**The read doors are the collection service's and take the store slot first; the write doors are the content
+service's.** Every collection service (entity, bucket, index, and a computed's `computedCollectionService`) has
+the read doors below; a single slot service has `getSingleSlot` / `holdSingleSlot` / `findSingleSlot` /
+`hasSingleSlotContent` in their place.
+
+```ts signature
+class OIMSlotCollectionService<TKey, TSlot, TStore, TSlotContentService, TColumnName, …> {
+    readonly slotContentService: TSlotContentService;
+    createStoreSlot(channelMap: IOIMChannelMap): TOIMStoreSlot<TStore, TSlot, TPatch>;
+    createStoreSlotFrom(sourceStoreSlot: TOIMStoreSlot): TOIMStoreSlot<TStore, TSlot, TPatch>;
+    findSlotByKey(storeSlot, key): TSlot | undefined;
+    hasSlotContentByKey(storeSlot, key): boolean;
+    getSlotByKey(storeSlot, key): TSlot;
+    holdSlotByKey(storeSlot, key): TSlot;
+    getSlots(storeSlot): IterableIterator<TSlot>;
+    getSlotCount(storeSlot): number;
+    isSameKey(key, otherKey): boolean;
+    getColumn / holdColumn / getAnyColumn / holdAnyColumn / getColumnGroup / holdColumnGroup / unholdColumn;
+}
+```
+
+| Door | Of | Signature | Mints? |
+|---|---|---|---|
+| `getSlotCount(storeSlot)` | collection | `number` | no |
+| `getSlots(storeSlot)` | collection | `IterableIterator<TSlot>` | no |
+| `findSlotByKey(storeSlot, key)` | collection | `TSlot \| undefined` — the store lookup alone; takes no hold and leaves nothing tracked | no |
+| `getSlotByKey(storeSlot, key)` | collection | `TSlot` — never `undefined`; minted if missing, then tracked by the unused-slot collector | **yes** |
+| `holdSlotByKey(storeSlot, key)` | collection | `TSlot` — minted if missing, `holdCount` up by one | **yes** |
+| `hasSlotContentByKey(storeSlot, key)` | collection | `boolean` — **does this key have content right now**, not whether an identity is filed under it: a slot a read or a hold minted and nobody wrote answers `false`. It hands back no slot, which is why it can answer without minting, and it is not a read: the answer is about the past the moment it returns | no |
+| `isSameKey(key, otherKey)` | collection | `boolean` — whether two keys name one slot here, answered by the store service (SameValueZero for a Map store, part by part for a tree store) | no |
+| `insertEntity(storeSlot, key, entity, changed?)` | entity content | `TOIMEntitySlot` — **total; always the identity it resolved or minted** | **yes** |
+| `upsertEntity(storeSlot, entity, changed?)` / `upsertEntities(storeSlot, entities, changed?)` | entity content | the slot(s) — `insertEntity` under `keyOf(entity)` | **yes** |
+| `writeEntity(slot, entity)` / `writeBucketMemberSlots(bucketSlot, members)` | content | `boolean` — on a slot you already hold; the boolean is about the CONTENT | no |
+| `deleteEntity(slot)` / `deleteEntities(storeSlot, slots)` / `clearBucketMemberSlots(bucketSlot)` | content | `void` — it takes the value, not the identity | no |
+| `clearAllEntities(storeSlot)` | entity content | `void` — clears every slot filed in that store slot | no |
+| `markContentChanged(bucketSlot)` | bucket content | `void` — re-settle emptiness and re-ask the guard after a write you made another way; the entity counterpart is `markEntityChanged(slot, changedColumns?)` | no |
+| `fillEntities(storeSlot, keys, entities)` / `insertEntities(storeSlot, entities)` | entity content | `void` — a bulk load of new keys; hands out no reference. On a key that is already filed or named twice it throws and rolls back only the entities this call filed; `fillEntities` also requires an empty store slot, and throws on lists of different lengths | yes |
+| `slot.owner.holdSlot(slot)` / `slot.owner.unholdSlot(slot)` | `void` — the `IOIMSlotOwner` pair; `unholdSlot` on an unheld slot throws by name | no |
+| `slot.owner.releaseSlotIfUnheld(slot)` | `void` — run the release guard; it releases nothing unless the slot is unheld, unreferenced, still owned here and out of grace | no |
+
+**`releaseSlotIfUnheld` is PUBLIC and it is still not a "release" door.** It is public because the release queue calls it through
+`slot.owner`, and it is a guard, not a command: on a held, referenced, foreign-
+owned or in-grace slot it returns having done nothing, and on an
+already-released one it returns silently rather than throwing.
+
+**`insertEntity` does not file a key whose content is refused.** On a MISS it
+mints, writes inside a `try`, and on a throw runs the release guard on what it
+just minted before re-raising — so the caller's error is the only thing that
+leaves. Every path still runs `closeSubframe` from a `finally`. The HIT path looks
+the key up first and never mints, so a refused write on an existing key leaves
+that key exactly as it was.
+
+**REFUSED IS NOT UNCHANGED**, and the two get opposite answers:
+
+| | What happened | What the caller gets |
+|---|---|---|
+| **Refused** | The write threw; **no content ever arrived** | The throw. A key minted for it is unwound — `insertEntity` files nothing |
+| **Unchanged** | The write **did** happen and the content was already there | The identity, like any other write. Nothing is unwound |
+
+`insertEntity` is **total**: whatever it decides about the content, it hands back
+the identity it resolved or minted. A door that mints must leave a reference
+behind, which is the one test that admits a door at all.
+
+`fillEntities` is the companion and does not carry the rule: it returns `void` and hands
+out no reference at all.
+
+**`changed?` — the verdict, into an array you own.**
+
+```ts
+const changed: TOIMEntitySlot<Card, TOIMStoreKey>[] = [];
+cardService.slotContentService.insertEntity(cards, 'c1', { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' }, changed);   // pushed exactly when the content differed
+```
+
+- **Optional, yours, and appended to** — never read by the engine, never cleared.
+  The slot is pushed exactly when the write put in content different from what
+  the slot held.
+- A batch therefore comes out of one loop as the list of entity slots that **actually
+  changed**, which is what a consumer owning a bucket this engine does not
+  maintain needs.
+- It is an out-parameter and not a return because the return is spoken for (see
+  above), and a `{ slot, changed }` record would allocate once per write on the
+  path this exists to make cheaper. What it costs a caller who does not want it
+  is one `undefined` compare per write.
+
+---
+
+## Writing
+
+Every write door is on the entity content service, `service.slotContentService`. A store door takes the store
+slot first; a slot door takes the slot alone. There are no by-key write doors: resolve the slot with
+`getSlotByKey` / `findSlotByKey` and write through it.
+
+| Call | Signature |
+|---|---|
+| `upsertEntity(storeSlot, entity, changedEntitySlots?)` | `(storeSlot, TEntity, TOIMEntitySlot<TEntity, TKey>[]?) => TOIMEntitySlot<TEntity, TKey>` — **total** |
+| `upsertEntities(storeSlot, entities, changedEntitySlots?)` | `(storeSlot, readonly TEntity[], TOIMEntitySlot<TEntity, TKey>[]?) => TOIMEntitySlot<TEntity, TKey>[]` — the slot of EVERY entity, in input order, whether or not its write changed anything |
+| `insertEntity(storeSlot, key, entity, changedEntitySlots?)` | `(storeSlot, TKey, TEntity, TOIMEntitySlot<TEntity, TKey>[]?) => TOIMEntitySlot<TEntity, TKey>` — **total**, under a key you name |
+| `insertEntities(storeSlot, entities)` | `(storeSlot, readonly TEntity[]) => void` — a bulk load of NEW keys. A key already filed, or named twice in the list, throws and rolls back only the entities this call filed; what was in the store slot before stays. No `changed` — a bulk load changes every entity |
+| `fillEntities(storeSlot, keys, entities)` | `(storeSlot, readonly TKey[], readonly TEntity[]) => void` — the same under keys you name, with the same rollback; it also **throws unless the store slot is empty** |
+| `updateEntity(slot, patch)` | `(slot, Partial<TEntity>) => slot` |
+| `updateEntityColumn(slot, columnName, value)` | `<C extends keyof TEntity & string>(slot, C, TEntity[C]) => slot` — one column, no patch object and no walk over it |
+| `deleteEntity(slot)` | `(slot) => void` |
+| `deleteEntities(storeSlot, slots)` | the batch form — one subframe for the whole batch, so the store slot is written to the channel ONCE for the batch, not once per entity (`upsertEntities` and `insertEntities` are the same) |
+| `clearAllEntities(storeSlot)` | `(storeSlot) => void` — clears every filed slot inside one subframe, so the whole clear is one frame, not one per slot |
+| `markEntityChanged(slot, changedColumns?)` | `(TOIMEntitySlot<TEntity, TKey>, readonly (keyof TEntity & string)[]?) => void` |
+| `deleteEntityColumns(slot, columnNames)` | `(slot, readonly TOIMEntityColumnName<TEntity>[]) => slot` — the named columns go |
+| `writeEntity(slot, entity)` | `(slot, TEntity) => boolean` — the whole value onto a slot you hold; columns it had and `entity` does not, go |
+| `findEntityByKey(storeSlot, key)` | `(storeSlot, TKey) => TEntity \| undefined` — the entity alone; mints nothing |
+
+- **The store keeps your object by default.** Under the default `oimInsertEntityWithoutCopy` the
+  slot holds the object you hand in, so with the in-place writer a later update edits that
+  same object; pass `entityInsertStrategy: oimInsertEntityWithCopy` to store `{ ...entity }`
+  and leave your object untouched. After an insert, change the object only through the
+  content service (`updateEntity`, or `markEntityChanged` after a hand edit): editing it and calling
+  `upsertEntity` with the same object again wakes nobody, because no column reads as changed. `oimInsertEntityWithSanitizedCopy` also removes an own
+  `__proto__` key: pick it for untrusted JSON.
+- `updateEntity` takes a **patch** — named columns move, unnamed ones stay.
+  `insertEntity`, `upsertEntity` and `writeEntity` take a **whole value**, and a column the new value does not name
+  is removed from the entity.
+- A write that moves no column wakes nobody.
+- **`upsertEntity` always hands back the slot**, whatever the write changed — see the
+  rule on `insertEntity`; this door is that one plus `keyOf`.
+- **`changedEntitySlots?` is the same array on both**: optional, yours, appended with the
+  entity slots whose content was different from what they already held. One array reused
+  across a whole `upsertEntities` batch is the intended use, so a
+  pass over its slots costs the entities that changed rather than the entities that
+  arrived. It is never cleared — you empty it.
+
+```ts
+const changed: TOIMEntitySlot<Card, TOIMStoreKey>[] = [];
+cardService.slotContentService.upsertEntities(cards, payload, changed);
+for (const slot of changed) reindex(slot);   // the re-sent entities are not in here
+changed.length = 0;
+```
+
+### `markEntityChanged` — you mutated the entity yourself, now say so
+
+```ts signature
+markEntityChanged(
+    slot: TOIMEntitySlot<TEntity, TKey>,
+    changedColumns?: readonly (keyof TEntity & string)[],
+): void
+```
+
+Every other write door computes what moved: the writer walks the patch
+(`oimPatchEntityColumns`, `oimPutEntityColumns`) and puts each value through `sameValueGuard`. A caller who edited the stored object by hand
+already knows the answer, and this door takes it instead of recomputing it — no
+patch object, no copy, no per-column comparison. The shape is: mutate
+`slot.entity`, then report it.
+
+```ts
+slot.entity!.title = 'two';
+cardService.slotContentService.markEntityChanged(slot, ['title']);
+```
+
+- **The hand mutation already compiles.** `TOIMEntitySlot` declares
+  `readonly entity: TEntity | undefined`, and `readonly` forbids REPLACING the
+  object, not writing its columns — `entity.title = 'two'` needs no cast, only
+  the usual narrowing of `| undefined`. `TOIMSlotEditable<TSlot>` is what strips
+  `readonly` from the field itself, which is what assigning `slot.entity` needs.
+- **With a list, only the named columns wake. Without it, every watched column
+  does** — the column owner walks the slot's whole column store, and a
+  column slot exists there only while something holds it or subscribes to it
+  (the slot owner drops it otherwise, in `releaseSlotIfUnheld`), so "watched" is exactly
+  what the store holds. **Pass the list.** The no-argument form is the convenient
+  one and it gives back the per-column walk this door exists to skip.
+- **An empty list wakes nothing at all** — not the columns, not the entity slot, not the
+  store slot's listeners. `[]` is the caller saying nothing moved, so it returns before the
+  subframe opens: a write that changes nothing wakes nobody here too.
+- **With either of the other two it wakes the entity slot and the store slot's content-change listeners**, so an
+  effect on the slot itself and an index over the store slot both see a hand mutation.
+- **It re-stamps emptiness** whenever emptiness can depend on the mutation — with no column list,
+  on a slot whose `entity` is `undefined`, and on a content service with a `slotEmptiness` other than
+  `OIMSlotEmptinessByEntityPresence.INSTANCE`, a release policy that releases written slots, or a db with a
+  `slotStamp` — so a hand mutation that emptied the entity leaves `oimIsSlotEmpty(slot)`
+  true rather than lying, and the release guard can take the identity when it should.
+- **It refuses inside a frame**, through the same `assertWritable` →
+  `OIMChannelService.INSTANCE.assertNotFlushing(channelSlot)` as every other write, and throws on a released
+  identity.
+- **The column names are type-checked**: `keyof TEntity & string` rejects a
+  misspelt name, a bare runtime `string`, and a slot of another entity type.
+
+---
+
+## Write strategies
+
+A **writer** is the operations that move an entity's columns, and nothing
+else: it reaches no channel, takes no holds and knows nothing about lifetime.
+Both strategies ship as factories; the fork is chosen once, as the content service's `entityWriter`
+(or for every collection of a db, `new OIMDB({ entityWriter })`).
+
+```ts signature
+interface IOIMEntityWriter {
+    readonly fillEntity: (slot: TOIMEntitySlot, entity: object) => void;
+    readonly putEntity: (slot: TOIMEntitySlot, entity: object, changedColumnNames: string[] | undefined) => boolean;
+    readonly patchEntity: (slot: TOIMEntitySlot, patch: object, changedColumnNames: string[] | undefined) => boolean;
+    readonly patchColumn: (
+        slot: TOIMEntitySlot, columnName: string, value: unknown, changedColumnNames: string[] | undefined,
+    ) => boolean;
+    readonly deleteColumns: (slot: TOIMEntitySlot, names: readonly string[]) => readonly string[];
+    readonly clearEntity: (slot: TOIMEntitySlot) => void;
+}
+
+type TOIMEntityWriterOptions = {
+    sameValueGuard?: TOIMSameValueGuard;
+    entityInsertStrategy?: TOIMEntityInsertStrategy;
+    putEntityColumns?: typeof oimPutEntityColumns;      // oimPutEntityColumns | oimPutEntityColumnsGuarded
+    patchEntityColumns?: typeof oimPatchEntityColumns;  // oimPatchEntityColumns | oimPatchEntityColumnsGuarded
+    patchEntityColumn?: typeof oimPatchEntityColumn;    // oimPatchEntityColumn | oimPatchEntityColumnGuarded
+};
+
+createOIMEntityWriterInPlace(options?: TOIMEntityWriterOptions): IOIMEntityWriter    // stored object keeps its identity
+createOIMEntityWriterReplacing(options?: TOIMEntityWriterOptions): IOIMEntityWriter  // a new object per write that changed something
+```
+
+`entityInsertStrategy` is the first-write strategy: `oimInsertEntityWithoutCopy` (the default) stores
+your object itself, `oimInsertEntityWithCopy` stores `{ ...entity }`, `oimInsertEntityWithSanitizedCopy`
+stores a copy with an own `__proto__` key removed (for untrusted JSON).
+
+`deleteColumns` hands back **the names that actually moved**, a frozen empty
+array when nothing did — that list is what the entity content service routes to
+column subscribers, and it is why a write that changes nothing wakes nobody.
+**`putEntity` and `patchEntity` answer whether anything moved, and name the moved
+columns only into the array they are handed**: one pass compares and writes (a put
+then walks the stored columns the new value lacks), and with `undefined` they build
+no list at all. The entity content service asks whether the slot has changed-column readers — the slot has
+column slots, or its store slot has a content listener such as an index — and hands
+an array only then, so a write of an entity nobody reads by column allocates no names.
+The list it builds goes on to the listeners: an index wakes a bucket column exactly
+when a member's value of it changed, left, or became `undefined`. The first write
+into an empty slot tells listeners `undefined` ("everything"), not an empty list. `sameValueGuard` defaults to `oimSameValueZeroGuard` and is the
+per-column comparison that decides "moved".
+
+`putEntity` is PUT, `patchEntity` is PATCH (HTTP semantics). PUT makes the stored entity
+the value handed in — changed columns written, columns the value lacks removed — in ONE
+call, returning both sets of names; PATCH writes only the columns named. `upsertEntity`
+of a key that already has a value and `slotContentService.writeEntity(slot, entity)` are PUT: a whole-entity
+write that drops a column is ONE channel write of the slot, and the replacing writer
+builds ONE new object.
+
+Pick `createOIMEntityWriterReplacing` when something downstream compares by
+reference — a React `useSyncExternalStore` snapshot, a memo, a shallow-equal
+selector. Under `createOIMEntityWriterInPlace` the entity reference never moves,
+so a value comparison never fires and a binding needs a counter bumped inside its
+handler. Replacing allocates one object per changed write; in-place allocates
+none.
+
+Neither writer `delete`s: a column a PUT drops or `deleteColumns` takes away is
+written `undefined` — into the stored object in place, into a spread copy when
+replacing — so the entity keeps its hidden class, and the key stays in
+`Object.keys` and `in`. A column holding `undefined` counts as absent — a later write that
+leaves it out does not report it, and taking the entity away does not wake its
+readers.
+
+**Neither strategy reports anything.** Reporting is `OIMSlotContentEntityService`'s,
+and it wraps each writer call in a content subframe on the store slot's channel slot so the whole write is
+one logical change.
+
+**A writer of your own** reuses the column walks both shipped writers run:
+
+```ts signature
+oimPatchEntityColumns(slot, patch: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPatchEntityColumn(slot, columnName: string, value: unknown, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPutEntityColumns(slot, entity: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPutEntityColumnsGuarded(slot, entity: object, sameValueGuard, changedColumnNames: string[] | undefined,
+    targetOf: (entity: Record<string, unknown>) => Record<string, unknown>): Record<string, unknown> | undefined
+oimPatchEntityColumnsGuarded(slot, patch: object, sameValueGuard, changedColumnNames, targetOf)        // same signature as the unguarded walk
+oimPatchEntityColumnGuarded(slot, columnName: string, value: unknown, sameValueGuard, changedColumnNames, targetOf)
+```
+
+Each compares every column through `sameValueGuard`, writes the moved ones into
+the object `targetOf` hands back on the first move (the stored entity in place, a
+copy when replacing), pushes their names into `changedColumnNames` when it is an
+array, and returns that object; `undefined` means nothing moved or the slot holds
+no entity. The put walk also writes `undefined` over every column the new value
+lacks. Each walk is a strategy, an option of the writer factories (`TOIMEntityWriterOptions`), and each
+ships two arms:
+
+| Option | Default (unguarded) | Guarded arm |
+|---|---|---|
+| `putEntityColumns` | `oimPutEntityColumns` — skips neither `__proto__` keys nor inherited stored columns | `oimPutEntityColumnsGuarded` — skips both |
+| `patchEntityColumns` | `oimPatchEntityColumns` — every enumerable key of the patch, `__proto__` included | `oimPatchEntityColumnsGuarded` — skips a `__proto__` key and a key the patch does not own |
+| `patchEntityColumn` | `oimPatchEntityColumn` | `oimPatchEntityColumnGuarded` — refuses the column name `__proto__` |
+
+Take the guarded arms, at a cost on every write, for values that can carry a `__proto__` key or are class
+instances — `createOIMEntityWriterInPlace({ putEntityColumns: oimPutEntityColumnsGuarded,
+patchEntityColumns: oimPatchEntityColumnsGuarded, patchEntityColumn: oimPatchEntityColumnGuarded })`, the
+same options on `createOIMEntityWriterReplacing`. The writer decides only where the result goes — this one
+stores every value frozen:
+
+```ts
+const copyColumns = (entity: Record<string, unknown>): Record<string, unknown> => ({ ...entity });
+
+function storeFrozen(slot: TOIMEntitySlot, next: Record<string, unknown> | undefined): boolean {
+    if (next === undefined) return false;
+    (slot as TOIMSlotEditable<TOIMEntitySlot>).entity = Object.freeze(next);
+    return true;
+}
+
+const replacingWriter = createOIMEntityWriterReplacing();
+
+const freezingWriter: IOIMEntityWriter = {
+    fillEntity: (slot, entity) => { storeFrozen(slot, copyColumns(entity as Record<string, unknown>)); },
+    clearEntity: replacingWriter.clearEntity,
+    putEntity: (slot, entity, changedColumnNames) =>
+        storeFrozen(slot, oimPutEntityColumns(slot, entity, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    patchEntity: (slot, patch, changedColumnNames) =>
+        storeFrozen(slot, oimPatchEntityColumns(slot, patch, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    patchColumn: (slot, columnName, value, changedColumnNames) =>
+        storeFrozen(slot, oimPatchEntityColumn(slot, columnName, value, oimSameValueZeroGuard, changedColumnNames, copyColumns)),
+    deleteColumns: (slot, names) => {
+        const deleted = replacingWriter.deleteColumns(slot, names);
+        if (deleted.length !== 0) storeFrozen(slot, slot.entity as Record<string, unknown>);
+        return deleted;
+    },
+};
+```
+
+---
+
+## Single entities
+
+A single entity — one value under no key, such as settings or a session — is a store slot of an
+`OIMSingleSlotService` over an entity content service whose key type is `void` and whose store service is
+`OIMSlotStoreServiceSingleSlotDriven.INSTANCE`, which files at most one slot per store slot. It has no
+by-key doors: its read doors name the one slot.
+
+```ts signature
+createOIMSingleEntityService<TEntity, TColumnName?>(db, {
+    entityWriter?, slotEmptiness?, slotReleasePolicy?, columnSlotStoreService?, columnNames?,
+}?): OIMSingleSlotService<TOIMEntitySlot<TEntity, void>, OIMSlotContentEntityService<TEntity, void, TOIMSingleSlotStore<…>, TColumnName>, …>
+
+// the base layer it assembles
+createOIMSingleSlotService({
+    slotContentService: createOIMSlotContentEntityService<TEntity>(db, {
+        slotStoreService: OIMSlotStoreServiceSingleSlotDriven.INSTANCE,   // no keyOf
+    }),
+})
+
+class OIMSingleSlotService<TSlot, TSlotContentService, TColumnName, …> {
+    readonly slotContentService: TSlotContentService;
+    createStoreSlot(channelMap: IOIMChannelMap): TOIMStoreSlot<TOIMSingleSlotStore<TSlot>, TSlot, TPatch>;
+    findSingleSlot(storeSlot): TSlot | undefined;     // mints nothing
+    hasSingleSlotContent(storeSlot): boolean;         // mints nothing
+    getSingleSlot(storeSlot): TSlot;                  // minted if missing, tracked until the next flush
+    holdSingleSlot(storeSlot): TSlot;                 // minted if missing, holdCount up by one
+    getColumn / holdColumn / getAnyColumn / holdAnyColumn / getColumnGroup / holdColumnGroup / unholdColumn;
+}
+```
+
+One service serves every single entity of that type: each `createStoreSlot(db)` is another one, and starts
+with no value until something writes it. Its store slot is a `TOIMSingleSlotStoreSlot`, which is what
+`@oimdb/persist`'s single-entity source takes.
