@opetope/lint 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,461 @@
 # @opetope/lint
 
+## 0.12.0
+
+### Minor Changes
+
+- 34bdbfb: **A retired word is named, not rewritten: `opetope/no-retired-vocabulary` (D404).** The rule reports every word the
+  D365–D401 wave retired, together with the word that replaced it: `invalidate()` → `reset()`; `backpressure` →
+  `delivery`, with `kind` → `pending` and `key` → `by` inside the record; `activity` of a `loading` state → `failure`;
+  `scope.keyed(source, open, { key })` → `scope.each(source, key, open)`; `skipInitial` → `initial`, `when` of an
+  effect → `filter` or `initial`, `onDispose` → `finalize`; `externalReadable` → `fromExternal`;
+  `Call`/`ctx.call`/`runCall` → `Command`/`ctx.command`/`runCommand`; `policy`/`queueBy`/`lane` → `concurrency`;
+  `ctx.calls`/`own.calls`/`useCommands` → `ctx.select`/`own.select`/`useModel(Declaration, select)`; `once` →
+  `memoize`. It joins `configs.recommended` and the shipped `oxlintrc.json` as an error.
+
+  ```ts
+  ctx.command(run, { policy: 'latest' });
+  //                 ^ `policy` is now `concurrency`: one word for the order the runs take …
+  ctx.effect(draft, save, { skipInitial: true });
+  //                        ^ `skipInitial` is now `initial`, and the polarity is inverted …
+  ```
+
+  - **There is no autofix, and that is the decision.** Several of these renames are not one to one: `policy`,
+    `queueBy` and `lane` collapse into one `concurrency` whose shape depends on which of the three a record wrote
+    together, `when` at an effect becomes `filter` **or** `initial` depending on what the predicate asks, and
+    `skipInitial` → `initial` inverts the polarity. A fix that guessed wrong would rewrite a consumer's source
+    silently, which is worse than refusing, so each report names the word, names the replacement, and says so where
+    the replacement is a choice.
+  - **The severity is `error` because every one of these words is already a compile error on this release** — there
+    are no aliases — so the rule cannot redden a build that was green; what it adds is the one message that names the
+    replacement. The cases where the compiler is silent, such as an options record assembled beside the call, are
+    exactly the ones a warning would lose, and `--quiet`, which both linters are run with here, prints no warnings at
+    all. A consumer who wants one pass softer writes the rule into its own `rules` after `extends`.
+  - **Ownership is proved by symbol, never by spelling.** A retired member is reported only on a declaring context of
+    this library — a parameter annotated `ModelContext` of `@opetope/core`, or an `own` section of a `defineFeature`
+    of `@opetope/runtime` — a retired name only where an `@opetope/*` module exports it, and `activity` only inside a
+    narrowing that proves the state is `loading`. `Call` in «Margin Call» and in translation keys, the `{ once: true }`
+    of `addEventListener`, a host's own `policy` option, `Navigator.reset()` and `when` at a feature, at a
+    contribution and at `scope.while` are all left alone.
+  - The rule is written for one migration pass and never fires after it. Its silence is not proof that a migration is
+    complete: a Resource reached through a model record, a state narrowed in a `switch`, and an options record
+    assembled in another module stay with the compiler, which since D401 prints the replacement for every word it can
+    name.
+
+- aaaa92c: **A collection scope is `each`, and its key is written where it belongs (D378).** `scope.keyed(source, open, { key })`
+  is now `scope.each(source, key, open)`, in a model and in `own` alike. Nothing about the node changes — the same
+  controller, the same replace → drain → open order, the same refusals and the same key identity.
+
+  ```ts
+  // before
+  ctx.scope.keyed(rows, (row, { signal }) => watch(row.id, signal), { key: row => row.id });
+  // after
+  ctx.scope.each(
+    rows,
+    row => row.id,
+    (row, { signal }) => watch(row.id, signal),
+  );
+  ```
+
+  `keyed` named the mechanism rather than the relationship its two neighbours name: `while` says «as long as»,
+  `switch` says «instead of», and `keyed` only said that there are keys inside — which is also what `keyedLane`, a
+  keyed Resource and a keyed delivery say, where a key tells apart the parallel queues of one node instead of deciding
+  how many children exist. `each` says what the node does: one child per element.