+
+```ts
+type Settings = { theme: 'light' | 'dark'; zoom: number };
+
+const settingsService = createOIMSingleEntityService<Settings>(db);
+const settings = settingsService.createStoreSlot(db);
+settingsService.slotContentService.upsertEntity(settings, { theme: 'light', zoom: 1 });
+const settingsSlot = settingsService.holdSingleSlot(settings);
+const themeColumn = settingsService.holdColumn(settingsSlot, 'theme');
+const themeEffect = effectService.createEffect(db, [themeColumn], [], () => { console.log(settingsSlot.entity?.theme); });
+settingsService.slotContentService.updateEntity(settingsSlot, { theme: 'dark' });
+db.flush();
+effectService.disposeEffect(themeEffect);
+settingsService.unholdColumn(themeColumn);
+settingsSlot.owner.unholdSlot(settingsSlot);
+```
+
+**The slot is reached only through the service.** `getSingleSlot(storeSlot)` hands back the live slot, and
+mints a fresh one — tracked by the unused-slot collector until the next flush — when there is none;
+`holdSingleSlot(storeSlot)` does the same and takes a hold. Every store write door of the content service
+works on it as on a keyed store slot (`upsertEntity`, `clearAllEntities`), and every slot door
+(`updateEntity`, `updateEntityColumn`, `deleteEntityColumns`, `writeEntity`, `markEntityChanged`,
+`deleteEntity`) takes that slot.
+
+The slot is of the keyed entity slot's literal shape, owned by the content service's slot owner —
+`settingsSlot.owner === settingsService.slotContentService.slotOwner`, and its `storeSlot` is `settings` — so
+`effectService.createEffect(db, [settingsSlot], [], …)` works and a column of it is a root like any other.
+Its key is `undefined`, and its store is `{ slot }` (`TOIMSingleSlotStore`). Its lifetime is the
+`slotReleasePolicy` (the db's, then `OIMSlotReleasePolicyAtEmpty`), so a single entity that holds a value
+stays; one emptied and unheld is released, and the slot `getSingleSlot` mints next holds no entity. The value
+is stored by the writer's `entityInsertStrategy`, which by default keeps the object handed in rather than a copy.
+
+---
+
+## Buckets
+
+A bucket collection is, like an entity collection, a content service and the collection service over it.
+The content service is the strategy — how a bucket keeps its member slots — and it is chosen at the factory:
+
+```ts signature
+createOIMBucketService<TBucketMemberSlot = TOIMEntitySlot, TKey = TOIMStoreKey, TSlots?, TSlotContentService?, TStore?>(db, {
+    slotContentService?: OIMSlotContentBucketService<TBucketMemberSlot, TSlots>;  // default: array-driven, with commands
+    maxCommandsPerSlot?: number;            // for the default content service's OIMBucketCommands
+    bucketSlotStoreService?: IOIMSlotStoreService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore>; // Map; REQUIRED for an array TKey
+    slotReleasePolicy?: IOIMSlotReleasePolicy;
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>;
+    columnNames?: readonly string[];
+}?): OIMSlotCollectionService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore, TSlotContentService, …>
+
+new OIMSlotContentBucketServiceSetDriven<TBucketMemberSlot>({ bucketCommands? })
+new OIMSlotContentBucketServiceArrayDriven<TBucketMemberSlot, TSlots?>({ bucketCommands?, bucketArrayMembership? })
+new OIMSlotContentBucketServiceSortedArrayDriven<TBucketMemberSlot>({ compareBucketMemberSlots })
+```
+
+A bucket holds bucket member slots of any slot type — entity slots, bucket slots, computeds — and its
+type parameter `TBucketMemberSlot extends TOIMSlot` (default `TOIMEntitySlot`) is that slot type, not the
+entity type. The services hold no bucket: `createStoreSlot(db)` is one keyed set of buckets, the read doors
+of the collection service take that store slot first, and the bucket doors of the content service take the
+bucket slot.
+
+```ts
+const colourService = createOIMBucketService<TOIMEntitySlot<Card>, TOIMStoreKey, TOIMBucketSlotsSetStore<TOIMEntitySlot<Card>>,
+    OIMSlotContentBucketServiceSetDriven<TOIMEntitySlot<Card>>>(db, {
+    slotContentService: new OIMSlotContentBucketServiceSetDriven<TOIMEntitySlot<Card>>(),
+});
+const colours = colourService.createStoreSlot(db);
+const red = colourService.holdSlotByKey(colours, 'red');
+colourService.slotContentService.writeBucketMemberSlots(red, [slot, cardService.getSlotByKey(cards, 'c2')]);
+db.flush();
+for (const deckSlot of colourService.slotContentService.getBucketMemberSlots(red)) { paint(deckSlot.entity); }
+colourService.slotContentService.clearBucketMemberSlots(red);
+red.owner.unholdSlot(red);
+```
+
+Every door below is the bucket content service's and takes the bucket slot:
+
+| Door | Signature |
+|---|---|
+| `writeBucketMemberSlots(bucketSlot, bucketMemberSlots)` | `boolean` — states the whole bucket; idempotent; true when anything arrived or departed |
+| `addBucketMemberSlot(bucketSlot, bucketMemberSlot)` / `addBucketMemberSlots(bucketSlot, bucketMemberSlots)` | joins the named bucket member slots and touches nothing else. REMOVES NOTHING |
+| `removeBucketMemberSlot(bucketSlot, bucketMemberSlot)` / `removeBucketMemberSlots(bucketSlot, bucketMemberSlots)` | takes the named bucket member slots out and touches nothing else |
+| `clearBucketMemberSlots(bucketSlot)` | empties it |
+| `getBucketMemberSlots(bucketSlot)` | `Iterable<TBucketMemberSlot>` |
+| `getBucketMemberSlotCount(bucketSlot)` | `number` |
+| `hasBucketMemberSlot(bucketSlot, bucketMemberSlot)` | `boolean` — the content service's own membership test: one `Set.has` on a set-driven bucket, the membership's `hasSlot` on an array-driven one |
+| `markBucketColumnsChanged(bucketSlot, patch, changedColumns)` | `void` — tell the bucket's column slots which member columns moved |
+| `markContentChanged(bucketSlot)` | `void` — re-settle emptiness and re-ask the release guard after a write made another way |
+| `fillBucketMemberSlots(bucketSlot, bucketMemberSlots)` | `void` — fills a bucket slot nobody was told about yet; it throws on one that was already announced, which `addBucketMemberSlots` / `writeBucketMemberSlots` are for |
+
+The entities of a bucket by key are the index's door, `indexService.getEntitiesByKey(indexStoreSlot, key)`
+([The index that fills itself](#the-index-that-fills-itself--oimindexservice)).
+
+### Which door: you hold the answer, or you hold the delta
+
+`writeBucketMemberSlots` is for a caller who has THE LIST THAT SHOULD BE THERE and does not
+know what changed — a search result, a page from a server, a filter re-run. One
+call, and the engine works out the arrivals and the departures. Its cost is
+proportional to WHAT THE BUCKET HOLDS, not to the change: the difference builds a
+map over the whole incoming list and walks the standing one, so a batch of ten
+into a bucket of two hundred pays for two hundred and ten.
+
+`addBucketMemberSlots` / `removeBucketMemberSlots` are for a caller who KNOWS THE DELTA — an entity arrived
+over a socket, a card was dragged in, an infinite list appended a page, an entity was
+deleted. The standing slots keep the holds they already have. Adding costs what you
+name. Removing k slots from an ordered bucket of n is ONE pass, n + k, through the content service's
+`removeSlots` (the erase-remove idiom, as in Java's ArrayList.removeAll); k separate
+`removeBucketMemberSlot` calls are up to k·n. The recorded `remove` commands come
+in LIST order, not argument order, each at its position after the earlier ones
+applied, so replaying them draws the same list. A set-driven bucket removes them in
+the order you name them.
+
+**`addBucketMemberSlots` removes nothing.** If the authoritative list SHRANK and you call
+`addBucketMemberSlots`, the entity slots that left stay in the bucket, held. Not knowing what left is
+exactly when `writeBucketMemberSlots` is the right door, and its cost is the price of not
+knowing.
+
+The keyed doors are the collection service's and take the store slot first —
+`decksService.getSlotByKey(decks, key)`, `decksService.holdSlotByKey(decks, key)` — and a hold is given back
+with `bucketSlot.owner.unholdSlot(bucketSlot)`. There is no by-key write: resolve the bucket slot, then
+`decksService.slotContentService.writeBucketMemberSlots(bucketSlot, members)`.
+
+A bucket's emptiness is the content service's `isSlotEmpty(bucketSlot)`, a member count of zero, so
+an emptied bucket that nothing holds and nothing watches is released by the
+guard on the same call that emptied it.
+
+**A bucket never sorts.** Its order is what the caller put in — `addBucketMemberSlots`
+appends, `insertBucketMemberSlotAt` inserts, a move moves, `writeBucketMemberSlots` takes the
+sequence given. A sorted list is a computed over an index:
+[Sorted lists](#sorted-lists); or the bucket of a `createOIMIndexServiceSortedArrayDriven` index, which
+orders itself: [Sorted at write](#sorted-at-write).
+
+`writeBucketMemberSlots(bucketSlot, members)` runs `assertWritable` — the frame guard
+(`assertNotFlushing`) and the released-identity check — then the reconcile (an empty `arrived` and
+`departed` is an unchanged write, which wakes nobody), the holds taken on arrivals, the holds given back by
+departures and the single channel write of the bucket slot. It is handed a slot, so it hands back a
+`boolean`: true when anything arrived or departed.
+
+`writeBucketMemberSlots` **joins before it evicts**, so a slot named by both the old and the
+new list never reaches zero references. It empties with one `drainSlots` rather
+than one removal at a time — per-slot eviction on an array-driven bucket is
+n(n-1)/2 element moves.
+
+The commit itself is the strategy's, through the content service's protected `reconcileSlots` — the
+reconciliation pattern (diff, then patch): bring the bucket to the new list and fill
+two out-queues with one entry per hold taken and one per hold given
+up, so the write links each of the first and unlinks each of the second. Both
+empty means nothing changed. Each content service reconciles its own way:
+
+- **Array-driven**: the caller's sequence IS the slots, so the same sequence is
+  left alone and any other sequence — a reordered one included — is drained and
+  re-added whole.
+- **Set-driven** takes the set difference and never rebuilds: an untouched member
+  keeps its hold.
+
+**NO FRAME NUMBER IS PASSED ON THIS PATH.** `reconcileSlots` and `drainSlots` take none. A render script lives for exactly one frame:
+`OIMBucketCommands` records onto the bucket slot (`bucket.commands`) as the writes land and
+empties it once the flush has fully ended, so a consumer reads it INSIDE the
+frame and what it reads can only describe the writes it was woken for.
+`clearBucketMemberSlots` asks whether the bucket is empty **before** it
+touches the store, so an already-empty bucket records nothing for a call that
+reports nothing.
+
+### Bucket content services
+
+| Class | Storage type | One add records |
+|---|---|---|
+| `OIMSlotContentBucketServiceSetDriven<TBucketMemberSlot>({ bucketCommands? })` | `TOIMBucketSlotsSetStore<TBucketMemberSlot>` = `Set<TBucketMemberSlot>` | one per slot |
+| `OIMSlotContentBucketServiceArrayDriven<TBucketMemberSlot, TSlots>({ bucketCommands?, bucketArrayMembership? })` | whatever `bucketArrayMembership` builds | whatever `bucketArrayMembership` records |
+| `OIMSlotContentBucketServiceSortedArrayDriven<TBucketMemberSlot>({ compareBucketMemberSlots })` | `TOIMBucketSlotsSortedArrayStore<TBucketMemberSlot>` | one per slot, at its sorted place |
+
+The first two are the ones a caller picks between, and neither sorts: the array-driven service keeps the
+caller's order. The third is the one the sorted-at-write index builds for itself
+([Sorted at write](#sorted-at-write)); its `repositionBucketMemberSlot(bucketSlot, bucketMemberSlot)` moves one
+member to its place after its sort columns changed.
+
+`bucketArrayMembership` defaults to `OIMBucketArrayMembershipNonUnique.INSTANCE` and is the fork between one
+entry per mention and one per slot. There is no "ordered unique" class; you build one like this:
+
+    new OIMSlotContentBucketServiceArrayDriven<
+        TOIMEntitySlot<Card>, TOIMBucketSlotsArrayUniqueStore<TOIMEntitySlot<Card>>
+    >({
+        bucketArrayMembership: new OIMBucketArrayMembershipUnique<TOIMEntitySlot<Card>>(),
+    })
+
+| Membership | Storage it builds | One add records |
+|---|---|---|
+| `OIMBucketArrayMembershipNonUnique.INSTANCE` (default) | `TOIMBucketSlotsArrayStore<TBucketMemberSlot>` | one per **mention** |
+| `new OIMBucketArrayMembershipUnique<TBucketMemberSlot>()` | `TOIMBucketSlotsArrayUniqueStore<TBucketMemberSlot>` | one per slot |
+
+`IOIMBucketArrayMembership<TBucketMemberSlot, TSlots>`: `createStore`, `addSlot`, `removeSlot`,
+`hasSlot`, `clearSlots`, `containsTheSameSequence`. `hasBucketMemberSlot` asks the membership's `hasSlot`: the
+unique membership answers from its `Set` (no array walk), the non-unique one walks the
+array. Only the array-driven service takes one — a set-driven service keeps its slots IN a `Set`.
+
+Nothing positional is on the abstract `OIMSlotContentBucketService`: the reads `getBucketMemberSlotAt` and
+`getBucketMemberSlotPosition` are on the array-based services (array-driven and sorted), and the five
+position writes on the array-driven one only. The set-driven service has none — a `Set` has no place to name,
+so asking it does not compile. A content service keeps no per-bucket state.
+
+The protected `removeSlot` answers WHERE the slot was, so the door recording an edit script never asks for a
+position the removal itself had to compute. Two of its answers are not positions, and both are exported as
+named constants:
+
+| returns | means |
+|---|---|
+| `0` and up | the index the slot occupied, now vacated |
+| `OIM_NOTHING_WAS_REMOVED` (`-1`) | the bucket did not hold it; nothing changed |
+| `OIM_REMOVED_WITHOUT_A_POSITION` (`-2`) | removed from a store that keeps no positions, which is the set-driven service |
+
+A removal answering the third is recorded as `recordWholeList(bucketSlot)`: a set has no index to patch,
+so the consumer is told to re-read the bucket rather than handed a fabricated one.
+
+`OIM_NOTHING_WAS_INSERTED` (`-1`) is the insert's answer when nothing was inserted, which is a repeat on an
+`OIMBucketArrayMembershipUnique`. The recorded insert names the index the slot LANDED on — `at` clamped to the
+ends of the list — and not `getBucketMemberSlotPosition`, because the default ordered list keeps one place per
+**mention**: inserting a slot the bucket already holds gives it a second position, and the position read
+names the FIRST. A command script built from it would tell the consumer to patch at an index the slot is not
+at, and the consumer's list would diverge from the bucket's permanently.
+
+**A bucket's storage is `bucketSlot.bucketSlotsStore`.** The bucket's own type carries it
+(`TOIMBucketSlot<TOIMBucketSlotsArrayStore<TOIMEntitySlot<Card>>>`), so a mismatched pairing is a compile
+error. **One content service instance may serve two bucket collections** — it keeps no per-bucket state.
+
+### Positions the caller decides
+
+A bucket whose positions are the caller's is one over `OIMSlotContentBucketServiceArrayDriven`, which is
+what `createOIMBucketService(db)` builds when it is given no content service — the `pageService` of the setup
+block. The two position reads and the five writes are that content service's, they take the bucket
+slot and no store slot, and an index is valid only until the next write:
+
+| Door | What it does |
+|---|---|
+| `getBucketMemberSlotAt(bucketSlot, index)` | who sits there, `undefined` past the end |
+| `getBucketMemberSlotPosition(bucketSlot, bucketMemberSlot)` | where it sits, `-1` when it does not |
+| `insertBucketMemberSlotAt(bucketSlot, at, bucketMemberSlot)` | puts it at `at`, clamped to the ends of the list |
+| `removeBucketMemberSlotAt(bucketSlot, at)` | takes it out and hands it back, `undefined` past the end |
+| `removeBucketMemberSlotRange(bucketSlot, at, count)` | takes a run out and hands it back |
+| `moveBucketMemberSlotToPosition(bucketSlot, from, to)` | moves one slot; refuses `from === to` and either end out of range |
+| `moveBucketMemberSlotRangeToPosition(bucketSlot, from, count, to)` | moves a run; the landing is read in the list WITHOUT the run in it |
+
+Every position and count must be a whole number: `NaN` or a fraction throws
+(`a position must be a whole number`) before anything moves, because the list
+and `splice` would read it two different ways. `±Infinity` is allowed and clamps
+like any other out-of-range position.
+
+Each wraps a store change in the frame guard, the holds, the report and the
+release question. The default ordered list records one place per MENTION, so
+`insertBucketMemberSlotAt` of a slot the bucket already holds gives it a second position —
+build the content service with an `OIMBucketArrayMembershipUnique` when a position must name
+exactly one entity slot.
+
+Per strategy, generating code:
+
+```ts
+const slotContentBucketService = pageService.slotContentService;
+
+// kanban, between columns
+const cardItWasDroppedOn = cardService.getSlotByKey(cards, 'c2');
+slotContentBucketService.removeBucketMemberSlotAt(todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot));
+slotContentBucketService.insertBucketMemberSlotAt(
+    done, slotContentBucketService.getBucketMemberSlotPosition(done, cardItWasDroppedOn) + 1, slot,
+);
+
+// priority queue — raise to the front, then nudge down two
+slotContentBucketService.moveBucketMemberSlotToPosition(todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot), 0);
+slotContentBucketService.moveBucketMemberSlotToPosition(
+    todo, slotContentBucketService.getBucketMemberSlotPosition(todo, slot),
+    slotContentBucketService.getBucketMemberSlotPosition(todo, slot) + 2,
+);
+
+// a whole list at once, in the order the server sent
+slotContentBucketService.writeBucketMemberSlots(todo, cardService.slotContentService.upsertEntities(cards, payload));
+```
+
+### The render script: `OIMBucketCommands`
+
+```ts signature
+new OIMBucketCommands(options: { maxCommandsPerSlot?: number })   // default OIM_MAX_COMMANDS_PER_SLOT
+
+// a bucket content service takes it at construction, once:
+new OIMSlotContentBucketServiceArrayDriven({ bucketCommands: new OIMBucketCommands({ maxCommandsPerSlot: Infinity }) });
+// createOIMBucketService(db, { maxCommandsPerSlot }) builds the default content service with one
+```
+
+**Recording is a strategy chosen when the bucket content service is built.** `bucketCommands` is read once
+into a readonly field; left out of a content service built with `new`, it is `OIMBucketCommandsNone`, whose
+every method is empty, so a bucket nobody renders positionally pays one empty call per write and allocates no
+command. The default content service of `createOIMBucketService` records. There is no setter: a content
+service records into the one recorder it was built with. One recorder serves every bucket of every store slot
+and of every db — it is stateless.
+
+It writes the script onto the BUCKET slot itself, and is handed the member count for the cap below. The bucket
+content service already writes the bucket slot on every mutation, so a consumer subscribes to the bucket and
+reads the script inside the effect:
+
+```ts
+effectService.createEffect(db, [todo], [], () => {
+    if (todo.isWholeListRecorded) render(Array.from(pageService.slotContentService.getBucketMemberSlots(todo)));
+    else applyToTheRenderedList(todo.commands ?? []);
+});
+```
+
+`TOIMBucketSlot` carries two fields for it, and a consumer reads both:
+
+| Field | What it says |
+|---|---|
+| `commands` | `readonly TOIMOrderedListCommand[]`, or `undefined` before the first write — what this frame's writes did, in order |
+| `isWholeListRecorded` | the script was given up on; read the bucket's slots and rebuild |
+
+**READ BOTH INSIDE THE FRAME.** They are reset once the flush has FULLY ended —
+after `db.flush()` returns, `commands` is empty and `isWholeListRecorded` is
+`false` — so the only places they exist are an effect body and a
+`OIMChannelService.INSTANCE.subscribeAfterEachFrame(channelSlot, handler)` handler. No frame number is passed
+back: a consumer that did not read this frame's script reads the list instead.
+
+A script is stamped with the clock reading it started at (`commandsStartedAtRevision`/`commandsStartedAtEpoch`),
+and it is stale once a frame has opened after that stamp (`channelSlot.frame.openedAtRevision`/`openedAtEpoch`).
+The recorder clears a stale script before it records into it, as well as in the after-flush reset, so a write
+that lands after a flush but before that reset starts a new script instead of extending one consumers already
+read. The reset is subscribed with `subscribeAfterEachFlush` on the first script a channel slot ever sees, and
+walks only the buckets that recorded.
+
+A positional write is always recorded as a position. `isWholeListRecorded` is set by a write of the whole bucket — `writeBucketMemberSlots`,
+`clearBucketMemberSlots`, `moveBucketMemberSlotRangeToPosition` — by a removal from a bucket whose
+content service keeps no positions, which has no index to patch, and by the script
+outgrowing the list
+it describes. `maxCommandsPerSlot` is that ratio; it defaults to
+`OIM_MAX_COMMANDS_PER_SLOT`, which is 1, the same ratio
+`oimOrderedListCommandsOfTransition` takes as `maxCommandsPerSlot`. `Infinity` refuses the collapse
+outright, which is what a consumer animating item moves needs: a whole-list answer
+tells it everything changed and costs it every move it meant to animate.
+
+`IOIMBucketCommands` is the interface the bucket content service records through:
+`recordInsert(bucketSlot, index, bucketMemberSlot, bucketMemberSlotCount)`,
+`recordRemove(bucketSlot, index, count, bucketMemberSlotCount)`, `recordMove(bucketSlot, from, to, bucketMemberSlotCount)`
+and `recordWholeList(bucketSlot)`. They take positions, not a command object, so the
+empty strategy is handed nothing to allocate. A consumer does not call the record methods; the
+content service's own write doors do.
+
+### A single bucket
+
+One bucket under no key is a store slot of an `OIMSingleSlotService` over a bucket content service, with
+`OIMSlotStoreServiceSingleSlotDriven.INSTANCE` as the store service:
+
+```ts signature
+createOIMSingleBucketService<TBucketMemberSlot = TOIMEntitySlot, TSlots?, TSlotContentService?>(db, {
+    slotContentService?, maxCommandsPerSlot?, slotReleasePolicy?, columnSlotStoreService?, columnNames?,
+}?): OIMSingleSlotService<TOIMBucketSlot<TSlots, void>, TSlotContentService, …>
+```
+
+```ts
+const handService = createOIMSingleBucketService<TOIMEntitySlot<Card>>(db);
+const hand = handService.createStoreSlot(db);
+const handSlot = handService.holdSingleSlot(hand);
+handService.slotContentService.writeBucketMemberSlots(handSlot, [slot]);
+handService.slotContentService.insertBucketMemberSlotAt(handSlot, 0, cardService.getSlotByKey(cards, 'c2'));
+effectService.disposeEffect(effectService.createEffect(db, [handSlot], [], () => {
+    render(Array.from(handService.slotContentService.getBucketMemberSlots(handSlot)));
+}));
+handSlot.owner.unholdSlot(handSlot);
+```
+
+One bucket, no key: the single-slot store files its one bucket slot under `undefined`. The bucket slot is a
+plain `TOIMBucketSlot<TSlots, void>`, what an effect subscribes to and what a reader is handed,
+so the channel's write door still sees three slot shapes. Every door of the bucket content service takes it as
+it takes a keyed bucket slot, and `markBucketColumnsChanged(bucketSlot, patch, changedColumns)` is how the
+caller that changed members says which of their columns moved, as the index does for a keyed bucket. Each
+door opens its own subframe on the channel slot and coalesces the bucket's change to one channel write per
+subframe.
+
+**Its lifetime is the `slotReleasePolicy`.** With none named (here or on the db) it is
+`OIMSlotReleasePolicyAtEmpty.INSTANCE`, so an emptied single bucket that nothing holds or watches is
+released, and `getSingleSlot(storeSlot)` mints a fresh, empty one on the next read. Hold the
+slot (`holdSingleSlot(storeSlot)`) for as long as you write into it, or name `OIMSlotReleasePolicyNever.INSTANCE`.
+
+### The index that fills itself — `OIMIndexService`
+
+```ts signature
+createOIMIndexService<TEntity, TSourceKey, TColumns?, TKey?, TSourceStore?, TSlots?, TSlotContentService?>(db, {
+    entityService: Pick<OIMSlotCollectionService<TSourceKey, TOIMEntitySlot<TEntity, TSourceKey>, TSourceStore, unknown>, 'getSlots'>;
+    ...TOIMIndexKeyOptions<TKey, TEntity, TColumns>;          // { columns } | { keyOf } | { keyOf, columns }
+    slotContentService?: OIMSlotContentBucketService<TOIMEntitySlot<TEntity>, TSlots>;  // default: array-driven, no commands
+    bucketSlotStoreService?: IOIMSlotStoreService<TKey, TOIMBucketSlot<TSlots, TKey>, TStore>; // REQUIRED for an array TKey
+    slotReleasePolicy?: IOIMSlotReleasePolicy;
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMColumnSlot>;
+    columnNames?: readonly string[];
+}): OIMIndexService<TKey, TEntity, TSlots, TSourceKey, TSourceStore, TSlotContentService, …>
+
+class OIMIndexService<…> extends OIMSlotCollectionService<…> {
+    createIndexStoreSlot(sourceStoreSlot: TOIMStoreSlot<TSourceStore, TOIMEntitySlot<TEntity, TSourceKey>, Partial<TEntity>>): TOIMIndexStoreSlot<…>;
+    disposeIndexStoreSlot(indexStoreSlot: TOIMIndexStoreSlot<…>): void;
+    getEntitiesByKey(indexStoreSlot, key): (TEntity | undefined)[];
+    getSlotsByKeys(indexStoreSlot, keys): TBucketSlot[];
+    holdSlotsByKeys(indexStoreSlot, keys): TBucketSlot[];
+    getBucketColumnByKey / holdBucketColumnByKey(indexStoreSlot, key, columnName): TOIMColumnSlot;
+    getAnyBucketColumnByKey / holdAnyBucketColumnByKey(indexStoreSlot, key): TOIMColumnSlot;
+}
+```
+
+`OIMIndexService` is a collection service of buckets, so it has every read door of one, and its
+`slotContentService` is the bucket content service narrowed by type to its reads (`getBucketMemberSlots`,
+`getBucketMemberSlotCount`, `hasBucketMemberSlot`, and the positional reads where the strategy has them) — the
+index is the only writer of its buckets. The strategy is chosen at the factory:
+`OIMSlotContentBucketServiceArrayDriven` by default, `OIMSlotContentBucketServiceSetDriven` passed as
+`slotContentService`, and the sorted one built by `createOIMIndexServiceSortedArrayDriven`. Only the array-based
+content services answer by position: `getBucketMemberSlotAt(bucketSlot, index)` (O(1), `undefined` past the
+end) and `getBucketMemberSlotPosition(bucketSlot, entitySlot)` (walks the array, O(n), `-1` for a non-member).
+The index's default content service records no commands; pass one built with `bucketCommands` for a render
+script.
+
+**One index service per entity collection type; one index store slot per entity store slot.**
+`indexService.createIndexStoreSlot(entityStoreSlot)` registers the index on that entity store slot
+and hands back the index's bucket store slot, a `TOIMIndexStoreSlot` — a store slot of buckets
+that also names its `sourceStoreSlot`. Entity slots are filed into it by a key derived from the entity. You
+read through the index service, passing that store slot; the index is what writes its buckets.
+**No bucket exists for a key until it is minted**: `getSlotByKey`,
+`holdSlotByKey`, `getSlotsByKeys` and `holdSlotsByKeys` mint it and fill it from the source entities
+written before it, without a flush, so minting inside an effect body does not throw.
+`getSlotsByKeys` / `holdSlotsByKeys` fill every new bucket in ONE pass over the source. How long it lives after that is **the
+`slotReleasePolicy`'s ordinary business**, exactly as for a hand-held bucket; the index injects no lifetime of its
+own. With none named it is `OIMSlotReleasePolicyAtEmpty.INSTANCE`: the bucket stands while it has members and is
+maintained on every write.
+
+```ts
+const byDeckService = createOIMIndexService(db, {
+    entityService: cardService,
+    keyOf: (card: Card) => card.deck,
+});
+const byDeck = byDeckService.createIndexStoreSlot(cards);
+
+const spades = byDeckService.holdSlotByKey(byDeck, 'spades');
+effectService.createEffect(db, [spades], [], () => render(Array.from(byDeckService.slotContentService.getBucketMemberSlots(spades))));
+```
+
+A set-driven index names its content service, whose bucket member slot type is spelled out —
+`new OIMSlotContentBucketServiceSetDriven()` infers `<TOIMSlot>` and fails to type-check:
+
+```ts
+const bySuitService = createOIMIndexService(db, {
+    entityService: cardService,
+    columns: ['deck'],
+    slotContentService: new OIMSlotContentBucketServiceSetDriven<TOIMEntitySlot<Card>>(),
+});
+const bySuit = bySuitService.createIndexStoreSlot(cards);
+```
+
+- **Passing the entity store slot to `createIndexStoreSlot` is the whole wiring.** It registers
+  a content-change listener on that store slot (`OIMContentChangeListenerService.INSTANCE.addContentChangeListener`);
+  the entity services know nothing about indexes. Call `createIndexStoreSlot` twice over one entity
+  store slot and it files into both. `entityService` is used only for its `getSlots`, to fill a new bucket
+  from the source.
+- **The key comes from `columns`, `keyOf`, or both** — the same pair as the sorter's
+  `sortColumns` / `comparator` (`TOIMIndexKeyOptions`). `{ columns: ['deck'] }`: the key is
+  the value of that ONE column, typed by `TOIMIndexKey<TEntity, TColumns>` from the
+  column itself. `{ keyOf }`: any function, read again on every write, because a
+  function does not say which columns it reads. `{ keyOf, columns }`: the columns are the
+  ones `keyOf` reads. With `columns`, a patch or put whose changed columns include none of
+  them keeps the entity's key and calls nothing; a write of the whole value (a fill, a
+  clear, `markEntityChanged(slot)` with no names) always reads the key again.
+- **A key of several columns** takes its own door: `createOIMIndexServiceByCompositeKey(db,
+  { entityService, columns: ['deck', 'suit'] })` makes the key the array of those values in order, typed as a
+  tuple. It builds the bucket store on `OIMSlotStoreServiceTreeDriven` over
+  `OIMDefaults.KEY_TREE_WALK_SCALAR.getValue()`, and only that store knows the key is an array (its
+  `isSameKey`), so a fresh array with the same parts moves nothing. `createOIMIndexService` takes a scalar key
+  unless it is handed a `bucketSlotStoreService`: two columns or an array `keyOf` without one do not compile.
+  `getSlotsByKeys` / `holdSlotsByKeys` fill array-keyed buckets one pass over the
+  source per key (the cost of `getSlotByKey` each); only a scalar key gets one pass for all.
+- **Entity slots are filed on write**, using the index's key. Batch doors (`upsertEntities`,
+  `insertEntities`/`fillEntities`, `deleteEntities`, `clearAllEntities`) notify once per
+  batch; the index groups the entity slots by key and moves each group with one bucket write.
+- **Reading**, each taking the index store slot first: `getSlotByKey`, `holdSlotByKey`, `findSlotByKey`,
+  `hasSlotContentByKey`, `getSlotsByKeys`, `holdSlotsByKeys`, `getSlots`, `getSlotCount`, `getEntitiesByKey`, and the bucket column
+  slot doors `getAnyBucketColumnByKey`, `holdAnyBucketColumnByKey`,
+  `getBucketColumnByKey`, `holdBucketColumnByKey`; on a bucket slot, `slotContentService.getBucketMemberSlots`,
+  `getBucketMemberSlotCount`, `hasBucketMemberSlot`; and `unholdColumn` (below).
+  `getEntitiesByKey` resolves the bucket with `getSlotByKey`, so a key with no bucket MINTS one — one `keyOf`
+  walk over the source — and an empty unheld bucket is released at the flush, so reading an empty key every
+  frame walks every frame. Hold a key you read repeatedly.
+- **The channel** is the index store slot's `channelSlot`, the source store slot's — what a
+  React hook checks before subscribing.
+- **`disposeIndexStoreSlot(indexStoreSlot)`** unsubscribes from the source store slot, empties that
+  store slot's buckets and gives back every entity slot it held. The minting doors (`getSlotByKey`,
+  `holdSlotByKey`, `getSlotsByKeys`, `holdSlotsByKeys`, `getEntitiesByKey`, the bucket column doors)
+  throw after it, for that store slot;
+  the two give-backs (`slot.owner.unholdSlot`, `indexService.unholdColumn`)
+  still take back a hold given out before it, so a cleanup that runs late does not
+  throw.
+- **A key with no bucket is not maintained at all**, so a write under such a key
+  costs nothing beyond one key read and one comparison — no bucket store, no
+  maintenance nodes. What decides it is the BUCKET, not the hold: a standing bucket
+  is maintained whether anyone holds it or not.
+- **Order is not the bucket's business, unless you pick the strategy that makes it so.**
+  A bucket keeps its arrival order; a sorted list is
+  `createOIMComputedServiceSorted(db, { indexService, sortColumns?, comparator? })`
+  — see [Sorted lists](#sorted-lists) — or the index is built with
+  `createOIMIndexServiceSortedArrayDriven`, whose buckets are already in order — see
+  [Sorted at write](#sorted-at-write). A second computed over the bucket handles
+  projection or filtering.
+- **Members are read through the bucket content service**: `Array.from(indexService.slotContentService.getBucketMemberSlots(bucketSlot))`.
+  There is no `.value`.
+- **Subscription is on the bucket, not a computed.** The bucket is a ROOT slot, so it
+  goes in the FIRST array of `createEffect` — not the second. **The bucket wakes on
+  membership only**: an entity slot joining or leaving. A write to an entity that stays in the
+  bucket does not wake it — subscribe to that entity's own slot for that.
+- **Bucket lifetime is the `slotReleasePolicy` option, not the index's.** Name nothing (here or on the db)
+  and it is `OIMSlotReleasePolicyAtEmpty.INSTANCE`: an unheld bucket stays while it has members and goes
+  once empty; `OIMSlotReleasePolicyNever.INSTANCE` keeps it for good; pass an `OIMSlotReleasePolicyAfterIdle`
+  and it cools on its queue; pass `OIMSlotReleasePolicyAtUnhold.INSTANCE` and it dies at the last give-back,
+  and the next hold builds a fresh one by walking the source again.
+
+**The bucket's any-column slot exists, but it is not the recommended path.**
+`holdAnyBucketColumnByKey(indexStoreSlot, key)` (and `getAnyBucketColumnByKey(indexStoreSlot, key)`) returns a
+`TOIMColumnSlot` on the bucket slot that wakes when the content of a member changes —
+any write to a member inside. A member joining or leaving is NOT its business: that wakes
+the bucket slot (`getSlotByKey` / `holdSlotByKey`). A reader that wants both subscribes
+to both, and the subscriber picks by which slots it puts in `createEffect`.
+
+```ts
+const deckIndexService = createOIMIndexService(db, { entityService: cardService, keyOf: (card: Card) => card.deck });
+const deckIndex = deckIndexService.createIndexStoreSlot(cards);
+const spadesBucket = deckIndexService.holdSlotByKey(deckIndex, 'spades');
+const spadesAnyColumn = deckIndexService.holdAnyBucketColumnByKey(deckIndex, 'spades');
+const entitiesEffect = effectService.createEffect(db, [spadesBucket, spadesAnyColumn], [], () => {
+    console.log(deckIndexService.getEntitiesByKey(deckIndex, 'spades'));
+});
+effectService.disposeEffect(entitiesEffect);
+deckIndexService.unholdColumn(spadesAnyColumn);
+spadesBucket.owner.unholdSlot(spadesBucket);
+```
+
+A column slot taken with `getAnyBucketColumnByKey` and subscribed to is held by the
+effect, so a plain getter is enough: the slot lives while the effect does and goes at the
+next `flush()` after `disposeEffect`; one nobody kept is gone at the next `flush()`.
+
+**Do not reach for it to render a list.** Every edit of every member wakes whoever
+reads it, so a list bound to it re-renders whole for a one-field change. Subscribe
+the list to the bucket (membership) and each item to its own entity slot — that is the
+path the engine is built for. The any-column slot is for a reader that genuinely
+needs the whole list each time: an export, an aggregate over the entities, a log.
+
+It costs nothing until someone asks for one: a write is checked against it only after
+the index has been asked for the first any-column slot.
+
+**The content-change hook.** `OIMContentChangeListenerService.INSTANCE.addContentChangeListener(storeSlot, listener, readColumnNames): void`
+and `removeContentChangeListener(storeSlot, listener): boolean` file and unfile a listener on that one store
+slot, by the listener object. `addReadColumn` / `removeReadColumn` / `addReadAnyColumn` / `removeReadAnyColumn`
+declare reads without a listener of their own, which is how an index declares its bucket columns.
+**Which columns a listener reads** is declared when it is added: `readColumnNames` lists them, and
+`undefined` means every column. Removing the listener gives its columns back. An
+index store slot declares its key `columns` (all columns when the key is an opaque `keyOf`), and
+adds each column its bucket column slots watch, and all columns once a bucket any-column slot was
+asked for. Column slots on entities are not in it: a write finds them on the entity
+itself. A write whose changed columns no listener reads costs one `Map.has` per name:
+no listener is called, nothing is buffered, and the names array is reused across writes. A write that names no columns
+(a fill, a clear) always reaches the listeners. A listener of your own that must see
+every column write is added with `readColumnNames` `undefined`. **The filter is the union, per store
+slot, not per listener**: once a write touches a column ANY listener of that store reads, every
+listener of that store is called, so a listener that declared a narrower set still checks
+`changedColumns` itself, as `OIMIndexService` does against its key columns.
+`IOIMContentChangeListener<TSlot, TPatch>` has two methods:
+`onContentChanged(slot, patch, changedColumns)` and
+`onContentChangedMany(slotChannelQueue, patchChannelQueue, changedColumnsChannelQueue)` — three
+parallel `OIMChannelQueue`s read with `getEntryCount()` / `getEntryAt(i)`, valid only during the
+call, so a listener copies what it keeps — `patch` is what an update
+wrote, `changedColumns` the names `markEntityChanged(slot, columns)` was given, either
+`undefined` when the write carries none. A content service holds a store slot's notifications until ITS
+outermost content subframe closes: a single write delivers one `onContentChanged` when its own
+subframe closes, and a many-entity door (`upsertEntities`, `insertEntities`, `fillEntities`,
+`deleteEntities`, `clearAllEntities`) delivers ONE
+`onContentChangedMany` when the door returns. A subframe the caller opens on the channel slot
+does not hold them — an index is up to date as soon as the content service's own door returns.
+This hook is the only seam an index uses; an index of your own is a listener.
+
+**Bucket column slots.** An index hands out one column slot per bucket and column:
+`getBucketColumnByKey(indexStoreSlot, key, columnName)`, `holdBucketColumnByKey(indexStoreSlot, key, columnName)`,
+`indexService.unholdColumn(columnSlot)`. It is a `TOIMColumnSlot` whose `carrierSlot` is the
+bucket slot, and it is written when a write changes that column on any member of the
+bucket (the index calls its bucket content service's `markBucketColumnsChanged(bucketSlot, patch, changedColumns)`,
+as the caller does on a single bucket).
+The any-column doors `getAnyBucketColumnByKey(indexStoreSlot, key)` / `holdAnyBucketColumnByKey(indexStoreSlot, key)`
+return the same kind of slot, written when any column of any member changes. A give-back is
+`slot.owner.unholdSlot(slot)`.
+
+```ts
+const decksService = createOIMIndexService(db, { entityService: cardService, keyOf: (card: Card) => card.deck });
+const decks = decksService.createIndexStoreSlot(cards);
+const rankOfSpades = decksService.holdBucketColumnByKey(decks, 'spades', 'rank');
+effectService.disposeEffect(effectService.createEffect(db, [rankOfSpades], [], () => {}));
+decksService.unholdColumn(rankOfSpades);
+```
+
+### Sorted lists
+
+```ts signature
+createOIMComputedServiceSorted<TKey, TEntity extends object, TSlots, TSourceKey, TSourceStore, TComputedStore?>({
+    indexService: OIMIndexService<TKey, TEntity, TSlots, TSourceKey, TSourceStore>;
+    sortColumns?: readonly TOIMSortColumn<TEntity>[];   // { column: TOIMSortableColumnName<TEntity>; direction: 'asc' | 'desc' }
+    comparator?: (left: TEntity, right: TEntity) => number;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;          // default OIMSlotReleasePolicyAtUnhold.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<…>, TComputedStore>;  // Map; REQUIRED for any other store
+}): OIMComputedServiceSorted<TKey, TEntity, TSlots, TSourceKey, TSourceStore, TComputedStore>
+
+createSortedStoreSlot(indexStoreSlot: TOIMIndexStoreSlot<…>): TOIMStoreSlot<TComputedStore, TOIMSortedComputedSlot<TEntity, TKey>>
+readonly computedCollectionService: OIMSlotCollectionService<TKey, TOIMSortedComputedSlot<TEntity, TKey>, TComputedStore, …>
+```
+
+`slotReleasePolicy` decides whether a key's sorted list outlives its last hold. The
+default lets it go at the unhold, so holding the key again sorts from scratch;
+`OIMSlotReleasePolicyNever.INSTANCE` keeps every key that was ever read and re-sorts it
+only when a read finds it changed — the arm for a view that switches between groups.
+Pass the same policy to the index the list reads, or its bucket is rebuilt instead.
+
+An `OIMComputedServiceSorted` takes no db: its store slots run on the channel slot of the index store slot
+they sort. One per index service. `createSortedStoreSlot(indexStoreSlot)` makes one sorted store slot over
+one index store slot, and the read doors of `computedCollectionService` take that store slot first:
+`getSlotByKey`, `holdSlotByKey`, `findSlotByKey`, `getSlots`, `getSlotCount`, and the column doors; per key a
+computed slot whose value, read through `slot.computedValueService.getValueForSlot(slot)`, is that key's entity
+slots sorted. A hold is given back with `slot.owner.unholdSlot(slot)`.
+
+- **`sortColumns` decide which writes re-sort**: only a write that changes one of them on a
+  member. A `TOIMSortableColumnName<TEntity>` is a column whose values are strings,
+  numbers or bigints.
+- **`comparator` decides the order.** Without it the order is `oimColumnsComparator(sortColumns)`:
+  the columns in turn, each by its `direction`, an undefined or null value last. An
+  entity slot with no entity sorts last.
+- **Only `comparator`** → any write to a member re-sorts, since nothing names the
+  columns it reads.
+- **Neither** → a member keeps the place it first took; an arrival is appended.
+- **Both `sortColumns` and `comparator`** → the two split the job: `comparator` orders,
+  `sortColumns` is the list of columns whose change wakes the sort. **List every column
+  the comparator reads**: a change to a column it reads but `sortColumns` omits does not
+  re-sort, and the list stays in its old order until something listed changes. This
+  is the combination to reach for when the order needs a rule `oimColumnsComparator`
+  cannot express — a locale compare, a computed key, a tie-break — and the sort
+  should still wake only for the columns that rule reads, instead of for every write
+  to a member as with `comparator` alone.
+
+  ```ts
+  const cardsInDeckService = createOIMIndexService(db, {
+      entityService: cardService,
+      keyOf: (card: Card) => card.deck,
+  });
+  createOIMComputedServiceSorted({
+      indexService: cardsInDeckService,
+      sortColumns: [{ column: 'title', direction: 'asc' }, { column: 'rank', direction: 'asc' }],
+      comparator: (l, r) => l.title.localeCompare(r.title, 'de') || l.rank - r.rank,
+  }).createSortedStoreSlot(cardsInDeckService.createIndexStoreSlot(cards));
+  // a write to `title` or `rank` re-sorts; a write to `note` does not
+  ```
+
+Its sources are the bucket slot of the key (membership) plus the bucket column slot
+of each column — or the bucket's any-column slot when only a comparator is given. It is
+a pull computed: re-derived on the read that asks; an effect subscribes to it in the
+SECOND array of `createEffect`. A re-sort that yields the same sequence
+(`oimSameSlotSequence`) keeps the previous array, so its identity is stable.
+
+```ts
+const decksService = createOIMIndexService(db, { entityService: cardService, keyOf: (card: Card) => card.deck });
+const decks = decksService.createIndexStoreSlot(cards);
+const byRankInDeckService = createOIMComputedServiceSorted({
+    indexService: decksService,
+    sortColumns: [{ column: 'rank', direction: 'asc' }],
+});
+const byRankInDeck = byRankInDeckService.createSortedStoreSlot(decks);
+const spadesByRank = byRankInDeckService.computedCollectionService.holdSlotByKey(byRankInDeck, 'spades');
+const sortedEffect = effectService.createEffect(db, [], [spadesByRank], () => {
+    render(spadesByRank.computedValueService.getValueForSlot(spadesByRank));
+});
+effectService.disposeEffect(sortedEffect);
+spadesByRank.owner.unholdSlot(spadesByRank);
+```
+
+### Sorted at write
+
+A second way to get a sorted list. `createOIMComputedServiceSorted` sorts at read, over any
+index. `createOIMIndexServiceSortedArrayDriven` keeps the index's own buckets sorted at write, and
+the user picks one at construction.