+
+  - The key moved into the signature because it is required, and a required member of a modifier record is not a
+    modifier: of the nodes that have one calling form, `scope.keyed` was the only one whose trailing record was
+    mandatory. D279 is not repealed — its principle holds and D378 names this one exception to its letter. The keyed
+    form of a command, `call(run, { lane: ctx.keyedLane<Key>(), queueBy })`, keeps its required record and is
+    unaffected: there the record selects which scheduling form the node has, so what is required is required by the
+    chosen form rather than by the node.
+  - `Value` is still inferred from the source alone. Both callbacks read it through `NoInfer`, so an annotation on the
+    key or on the child is checked against the list rather than widening it; a compiled type test records that.
+  - The messages of the node carry the word the author wrote: `Feature each scope contains duplicate key d.`,
+    `Model each scope source must contain a readonly array.`
+  - `@opetope/lint` knows the new argument index: for `scope.each` the callback that opens is the third argument, so
+    `opetope/no-subscribe-outside-models` stays silent exactly where it did.
+  - There is no alias: a `scope` object has no `keyed` member at all.
+
+- bb05f21: **The advice a library gives has to be one an author can carry out (D444).** Three places where it was not. Nothing
+  runs differently: no public name, no lifecycle law and no runtime branch changes, and the four size consumers are
+  byte-identical to the ones before this change.
+
+  **The `call` → `command` report named a replacement that does not compile.** The rule said the body «takes one
+  argument, its context, and reads the declared input off it as `input`» and never said that the input is named by
+  **annotating** that context — and there is no other place to name it, because TypeScript has no partial inference.
+  Measured on a consumer tree migrated to the letter of that report: the lint run is **green, 0 messages**, and `tsc`
+  is **red with 4 errors**, every one of them standing on code the author wrote correctly — at an `invoke`, at a host
+  call, at the shape a factory returns — and the last of them reading backwards, `Type 'Deposit' is not assignable to
+type 'void'`. The report names both annotations now,
+  `({ input, update }: ModelCommandContext<Deposit>)` and `({ input, source }: FeatureCommandContext<typeof within,
+Deposit>)`, and so do both language pairs of the lint README. The type says it too: reading an input off a context
+  the body never annotated is refused **on the read**, with that annotation printed, instead of answering `void` and
+  letting the refusal land somewhere else. The `void` default, the result type and both inference forms D386 promises
+  are untouched.
+
+  **The order the upgrade guide argued from could not be carried out.** «Taken against the tree as it stands before
+  any rename, the same report is what it is» — measured, it is not: on a pre-wave tree carrying a real D288 defect the
+  first lint run reports seven `opetope/no-retired-vocabulary` and **nothing else**. Four rules of the six read a
+  shape this wave introduced and say nothing until it is written: `no-write-after-source-write` reads the writer off
+  the effect run's second parameter, `capture-command-cleanup` off a command body's one parameter, `enabled-predicate`
+  reads the field `enabled`, and `no-command-in-deps` names the record `useModel(Declaration, select)` answers.
+  `prefer-effect-current` reports in both shapes and writes its fix only on the new one. The guide names that limit in
+  both pairs and gives a two-pass order: the four shape renames first — all four named by the first run or by `tsc`,
+  and none of them moving a write, a commit or a dependency array — then the lint again, and that is the run the rest
+  of the guide is about. Teaching the rules the old shape was weighed and refused: the pre-wave effect run and a legal
+  new run destructuring a value that carries `update` are the same syntax, so a rule taught the old one reports
+  correct new code.
+
+  **Six retired words were refused without a replacement.** `skipInitial`, `when` and `onDispose` at an effect,
+  `backpressure` at an event, `when` at a contribution and `from` at `defineCondition`. Five of them answered one
+  sentence — «is not a field this record names» — which is true of a word that never existed and false of a word that
+  did, and on `skipInitial`, the one rename of the wave a word-for-word transfer gets wrong in silence, it advised
+  deleting the word; the sixth, `from`, named the word and not the replacement. Each record names its retired word now, in the form `policy` and `once` already use, and `skipInitial` names
+  the inverted polarity as well. A retired word whose value is a callback is spelled as a callback, so the predicate
+  an author wrote keeps its contextual type: on the same probe the six words cost **10 errors before and 7 after**,
+  and the three that went were implicit-`any` noise around the instruction.
+
+- aaaa92c: **An effect run takes its value first, and its modifiers are `initial`, `filter` and `finalize` (D379).** The run is
+  `(current, context)` instead of one context that carried `current` inside it, and the three tail options are renamed.
+  No branch of the runtime changes: the same loop, the same supersession, the same failures, the same release order.
+
+  ```ts
+  // before
+  ctx.effect(draft, async execution => save(execution.current, execution.signal), {
+    skipInitial: true,
+    when: (current, previous) => current.text !== previous?.text,
+    onDispose: ({ source }) => close(source),
+  });
+  // after
+  ctx.effect(draft, async (current, { signal }) => save(current, signal), {
+    filter: (current, previous) => current.text !== previous?.text,
+    finalize: ({ source }) => close(source),
+    initial: false,
+  });
+  ```
+
+  - Position 1 of a body is what the body is about, everywhere else in the vocabulary: `call` takes `(input, context)`
+    and the child of a scope takes `(value, context)`. The effect run hid its subject inside the context; the `run` of
+    an event still does, carrying `payload` as a member, and this release does not change it. That context is one of
+    the places an event's payload is named (D324, D347), so moving the subject there moves an inference site — its own
+    decision, with its own measurement — and an event's `subscribe` cannot follow at all, since its subject is `emit`,
+    a channel rather than one value.
+  - `previous` stays on the context. It is not the subject of the run but a circumstance of it, beside `signal`,
+    `timers` and `source`; a run that needs both writes `(current, { previous })`. D379 names the price — in a run that
+    reads both, the pair now spans two levels — and the measurement behind the choice.
+  - `when` is `filter`. The same word names a feature's and a slot's condition of existence, and as an effect option it
+    was never that: it selects values without gating the node's lifetime.
+  - `skipInitial: true` is `initial: false`, and the modifier now defaults to `true`. The old name promised to skip the
+    initial _value_; D296 says that value is observed either way and only the _run_ is skipped.
+  - `onDispose` is `finalize`: an effect has two releases — the disposer a run returns, and the one the node itself
+    gets once — and an `on*` prefix did not tell them apart. No word of the authoring vocabulary carries that prefix
+    any more.
+  - `opetope/prefer-effect-current` now rewrites `source.getSnapshot()` to the run's first parameter, under whatever
+    name the author bound it; `opetope/no-write-after-source-write` reads the writer off the context in its new
+    position. There are no aliases: the three retired words are refused as unknown fields of the record.
+
+- dae5079: **The one section order now reaches the body file, and a selection from a required import says why it takes no
+  options (D434, D435).** Two named limits of the wave, both of them a refusal that was missing rather than a
+  behaviour that was wrong. Nothing runs differently: the runtime checks the same records in the same order, and
+  every call that compiled still compiles.
+
+  - **`opetope/define-feature-property-order` reads both callees.** It compared the callee with `defineFeature`, and
+    the body form's callee is `defineFeature.body`, so the three sections of every body file were unordered — a
+    `{ exports, own }` body passed in silence under a rule that stands at `error` in `recommended`. Both callees are
+    now read against the one order of spec §2.1 and D280, `imports`, `requires`, `own`, `exports`, `provides`,
+    `when`, `body`, of which a body writes a subsequence. **Breaking for a consumer** whose `defineFeature.body(…)`
+    is written in another order: it becomes an `error`, with the same autofix that reorders the header form. A key
+    no body takes, a spread, and `defineFeature.body(header)` are still left to the type checker.
+  - **The message names the sections of the callee it reports.** It enumerated all seven; a body takes three, and the
+    other four are not keys an author can write there. The body form now reads `own, exports, provides`. The
+    `messageId` and the options schema are unchanged, so a configuration that names either keeps working.
+  - **`own.select` beside a required import answers with an instruction instead of `never`.** `whenMissing` answers
+    an absence only an `optional(…)` import can have, and scheduling belongs to `own.command`, so there is no legal
+    options record there at all — and the parameter typed `never` printed back the key the author had written,
+    correct as written, refused against a word that says nothing about the record. The key set is inferred and
+    mapped to the sentence, the way every other unnamed word of this family is, and the sentence says there is
+    nothing to write here and that the call is two arguments long. An empty record and an explicit `undefined` are
+    named too, instead of asking for a `whenMissing` that the next line would refuse.