+
+```ts signature
+createOIMIndexServiceSortedArrayDriven<TEntity extends object, TSourceKey, TColumns?, TKey extends TOIMStoreKey?, TSourceStore?, TStore?>(db, {
+    entityService, ...TOIMIndexKeyOptions<TKey, TEntity, TColumns>,     // as createOIMIndexService, scalar key
+    sortColumns: readonly TOIMSortColumn<TEntity>[];                   // REQUIRED
+    bucketSlotStoreService?, slotReleasePolicy?, columnSlotStoreService?, columnNames?,
+}): OIMIndexServiceSortedArrayDriven<…>   // its slotContentService is an OIMSlotContentBucketServiceSortedArrayDriven
+```
+
+```ts
+declare const someCardSlot: TOIMEntitySlot<Card, TOIMStoreKey>;
+const cardsByDeckService = createOIMIndexServiceSortedArrayDriven(db, {
+    entityService: cardService,
+    columns: ['deck'],
+    sortColumns: [{ column: 'rank', direction: 'asc' }, { column: 'id', direction: 'desc' }],
+});
+const cardsByDeck = cardsByDeckService.createIndexStoreSlot(cards);
+const spades = cardsByDeckService.holdSlotByKey(cardsByDeck, 'spades');
+for (const cardSlot of cardsByDeckService.slotContentService.getBucketMemberSlots(spades)) { /* in rank order */ }
+cardsByDeckService.slotContentService.getBucketMemberSlotAt(spades, 0);
+cardsByDeckService.slotContentService.getBucketMemberSlotPosition(spades, someCardSlot);
+```
+
+- **Reads come back in order**: `getBucketMemberSlots`, `getBucketMemberSlotAt` and
+  `getBucketMemberSlotPosition` on `OIMSlotContentBucketServiceSortedArrayDriven` answer in `sortColumns` order,
+  so no sorted computed is needed.
+- **A lazy insertion buffer.** A write appends the arrival to an unsorted tail of the bucket's
+  array (`TOIMBucketSlotsSortedArrayStore`: the array store plus `sortedCount`). The first read
+  settles the tail: binary insertion when the tail is short, one sort of the array when it is
+  long. A bucket nobody reads is never sorted.
+- **The index re-files a member when one of its sort columns changes, and only then.** A write
+  to a column that is neither the key nor a sort column neither reorders the bucket nor wakes it.
+  A re-file wakes the bucket once per frame.
+- **There are no positional writes** on this bucket (`insertBucketMemberSlotAt` and the other
+  position writes belong to `OIMSlotContentBucketServiceArrayDriven`): the order is the comparator's,
+  not the caller's.
+- **Bucket commands are always `OIMBucketCommandsNone`**: this strategy records no per-flush
+  script.
+- **Parts**: `OIMSlotContentBucketServiceSortedArrayDriven` (options
+  `TOIMSlotContentBucketServiceSortedArrayDrivenOptions`: `compareBucketMemberSlots`; adds
+  `repositionBucketMemberSlot(bucketSlot, bucketMemberSlot)`), `OIMIndexServiceSortedArrayDriven`.
+
+**Choosing between the two arms.** Sort-at-write suits point updates: a change to a sort
+column re-files one member. Sort-at-read (`createOIMComputedServiceSorted` over any index)
+suits bulk loads. Both are shipped; neither is a default.
+
+**`indexKeys` on each entity slot.** Each indexable slot carries, per index store slot, the key the entity is
+filed under now, so a moved entity slot leaves its old bucket in O(1), also under the in-place
+writer. Only the index writes it, through the `IOIMIndexKeysService` (`get(slot, position)`,
+`set(slot, position, indexKey)`), at the position `createIndexStoreSlot` allocated
+(`indexStoreSlot.indexKeysPosition`). Positions are allocated per entity store slot
+(`sourceStoreSlot.indexKeysPositions`). Pick the strategy once per db, `new OIMDB({ indexKeysService })`
+(default `OIMDefaults.INDEX_KEYS_SERVICE.getValue()`):
+
+| strategy | on `disposeIndexStoreSlot` | cost |
+|---|---|---|
+| `OIMIndexKeysServiceAppending` (default) | the index's position is never reused; its stale entry stays on each entity slot | an entity slot's `indexKeys` grows to the highest position any index wrote on it (K indexes made and disposed → an array of K on an entity slot the last one filed), and a stale entry keeps its key reachable. Writes pay nothing for a disposed index: only live listeners are kept |
+| `OIMIndexKeysServiceReclaiming` | wipes that position on every entity slot of the source store slot and reuses it | O(N) per dispose |
+
+Switch to `OIMIndexKeysServiceReclaiming` only if you create indexes dynamically and often. Creating
+indexes dynamically and often is expensive, so avoid it.
+
+### The channel of a bucket store slot
+
+A bucket store slot takes its channel slot at `createStoreSlot(db)` (an index store slot, from its source
+store slot). The refusal to write during a flush lives inside `OIMChannelService.INSTANCE.write`.
+
+---
+
+## Derivations
+
+```ts signature
+type TOIMComputedSources = {
+    readonly sourceSlots: readonly TOIMSlot[];
+    readonly sourceComputeds: readonly TOIMComputedSlot[];
+};
+```
+
+In a `createSources` result (of `createOIMComputedService`'s options, or of `createStoreSlot`) both `sourceSlots` and `sourceComputeds` are optional; a missing one means none.
+
+```ts signature
+type TOIMComputedSlot<TValue = unknown, TKey = unknown> = TOIMIndexableSlot<TKey> & Readonly<TOIMDerivation> & {
+    readonly owner: IOIMSlotOwner;
+    readonly computedValueService: IOIMComputedValueService<TValue>;
+    readonly value: TValue;
+    readonly checkedAtRevision: number;
+    readonly checkedAtEpoch: number;
+    readonly isDeriving: boolean;
+    readonly allRootSlots: readonly TOIMSlot[] | undefined;
+};
+
+interface IOIMComputedValueService<TValue = unknown> {
+    getValueForSlot(computedSlot: TOIMComputedSlot<TValue>): TValue;
+}
+```
+
+A computed is a SLOT, the plain data type `TOIMComputedSlot`. Its owner is the slot owner of the
+`OIMComputedService` that minted it, and the service is the only writer of the slot. The value service
+(`OIMComputedValueService`, which every computed slot carries as `computedValueService`) holds the
+`sameValueGuard` ONCE, the store slot holds its `derive` and `createSources` and its channel slot's clock,
+and the value service serves the value. Every source list in this engine —
+`createEffect`'s third argument and `sourceComputeds` — is typed
+`readonly TOIMComputedSlot[]`; a source computed is a slot taken from its own
+service, through `computedCollectionService.getSlotByKey(storeSlot, key)` (`undefined` for a single). Inside
+`derive`, `computedSlot.value` is the previous value.
+
+A derivation is **asked, never woken**. A chain short-circuits on "did anything I
+read move?", so `filter → sort → page` over quiet roots is a walk of integer
+comparisons. A cycle cannot be built.
+
+**Creating a service or a store slot takes no hold.** A computed slot is held on every slot in its
+`sourceSlots` and on every entry of its `sourceComputeds`, and the holder is its
+owner: it takes them when it mints the slot and gives them back when the slot's content is released.
+The slot dies when nothing holds it; the store slot lives on and mints a fresh slot on
+the next read or hold.
+
+### One derivation per key
+
+```ts signature
+class OIMComputedService<TKey, TValue, TComputedStore> {
+    constructor(options: TOIMComputedServiceOptions<TKey, TValue, TComputedStore>);
+    readonly computedCollectionService: OIMSlotCollectionService<TKey, TOIMComputedSlot<TValue, TKey>, TComputedStore,
+        OIMComputedValueService<TKey, TValue>, Extract<keyof TValue, string>, TOIMComputedColumnSlot, OIMColumnOwnerPullDriven>;
+    createComputedStoreSlot(channelMap: IOIMChannelMap, derive?, createSources?): TOIMComputedStoreSlot<TComputedStore, TValue, TKey>;
+}
+
+createOIMComputedService<TKey, TValue, TComputedStore = Map<TKey, TOIMComputedSlot<TValue, TKey>>>({
+    createSources?: (key: TKey, storeSlot: TOIMStoreSlot | undefined) => Partial<TOIMComputedSources>;
+    derive?: (computedSlot: TOIMComputedSlot<TValue, TKey>) => TValue;
+    sameValueGuard?: TOIMSameValueGuard<TValue>;   // default Object.is
+    initialValue?: TValue;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;     // default OIMSlotReleasePolicyAtUnhold.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;  // OIMDefaults.COMPUTED_COLUMN_SLOT_STORE_SERVICE
+    columnNames?: readonly Extract<keyof TValue, string>[];
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<TValue, TKey>, TComputedStore>;  // Map; REQUIRED for any other store
+}): OIMComputedService<TKey, TValue, TComputedStore>
+```
+
+The factory takes no db: a computed service is configuration, and each store slot takes its channel slot at
+`createComputedStoreSlot(db, …)`.
+
+**`derive` and `createSources` come from the store slot or from the service.** Each one a store
+slot is given (`createComputedStoreSlot(db, derive, createSources)`) is used for that store slot; each one it is
+not given comes from the service's options. A store slot that would end up without one of the two throws by name at
+`createComputedStoreSlot`. So one service per value type can serve many derivations, each its own store slot.
+
+Doors of a keyed computed store slot are the read doors of `computedCollectionService`, each taking it first:
+`getSlotByKey(storeSlot, key)`, `holdSlotByKey(storeSlot, key)`, `findSlotByKey(storeSlot, key)`,
+`getSlots(storeSlot)`, `getSlotCount(storeSlot)`, and the column doors; the value is
+`slot.computedValueService.getValueForSlot(slot)`, and a give-back is `slot.owner.unholdSlot(slot)`.
+
+**One service, both computed shapes.** A keyed store slot and a single one — a store slot of a
+`void`-keyed service over `OIMSlotStoreServiceSingleSlotDriven.INSTANCE` — outlive every computed slot they
+mint, and mint a fresh one on the next read or hold once the previous one is gone. There is no
+single-computed class and no single-computed door: the single one is read by key `undefined`.
+
+```ts
+const topRankService = createOIMComputedService<void, number, TOIMSingleSlotStore<TOIMComputedSlot<number, void>>>({
+    computedSlotStoreService:
+        OIMSlotStoreServiceSingleSlotDriven.INSTANCE as unknown as OIMSlotStoreServiceSingleSlotDriven<TOIMComputedSlot<number, void>>,
+    sameValueGuard: oimSameValueZeroGuard,
+    initialValue: -1,
+});
+const topRank = topRankService.createComputedStoreSlot(
+    db,
+    () => cardService.getSlotByKey(cards, 'c1').entity?.rank ?? -1,
+    () => ({ sourceSlots: [cardService.getSlotByKey(cards, 'c1')] }),
+);
+const heldTopRank = topRankService.computedCollectionService.holdSlotByKey(topRank, undefined);   // the same slot while anything holds it
+heldTopRank.computedValueService.getValueForSlot(heldTopRank);
+heldTopRank.owner.unholdSlot(heldTopRank);        // gone; the next holdSlotByKey(topRank, undefined) mints a new one
+```
+
+A single computed store slot has one key, `undefined`, and a store of one slot. `getSlotByKey(storeSlot,
+undefined)` hands a slot without a hold — a fresh one goes to the unused-slot collector and is let go at the
+next flush unless something holds it — and `holdSlotByKey(storeSlot, undefined)` holds the live slot, minting
+one if the previous is gone. A computed slot goes at its last unhold once no effect reads it
+(`OIMSlotReleasePolicyAtUnhold`, the default), and gives back the holds it took on its
+sources. A last unhold during a flush releases at the end of that flush, through the
+db's unused-slot collector, as for every non-empty slot. The holds a computed takes on its sources and
+gives back are one stateless service, shared by both shapes.
+
+**`createSources` takes the key and the store slot, and nothing else. There is no `keep`.** A build that
+needs a source resolves it with `holdSlotByKey` or `getSlotByKey` like any other caller,
+and the holds the service itself takes are the ones named in
+`sourceSlots` / `sourceComputeds` — so the source list IS the dependency
+list, and a source a build closes over without naming is a source nothing holds.
+
+**A derivation is never empty.** `OIMComputedService` answers
+"empty" with `false`, so a filed derivation is released only when nothing holds
+it, nothing watches it, and the grace is `0` — which is what
+`OIMSlotReleasePolicyAtUnhold` answers, and the default when no `slotReleasePolicy` is given.
+
+```ts setup
+const rankService = createOIMComputedService<TOIMStoreKey, number>({
+    createSources: (id: TOIMStoreKey) => ({ sourceSlots: [cardService.getSlotByKey(cards, id)] }),
+    derive: (computedSlot) => cardService.getSlotByKey(cards, computedSlot.key).entity?.rank ?? -1,
+    sameValueGuard: oimSameValueZeroGuard,
+    initialValue: -1,
+});
+const ranks = rankService.createComputedStoreSlot(db);
+```
+
+```ts
+const rank = rankService.computedCollectionService.holdSlotByKey(ranks, 'c1');
+rank.computedValueService.getValueForSlot(rank);
+rank.owner.unholdSlot(rank);
+```
+
+### Computed columns
+
+A computed's value can be subscribed to by field. `getColumn(slot, columnName)`, `holdColumn(slot, columnName)`,
+`getColumnGroup(names)`, `holdColumnGroup(slot, group)`, `unholdColumn(columnSlot)`, and the
+any-column pair `getAnyColumn(slot)` / `holdAnyColumn(slot)` are on `computedCollectionService`
+(so on the sorted and memo services too), for keyed and single store slots alike; a single one passes
+`getSlotByKey(storeSlot, undefined)` as the slot. Column names are typed as the keys of the value.
+
+A computed service's column owner is the derive-driven strategy: each column slot is a computed slot
+over the carrier computed, its value `carrier.value[column]` (a tuple of the group's fields, ordered by the sorted column names, for a group,
+the whole value for the any-column), compared with `Object.is`. It is a `TOIMComputedColumnSlot`
+(`TOIMComputedSlot<unknown, string>`), so it goes in the SECOND array of `createEffect`, and its value
+is read off `columnSlot.value`. It wakes an effect only when that field of the derived value changes.
+Pinned by `facade/computed/tests/what-a-computed-column-wakes-on.test.ts`.
+
+```ts
+type Summary = { top: number; count: number };
+const summaryService = createOIMComputedService<void, Summary, TOIMSingleSlotStore<TOIMComputedSlot<Summary, void>>>({
+    computedSlotStoreService:
+        OIMSlotStoreServiceSingleSlotDriven.INSTANCE as unknown as OIMSlotStoreServiceSingleSlotDriven<TOIMComputedSlot<Summary, void>>,
+});
+const summary = summaryService.createComputedStoreSlot(
+    db,
+    () => ({ top: slot.entity?.rank ?? -1, count: cardService.getSlotCount(cards) }),
+    () => ({ sourceSlots: [slot] }),
+);
+const summaryCollectionService = summaryService.computedCollectionService;
+const summaryTop = summaryCollectionService.holdColumn(summaryCollectionService.getSlotByKey(summary, undefined), 'top');
+const topEffect = effectService.createEffect(db, [], [summaryTop], () => { paint(slot.entity); });
+effectService.disposeEffect(topEffect);
+summaryCollectionService.unholdColumn(summaryTop);
+```
+
+### The order of a bucket, as one derivation per key
+
+```ts signature
+createOIMComputedServiceBucketMemo<TKey, TBucketMemberSlot extends TOIMSlot, TSlots, TBucketStore, TComputedStore?>({
+    bucketCollectionService: OIMSlotCollectionService<TKey, TOIMBucketSlot<TSlots, TKey>, TBucketStore, OIMSlotContentBucketService<TBucketMemberSlot, TSlots>, …>;
+    slotReleasePolicy?: IOIMSlotReleasePolicy;      // default OIMSlotReleasePolicyAtUnhold.INSTANCE
+    columnSlotStoreService?: IOIMSlotStoreService<string, TOIMComputedColumnSlot>;
+    computedSlotStoreService?: IOIMSlotStoreService<TKey, TOIMComputedSlot<readonly TBucketMemberSlot[], TKey>, TComputedStore>;
+}): OIMComputedServiceBucketMemo<TKey, TBucketMemberSlot, TSlots, TBucketStore, TComputedStore>
+
+createBucketMemoStoreSlot(bucketStoreSlot: TOIMStoreSlot<TBucketStore, TOIMBucketSlot<TSlots, TKey>, readonly TBucketMemberSlot[]>): TOIMStoreSlot<TComputedStore, TOIMBucketMemoComputedSlot<TBucketMemberSlot, TKey>>
+```
+
+It takes no db: a memo store slot runs on the channel slot of the bucket store slot it reads. The class is
+`new OIMComputedServiceBucketMemo(options)` (options type `TOIMComputedServiceBucketMemoOptions`), whose
+`computedCollectionService` reads the per-key derivations; `createBucketMemoStoreSlot(bucketStoreSlot)` makes
+one memo store slot over one bucket store slot.
+
+Subscribe to THIS, not to the bucket, when a consumer wants the list as an array
+it can compare by identity. The value is the bucket's slots in the bucket's order;
+it is produced on the read that asks for it and never while nothing reads it, and
+its `changedAtRevision` and `changedAtEpoch` move only when the list a reader would
+see actually changed. The list is handed back by IDENTITY: it is the same array for
+as long as the list holds, so a consumer memoising on identity needs no comparison
+of its own. For a SORTED list use [`createOIMComputedServiceSorted`](#sorted-lists).
+
+The source list is ONE slot — the bucket — and it never grows: a bucket
+change is a move of the bucket's value, not of the derivation's sources.
+
+```ts
+const orderService = createOIMComputedServiceBucketMemo({
+    bucketCollectionService: orderedService,
+});
+const order = orderService.createBucketMemoStoreSlot(ordered);
+const deck = orderService.computedCollectionService.holdSlotByKey(order, 'spades');        // mints the bucket too, and holds it
+effectService.createEffect(db, [], [deck], () => render(deck.computedValueService.getValueForSlot(deck)));
+```
+
+---
+
+## Key stores
+
+```ts signature
+interface IOIMSlotStoreService<TKey, TSlot extends TOIMKeyedSlot = TOIMKeyedSlot, TStore = unknown> {
+    createStore(): TStore;
+    ownKey<TOwnedKey extends TKey>(key: TOwnedKey): TOwnedKey;
+    isSameKey(key: TKey, otherKey: TKey): boolean;
+    get(store: TStore, key: TKey): TSlot | undefined;
+    set(store: TStore, key: TKey, slot: TSlot): void;
+    remove(store: TStore, key: TKey): void;
+    getSlots(store: TStore): IterableIterator<TSlot>;
+    getSlotCount(store: TStore): number;
+}
+```
+
+**The store service is STATELESS and the storage is its first argument.** It
+builds the storage with `createStore()` and the store slot keeps it, as `storeSlot.store`; `getSlotCount` is a
+method taking that storage, not a getter. One store service instance can
+therefore serve every store slot of every service in a process.
+
+**`ownKey(key)` is the key a slot is minted with, and the store never touches a
+slot.** The content service asks it once, before the slot owner's `createSlot`, so the slot's `key` is
+written by its owner and no one else. The map-driven store answers the key itself;
+the tree-driven one answers a copy of the composite key, so a caller reusing the
+array it handed in cannot change the key of a slot already filed.
+
+**`isSameKey(key, otherKey)` is what the store means by one key.** The map-driven
+store answers SameValueZero; the tree-driven one compares length and then every
+part by SameValueZero, so two arrays with the same parts are one key. Every collection
+service answers the same question as `service.isSameKey(key, otherKey)`, asking
+its own store service; an index deciding whether a key moved first checks `===` (the key
+columns did not change) and otherwise asks its bucket store service.
+
+```ts signature
+type TOIMSlotStoreTree<TSlot, TCompositeKeyPart> = {
+    readonly root: TOIMCompositeKeyNode<TSlot, TCompositeKeyPart>;
+    readonly slots: Set<TSlot>;
+};
+
+type TOIMCompositeKeyNode<TAtKey = unknown, TCompositeKeyPart = TOIMEntitySlot> = {
+    childNodes: Map<TCompositeKeyPart, TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>> | undefined;
+    atThisKey: TAtKey | undefined;
+};
+```
+
+`TOIMSlotStoreTree` is what `OIMSlotStoreServiceTreeDriven.createStore()` builds:
+the tree's root plus a flat `Set` of every filed slot, which makes `getSlots()` and
+`getSlotCount()` O(1) rather than a walk, and keeps `getSlots()` in filing order like every other store.
+`TOIMCompositeKeyNode` is one level of that tree — a `Map` from composite key part to the
+level below, created only when the first longer key is filed under it (a leaf has
+`childNodes: undefined`), and the slot, if any, whose key ends here. Both are exported so a caller can annotate the storage they
+are holding; neither is something you build by hand.
+
+| Store | Key type |
+|---|---|
+| `OIMSlotStoreServiceMapDriven<TSlot>` | `TOIMStoreKey` = `string \| number` |
+| `OIMSlotStoreServiceTreeDriven<TOIMStoreKey, TSlot>` built with `OIMDefaults.KEY_TREE_WALK_SCALAR.getValue()` | `readonly TOIMStoreKey[]` — **a chain of VALUES** |
+| `OIMSlotStoreServiceTreeDriven<TOIMEntitySlot, TSlot>` built with `OIMDefaults.KEY_TREE_WALK_COMPOSITE.getValue()` | `readonly TOIMEntitySlot[]` — **a chain of entity SLOTS** |
+| `OIMSlotStoreServiceSingleSlotDriven.INSTANCE` | `void` — one slot per store slot, its store a `TOIMSingleSlotStore` (`{ slot }`); what every single is built on |
+
+Two stores for keys, one per shape of address, and the single-slot store for no key. The chain store descends one `Map`
+lookup per composite key part, keeps `[a]` and `[a, b]` apart, and has **no encoding step**:
+`JSON.stringify` and a NUL-join were both rejected — the latter was not
+injective, so `['a b']` and `['a', 'b']` were one key.
+
+**The two DESCENTS are a fork chosen at construction, and the choice is about
+lifetime.** The store takes an `IOIMKeyTreeWalk<TCompositeKeyPart>` as its only
+constructor argument; there is no runtime branch on what a composite key part is, and the
+first type parameter is the composite key part type. Do not treat the strategies as one store
+with looser typing, and do not expect a class per strategy — there is one store class
+and two walks.
+
+```ts signature
+interface IOIMKeyTreeWalk<TCompositeKeyPart> {
+    mintNodeAt<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>;
+    nodeAt<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart> | undefined;
+    deleteKey<TAtKey>(
+        rootCompositeKeyNode: TOIMCompositeKeyNode<TAtKey, TCompositeKeyPart>,
+        compositeKey: readonly TCompositeKeyPart[],
+    ): TAtKey | undefined;
+}
+```
+
+`deleteKey` takes the value filed at the key and hands it back, in one descent:
+one `Map.get` per key part and no array of the path. On the way back up it
+unlinks every node the delete left empty and stops at the first one that still
+holds a value or leads to a longer key, so `['u1', 'p7', 'x']` survives a delete
+of `['u1', 'p7']`. A key that is only a prefix of filed keys, or reaches nothing,
+deletes nothing and returns `undefined`.