+  - **Where the report lands moved, for `own.select` only.** It now points at the word inside the options record
+    rather than at the whole argument. Source that pins a refusal to a line — a `@ts-expect-error` above a
+    multi-line call — moves the directive to the line of the word. No call shape changes.
+
+- aaaa92c: **One word for a command, one for its order (D385–D389).** The primitive is `Command<Input, Output>`: the type was
+  the last place the vocabulary still said `Call`, while the hook was already `useCommand`, the record `CommandHook`,
+  the outcome `CommandOutcome` and the fixture `command(...)`. `CallError` is `CommandError`, `runCall` is
+  `runCommand`, `RunCallOptions` is `RunCommandOptions`, `CallTimeoutError` is `CommandTimeoutError` and
+  `CallInputArgs` is `CommandInputArgs`. There are no aliases.
+
+  - **A body takes one argument, its context (D386).** `ctx.command(({ input, update }) => …)` and
+    `own.command(within, ({ input, source, signal }) => …)`. `Input` and `Output` default to `void`, so the
+    `_input: void` placeholder is gone from every command that takes none. A typed input is declared once, by
+    annotating the destructured context: `({ input, update }: ModelCommandContext<Deposit>)` or
+    `({ input, source }: FeatureCommandContext<typeof polling, Deposit>)`. Both types are new public exports. Give a
+    model factory a result type — `function createCounter(context: ModelContext): ModelOf<typeof Counter>`, the form
+    the examples use: inside an inline arrow handed straight to `openModel(Decl, ctx => …)` or `model(Decl, ctx => …)`
+    the expected type is not instantiated yet, so a body that names no input reads as `Command<never, …>` instead of
+    taking the `void` default.
+  - **`concurrency` replaces `policy`, `queueBy` and `lane` (D387).** One word that also takes the queue node itself:
+    `'parallel' | 'queue' | 'latest' | lane | { by } | { by, lane } | { lane, pending: 'latest' }`. A lane is a
+    reference commands share, which is why the word accepts it; `'parallel'` beside a lane and a bare `by` without a
+    queue are now unwritable rather than refused. `dedupe` stays a sibling option and `'latest'` still refuses it.
+    A selection writes the same word with the members it can answer for — the keyed record is not one of them, and
+    a feature has no keyed queue either, so both are refused with the reason. The retired `policy`, `queueBy`, `lane`
+    and `once` are named by each options record, so they are refused in a written literal and in an assigned record
+    alike — on `ctx.command`, on `own.command` and on `ctx.select`, which also refuses `memoize` and `dedupe`.
+  - **Declaring and selecting are two words (D388).** `ctx.command(run, options?)` declares;
+    `ctx.select(source, 'name' | ['a', 'b'], options?)` selects what a dependency already declares — one name answers
+    one command, a list answers a record. `ctx.calls` and `own.calls` are gone, and so is `useCommands`: a record of command consumers
+    comes from `useModel(Declaration, select)`, which has an owner and a lifetime. `bind` of `@opetope/runtime` is
+    unchanged.
+  - **`once` is `memoize` (D389).** The cache keeps its behaviour and loses a name the platform already owns:
+    `addEventListener(type, handler, { once: true })` means "then stop", which is not what this option ever did.
+
+  `@opetope/lint` follows the vocabulary: `opetope/capture-command-cleanup` reads the context off the body's one
+  parameter and recognises `concurrency: 'parallel'`, and `opetope/no-command-in-deps` names the selection a record
+  comes from.
+
+- 34bdbfb: **One word for one thing, and one sentence for one question (D410, D411).** A vocabulary pass over the public API:
+  the refusals that asked one question in five sentences now ask it in one, the position a signature calls `source`
+  is called `source` everywhere, and eight words that named one behaviour twice are one word apiece. No branch of the
+  runtime changes: the same checks run in the same order.
+
+  **Breaking, word by word.** Every row is a source change with no alias; `opetope/no-retired-vocabulary` reports each
+  one and names the replacement.
+
+  | Before                                                         | After                                               |
+  | -------------------------------------------------------------- | --------------------------------------------------- |
+  | `defineCondition(id, { from, select })`                        | `defineCondition(id, { select, source })`           |
+  | `slot(target, value, { when })`, same at `pipe`, `register`    | `slot(target, value, { enabled })`                  |
+  | `resource.live({ delivery: { overflow: 'reject' } })`          | `resource.live({ delivery: { overflow: 'drop' } })` |
+  | `outcome.status === 'ok' \| 'failed' \| 'cancelled'`           | `outcome.kind === 'ok' \| 'failed' \| 'cancelled'`  |
+  | `ResourceActivity` from `@opetope/devtools`                    | `ResourceNodeActivity` from `@opetope/devtools`     |
+  | `ResourceDisposer` from `@opetope/core/internal`               | `Disposer` from `@opetope/core/internal`            |
+  | `NavigatorPolicy` from `@opetope/navigation`                   | `NavigatorCatalogue`                                |
+  | `surface.policy`                                               | `surface.catalogue`                                 |
+  | `ApplicationConditionBinding` from `@opetope/runtime/internal` | the same name, from `@opetope/runtime`              |
+
+  `@opetope/lint` renames the rule that read that field: `opetope/when-predicate` is `opetope/enabled-predicate`,
+  and its message ids are `enabledIsAsync`, `enabledReturnsBareSource` and `enabledReturnsSource`. A configuration
+  that named the old rule has to name the new one; `configs.recommended` and the shipped `oxlintrc.json` fragment
+  already do.
+
+  Two of these are record keys, so a source with `sort-keys` reorders the literal as well as renaming the key:
+  `{ from, select }` becomes `{ select, source }`, and `{ Component, when }` becomes `{ Component, enabled }`.
+  `{ status: 'ok', value }` becomes `{ kind: 'ok', value }`, which sorts unchanged, while
+  `{ reason, status: 'cancelled' }` becomes `{ kind: 'cancelled', reason }`, which does not.
+
+  **Why each one.** `source` is the word every context already answers the position with, and `from*` stays the
+  prefix of a factory that names where a `Readable` comes from (`fromExternal`, `fromMaybe`). `enabled` is the truth
+  the runtime reads while a node exists — one word at a contribution and at a Resource — while `when` keeps the other
+  mechanism, the declared `Condition`s an application resolves before the node exists; `scope.while(source, open,
+{ when })` and an effect's `filter` are untouched. `drop` is what a full capacity does with the value that does not
+  fit, at both nodes that admit a producer; `flush-oldest` is still the default of a keyed delivery and still the
+  answer for a producer that may lose nothing. `kind` is the discriminant eleven settled answers already carried.
+  `NavigatorCatalogue` is named for its job, beside `NavigatorPersistence`, because a policy is data (D291) and this
+  is four callbacks a navigator asks.
+
+  **Not breaking, and worth reading.** Every options record now refuses an unknown field with the sentence spec §3
+  promised — `<subject> <node> <record> contains unknown field <key>.` — and says which field it owes with
+  `<subject> <node> <record> requires <key>.` Five sentences became one, and the three that never printed the field
+  at all (`requires exact data fields`, `own.attach takes open, or open and close, and nothing else`) now print it. A
+  node that reads a source says so in two sentences per surface instead of three, and the word of the position is the
+  author's. `own.select` lost two of its four overloads: a call that writes the options record has one candidate of
+  its arity now, so a fault in that record is reported as the record's own refusal instead of
+  `Argument of type '"echo"' is not assignable to parameter of type 'never'`, and the record names the five words a
+  selection does not take — `concurrency`, `dedupe`, `lane`, `memoize`, `policy` — each with what to write instead.
+
+  **Measured.** Runtime size consumers, rebuilt: `application graph consumer` 48 248 B against a ceiling of 49 000
+  (48 318 before), `public feature consumer` 39 579 B against 41 000 (39 712 before). Type stress: 11 695 / 87 068 /
+  159 371 instantiations, unchanged to the digit. No ceiling moved.
+
+### Patch Changes
+
+- dae5079: **A refusal names a remedy the author can execute, and a gate holds what the tree prints (D415).** Four debts the
+  wave D365–D414 left behind, each reproduced before it was fixed and measured after. No branch of the runtime
+  changes.
+
+  **The instruction of `EventPayloadNotNamed` carries its condition.** `run` names the payload of an event only while
+  it is not context-sensitive, and a callback becomes context-sensitive as soon as one parameter it writes has no
+  annotation. The old text said «annotate the first parameter of `run`», which for a `run` that also destructures its
+  context names nothing and earns a second refusal — the shape the cookbook's `polling` recipe was written in. The
+  marker now reads «name the event payload: annotate every parameter of `run`, the payload first — a `run` that
+  leaves its context unannotated names nothing — or annotate a `delivery.by` parameter», the recipe is written in the
+  form it names, and spec §2.23 compiles that form. A source that compares the marker text line by line updates the
+  line; the shape of author code is unchanged.