+
+| Walk | Class | Shared instance | What a composite key part is | Holds? |
+|---|---|---|---|---|
+| scalar | `OIMKeyTreeWalkScalar` | `OIMDefaults.KEY_TREE_WALK_SCALAR.getValue()` | `TOIMStoreKey` | no |
+| composite | `OIMKeyTreeWalkComposite` | `OIMDefaults.KEY_TREE_WALK_COMPOSITE.getValue()` | `TOIMEntitySlot` | **yes — one hold per edge** |
+
+**The hold is the whole difference.** `OIMKeyTreeWalkComposite.mintNodeAt` calls
+`holdCompositeKeyPart` the first time it creates an edge, which runs
+`entitySlot.owner.holdSlot(entitySlot)`; `deleteKey` calls `unholdCompositeKeyPart` on
+exactly the edges it unlinked, deepest first and only after every unlink is done, which runs `entitySlot.owner.unholdSlot(entitySlot)` unless
+`oimIsSlotReleased(entitySlot)` — so an entity slot stays addressable for
+as long as its composite key parts are, and a composite key part nothing else refers to goes the
+moment the last entity keyed on it does. The scalar walk holds nothing: a value has
+no identity to keep alive. Both throw `an empty key is not a key` on `[]`.
+
+Construct the classes yourself only if you want your own instance; both walks are
+stateless, and the shared one on `OIMDefaults` is what you normally pass.
+
+```ts
+// A CHAIN OF VALUES — `['deck-1', 'red']`.
+type TScalarChain = readonly TOIMStoreKey[];
+type Tally = { deck: string; day: string; count: number };
+type TTallyStore = import('@oimdb/core').TOIMSlotStoreTree<TOIMEntitySlot<Tally, TScalarChain>, TOIMStoreKey>;
+
+const tallyService = createOIMSlotCollectionService({
+    slotContentService: createOIMSlotContentEntityService<Tally, keyof Tally, TScalarChain, TTallyStore>(db, {
+        slotStoreService: new OIMSlotStoreServiceTreeDriven<TOIMStoreKey, TOIMEntitySlot<Tally, TScalarChain>>(
+            OIMDefaults.KEY_TREE_WALK_SCALAR.getValue(),
+        ),
+        keyOf: (t) => [t.deck, t.day],
+    }),
+});
+const tallies = tallyService.createStoreSlot(db);
+tallyService.slotContentService.upsertEntity(tallies, { deck: 'spades', day: 'mon', count: 1 });
+tallyService.getSlotByKey(tallies, ['spades', 'mon']);
+```
+
+```ts
+// A CHAIN OF IDENTITIES — each composite key part is a slot, and each edge takes a counted
+// hold on it, so the entity keeps its composite key parts resolvable for as long as it is
+// addressable.
+type User = { id: string };
+type Group = { id: string };
+declare const alice: TOIMEntitySlot<User, TOIMStoreKey>;
+declare const admins: TOIMEntitySlot<Group, TOIMStoreKey>;
+
+type Enrolment = {
+    user: TOIMEntitySlot<User, TOIMStoreKey>;
+    group: TOIMEntitySlot<Group, TOIMStoreKey>;
+    since: number;
+};
+type TChain = readonly TOIMEntitySlot[];
+type TEnrolmentStore = import('@oimdb/core').TOIMSlotStoreTree<TOIMEntitySlot<Enrolment, TChain>, TOIMEntitySlot>;
+
+const enrolmentService = createOIMSlotCollectionService({
+    slotContentService: createOIMSlotContentEntityService<Enrolment, keyof Enrolment, TChain, TEnrolmentStore>(db, {
+        slotStoreService: new OIMSlotStoreServiceTreeDriven<TOIMEntitySlot, TOIMEntitySlot<Enrolment, TChain>>(
+            OIMDefaults.KEY_TREE_WALK_COMPOSITE.getValue(),
+        ),
+        keyOf: (m) => [m.user, m.group],
+    }),
+});
+const enrolments = enrolmentService.createStoreSlot(db);
+enrolmentService.slotContentService.upsertEntity(enrolments, { user: alice, group: admins, since: 2026 });
+enrolmentService.getSlotByKey(enrolments, [alice, admins]);
+```
+
+**Never put a scalar in a composite-walk key.** It is a type error, and
+past a cast it throws a TypeError inside the mint, setting `holdCount` on a
+string, after the edge is already in the tree. `OIMDefaults.KEY_TREE_WALK_SCALAR.getValue()` is
+the walk for that key — the same store class, the other strategy.
+
+**Compare a chain with the strategy that matches it**: `oimSameSlotSequence` for identities
+(reference, per composite key part), `oimSameKeySequence` for a chain or list of values.
+`oimSameSlotSequence` over a scalar chain is the `NaN` defect — it answers "a different
+address" for the address the tree is looking at.
+
+---
+
+## Lifetime — the owner protocol
+
+**`slot.owner` is the only reference a slot carries, and it is never
+`undefined`.** Every slot minted anywhere has one; a slot nothing filed carries
+`OIMDefaults.STANDALONE_SLOT_OWNER.getValue()`, a slot a collection filed carries that collection type's slot owner (an `OIMSlotOwnerService`) — keyed or single alike — and a slot that has been released KEEPS its owner
+and raises the RELEASED flag in `slot.slotFlags` instead, which the doors below read.
+
+```ts signature
+interface IOIMSlotOwner {
+    holdSlot(slot: TOIMSlot): void;
+    unholdSlot(slot: TOIMSlot): void;
+    releaseSlotIfUnheld(slot: TOIMSlot): void;
+    subscribeToSlot(slot: TOIMSlot, effect: TOIMEffect, edge: number): number;
+    unsubscribeFromSlot(slot: TOIMSlot, at: number, effect: TOIMEffect): boolean;
+}
+```
+
+At a deadline the release queue reads its MARKER off the slot, decides, and calls
+`releaseSlotIfUnheld` itself. The owner has no "how long is left" question.
+
+| Door | What it is for |
+|---|---|
+| `holdSlot(slot)` | `holdCount++`. That is all — no handle, no `{ slot, release }` record. **Throws by name** on a released slot |
+| `unholdSlot(slot)` | `holdCount--`, then run `releaseSlotIfUnheld`. **It opens no window** — nothing is stamped here, so a slot whose deadline has passed goes at this call. **Throws by name** on a released slot, and when `holdCount` is already `0`: a second unhold against one hold would release a slot somebody else is reading |
+| `releaseSlotIfUnheld(slot)` | run the release guard. Releases only an unheld, unreferenced, still-owned, out-of-grace slot; **returns silently** on one already released |
+| `subscribeToSlot(slot, effect, edge)` | push the effect onto `slot.effects` and its `edge` (which of the effect's sources this slot is) onto `slot.effectEdges`, and hand back **the position**, which the effect remembers. **It takes a hold** through `holdSlot`, so a subscribed slot is a held one and nothing can subscribe without holding. **Throws by name** on a released slot: a subscriber filed on one would never be woken |
+| `unsubscribeFromSlot(slot, at, effect)` | swap the tail of both arrays into `at`, tell the moved effect its new position at its edge (one write, no search), and **if that emptied the list, `onSlotIdle(slot)` opens a fresh idle window**, then give the subscription's hold back through `unholdSlot`; hand back whether it unfiled. Unfiling by remembered position is why taking N subscribers off one identity is O(N) and not quadratic. **Throws by name** on a released slot |
+
+**`OIMSlotOwner`** is the base class and it is concrete: it implements all five.
+Its `releaseSlotIfUnheld` does nothing, and a `protected
+onSlotIdle` does nothing; a `protected assertNotReleased` is what every refusing
+door above calls. `OIMSlotOwnerService` overrides `onSlotIdle` and
+`releaseSlotIfUnheld`, asking its release policy and its content strategy; the clock is the slot's channel slot's.
+Extend `OIMSlotOwner` when you own slots that no collection files.
+**`OIMDefaults.STANDALONE_SLOT_OWNER`** is one shared instance of it — the owner of a
+computed slot nobody has filed. It never releases anything, which is exactly what
+"filed nowhere, so nothing can unfile it" means. A single's slot is not such a slot: its
+owner is its collection type's slot owner, and that release policy applies to it.
+
+### The column owner
+
+**Columns are a module of every collection.** The column slots of a carrier slot live
+in `carrierSlot.columnSlotStore`, a field of the base `TOIMSlot`, so any slot can carry
+them — an entity slot, a bucket slot, a computed slot. `OIMColumnOwner` is abstract, an
+`OIMSlotOwner` subclass, with two strategies:
+`OIMColumnOwnerPushDriven` (plain column slots woken by marks on a write; entity and bucket collections,
+keyed and single) and `OIMColumnOwnerPullDriven` (each column slot a computed slot over its carrier;
+computed collections, keyed and single). The factory hands the strategy's factory to the slot owner as
+`createColumnOwner`. Each collection type has its own column owner, and every column slot it mints names that
+owner as its `owner`. The owner holds only the column slot store service; the column state — the column
+groups and which columns are referenced — lives on the store slot. The collection exposes it only
+through its column doors: `getColumn(slot, columnName)`, `holdColumn(slot, columnName)`,
+`unholdColumn(columnSlot)`, `getColumnGroup(names)`, `holdColumnGroup(slot, group)` (on
+a single the same doors, with the slot `getSingleSlot(storeSlot)` hands back; the computed ones take a computed slot
+and return a `TOIMComputedColumnSlot`), and `getAnyColumn(slot)` / `holdAnyColumn(slot)`.
+A column slot is released the moment its last effect is disposed and nothing holds it:
+disposing the effect gives its hold back through the column owner, which then runs its own
+`releaseSlotIfUnheld`, which stops on `holdCount > 0` or a non-empty `effects`,
+takes the column out of the carrier slot's column store — dropping that store
+entirely when it empties — sets the RELEASED flag of `columnSlot`, and then runs
+`carrierSlot.owner.releaseSlotIfUnheld(carrierSlot)`, because a carrier kept alive only by
+a watched column is one nothing watches any more. This guard is the one place a store
+lookup survives — it compares `columnSlotStoreService.get(columnSlotStore, columnSlot.key)`
+against the column slot — because a column is filed on its carrier slot, not in the
+store slot that the `owner` check covers.
+`OIMSlotOwnerService`'s release guard refuses while `slot.columnSlotStore` stands,
+so a slot with any live column slot is never released.
+
+---
+
+## Ordered lists
+
+### Disposers
+
+The disposers this package hands back are the unsubscribes `OIMChannelService.INSTANCE.subscribeAfterEachFrame`
+and its siblings return, and the one `effectService.subscribeEffect(db, sourceSlots, sourceComputeds, body)`
+returns. An effect from `createEffect` has none, so the caller writes
+`() => effectService.disposeEffect(effect)`. A hold is given back through its owner, not through a disposer.
+
+```ts
+const effect = effectService.createEffect(db, [slot], [], () => { paint(slot.entity); });
+const disposers: TOIMDisposer[] = [];
+disposers.push(() => { effectService.disposeEffect(effect); });
+disposers.push(() => { slot.owner.unholdSlot(slot); });
+for (let i = disposers.length - 1; i >= 0; i--) disposers[i]();
+```
+
+### `oimOrderedListCommandsOfTransition`
+
+```ts signature
+oimOrderedListCommandsOfTransition(
+    prev: readonly TOIMEntitySlot[],
+    next: readonly TOIMEntitySlot[],
+    maxCommandsPerSlot?: number,   // commands per slot of `next`; left out, it NEVER resets
+): TOIMOrderedListCommand[]
+
+type TOIMOrderedListCommand =
+    | { type: 'insert'; index: number; slot: TOIMEntitySlot }
+    | { type: 'remove'; index: number }
+    | { type: 'move'; from: number; to: number }
+    | { type: 'reset'; slots: readonly TOIMEntitySlot[] };
+```
+
+A free function, not a method on `OIMChannelService`: a class's methods cannot be
+dropped one at a time by a bundler.
+
+`prev` MUST BE A SNAPSHOT TAKEN WHERE YOU RENDERED. Every member read on a bucket
+content service hands back the LIVE list — declared `Iterable`, not an array, so
+`Array.from(bucketService.slotContentService.getBucketMemberSlots(bucketSlot))` is required and is the copy. A `prev` kept
+live is the same array as `next` on the following frame: the diff is empty,
+no reorder is ever drawn, and nothing throws. The other safe `prev` is
+`createOIMComputedServiceBucketMemo`'s value — a fresh array on every write that
+changed the list, the same array while it did not.
+
+A LIST MAY NAME ONE SLOT TWICE, and then it holds that slot twice.
+`OIMBucketArrayMembershipNonUnique` — the default strategy of `OIMSlotContentBucketServiceArrayDriven` —
+records every mention, so an ordered bucket's list is exactly such a list. The
+mentions of one identity are matched in the order they appear, and the script
+reproduces `next` mention for mention. The minimal move count (`common − LIS`)
+is claimed for lists whose identities are distinct: where the two lists name one
+identity a different number of times, which mentions are matched decides how
+long the common subsequence can be, and matching them in order does not always
+leave the longest.
+
+---
+
+## Types
+
+```ts signature
+type TOIMStoreKey = string | number;
+type TOIMDisposer = () => void;
+type TOIMEffectBody = () => (() => void) | void;   // a returned function is the undo
+type TOIMEffectBodyWithSourceTracking = (effectSourceTracker: OIMEffectSourceTracker) => (() => void) | void;
+type TOIMSameValueGuard<TValue = unknown> = (prev: TValue, next: TValue) => boolean;
+type TOIMChannelScheduler = (flush: () => void) => void;
+type TOIMSortColumn<TEntity extends object> = { column: TOIMSortableColumnName<TEntity>; direction: 'asc' | 'desc' };
+type TOIMSortableColumnName<TEntity extends object> =   // a column whose values are string | number | bigint
+    { [TColumn in keyof TEntity]-?: NonNullable<TEntity[TColumn]> extends string | number | bigint ? TColumn : never }[keyof TEntity] & string;
+
+// EVERY property is `readonly`. A slot is written through its owner and its
+// service, never by assigning to it; `TOIMSlotEditable` is how the engine
+// itself drops that guard where it is the one mutator.
+type TOIMSlot = {
+    readonly effects: TOIMEffect[] | undefined;
+    readonly effectEdges: number[] | undefined; // beside each effect, which of its sources this slot is
+    readonly changedAtRevision: number;
+    readonly changedAtEpoch: number;
+    readonly holdCount: number;
+    readonly releaseDueAfterWriteMs: number; // -1 until a write stamps it
+    readonly releaseDueAfterIdleMs: number;  // -1 until idleness stamps it
+    readonly releaseDueAfterUnholdMs: number; // -1 until the last unhold stamps it
+    readonly slotFlags: number;        // OIM_SLOT_FLAG_EMPTY = 1, OIM_SLOT_FLAG_RELEASED = 2
+    readonly columnSlotStore: unknown; // the column slots this slot carries; undefined while none
+    readonly storeSlot: TOIMStoreSlot | undefined;
+    readonly owner: IOIMSlotOwner;     // never undefined, never cleared
+};
+
+// A store slot is NOT a slot: nothing holds, subscribes or wakes it. It is the state of one
+// collection instance — its store, its channel slot, its listeners and column state — and every
+// service that touches it is stateless. Only the fields a consumer reads are shown.
+type TOIMStoreSlot<TStore = unknown, TSlot extends TOIMSlot = TOIMSlot, TPatch = unknown> = {
+    readonly store: TStore;
+    readonly channelSlot: TOIMChannelSlot;
+    readonly contentChangeListeners: IOIMContentChangeListener<TSlot, TPatch>[] | undefined;
+    readonly contentChangeListenerReadColumnNames: (readonly string[] | undefined)[] | undefined;
+    readonly indexKeysPositions: TOIMIndexKeysPositions | undefined;
+    readonly sourceStoreSlot: TOIMStoreSlot | undefined;   // an index store slot's source
+    readonly isDisposed: boolean;                          // an index store slot after disposeIndexStoreSlot
+    // … column-reader counts, column groups, subframe queues, bucket write queues: the services' own
+};
+
+type TOIMSingleSlotStore<TSlot> = { slot: TSlot | undefined };
+type TOIMSingleSlotStoreSlot<TSlot extends TOIMSlot, TPatch = unknown> = TOIMStoreSlot<TOIMSingleSlotStore<TSlot>, TSlot, TPatch>;
+
+type TOIMIndexStoreSlot<TStore, TBucketSlot, TBucketPatch, TSourceSlot, TSourcePatch, TKey, TSourceStore> =
+    TOIMStoreSlot<TStore, TBucketSlot, TBucketPatch> & {
+        readonly sourceStoreSlot: TOIMStoreSlot<TSourceStore, TSourceSlot, TSourcePatch>;
+        readonly indexKeysPosition: number;
+        readonly contentChangeListener: IOIMContentChangeListener<TSourceSlot, TSourcePatch>;
+        readonly requestedKeys: readonly TKey[] | undefined;
+        readonly bucketColumnNames: Set<string>;
+        readonly isAnyBucketColumnRead: boolean;
+        readonly isDisposed: boolean;
+    };
+
+type TOIMComputedStoreSlot<TStore = unknown, TValue = unknown, TKey = unknown> =
+    TOIMStoreSlot<TStore, TOIMComputedSlot<TValue, TKey>> & {
+        readonly derive: ((computedSlot: TOIMComputedSlot<TValue, TKey>) => TValue) | undefined;
+        readonly createSources: ((key: TKey, storeSlot: TOIMStoreSlot | undefined) => Partial<TOIMComputedSources>) | undefined;
+    };
+
+type TOIMSlotEditable<TSlot> = { -readonly [K in keyof TSlot]: TSlot[K] };
+
+type TOIMKeyedSlot<TKey = unknown> = TOIMSlot & { readonly key: TKey };
+type TOIMIndexableSlot<TKey = unknown> = TOIMKeyedSlot<TKey> & { readonly indexKeys: unknown[] | undefined };
+
+type TOIMEntitySlot<TEntity extends object = object, TKey = unknown> = TOIMIndexableSlot<TKey> & {
+    readonly entity: TEntity | undefined;
+    readonly data: unknown[] | undefined;
+};
+
+// `data` belongs to the consumer: the core never reads or writes it, and clearing or
+// removing the slot (`slotContentService.deleteEntity(slot)`) does not reset it. Each index keeps its
+// last key for the entity slot in `indexKeys`, through the db's `IOIMIndexKeysService`.
+
+type TOIMColumnSlot = TOIMSlot & {
+    readonly carrierSlot: TOIMSlot;    // the entity slot or bucket slot it hangs off
+    readonly key: string;
+};
+
+type TOIMComputedColumnSlot = TOIMComputedSlot<unknown, string>;   // a computed's getColumn / holdColumn return it; it goes in createEffect's second list
+
+type TOIMBucketSlot<TSlots = unknown, TKey = unknown> = TOIMIndexableSlot<TKey> & {
+    readonly owner: IOIMSlotOwner;
+    readonly storeSlot: TOIMStoreSlot<unknown, TOIMBucketSlot<TSlots>>;
+    readonly bucketSlotsStore: TSlots;
+    readonly commands: readonly TOIMOrderedListCommand[] | undefined;   // emptied when the flush has ended
+    readonly isWholeListRecorded: boolean;                               // reset to false with it
+    readonly commandsStartedAtRevision: number;                          // the clock the script started at
+    readonly commandsStartedAtEpoch: number;
+    readonly wasEmptyBeforeChange: boolean | undefined;
+    readonly isChangedAgainInSubframe: boolean;
+};
+
+// `holdSlotByKey(storeSlot, key)` hands back the slot itself; give the hold back with `slot.owner.unholdSlot(slot)`.
+
+type TOIMBucketSlotsSetStore<TBucketMemberSlot extends TOIMSlot = TOIMSlot> = Set<TBucketMemberSlot>;
+type TOIMBucketSlotsArrayStore<TBucketMemberSlot extends TOIMSlot = TOIMSlot> = {
+    bucketMemberSlots: TBucketMemberSlot[];
+};
+type TOIMBucketSlotsArrayUniqueStore<TBucketMemberSlot extends TOIMSlot = TOIMSlot> =
+    TOIMBucketSlotsArrayStore<TBucketMemberSlot> & { uniqueBucketMemberSlots: Set<TBucketMemberSlot> };
+
+type TOIMEntityColumnName<TEntity extends object> =
+    [TEntity] extends [never] ? never
+        : object extends TEntity ? string : keyof TEntity & string;
+
+type TOIMDerivation = TOIMComputedSources & {   // what a computed slot and a TOIMEffect share
+    ranAtRevision: number; ranAtEpoch: number;
+};
+
+type TOIMTimer = (run: () => void, inMs: number) => TOIMDisposer;
+```
+
+**`TOIMSlotEditable<TSlot>` strips `readonly` from every property.** It is exported
+because the rule "data has one mutator" is enforced by the slot types being
+readonly everywhere else: a class that IS the sole mutator of a slot's property
+casts through this type at the one place it writes, and every other reader is
+stopped by the compiler. `IOIMSlotStamp.stamp` takes one, which is what lets a
+stamp write `releaseDueAfterWriteMs` and nothing else write it. **Do not reach for this to
+work around a compile error** — if you need it and you do not own the property,
+the mutation belongs on whoever does.
+
+Comparison helpers — one per shape of address, plus the value rule. Use the one
+that matches what you are comparing; they are not interchangeable.