+
+  **`ctx.select` refuses the record and not the key.** Its four overloads are two, differing by how many arguments
+  they take, the way D410 collapsed `own.select`. A misspelled or retired field of the one-name form used to print
+  `Argument of type '"load"' is not assignable to parameter of type 'never'`, naming the key the author got right; it
+  now prints the instruction the record carries. Both call forms and every written type argument list are accepted as
+  before.
+
+  **spec §3 names the three sentences an owed field actually has**, instead of promising one that two nodes of six
+  hold: a record all of whose keys are required says `requires <key>.`, a key that has to be a callback says
+  `<key> must be a function.` — which names its type as well — and a key owed only because a sibling was written says
+  which sibling.
+
+  **`opetope/no-retired-vocabulary` names the last three migrations it was missing.** `ApplicationExecution` and
+  `ApplicationImportBinding` of `@opetope/runtime/internal` are reported beside `ApplicationConditionBinding`, and
+  `surface.policy` is reported on a surface `defineSurface` of `@opetope/navigation/react` declared — the word the
+  message of `NavigatorPolicy` already named and the rule never fired on. The shared message id is
+  `runtimeInternalEntry`, renamed from `conditionBindingEntry` because it answers three names now.
+
+  Size: `application graph consumer` 48 248 B against 49 000, `public feature consumer` 39 579 B against 41 000 —
+  byte for byte what D410 measured. Type stress: 11 695 / 87 068 / 159 371 against ceilings 12 034 / 99 062 /
+  181 237, to the digit the recorded baseline, which is not rewritten.
+
+- bb31983: **Five debts the wave named out loud, closed together (D437).** None of them was found by reading the code: each was
+  written down as a limit or a debt by the decision that left it, and left because the files it needed were being
+  edited on another branch. No authoring word moves, no runtime behaviour changes, and no package `src` outside the
+  lint rule's message is in this diff.
+
+  - **`opetope/no-write-after-source-write` stops saying «in silence».** D432 made the first write such a run loses
+    reach the reporter as `LostWrite`, once per run and saying the rest went with it, so the rule's message and its
+    section in both READMEs were describing a silence that is no longer whole. All three are corrected in one hand:
+    the drop is still a drop, the refused `invoke` after it is still silent, and so is every other way a write is
+    lost — a newer value, a cancelled caller, a generation fence, a closed model. The README also stops implying that
+    a successor which hides the loss from the cell hides it from the record; it does not.
+  - **The example gate of `ci:docs` reads both callees that declare sections.** D434 recorded it as a named limit:
+    blocks were selected by `\bdefineFeature\s*\(`, which does not match `defineFeature.body(`, so a document block
+    declaring only a body reached the packaged order rule through nothing. The selection is
+    `\bdefineFeature(?:\.body)?\s*\(` now, spec §5.8 carries both forms in both languages, and the gate reads 60
+    feature examples where it read 58. Nothing was passing through the hole — both bodies of the repository hold the
+    order — so the change is proved by injection instead.
+  - **`docs/resource-migration.md` joins the compiled examples (D419).** Nine blocks are lifted into checked
+    fixtures, which makes eleven documents whose examples `ci:type` reads — the second migration guide to join, under
+    the «was» mechanism the first one brought with it. Three of its blocks are «before» blocks and cannot compile: each
+    carries `// @ts-expect-error` on the line that shows the removed form, so the count of asserted refusals is five
+    for one guide, three for this one and zero for the other nine. Nothing in the guide was wrong: the six live
+    blocks compiled as written.
+  - **The comment over four rows of `selected-call-diagnostics.test.mjs` stopped being true.** It pinned the shape
+    D435 has since replaced — a parameter of type `never`, a report anchored at the argument. It now quotes what the
+    tree prints.
+  - **The type ceiling of slice `01` is raised by the owner, 12 034 → 12 200.** The slice measures 11 695
+    instantiations, which left 2.8 % under the ceiling where D400 named 3.9 % over the measurement as its alarm; the
+    raise restores 4.1 % under the ceiling and 4.3 % over the measurement. No other ceiling moves, no bundle byte
+    changes, and the granted headroom may not be cited as an argument: it is given, not measured.