+
+| Helper | Compares | Rule |
+|---|---|---|
+| `oimSameValueZeroGuard(prev, next)` | a stored value, or one scalar address | SameValueZero |
+| `oimSameSlotSequence(prev, next)` | `readonly TOIMSlot[]` — a chain of identities | positional, by reference |
+| `oimSameKeySequence(keys, otherKeys)` | `readonly TKey[]` — a list of keys or a chain of values | positional, SameValueZero per key |
+
+---
+
+## Full export list
+
+**200 names, every export of `packages/core/src/index.ts`, grouped by topic.**
+
+*Channel and database slots* — `OIMChannelService` · `TOIMChannelSlot` · `TOIMChannelSlotOptions` · `createOIMChannelSlot` ·
+`IOIMChannelMap` · `TOIMDBOptions` · `OIMFlushSchedulerService` · `TOIMFlushSchedulerSlot`
+
+*Collector services and slots* — `OIMUnusedSlotCollectorService` · `TOIMUnusedSlotCollectorSlot` ·
+`createOIMUnusedSlotCollectorSlot` · `TOIMCollectorSlot` · `TOIMCollectorSlotOptions` · `createOIMCollectorSlot` ·
+`OIMReleaseSlotCollectorService` · `OIMReleaseSlotCollectorServiceAfterIdle` · `OIMReleaseSlotCollectorServiceAfterUnhold` ·
+`OIMReleaseSlotCollectorServiceAfterWrite` · `OIMReleaseSlotQueueService` · `TOIMReleaseSlotCollectorSlot` ·
+`createOIMReleaseSlotCollectorSlot`
+
+*Slot services* — `OIMSlotColumnService` (abstract; the column doors both slot services inherit) ·
+`OIMSlotCollectionService` · `TOIMSlotCollectionServiceOptions` · `createOIMSlotCollectionService` ·
+`OIMSingleSlotService` · `TOIMSingleSlotServiceOptions` · `createOIMSingleSlotService` · `OIMSlotOwnerService` (**type only**) ·
+`TOIMSlotOwnerServiceOptions` · `IOIMSlotContentStrategy` · `IOIMSlotContentFlushStrategy` · `IOIMSubframeCloseListener` ·
+`OIMContentChangeListenerService`
+
+*Content services* — `OIMSlotContentEntityService` · `TOIMSlotContentEntityServiceOptions` ·
+`createOIMSlotContentEntityService` · `TOIMSlotContentEntityServiceFactoryOptions` · `TOIMEntitySlotOwnerService` · `createOIMEntityService` and
+`createOIMSingleEntityService` (convenience wrappers) · `OIMSlotContentBucketService` ·
+`OIMSlotContentBucketServiceArrayBased` · `OIMSlotContentBucketServiceArrayDriven` · `OIMSlotContentBucketServiceSetDriven` ·
+`OIMSlotContentBucketServiceSortedArrayDriven` · `TOIMSlotContentBucketServiceOptions` ·
+`TOIMSlotContentBucketServiceSortedArrayDrivenOptions` · `TOIMBucketSlotOwnerService` · `createOIMBucketService` and
+`createOIMSingleBucketService` (convenience wrappers)
+
+*Index and computed store slots* — `createOIMIndexService` · `TOIMIndexServiceFactoryOptions` ·
+`createOIMIndexServiceByCompositeKey` (convenience wrapper) ·
+`TOIMIndexServiceStoreSlot` · `TOIMSortedComputedSlot` · `TOIMBucketMemoComputedSlot`
+
+*Runtime* — `TOIMChannelFrame` · `TOIMChannelClock` ·
+`TOIMChannelScheduler` · `TOIMDisposer` · `IOIMErrorPolicy` · `OIMErrorPolicyLogAndContinue` ·
+`TOIMErrorPolicyLogAndContinueOptions` · `OIMErrorPolicyThrowAtOnce` · `OIMChannelQueue` (**type only**) ·
+`oimIsAnySlotChangedAfter`
+
+`oimIsAnySlotChangedAfter(slots, revision, epoch): boolean` answers whether any of the slots was
+written after that clock reading — `channelSlot.clock` read earlier.
+
+*Derivations* — `OIMEffectService` · `IOIMEffectService` · `TOIMEffect` (**type only** —
+`OIMEffectService.createEffect` is the constructor) · `TOIMEffectBody` · `TOIMEffectBodyWithSourceTracking` ·
+`OIMEffectSourceTracker` (**type only** — the service builds it) · `TOIMComputedSlot` · `TOIMComputedSources` ·
+`OIMComputedValueService` · `IOIMComputedValueService` · `TOIMComputedValueServiceOptions` · `oimRefreshSourceComputeds` · `TOIMDerivation`
+
+`oimRefreshSourceComputeds(sourceComputeds)` brings every computed in the list current. A binding
+read outside an effect (`useOIMValue` in `@oimdb/react`, `exoBinding` in `@oimdb/exodra`) calls it
+on its `sourceComputeds` before `derive`, so the derive never reads a stale computed.
+
+*Slots and their owners* — `TOIMSlot` · `TOIMStoreSlot` · `TOIMSingleSlotStoreSlot` ·`IOIMStoreSlotListener` · `OIMStoreSlotListenerNone` ·`oimIsSlotEmpty` · `oimIsSlotReleased` · `TOIMSlotEditable` · `TOIMKeyedSlot` · `TOIMIndexableSlot` ·
+`TOIMEntitySlot` · `TOIMColumnSlot` · `TOIMComputedColumnSlot` · `TOIMColumnGroup` · `TOIMColumnReaders` · `OIMColumnOwner` ·
+`OIMColumnOwnerPushDriven` · `OIMColumnOwnerPullDriven` · `TOIMColumnOwnerOptions` · `TOIMBucketSlot` ·
+`TOIMSameValueGuard` · `OIMSlotOwner` ·
+`IOIMSlotOwner` · `IOIMSlotEmptiness` ·
+`IOIMSlotStamp` · `oimHoldSlots` · `oimUnholdSlotsIfAlive` · `IOIMContentChangeListener`
+
+`oimIsSlotEmpty(slot): boolean` reads the EMPTY bit of `slot.slotFlags`.
+`oimIsSlotReleased(slot): boolean` reads its RELEASED bit.
+
+*Release policies* — `IOIMSlotReleasePolicy` ·
+`OIMSlotReleasePolicyAfterWrite` · `TOIMSlotReleasePolicyAfterWriteOptions` ·
+`OIMSlotReleasePolicyAfterIdle` · `TOIMSlotReleasePolicyAfterIdleOptions` ·
+`OIMSlotReleasePolicyAfterUnhold` · `TOIMSlotReleasePolicyAfterUnholdOptions` ·
+`OIMSlotReleasePolicyAtUnhold` · `OIMSlotReleasePolicyAtEmpty` · `OIMSlotReleasePolicyNever` · `OIMSlotReleasePolicyEarliest` ·
+`TOIMTimer` · `oimSliceOfMs` · `OIM_SLICE_LENGTH_MS`
+
+*Entity writers* — `IOIMEntityWriter` · `createOIMEntityWriterInPlace` ·
+`createOIMEntityWriterReplacing` · `TOIMEntityWriterOptions` · `TOIMEntityInsertStrategy` ·
+`oimInsertEntityWithCopy` · `oimInsertEntityWithoutCopy` · `oimInsertEntityWithSanitizedCopy` · `oimPatchEntityColumns` · `oimPatchEntityColumn` · `oimPatchEntityColumnsGuarded` · `oimPatchEntityColumnGuarded` · `oimPutEntityColumns` · `oimPutEntityColumnsGuarded` · `TOIMEntityColumnName` · `TOIMEntityColumnValue`
+
+*Buckets* — `TOIMBucketCollectionFactoryArguments` ·
+`OIMBucketCommands` · `TOIMBucketCommandsOptions` · `IOIMBucketCommands` ·
+`IOIMBucketArrayMembership` · `OIMBucketArrayMembershipNonUnique` ·
+`OIMBucketArrayMembershipUnique` · `TOIMBucketSlotsSetStore` · `TOIMBucketSlotsArrayStore` ·
+`TOIMBucketSlotsSortedArrayStore` · `TOIMBucketSlotsArrayUniqueStore` · `OIM_NOTHING_WAS_INSERTED` ·
+`OIM_NOTHING_WAS_REMOVED` · `OIM_FROZEN_EMPTY_SLOTS` · `OIM_REMOVED_WITHOUT_A_POSITION`
+
+*Index services* — `OIMIndexService` · `OIMIndexServiceSortedArrayDriven` · `TOIMIndexServiceOptions` · `TOIMIndexStoreSlot` ·
+`createOIMIndexServiceSortedArrayDriven` · `TOIMIndexKeyOptions` · `TOIMIndexKey` ·
+`IOIMIndexKeysService` · `TOIMIndexKeysPositions` · `OIMIndexKeysService` ·
+`OIMIndexKeysServiceAppending` · `OIMIndexKeysServiceReclaiming`
+
+*Computed services* — `OIMComputedService` · `TOIMComputedServiceOptions` ·
+`createOIMComputedService` · `TOIMComputedStoreSlot` · `OIMComputedServiceSorted` · `TOIMComputedServiceSortedOptions` ·
+`createOIMComputedServiceSorted` · `OIMComputedServiceBucketMemo` · `TOIMComputedServiceBucketMemoOptions` ·
+`createOIMComputedServiceBucketMemo` · `TOIMSortColumn` · `TOIMSortableColumnName` · `oimColumnsComparator`
+
+*Stores and keys* — `TOIMStoreKey` · `IOIMSlotStoreService` ·
+`OIMSlotStoreServiceMapDriven` · `OIMSlotStoreServiceTreeDriven` ·
+`OIMSlotStoreServiceSingleSlotDriven` · `TOIMSingleSlotStore` · `TOIMDefaultSlotStore` ·
+`TOIMSlotStoreTree` · `IOIMKeyTreeWalk` · `TOIMCompositeKeyNode` ·
+`OIMKeyTreeWalk` · `OIMKeyTreeWalkComposite` · `OIMKeyTreeWalkScalar`
+
+*Assemblies* — `OIMDB` · `OIMDefaults` · `OIMDefaultValue` · `TOIMFactoryOptions`
+
+*Comparison and diffing* — `oimSameValueZeroGuard` ·
+`oimSameSlotSequence` · `oimSameKeySequence` · `oimOrderedListCommandsOfTransition` · `TOIMOrderedListCommand`
+
+*Shared defaults* — `OIMDefaults.STANDALONE_SLOT_OWNER`,
+`OIMDefaults.KEY_TREE_WALK_SCALAR` and `OIMDefaults.KEY_TREE_WALK_COMPOSITE`.
+
+**Nothing else is exported.** If a symbol is not on this list, it does not exist.
+
+---
+
+## Known defects
+
+### A scalar in a `KEY_TREE_WALK_COMPOSITE` key throws
+
+`OIMSlotStoreServiceTreeDriven` built with `OIMDefaults.KEY_TREE_WALK_COMPOSITE.getValue()` keys on
+`readonly TOIMEntitySlot[]`, so a string or a number in the key throws
+a TypeError past a cast, setting `holdCount` on a string. The store for a tuple
+of scalars is `OIMSlotStoreServiceTreeDriven` built with
+`OIMDefaults.KEY_TREE_WALK_SCALAR.getValue()` —
+see **Key stores** above. The fix is the other walk, never a cast.
+
+### `TOIMEffect` is a type-only export
+
+`effectService.createEffect(...)` and `effectService.createEffectImmediate(...)` are the whole of
+legitimate construction. An object literal typed `TOIMEffect` subscribes to nothing and
+schedules nothing: when one of its sources already moved in the open batch, a
+later write to that source is swallowed by the coalescing guard and the effect
+silently sits out the frame it is owed. Scheduling it is what `createEffect`
+does after constructing it.
+
+### Mixing `import` and `require` of `@oimdb/core` throws at the second load
+
+Every `@oimdb` package ships both formats — `dist/index.js` for `import`,
+`dist/index.cjs` for `require` (with `dist/index.d.cts` under the `require`
+condition so a CommonJS consumer's declarations match its runtime), both named
+in the `exports` map. A runtime loads a package once per format, so a process
+that reaches the core both ways would hold two copies of every class and every
+module-level value — two `OIMDefaults`, so a default set through one never
+reaches a service built by the other.
+
+So `src/index.ts` registers its copy under `Symbol.for('@oimdb/core')` on
+`globalThis`, and the second copy to load throws
+`@oimdb/core is loaded twice in this process`. The same throw fires for two
+installed copies of the package.
+
+`@oimdb/react` loaded twice fails loudly instead: every hook throws
+`useOIMDB: no <OIMDBProvider db={...}> above this component.` with the provider plainly above it, because a React
+context's identity is its lookup key.
+
+Do not generate code that reaches `@oimdb/core` — or any package that passes
+core objects around — through both spellings in one process. Pick one.
+
+---
+
+## Other packages
+
+`@oimdb/react`, `@oimdb/persist` (with its five backends) and `@oimdb/exodra` build
+on the current core — persist and exodra have sections of their own below. Every
+remaining package imports only names the core exports. Read a package's own
+source before generating code against it.
+
+`@oimdb/react` — `<OIMDBProvider db={db}>` carries the `OIMDB` (`useOIMDB()`) and nothing else: the effect
+service is stateless (`OIMEffectService.INSTANCE`) and every hook subscribes with
+`OIMEffectService.INSTANCE.subscribeEffect(db, …)`. A hook that resolves or takes a slot filed on another `OIMDB`
+throws, since nothing below would wake. Every hook that reads a collection takes the collection service, typed as a
+`Pick` of `OIMSlotCollectionService` with only the members it calls, and then the store slot:
+`useOIMEntity(entityCollectionService, entityStoreSlot, key)`,
+`useOIMField(entityCollectionService, slot, name)` (calls `getColumn(slot, name)`; no store slot, the slot carries it),
+`useOIMBucketSlots(bucketCollectionService, bucketSlot)` and
+`useOIMBucketSlotsByKey(bucketCollectionService, bucketStoreSlot, key)` (both read
+`bucketCollectionService.slotContentService.getBucketMemberSlots`; an index service and its index store slot fit too), and
+`useOIMValue(binding)`, where a binding is `{ sourceSlots?, sourceComputeds?, derive }` (a missing list means none)
+and must keep its identity across renders.
+`useOIMComputedValue(computedSlot: TOIMComputedSlot<TValue>): TValue` is the one-computed case: it subscribes to
+the slot, settles it and reads `computedSlot.value`, with no binding to memoise.
+`useOIMComputedValueByKey(computedService.computedCollectionService, computedStoreSlot, key)` reads one key of a
+computed store slot (plain, sorted, bucket memo) with the same by-key body as `useOIMEntity` /
+`useOIMBucketSlotsByKey`: resolve on commit with `holdSlotByKey`, effect over that slot, resolve-hold given back,
+a key built inline settled by meaning.
+The computed SERVICE is the caller's, built once at module scope with `createOIMComputedService(options)` (no db).
+`useOIMComputedCollection(computedService, derive, createSources, deps): TOIMComputedStoreSlot` builds only a store
+slot per mount — `computedService.createComputedStoreSlot(db, derive, createSources)` in a `useMemo` on `deps`;
+`derive` / `createSources` may be `undefined` when the service has them.
+`useOIMSingleComputedValue(computedService, derive, createSources, deps): TValue` is the same for a void-keyed
+service whose `computedSlotStoreService` is `OIMSlotStoreServiceSingleSlotDriven.INSTANCE`, read through
+`useOIMComputedValueByKey(computedService.computedCollectionService, computedStoreSlot, undefined)`, so a flush
+between render and subscribe is safe.
+`useOIMSlotsByKeys(slotCollectionService, storeSlot, keys)` holds the identities its keys name for as long as the
+component is mounted (a `holdSlotByKey` per key on commit, the same holds given back on unmount or when the list
+moves) and subscribes to nothing; it needs no provider.
+Singles are not keyed collections: `createOIMSingleEntityService(db)` / `createOIMSingleBucketService(db)` return an
+`OIMSingleSlotService` (`getSingleSlot(storeSlot)`, `holdSingleSlot(storeSlot)`), read by
+`useOIMSingleEntity(singleSlotService, singleSlotStoreSlot): TEntity | undefined` and
+`useOIMSingleBucketSlots(singleSlotService, singleSlotStoreSlot): readonly TOIMEntitySlot<TEntity>[]` — the by-key
+mechanics without a key (getSingleSlot on render, holdSingleSlot on commit, resolve-hold given back once the
+effect exists; the bucket members are copied per render). See `packages/react/README.md`.
+
+What each imports from `@oimdb/core`, read out of `src/`. The source moves —
+re-read the imports rather than trusting this table.
+
+| Package | Imports from the core | Imports a name the core does not export? |
+|---|---|---|
+| `@oimdb/persist` | `IOIMChannelMap`, `IOIMContentChangeListener`, `IOIMEntityWriter`, `OIMChannelService`, `OIMColumnOwnerPushDriven`, `OIMContentChangeListenerService`, `OIMEffectService`, `OIMSingleSlotService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIMSlotContentEntityService`, `TOIMBucketSlot`, `TOIMChannelClock`, `TOIMChannelSlot`, `TOIMColumnSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntitySlot`, `TOIMSingleSlotStore`, `TOIMSingleSlotStoreSlot`, `TOIMSlot`, `TOIMStoreKey`, `TOIMStoreSlot`, `oimHoldSlots`, `oimIsAnySlotChangedAfter`, `oimIsSlotReleased`, `oimSameValueZeroGuard`, `oimUnholdSlotsIfAlive` | no |
+| `@oimdb/redux-adapter` | `IOIMChannelMap`, `IOIMContentChangeListener`, `OIMChannelService`, `OIMColumnOwnerPushDriven`, `OIMContentChangeListenerService`, `OIMEffectService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIMSlotContentEntityService`, `TOIMBucketSlot`, `TOIMColumnSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntityColumnName`, `TOIMEntitySlot`, `TOIMStoreKey`, `TOIMStoreSlot` | no |
+| `@oimdb/exodra` | `IOIMChannelMap`, `OIMChannelService`, `OIMEffectService`, `OIMSlotContentBucketService`, `OIM_FROZEN_EMPTY_SLOTS`, `TOIMBucketSlot`, `TOIMComputedSlot`, `TOIMDisposer`, `TOIMEffect`, `TOIMEntitySlot`, `TOIMOrderedListCommand`, `TOIMSlot`, `TOIMStoreKey`, `oimOrderedListCommandsOfTransition`, `oimRefreshSourceComputeds`, `oimSameKeySequence` | no |
+| `@oimdb/react` | `IOIMChannelMap`, `OIMComputedService`, `OIMDB`, `OIMEffectService`, `OIMSingleSlotService`, `OIMSlotCollectionService`, `OIMSlotContentBucketService`, `OIM_FROZEN_EMPTY_SLOTS`, `TOIMBucketSlot`, `TOIMColumnSlot`, `TOIMComputedSlot`, `TOIMComputedSources`, `TOIMComputedStoreSlot`, `TOIMDisposer`, `TOIMEntityColumnName`, `TOIMEntityColumnValue`, `TOIMEntitySlot`, `TOIMIndexableSlot`, `TOIMKeyedSlot`, `TOIMSingleSlotStore`, `TOIMSlot`, `TOIMStoreKey`, `TOIMStoreSlot`, `oimHoldSlots`, `oimRefreshSourceComputeds`, `oimSameKeySequence`, `oimUnholdSlotsIfAlive` | no |
+| `@oimdb/devtools` | `IOIMChannelMap`, `IOIMStoreSlotListener`, `OIMChannelService`, `OIMComputedService`, `OIMDefaults`, `OIMSlotCollectionService`, `TOIMBucketSlot`, `TOIMComputedStoreSlot`, `TOIMDefaultSlotStore`, `TOIMDisposer`, `TOIMEntitySlot`, `TOIMKeyedSlot`, `TOIMStoreKey`, `TOIMStoreSlot` | no |
+| `@oimdb/async` | — | deprecated stub, `export {}` |
+| `@oimdb/snapshot-manager` | — | empty stub |
+
+Every package in the table has a `type-check` script (`tsc --noEmit`) that CI
+runs on each commit, and `@oimdb/core`, `@oimdb/persist`, `@oimdb/react`,
+`@oimdb/redux-adapter` and `@oimdb/exodra` pass it. Their documentation pages
+name only shipped exports, but the source is still the final word on a signature.
+
+## `@oimdb/persist`
+
+The persistence engine for `@oimdb/core` and its five backend packages. The
+engine names the parts and wires them; a backend package supplies the storage.
+Every constructor in the family takes ONE options object.
+
+| package | exports |
+|---|---|
+| `@oimdb/persist` | the engine, plus the key-value backend `OIMPersistKeyValueBackend` and its strategies; error types `TOIMPersistErrorHandler`, `TOIMPersistErrorContext`, `TOIMPersistOperation` and `TOIMPersistErrorReport` (`{ error, persistErrorContext }`, one failure as `onPersistError` receives it or as it lands in the `AggregateError`) |
+| `@oimdb/persist-memory` | `OIMPersistMemoryBackend`, `OIMPersistMemoryWriteBatch`, `OIMPersistMemoryRecordsStrategy`, `OIMPersistMemorySnapshotStrategy`, `TOIMPersistMemoryStrategyOptions` |
+| `@oimdb/persist-json` | `OIMPersistJsonBackend`, `TOIMPersistJsonBackendOptions`, `TOIMPersistJsonDump`; depends on `@oimdb/persist-memory` |
+| `@oimdb/persist-idb` | `OIMPersistIndexedDbBackend`, `OIMPersistIndexedDbWriteBatch`, `OIMPersistIndexedDbRecordsStrategy`, `OIMPersistIndexedDbSnapshotStrategy`, `TOIMPersistIndexedDbBackendOptions`, `TOIMPersistIndexedDbRecordsStrategyOptions`, `TOIMPersistIndexedDbSnapshotStrategyOptions`, `TOIMPersistIndexedDbPrimaryKey`, `TOIMPersistIndexedDbTableRecord` |
+| `@oimdb/persist-localstorage` | `OIMPersistLocalStorageBackend`, `TOIMPersistLocalStorageBackendOptions` |
+| `@oimdb/persist-async-kv` | `OIMPersistAsyncKVStorage`, `TOIMPersistAsyncKVStorageOptions`, `TOIMPersistAsyncKVMultiStorage` |
+
+### The wiring
+
+A persistor owns one backend, one scheduler and a list of resources. A resource is
+one thing being persisted: a source (the in-memory side), a strategy (where it
+lives in the backend) and what to do on hydrate.
+
+```ts
+import {
+    OIMPersistEntityWriter, OIMPersistRecordSourceCollectionWriteDriven, OIMPersistResourceRecords,
+    OIMPersistSchedulerMicrotaskDriven, OIMPersistor,
+} from '@oimdb/persist';
+import { OIMPersistMemoryBackend, OIMPersistMemoryRecordsStrategy, OIMPersistMemoryWriteBatch } from '@oimdb/persist-memory';
+
+const persistEntityWriter = new OIMPersistEntityWriter<Card, TOIMStoreKey>({
+    entityWriter: createOIMEntityWriterInPlace(),
+});
+const persistedCardCollectionService = createOIMEntityService<Card>(db, {
+    keyOf: card => card.id,
+    entityWriter: persistEntityWriter,
+});
+const persistedCardEntityStoreSlot = persistedCardCollectionService.createStoreSlot(db);
+
+const persistMemoryBackend = new OIMPersistMemoryBackend();
+const persistor = new OIMPersistor<OIMPersistMemoryBackend, OIMPersistMemoryWriteBatch>({
+    persistBackend: persistMemoryBackend,
+    persistScheduler: new OIMPersistSchedulerMicrotaskDriven(),
+    onPersistError: (error, persistErrorContext) => {
+        console.error(persistErrorContext.persistOperation, error);
+    },
+});
+const cardPersistResourceRecords = persistor.addPersistResource(new OIMPersistResourceRecords({
+    persistRecordSource: new OIMPersistRecordSourceCollectionWriteDriven({
+        entityCollectionService: persistedCardCollectionService,
+        entityStoreSlot: persistedCardEntityStoreSlot,
+        persistEntityWriter,
+    }),
+    persistRecordsStrategy: new OIMPersistMemoryRecordsStrategy<TOIMStoreKey, Card>({ storageKey: 'cards' }),
+}));
+
+await persistor.hydrate();
+persistor.start();
+persistedCardCollectionService.slotContentService.upsertEntity(
+    persistedCardEntityStoreSlot, { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' },
+);
+await persistor.persist();
+await persistor.unload(cardPersistResourceRecords, ['c1']);
+await persistor.load(cardPersistResourceRecords, ['c1']);
+```
+
+Rules a generator must keep:
+
+- Pass both generics of `OIMPersistor<TPersistBackend, TWriteBatch>`: the backend
+  class and its write batch class (`OIMPersistMemoryWriteBatch`, `OIMPersistIndexedDbWriteBatch`,
+  `OIMPersistKeyValueWriteBatch`; `OIMPersistJsonBackend` uses `OIMPersistMemoryWriteBatch`,
+  `OIMPersistLocalStorageBackend` uses `OIMPersistKeyValueWriteBatch`).
+- Pass the generics of strategies, codecs and `OIMPersistEntityWriter<TEntity, TKey>`
+  explicitly; their options carry no type to infer them from.
+- An entity collection persisted through a collection source is built with the
+  `OIMPersistEntityWriter` as its `entityWriter`, and the same writer goes into the
+  source's `persistEntityWriter`. The source takes the collection service and ONE of its store slots
+  (`entityCollectionService`, `entityStoreSlot`). The writer belongs to the content service, not to the store
+  slot, and the source keeps only the writes whose `entitySlot.storeSlot` is its own store slot; a write to
+  another store slot of the same collection type is ignored by it.
+  `new OIMPersistEntityWriter({ entityWriter })` wraps the `IOIMEntityWriter` that
+  really writes, and reports the entity slot of every fill, put, patch, column patch,
+  column delete and clear that changed something (`subscribeEntitySlotWritten`).
+- The entity collection service a source takes is any collection service with `getSlots`, `findSlotByKey` and a
+  `slotContentService` with `upsertEntities`, `deleteEntity` and `deleteEntities`
+  (`TOIMPersistEntityCollectionService`), so `createOIMEntityService(db, …)` and the base-layer assembly both fit.
+- A source refuses, by name, a store slot on another channel slot than the one it was given (the bucket source
+  checks both the entity and the bucket store slot).
+- Order: `addPersistResource` every resource, `await persistor.hydrate()`, then
+  `persistor.start()`.
+
+### Constructors and option keys
+
+| constructor | options |
+|---|---|
+| `OIMPersistor` | `{ persistBackend, persistScheduler, onPersistError? }` |
+| `OIMPersistResourceRecords` | `{ persistRecordSource, persistRecordsStrategy, persistHydrateReconcile? }` |
+| `OIMPersistResourceSnapshot` | `{ persistSnapshotSource, persistSnapshotStrategy, persistCodec, persistHydrateReconcile? }` |
+| `OIMPersistRecordSourceCollectionWriteDriven`, `OIMPersistRecordSourceCollectionChangeDriven` | `{ entityCollectionService, entityStoreSlot, persistEntityWriter }` (`TOIMPersistRecordSourceCollectionOptions`) |
+| `OIMPersistRecordSourceBucketDriven` | `{ channelMap, entityCollectionService, entityStoreSlot, slotContentBucketService, bucketSlot }` — `channelMap` is the db, `slotContentBucketService` the bucket collection's `slotContentService` |
+| `OIMPersistSnapshotSourceSingleEntityDriven` | `{ channelMap, singleSlotService, entityStoreSlot }` — a single entity service (`createOIMSingleEntityService`) and one of its store slots (`TOIMSingleSlotStoreSlot`) |
+| `OIMPersistEntityWriter` | `{ entityWriter }` |
+| `OIMPersistSchedulerMicrotaskDriven` | none |
+| `OIMPersistSchedulerFrameDriven` | `{ channelSlot }` — `db.defaultChannelSlot` |
+| `OIMPersistCodecIdentity` | none |
+| `OIMPersistCodecVersioned` | `{ version, migrations, persistCodec }` |
+| `OIMPersistMemoryBackend` | none |
+| `OIMPersistMemoryRecordsStrategy`, `OIMPersistMemorySnapshotStrategy` | `{ storageKey }` |
+| `OIMPersistJsonBackend` | `{ initialPersistJsonDump? }`, the object itself optional |
+| `OIMPersistIndexedDbBackend` | `{ databaseName, databaseVersion?, indexedDb? }` |
+| `OIMPersistIndexedDbRecordsStrategy` | `{ tableName }` |
+| `OIMPersistIndexedDbSnapshotStrategy` | `{ tableName, primaryKey }` |
+| `OIMPersistKeyValueBackend` | `{ persistKeyValueStorage, persistKeyValueSerializer? }` |
+| `OIMPersistKeyValueStorageItemDriven` | `{ persistKeyValueItemStorage }` |
+| `OIMPersistKeyValueEntryStrategy` | `{ storageKey }` |
+| `OIMPersistKeyValuePathStrategy` | `{ storageKey, path }` |
+| `OIMPersistLocalStorageBackend` | `{ persistKeyValueItemStorage?, persistKeyValueSerializer? }`, the object itself optional |
+| `OIMPersistSourceChangeMarkSlotDriven` | `{ channelClock, slots }` |
+| `OIMPersistSourceChangeMarkSubscriptionDriven` | `{ subscribeSourceChanged }` |
+| `OIMPersistAsyncKVStorage` | `{ persistAsyncKVMultiStorage }` |
+
+`onPersistError(error, persistErrorContext)` receives a `TOIMPersistErrorContext`,
+`{ persistResource, persistOperation }`. `TOIMPersistOperation` is
+`'start' | 'persist' | 'hydrate' | 'clear' | 'quarantine'`. `TOIMPersistErrorReport`
+is one failure, `{ error, persistErrorContext }`, as it is handed to `onPersistError`
+or collected into the `AggregateError`.
+
+### Two resource kinds, and when to pick each
+
+| | `OIMPersistResourceRecords` | `OIMPersistResourceSnapshot` |
+|---|---|---|
+| source | a record source: entity store slot or bucket | any snapshot source: entity store slot, bucket or single entity |
+| strategy | `OIMPersistMemoryRecordsStrategy`, `OIMPersistIndexedDbRecordsStrategy` | `OIMPersistMemorySnapshotStrategy`, `OIMPersistIndexedDbSnapshotStrategy`, `OIMPersistKeyValueEntryStrategy`, `OIMPersistKeyValuePathStrategy` |
+| autosave writes | the delta: one upsert or one deletion per entity slot written since the last drain | the whole snapshot, read from the source and encoded |
+| `persist()` writes | every record, replacing what is stored; while any key is unloaded, every in-memory record as an upsert over what is stored, plus the deletions the resource already heard | the whole snapshot |
+| codec | none | `persistCodec`, required |
+| `unload` | yes | no |
+| `load` | yes | no |
+
+Pick records whenever the backend has a records strategy (memory, JSON,
+IndexedDB): autosave then costs one entry per written entity slot, independent of
+the store slot's size. Pick snapshot for a single entity, for the key-value
+backends (localStorage, async KV), which have no records strategy, or when a
+versioned codec must migrate what is stored. A record source is also a snapshot
+source whose snapshot is `TOIMPersistRecords` (`{ records: { key, entity }[] }`),
+so an entity store slot or a bucket goes into either kind.
+
+A records resource keeps its dirty state as a set of entity slots, read through the
+slot with no key lookup; a slot written several times between drains is one entry.
+At the drain each slot becomes an upsert of `{ key, entity }` when it holds an entity
+and is not released, and a deletion of its key otherwise. When a key has both, a
+released slot and a live slot minted again for that key inside one batch, the live
+slot wins: an upsert, not a deletion.
+
+### The sources, and the scheduler each pairs with
+
+| source | reports | scheduler |
+|---|---|---|
+| `OIMPersistRecordSourceCollectionWriteDriven` | synchronously, at the write, from `OIMPersistEntityWriter` only | `OIMPersistSchedulerMicrotaskDriven` |
+| `OIMPersistRecordSourceCollectionChangeDriven` | synchronously, at the write, from `OIMPersistEntityWriter` and from a content-change listener on the entity store slot | `OIMPersistSchedulerMicrotaskDriven` |
+| `OIMPersistRecordSourceBucketDriven` | from effects (`OIMEffectService`), when the channel runs its frame | `OIMPersistSchedulerFrameDriven({ channelSlot })` |
+| `OIMPersistSnapshotSourceSingleEntityDriven` | from an effect, when the channel runs its frame | `OIMPersistSchedulerFrameDriven({ channelSlot })` |
+
+- **Collection** (an entity collection service and one of its store slots): every entity slot of that store slot that holds an entity. Starting
+  reports nothing; content present before `start()` is written by `persist()` or by
+  its next write. An entity removed for any reason, a slot release policy included,
+  goes through the writer's `clearEntity` and reaches the backend as a deletion;
+  `unload` is the call that removes from memory and keeps the stored value. The two
+  collection sources are one fork, chosen at construction, with the same options:
+
+  | collection source | in-place edit announced with `slotContentService.markEntityChanged(entitySlot, changedColumns?)` | cost while a resource listens | pick it when |
+  |---|---|---|---|
+  | `OIMPersistRecordSourceCollectionWriteDriven` | NOT persisted: it hears only the writer | none: every write stays on the core fast path | every change goes through the upsert / update / delete doors |
+  | `OIMPersistRecordSourceCollectionChangeDriven` | persisted: while subscribed it adds a content-change listener of every column to the store slot | EVERY write to that store slot leaves the core fast path, not only `markEntityChanged`: one subframe open/close, changed-column bookkeeping and the listener loop per write | the app edits entities in place |
+- **Bucket**: the entities one bucket slot holds. Get the slot with
+  `bucketCollectionService.holdSlotByKey(bucketStoreSlot, key)`. The source watches the
+  bucket slot with one effect and each member entity slot with one effect. An entity
+  that leaves the bucket is deleted from the backend and stays in the entity
+  store slot. The first subscription reports every member, so `start()` writes the
+  current members on the first drain, except members still holding the value a
+  hydrate restored.
+- **Single entity**: the snapshot is the entity itself (a store slot of a single entity service, read through
+  `findSingleSlot(entityStoreSlot)`), so it
+  goes only into `OIMPersistResourceSnapshot`. Its first subscription reports the
+  current value unless it is the value a hydrate restored. `readSnapshot` throws when
+  the entity slot holds no value.
+
+The bucket and single-entity sources tell their own restored writes apart from user
+writes by comparing the entity, column by column with SameValueZero (NaN equals NaN, as core's write guard does), against a copy taken when
+it was restored (`OIMPersistRestoredEntities`). A wake is not written while the source
+still holds the restored value. The first time a different value is seen, the memo for
+that key is gone, so an edit and a later revert to the restored value, in another
+frame, are both written.
+
+```ts
+import {
+    OIMPersistRecordSourceBucketDriven, OIMPersistResourceRecords, OIMPersistSchedulerFrameDriven, OIMPersistor,
+} from '@oimdb/persist';
+import { OIMPersistMemoryBackend, OIMPersistMemoryRecordsStrategy, OIMPersistMemoryWriteBatch } from '@oimdb/persist-memory';
+
+type TDeckCardSlot = TOIMEntitySlot<Card, TOIMStoreKey>;
+const deckCardCollectionService = createOIMEntityService<Card>(db, { keyOf: card => card.id });
+const deckCardEntityStoreSlot = deckCardCollectionService.createStoreSlot(db);
+const deckBucketService = createOIMBucketService<TDeckCardSlot>(db);
+const deckBucketStoreSlot = deckBucketService.createStoreSlot(db);
+const spadesBucketSlot = deckBucketService.holdSlotByKey(deckBucketStoreSlot, 'spades');
+
+const deckPersistor = new OIMPersistor<OIMPersistMemoryBackend, OIMPersistMemoryWriteBatch>({
+    persistBackend: new OIMPersistMemoryBackend(),
+    persistScheduler: new OIMPersistSchedulerFrameDriven({ channelSlot: db.defaultChannelSlot }),
+});
+deckPersistor.addPersistResource(new OIMPersistResourceRecords({
+    persistRecordSource: new OIMPersistRecordSourceBucketDriven({
+        channelMap: db,
+        entityCollectionService: deckCardCollectionService,
+        entityStoreSlot: deckCardEntityStoreSlot,
+        slotContentBucketService: deckBucketService.slotContentService,
+        bucketSlot: spadesBucketSlot,
+    }),
+    persistRecordsStrategy: new OIMPersistMemoryRecordsStrategy<TOIMStoreKey, Card>({ storageKey: 'spades' }),
+}));
+await deckPersistor.hydrate();
+deckPersistor.start();
+
+const aceSlot = deckCardCollectionService.slotContentService.upsertEntity(
+    deckCardEntityStoreSlot, { id: 'c1', title: 'Ace', rank: 1, deck: 'spades' },
+);
+deckBucketService.slotContentService.writeBucketMemberSlots(spadesBucketSlot, [aceSlot]);
+db.flush();
+await deckPersistor.whenIdle();
+```
+
+### Schedulers
+
+`IOIMPersistScheduler` is `attachDrain(drain)`, `start()`, `stop()`, `requestDrain()`.
+The persistor calls `attachDrain` from its constructor; both shipped schedulers throw
+when a second persistor attaches, so construct one scheduler per persistor.
+
+- `OIMPersistSchedulerMicrotaskDriven`: `requestDrain()` queues one microtask; the
+  requests that follow before it runs are absorbed by it. `stop()` makes a queued
+  microtask do nothing.
+- `OIMPersistSchedulerFrameDriven({ channelSlot })`: while started it subscribes with
+  `OIMChannelService.INSTANCE.subscribeAfterEachFrame(channelSlot, …)` and drains after a frame only when a drain was
+  requested since the last one; `stop()` unsubscribes and forgets the request. It
+  holds no slot and never asks the channel for a frame: it drains only after a frame
+  the channel runs anyway.
+
+**The pairing is a rule.** A write to an entity slot that nobody holds causes no frame
+(`OIMChannelService.INSTANCE.writeWithoutFlushCheck` returns at once when `holdCount` is `0`), so a
+collection source on the frame scheduler can report changes that no frame ever
+drains. Pair `OIMPersistRecordSourceCollectionWriteDriven` and
+`OIMPersistRecordSourceCollectionChangeDriven` with
+`OIMPersistSchedulerMicrotaskDriven`. The bucket and single-entity sources report from
+effects, which cause the frames they run in, so pair them with
+`OIMPersistSchedulerFrameDriven`. Resources of both groups in one persistor share its
+one scheduler; give them two persistors when they need different schedulers.
+
+`whenIdle()` resolves when the work queued at the moment of the call has settled. On
+the frame scheduler the drain runs inside `db.flush()`, so `db.flush(); await
+persistor.whenIdle()` covers the autosave. On the microtask scheduler the autosave
+is queued on the microtask after the write: let one microtask pass before calling
+`whenIdle()`, or call `persist()`.
+
+### Persistor methods
+
+| method | what it does |
+|---|---|
+| `addPersistResource(persistResource)` | registers and returns it; on a started persistor it starts the resource first and registers it only if that start succeeded (a failed start is thrown from `addPersistResource`) |
+| `removePersistResource(persistResource)` | stops it and drops its pending write |
+| `start()` / `stop()` | subscribe / unsubscribe every resource and the scheduler; `start()` skips quarantined resources; pending writes survive `stop()`. A resource whose subscribe throws does not stop the others: each failure goes to `onPersistError` with `persistOperation: 'start'`, or, without a handler, all are thrown as one `AggregateError`. A resource whose start failed stays registered and unsubscribed, with no autosave, until `stop()` and `start()` again; `addPersistResource` on a started persistor does not register a resource whose start throws. A bucket or single-entity source reports its current value at subscribe time (except a hydrate-restored value), so the first drain after `start()` writes it; a collection source reports nothing then |
+| `destroy()` | `stop()`, then forgets every resource |
+| `hydrate()` | reads every resource and writes it into its source; ends the upsert-only mode of an unloaded resource |
+| `persist()` | writes every resource in full, started or not, in one write batch; a records resource with unloaded keys writes its in-memory records as upserts over the stored table instead of replacing it, plus the deletions it already heard |
+| `clearPersisted()` | deletes every resource's stored data in one write batch; memory is untouched; ends the upsert-only mode of an unloaded resource |
+| `unload(persistResourceRecords, keys)` | writes the keys' current values plus the resource's pending change in one write batch, repeated until the keys have no unwritten change (unload holds the keys' entity slots while it writes and compares their revision stamps, a slot's stamp moving only on a real write; it also checks the resource's pending set and whether a key's slot was replaced), then removes the keys from memory only |
+| `load(persistResourceRecords, keys)` | the pair of `unload`: queued after the pending writes, reads only those keys from the backend (`readRecordsOfKeys`) and puts the stored entities back without writing them back; skips a key that holds a value in memory or has a change the resource has not written yet; the keys stop counting as unloaded |
+| `whenIdle()` | resolves when the queued work settles; never rejects |
+
+Every promise-returning call and every autosave runs on one ordered chain, one at a
+time, in request order. A snapshot is read when its work runs, not when it was queued.
+
+### The write batch, retry and quarantine
+
+- **One batch per drain.** A drain takes every dirty resource with a pending write,
+  calls `persistBackend.createWriteBatch()` once, lets each resource write into it,
+  and calls `commit()` once. `persist()` and `clearPersisted()` do the same for every
+  registered resource.
+- **Whole-batch failure.** Every resource in the batch puts its in-flight change back
+  (a records resource returns the failed entity slots to its dirty set; a snapshot
+  resource marks itself pending), then the persistor writes each resource again in a
+  batch of its own, so the healthy ones commit and the failure is attributed to the
+  resource that caused it. A failed batch of N resources costs 1 + N commits.
+- **Retry.** A failed autosave leaves the resource dirty; the next drain writes it.
+  The next drain comes from the next drain request (a change in any resource), a
+  `persist()` or an `unload`. There is no retry timer.
+- **Quarantine.** Three consecutive autosave failures of one resource stop it
+  listening to its source and drop its pending write; it is reported once with
+  `persistOperation: 'quarantine'`, or on `console.error` without `onPersistError`.
+  A successful `persist()` of it lifts the quarantine and, on a started persistor,
+  starts it again; `start()` skips a quarantined resource. Any successful write
+  resets the count, whichever operation committed it (autosave, `persist()`,
+  `clearPersisted()`, `unload`); `persist()` failures do not add to it.
+- **Errors.** With `onPersistError`, each failure is handed over and the promise
+  resolves; a failed autosave below quarantine is reported with `'persist'`, a failed
+  resource subscribe in `start()` with `'start'`. Without it, `start()` (throws),
+  `hydrate()`, `persist()` and `clearPersisted()` attempt every resource, then
+  reject with one `AggregateError` whose `errors` holds every failure; a failed
+  autosave below quarantine is silently retained, and the quarantine logs to the
+  console. `unload` rejects its own promise when its write fails, and then leaves
+  the keys in memory.
+
+### Hydrate: reconcile and refusal
+
+`hydrate()` reads each resource through its strategy. A read that resolves
+`undefined` means nothing is stored, and nothing is applied. Anything else, an empty
+`{ records: [] }` included, is applied: decoded through `persistCodec` on a snapshot
+resource, passed through `persistHydrateReconcile(currentSnapshot, incomingSnapshot)`
+when set, then written into the source. Hydrate's own writes are not reported as
+changes, so `start()` after `hydrate()` writes nothing back.
+
+What the source does with it:
+
+- collection: upserts every record into the entity store slot, then deletes every entity the records do not
+  name; the store slot becomes exactly the stored content;
+- bucket: upserts every record into the entity store slot and sets the bucket's
+  members to exactly the restored entities;
+- single entity: `singleSlotService.slotContentService.upsertEntity(entityStoreSlot, entity)`.
+
+**Refusal.** If the source changes while the backend read is in flight and the
+resource has no `persistHydrateReconcile`, hydrate throws instead of applying, because
+applying would revert that change. The source keeps its newer state; the error goes
+to `onPersistError` with `'hydrate'`, or into the `AggregateError`. Before the read
+the resource calls `persistSnapshotSource.markSourceChanges()`, which returns an
+`IOIMPersistSourceChangeMark` (`isSourceChangedSinceMark()`, `dispose()`): the
+single-entity and bucket sources return an `OIMPersistSourceChangeMarkSlotDriven`
+that holds the slots and compares their revision stamps (`changedAtRevision`, `changedAtEpoch`) with the
+channel clock reading taken at the mark (`oimIsAnySlotChangedAfter`), the
+collection sources an `OIMPersistSourceChangeMarkSubscriptionDriven` whose flag their
+own report sets. A change made during the read is seen even when no frame runs, and
+the guard runs whether or not the persistor is started.
+
+**Reconcile.** `oimReconcileByKey<TKey, TEntity>(resolveEntity)` builds a
+`TOIMPersistHydrateReconcile<TOIMPersistRecords<TKey, TEntity>>`.
+`resolveEntity(currentEntity, incomingEntity, key)` runs for every stored key, with
+`currentEntity` `undefined` when memory lacks the key, and returns the entity to keep
+or `undefined` to drop it. Keys only in memory are kept. Order: memory's keys first,
+then the stored keys memory lacked. A snapshot resource over a single entity takes any
+`(currentSnapshot, incomingSnapshot) => snapshot` function.
+
+```ts
+import { oimReconcileByKey } from '@oimdb/persist';
+
+const answerReconcile = oimReconcileByKey<TOIMStoreKey, Card>(
+    (currentEntity, incomingEntity) => currentEntity === undefined
+        ? incomingEntity
+        : { ...currentEntity, rank: incomingEntity.rank },
+);
+```
+
+### unload, load and clearPersisted
+
+`persistor.unload(persistResourceRecords, keys)` takes an `OIMPersistResourceRecords`
+only. It first drains the persistor's dirty resources onto the chain, then, in its
+own turn, writes in one write batch that resource's pending change and the current
+value of every unloaded key (`persistRecordSource.readRecordsDelta(persistRecordSource.findEntitySlotsByKeys(keys))`), so
+an edit no drain had reached, or one made while the persistor was stopped or the
+resource quarantined, is saved. unload holds the keys' entity slots while it writes, and after each commit it
+compares their revision stamps (a slot's stamp moves only on a real write), checks the
+resource's pending set and whether a key's slot was replaced; while any of those moved it
+writes another batch of the same shape, so an edit made during any commit
+(and, on the bucket source, an edit the channel has not flushed yet) reaches the
+backend. Only then does it remove
+the keys from the source with this resource's reporting suppressed, so the removal is
+not written by it. The backend keeps the keys; `load` brings those keys back and the
+next `hydrate()` brings back everything, and a restored entity persists its next edit like any other. A failed write rejects
+the unload and leaves the keys in memory. On a collection source and on the bucket source
+the keys are deleted from the entity store slot.
+Deleting an entity does not take it out of a bucket: the bucket keeps the slot as a
+member until it is refiled. The bucket source remembers the deletion as restored for
+every key that is a member of the bucket at unload time, whether or not the persistor
+is listening.
+
+While any key of a records resource is unloaded, `persist()` writes that resource's
+in-memory records as upserts over the stored table instead of replacing it, plus the
+deletions the resource already heard (its pending deletions), so the unloaded records
+stay on the backend. A deletion it never heard is not written in that mode.
+`hydrate()` and `clearPersisted()` end that mode, and so does a `load` of every
+unloaded key.
+
+`persistor.load(persistResourceRecords, keys)` is the pair of `unload` and takes an
+`OIMPersistResourceRecords` only (a key-value backend has no records strategy, so a
+snapshot resource has no `load`). It drains the dirty resources onto the chain and
+runs after those writes. In its turn it reads only those keys through
+`persistRecordsStrategy.readRecordsOfKeys(persistBackend, keys)`: on IndexedDB one
+`readonly` transaction with one `get` per key, on memory a lookup of each key in the
+stored map; a key the backend does not hold is left out. It skips every key that holds
+a value in memory or has a change the resource has not written yet (pending or in a
+commit), so neither a write nor a heard deletion made during the read is overwritten.
+The rest goes to `persistRecordSource.loadRecords(persistRecords)` with this
+resource's reporting suppressed, so the loaded entities are not written back. A
+collection source upserts them into the entity store slot; the bucket source upserts them
+into the entity store slot, adds the slots back to the bucket
+(`slotContentBucketService.addBucketMemberSlots`) and remembers them as restored. The keys
+stop counting as unloaded, so once none is, `persist()` replaces the stored table
+again. Another resource over the same entity store slot is not suppressed and hears
+the upserts as writes. A failed read rejects the promise `load` returned.
+
+When to unload and when to load (on a screen change, on idle, on a read miss) is the
+application's decision, or an orchestrator's; persist offers the two doors and decides
+neither.
+
+**Limit:** another resource over the same entity store slot is not suppressed. It
+reports the unloaded keys as deletions, and its next autosave deletes them from ITS
+storage. Unload only keys no other resource persists.
+
+**Limit:** a deletion made while the persistor is stopped, or the resource is
+quarantined, is not heard. While any key of the resource is unloaded, `persist()`
+writes no deletion it did not hear, and `unload` writes it only while the entity's slot
+still exists (once the slot was released no slot is found for the key); otherwise the
+record comes back on the next `hydrate()`. Call `persist()` while started, and with no
+key unloaded, to make a deletion the resource never heard durable.
+
+`persistor.clearPersisted()` calls every resource's strategy delete
+(`deleteRecords` / `deleteSnapshot`) inside one write batch with one commit, under the
+same whole-batch split and error rules as `persist()`. Memory is untouched.
+
+### Codecs
+
+A snapshot resource encodes on every write and decodes on hydrate through its
+required `persistCodec`, an `IOIMPersistCodec<TSourceSnapshot, TPersistedSnapshot>`
+(`encode`, `decode`). A records resource has no codec: it stores entities as the
+source holds them.
+
+- `new OIMPersistCodecIdentity<TSnapshot>()`: passes the snapshot through.
+- `new OIMPersistCodecVersioned<TSourceSnapshot, TPersistedSnapshot>({ version, migrations, persistCodec })`:
+  stores a `TOIMPersistVersionedShape`, `{ version, data }`, where `data` is the
+  inner `persistCodec`'s encoding (required; use `OIMPersistCodecIdentity` when
+  nothing transforms). `migrations` is a `Record<number, (data: unknown) => unknown>`
+  keyed by the version each migration produces. On decode it runs, ascending, every
+  migration whose key is above the stored `version` and at most the current one,
+  then decodes with the inner codec. A stored `version` above the codec's own is
+  refused: `decode` throws and the hydrate reports it with `'hydrate'`. The strategy
+  is typed with `TOIMPersistVersionedShape`.
+
+```ts
+import {
+    OIMPersistCodecIdentity, OIMPersistCodecVersioned, OIMPersistKeyValueBackend, OIMPersistKeyValueEntryStrategy,
+    OIMPersistKeyValueStorageItemDriven, OIMPersistKeyValueWriteBatch, OIMPersistResourceSnapshot,
+    OIMPersistSchedulerFrameDriven, OIMPersistSnapshotSourceSingleEntityDriven, OIMPersistor,
+} from '@oimdb/persist';
+import type { TOIMPersistVersionedShape } from '@oimdb/persist';
+
+type TSettings = { theme: 'light' | 'dark'; density: 'compact' | 'comfortable' };
+
+const settingsSingleEntityService = createOIMSingleEntityService<TSettings>(db);
+const settingsEntityStoreSlot = settingsSingleEntityService.createStoreSlot(db);
+settingsSingleEntityService.slotContentService.upsertEntity(settingsEntityStoreSlot, { theme: 'light', density: 'compact' });
+const itemByStorageKey = new Map<string, string>();
+const settingsPersistor = new OIMPersistor<OIMPersistKeyValueBackend, OIMPersistKeyValueWriteBatch>({
+    persistBackend: new OIMPersistKeyValueBackend({
+        persistKeyValueStorage: new OIMPersistKeyValueStorageItemDriven({
+            persistKeyValueItemStorage: {
+                getItem: storageKey => itemByStorageKey.get(storageKey) ?? null,
+                setItem: (storageKey, item) => { itemByStorageKey.set(storageKey, item); },
+                removeItem: storageKey => { itemByStorageKey.delete(storageKey); },
+            },
+        }),
+    }),
+    persistScheduler: new OIMPersistSchedulerFrameDriven({ channelSlot: db.defaultChannelSlot }),
+});
+settingsPersistor.addPersistResource(new OIMPersistResourceSnapshot({
+    persistSnapshotSource: new OIMPersistSnapshotSourceSingleEntityDriven({
+        channelMap: db, singleSlotService: settingsSingleEntityService, entityStoreSlot: settingsEntityStoreSlot,
+    }),
+    persistSnapshotStrategy: new OIMPersistKeyValueEntryStrategy<TOIMPersistVersionedShape>({ storageKey: 'settings' }),
+    persistCodec: new OIMPersistCodecVersioned<TSettings, TSettings>({
+        version: 2,
+        migrations: { 2: data => ({ density: 'comfortable', ...(data as object) }) },
+        persistCodec: new OIMPersistCodecIdentity<TSettings>(),
+    }),
+}));
+await settingsPersistor.hydrate();
+settingsPersistor.start();
+
+settingsSingleEntityService.slotContentService.updateEntity(
+    settingsSingleEntityService.getSingleSlot(settingsEntityStoreSlot), { theme: 'dark' },
+);
+db.flush();
+await settingsPersistor.whenIdle();
+```
+
+### Backends and their strategies
+
+**Memory** (`@oimdb/persist-memory`). `new OIMPersistMemoryBackend()`. Snapshot values
+and records live in two separate maps, so a snapshot and a records resource may share
+a `storageKey`. `OIMPersistMemoryRecordsStrategy<TKey, TEntity>({ storageKey })` keeps one
+`Map` of key to entity per `storageKey`: autosave sets and deletes keys, `persist()`
+replaces the map (while the resource has unloaded keys, sets keys and deletes only the deletions the resource already heard), `clearPersisted()` deletes it, and a `load` looks each of its keys up in the map through `readRecordsOfKeys`. `OIMPersistMemorySnapshotStrategy<TSnapshot>({ storageKey })`
+keeps one value. `readRecords(storageKey)` and `readSnapshotValue(storageKey)` read
+what was committed. `OIMPersistMemoryWriteBatch` queues every change and applies them in
+order on `commit()`.
+
+**JSON** (`@oimdb/persist-json`, depends on `@oimdb/persist-memory`).
+`OIMPersistJsonBackend` extends `OIMPersistMemoryBackend` and takes the memory
+strategies. `dehydrate()` returns a `TOIMPersistJsonDump`,
+`{ snapshotValues: Record<storageKey, value>, recordsByStorageKey: Record<storageKey, { key, entity }[]> }`;
+`new OIMPersistJsonBackend({ initialPersistJsonDump })` writes such a dump straight into
+its maps. The SSR flow: on the server, `await persistor.persist()` and then
+`JSON.stringify(persistJsonBackend.dehydrate())`; on the client,
+`new OIMPersistJsonBackend({ initialPersistJsonDump: JSON.parse(jsonText) })`, register
+the same resources under the same `storageKey`s, `await persistor.hydrate()`. To merge
+a durable cache over the server's content, hydrate the JSON persistor first, then the
+durable persistor with `persistHydrateReconcile`, then `start()` the durable one.
+
+**IndexedDB** (`@oimdb/persist-idb`). `new OIMPersistIndexedDbBackend({ databaseName, databaseVersion?, indexedDb? })`;
+`indexedDb` defaults to `globalThis.indexedDB` and the constructor throws without
+either. `OIMPersistIndexedDbRecordsStrategy<TKey, TEntity>({ tableName })` stores one value
+per entity key in an object store: autosave puts and deletes per key, `persist()`
+clears the table and puts every entity (while the resource has unloaded keys, only
+puts plus a delete per deletion the resource already heard), `clearPersisted()` clears it,
+and a `load` reads its keys through `readRecordsOfKeys` in one `readonly` transaction,
+one `get` per key.
+`OIMPersistIndexedDbSnapshotStrategy<TSnapshot>({ tableName, primaryKey })` stores one value
+at `primaryKey`. One commit is one `readwrite` transaction over every table the batch
+touches. A commit opens the database and creates missing tables by a version upgrade
+(retried when another connection upgrades first, up to five attempts; an upgrade
+blocked for five seconds rejects); a read never creates a table, and a missing table
+reads as `undefined`. A `TOIMPersistIndexedDbPrimaryKey` is an `IDBValidKey` or a plain
+object; a plain object is encoded as the string `oimdb:object:` plus its JSON with
+sorted property names, and is read back as that string.
+
+**Key-value** (`@oimdb/persist`). `new OIMPersistKeyValueBackend({ persistKeyValueStorage, persistKeyValueSerializer? })`
+stores serialized strings under string keys. `persistKeyValueStorage` is an
+`IOIMPersistKeyValueStorage` (`readItems(storageKeys)`, `writeItems(itemByStorageKey)`,
+`removeItems(storageKeys)`); `OIMPersistKeyValueStorageItemDriven({ persistKeyValueItemStorage })`
+adapts any `TOIMPersistKeyValueItemStorage` (`getItem`, `setItem`, `removeItem`,
+synchronous or returning promises) with one call per key. The serializer is a
+`TOIMPersistKeyValueSerializer` (`serialize`, `deserialize`) and defaults to
+`OIM_PERSIST_KEY_VALUE_JSON_SERIALIZER`. Strategies, both snapshot strategies:
+
+| strategy | stored as |
+|---|---|
+| `OIMPersistKeyValueEntryStrategy<TSnapshot>({ storageKey })` | the whole snapshot under `storageKey` |
+| `OIMPersistKeyValuePathStrategy<TSnapshot>({ storageKey, path })` | the snapshot at `path` (a `string[]`) inside an object under `storageKey`; several resources may share the key; the constructor throws on an empty `path` |
+
+`OIMPersistKeyValueWriteBatch` commits with at most one `readItems` (keys with path
+writes or path deletions and no whole-value write in the batch), one `writeItems` and
+one `removeItems`; it serializes every value before writing any. Path segments are
+own properties, so a stored `__proto__` is data.
+
+- **localStorage** (`@oimdb/persist-localstorage`): `OIMPersistLocalStorageBackend`
+  extends `OIMPersistKeyValueBackend` over a `TOIMPersistKeyValueItemStorage`
+  (`getItem`, `setItem`, `removeItem`) given as `persistKeyValueItemStorage`, which
+  defaults to `globalThis.localStorage`; the constructor throws without either. One `setItem` per written key.
+- **async KV** (`@oimdb/persist-async-kv`): no backend class. Use
+  `new OIMPersistKeyValueBackend({ persistKeyValueStorage: new OIMPersistAsyncKVStorage({ persistAsyncKVMultiStorage }) })`,
+  where `persistAsyncKVMultiStorage` is a `TOIMPersistAsyncKVMultiStorage` (`multiGet`, `multiSet`,
+  `multiRemove`, each returning a promise), the shape of React Native's
+  `AsyncStorage`. One `multiGet`, one `multiSet` and one `multiRemove` per commit at
+  most.
+
+### Writing a backend, a strategy, a source
+
+- Backend: `IOIMPersistBackend<TWriteBatch>` with `createWriteBatch()`; its batch is an
+  `IOIMPersistWriteBatch` with `commit(): Promise<void>`, collecting changes and
+  applying them in `commit`. `OIMPersistWriteBatchChanges<TWriteBatchTarget>` is the list a
+  batch keeps them in: `addWriteBatchChange(change)`, `hasWriteBatchChanges`,
+  `applyWriteBatchChanges(target)`. `oimWritePersistRecordsDelta(delta, putRecord, deleteRecord)`
+  walks a `TOIMPersistRecordsDelta` in the one order every backend uses: upserts, then deletions.
+- Snapshot strategy: `IOIMPersistSnapshotStrategy<TPersistBackend, TWriteBatch, TSnapshot>`
+  with `readSnapshot(persistBackend)`, `writeSnapshot(writeBatch, snapshot)`,
+  `deleteSnapshot(writeBatch)`. Records strategy:
+  `IOIMPersistRecordsStrategy<TPersistBackend, TWriteBatch, TKey, TEntity>` with
+  `readRecords(persistBackend)`, `readRecordsOfKeys(persistBackend, keys)`,
+  `writeRecords(writeBatch, persistRecords)`,
+  `writeRecordsDelta(writeBatch, persistRecordsDelta)` (a `TOIMPersistRecordsDelta`,
+  `{ upserts, deletedKeys }`), `deleteRecords(writeBatch)`. A read resolves
+  `undefined` only when nothing is stored; `readRecordsOfKeys` resolves the records of
+  the keys the backend holds and leaves out the rest.
+- Source: `IOIMPersistSnapshotSource<TSnapshot>` (`readSnapshot`, `writeSnapshot`,
+  `subscribeSnapshotChanged`, `markSourceChanges`) or
+  `IOIMPersistRecordSource<TKey, TEntity>`, which adds `subscribeEntitySlotChanged`,
+  `readRecordsDelta(entitySlots)`, `findEntitySlotsByKeys(keys)`, `markEntitySlotChanges(entitySlots)`,
+  `loadRecords(persistRecords)`, `unloadKeys(keys)`.
+  `markSourceChanges()` is required and returns an `IOIMPersistSourceChangeMark`
+  (`isSourceChangedSinceMark()`, `dispose()`); build it with
+  `new OIMPersistSourceChangeMarkSlotDriven({ channelClock, slots })` or
+  `new OIMPersistSourceChangeMarkSubscriptionDriven({ subscribeSourceChanged })`.
+  It must accept more than one subscription, each with its own `TOIMDisposer`.
+- Scheduler: `IOIMPersistScheduler`, above.
+
+### Limits
+
+- **No key-value records strategy.** Over `OIMPersistKeyValueBackend` (localStorage,
+  async KV) an entity store slot or a bucket goes through `OIMPersistResourceSnapshot`: every
+  autosave walks every entity slot of the source and serializes the whole snapshot
+  under one key.
+- **A bucket membership change walks the bucket.** Each change of the bucket slot
+  re-reads every member and every watched slot, and the source keeps one effect per
+  member entity slot.
+- **The memory and JSON backends keep values by reference.** With
+  `createOIMEntityWriterInPlace()` the stored entity is the live entity object, so an
+  in-place write moves the stored value before any commit, and `dehydrate()` returns
+  the live objects. Use `createOIMEntityWriterReplacing()` with
+  `entityInsertStrategy: oimInsertEntityWithCopy` where the stored value must stay
+  what was committed, and serialize a dump at once.
+- **Hydrate without a reconcile replaces.** The collection source deletes every
+  entity the stored records do not name, and an existing but empty records table
+  (IndexedDB after `clearPersisted()`) reads as an empty list and empties the
+  entity store slot.
+- **A key-value commit is not atomic across keys**: `writeItems` and `removeItems` are
+  separate calls, and the item-driven storage calls `setItem` once per key.
+- **One backend and one scheduler per persistor.** Sources needing different
+  schedulers, or two backends, take two persistors.
+
+---
+
+## `@oimdb/exodra`
+
+Turns a core read into an Exodra `TExoBindable` or `TExoBindableList`. It depends
+only on the type-only `@exodra/reactivity-types`.
+
+### One door: `exoBinding(channelMap, binding)`
+
+A subscription here is one call — `OIMEffectService.INSTANCE.subscribeEffect(channelMap, sourceSlots, sourceComputeds, onChange)` —
+and the value is read off the slots afterwards. So one adapter covers an entity, a
+column, a bucket's slots and a derivation:
+
+```ts
+import { exoBinding } from '@oimdb/exodra';
+
+const rank = rankService.computedCollectionService.holdSlotByKey(ranks, 'c1');
+
+exoBinding(db, { sourceSlots: [slot], derive: () => slot.entity });
+exoBinding(db, { sourceSlots: [todo], derive: () => Array.from(pageService.slotContentService.getBucketMemberSlots(todo)) });
+exoBinding(db, { sourceComputeds: [rank], derive: () => rank.computedValueService.getValueForSlot(rank) });
+```
+
+`TOIMExoBinding<TValue>` is `{ sourceSlots?, sourceComputeds?, derive }`; both source keys are optional and default to none. `sourceSlots` is typed
+`readonly TOIMSlot[]` and `sourceComputeds` `readonly TOIMComputedSlot[]`.
+
+What `exoBinding` owns, each failing silently if a caller writes the pair by hand:
+it **settles every derivation before the read** (a derivation is asked and never
+woken); and it
+arms **one effect** however many downstream subscribers there are, and none while
+nobody listens.
+
+**There is no observable wrapper on either side of this bridge**, and there must
+not be one: the core hands over no object carrying a value and a subscribe, so an
+intermediate type would have one producer and one consumer, both inside this
+package. Build the binding directly.
+
+### Lifetime is the caller's
+
+`exoBinding` **holds nothing**, and that is deliberate: a bindable is lazy, so it
+outlives its own subscriptions, and a hold scoped to one of them buys nothing —
+a hold's give-back ends in the owner's release guard, so returning it at teardown
+leaves exactly the state the teardown would have left. Whoever resolved the
+identity holds it, and says so with `TOIMExoDisposable<TValue>` =
+`TExoBindable<TValue> & { readonly dispose: TOIMDisposer }`:
+
+```ts
+import { exoBinding } from '@oimdb/exodra';
+
+const rankFor = (id: TOIMStoreKey) => {
+    const held = rankService.computedCollectionService.holdSlotByKey(ranks, id);
+    return Object.assign(
+        exoBinding(db, { sourceComputeds: [held], derive: () => held.computedValueService.getValueForSlot(held) }),
+        { dispose: () => { held.owner.unholdSlot(held); } },
+    );
+};
+```
+
+Only a valueless identity is exposed by getting this wrong: an empty bucket, a key
+resolved before its entity arrived, an entity since removed.
+
+### The views
+
+- `exoSource(read, subscribe)` — the lazy, ref-counted base. For sources that are
+  **not** this engine's.
+- `exoCombine(sources, fn)` — fan-in across any `TOIMExoReadable`. Not glitch-free;
+  keep heavy fan-in inside one computed.
+- `exoFollowKey(key, makeBindable)` — repoints as a selection moves. The factory
+  must return a `TOIMExoDisposable`.
+- `exoRows(keys, render)` — identity-stable children keyed by primary key. `render`
+  returns `TOIMExoRenderedRow<TSchema>` = `{ schema, dispose }`.
+
+### Lists are a fork, and both arms ship
+
+Who decided the order is the difference, and the core already forks on it.
+
+| | `exoDerivedList(channelMap, computedSlot, render, maxCommandsPerSlot?)` | `exoPositionalList(channelMap, slotContentBucketService, bucketSlot, render)` |
+|---|---|---|
+| takes | a `TOIMComputedSlot<readonly TOIMEntitySlot[]>` | a bucket content service built with an `OIMBucketCommands` (the default of `createOIMBucketService`) and one of its bucket slots, from any of its store slots |
+| the script | **derived**, by `oimOrderedListCommandsOfTransition` | **recorded**, by `OIMBucketCommands`, read inside the frame |
+| per changed frame | one diff: two passes plus an LIS pass, `common − LIS` moves | one pass over the frame's own script |
+
+Both hand back `TOIMExoList<TSchema>` = `TExoBindableList<TSchema> & { dispose }`,
+and both are **attached from construction**, not from their first subscriber —
+that is what lets `snapshot()` promise the list every later op is measured
+against. Each item's schema is memoised in a `WeakMap` inside the bridge, so a
+`reset` hands back the objects the previous snapshot did.
+
+The derived script comes from `oimOrderedListCommandsOfTransition`. Items are
+memoised per list, so two lists showing one entity slot render it twice.
+
+### Full export list
+
+`exoBinding`, `exoSource`, `exoCombine`, `exoFollowKey`, `exoRows`,
+`exoDerivedList`, `exoPositionalList`; `TOIMExoBinding`, `TOIMExoReadable`,
+`TOIMExoDisposable`, `TOIMExoRenderedRow`, `TOIMExoList`.
+
+---
+
+## Performance
+
+**No figure may be quoted for this engine, and none is quoted anywhere in this
+file.**
+
+Every artifact under `packages/bench/measurements/` predates the surface
+documented in this file, so none of its
+figures prices what is described here. Such figures are **struck, not updated** — a
+stale number with a real-looking artifact path attached is worse than none.
+
+`packages/bench/results/` holds a timing series
+that is still in flight: fifty-five timing artifacts beside one memory artifact,
+of which eleven scenarios — `readByKey`, `scrollWindow`, `filterTwoAxes`,
+`consumerFloor`, `patchColumn`, `patchOutsideWindow`, `churnChain`,
+`churnShared`, `churnSharedDeep`, `churnWide`, `mountFloor` — carry all three
+points. Two things bound
+what it may be quoted for, and both are recorded in the artifacts themselves:
+the series is **incomplete**, and every run in it was taken with the load gate
+raised — to **3.5** foreign runnable processes on the 22 `small`/`wide` pieces,
+and to **25** on the 34 `default`-point ones — against the harness's own
+default of **0.5** (`packages/bench/src/harness/load.ts`,
+`DEFAULT_MAX_FOREIGN_LOAD`). Read `packages/bench/measurements/README.md` for what
+a raised gate does to a comparison before quoting anything out of that directory.
+
+Everything outside that series has **no number at all**. No strategy of any shipped
+fork has a measured price, so no consumer can pick with the numbers in front of
+them.
+
+The one quantity that needs no measurement, because it is arithmetic rather than
+a reading: emptying a bucket one slot at a time on an array-driven bucket costs
+n(n-1)/2 element moves — **499 500** for a thousand — which is why a bucket content service's `writeBucketMemberSlots`
+and `clearBucketMemberSlots` go through one `drainSlots`. Counted, not timed, in
+`packages/core/src/engine/bucket/array/tests/everyone-out-at-once-and-not-one-at-a-time.test.ts`, which
+also pins `drainSlots` at zero element writes.
+
+Fast properties are checked, not timed. Every slot kind is one object literal with
+every field present at birth; per-index state lives in the `indexKeys` array;
+nothing adds a field to a slot later or deletes one; neither entity writer
+`delete`s a column — it writes `undefined`, in place or into a spread copy. So every slot of a kind keeps one V8
+hidden class through holds, effects, moves between buckets, patches and release
+deadlines, and an entity keeps its own when a column leaves or arrives —
+`packages/core/tests/what-v8-keeps-on-fast-properties.test.ts` asks V8 directly
+through its own natives for fast properties and a shared map, and
+`packages/core/tests/how-many-shapes-reach-the-write-door.test.ts` pins three slot
+shapes at the write door, one below V8's polymorphic ceiling, and four at `holdSlot`,
+at it, a computed column slot among them as a computed slot. What that saves per read is not measured. An
+entity handed in with a few hundred fields is in dictionary mode before it
+arrives.
+
+The goal the measurement work serves: prove that **for every typical task there
+is a combination of shipped strategies whose cost is at or below the hand-written
+floor**, on the same tasks every framework in `packages/bench` is measured on. A
+ratio above 1.00 is a loss only when no strategy combination reaches the floor.