+
+- aaaa92c: **The write a run loses after moving its own source (D365).** A write of an effect run into a cell its own source
+  reads changes the value that source publishes, and the notification is synchronous: the run is aborted inside that
+  write, so every write of the run after it is dropped and an `invoke` after it is refused. That is the law of spec
+  §2.11 and of a late write (D288), and neither changes here. The drop was silent when this was written; D432, later in
+  the same release, sends the first of the dropped writes to the reporter as `LostWrite`, and the refused `invoke`
+  stays silent. What was missing is the reason the defect reaches production instead of a test, and the tool that
+  catches it.
+
+  - **`opetope/no-write-after-source-write`**, `error` in `configs.recommended` and in the shipped `oxlintrc.json`. It
+    reports the write that moves the effect's own source when another write of the same run can follow it, and it
+    proves three things first: the effect is declared on a context of this library; the cell the write names is part of
+    the source — the cell itself, or a `derive` of `@opetope/core` whose dependencies name it **and whose selector
+    publishes the value of that dependency**, which is the law's own carve-out for a write that leaves the published
+    value equal; and the later write stands in the same block, in a later statement, with no `return` or `throw` of the
+    run between the two. A source assembled in another function, a source read off an object, a cell that arrived as a
+    parameter, a `derive` over a `derive` and a commit as the moving write are all outside what it reads, and its
+    README lists them. There is no fix: make the write into the source the run's last write, or keep what the run
+    accumulates out of its source and read it with `getSnapshot()`.
+  - **The successor run is now written down** in spec §2.11, in spec §4 «Effect runs» and in `primitives` §4.1 step 8:
+    the loop opens a successor run for the new value **where `when` admits it**, and a successor that repeats the write
+    hides the loss, so the cell ends up correct through the second run. The loss stands whole where a guard makes that
+    successor return early, and where a `when` that rejects the new value leaves no successor at all (D329). A third
+    form is recorded with it: a `capture` taken after the moving write throws the run's own cancellation, and nothing
+    is reported for it either.
+  - **A repeated commit names its cure**: `State commit has already been used.` became
+    `State commit has already been used. Capture per write.` — legitimate by the same section, which says two commits
+    of one target in one call are what a command with two mutually exclusive places to write needs.
+
+  This change moves no budget by itself. Measured against a clean rebuild of `af278de`: the runtime
+  `public feature consumer` is 38 771 → 38 784 B and the `application graph consumer` 47 394 → 47 403 B. The two
+  runtime ceilings are ratcheted once for the whole wave this ships in, over a measurement of the merged tree
+  (D372).
+
+- bb05f21: **A lost write is heard by the whole authority of a run, not by one writer (D447).** D432 made the most expensive
+  defect of this library audible: a write of a run into a cell its own source reads ends that run inside the write, and
+  the writes after it are dropped where everything still looks repaired. It heard only the writer that made the moving
+  write — so the shape the library itself recommends stayed mute. When one operation is shared by an effect and a
+  command (D288), the effect invokes the command, the command makes the write, and the command has nothing more to
+  write: the run lost the money and nobody said anything.
+
+  - **The authority is the run and the commands it `invoke`s.** A command inherits the cancellation of the run that
+    started it, so one abort ends them both, and the moving write may be made by any of them. The first write that
+    authority drops reaches the reporter as `LostWrite`, once, with the same three remedies as before.
+  - **Nothing outside that authority changed.** A write dropped by a newer value, a cancelled caller, a generation
+    fence or a closed model is as silent as it was — the abort each of them carries is its own, and the runtime proves
+    the authority by the identity of the abort, not by a guess about timing. This is still the half of D288 that stands.
+  - **The record's sentence moved with the law**: «the run had already ended inside an earlier write under its own
+    authority into a cell its source reads». A test that pinned the old sentence word for word needs the new one.
+  - **`opetope/no-write-after-source-write` now reports the call**, not just the write: an `invoke` of a command that
+    writes a cell the run's source reads, where another write of the run follows it. That form is the one the runtime
+    usually cannot report — the run is awaiting that very call when the write lands, so its promise is cancelled and
+    the body reaches no write at all — which is why the editor has to name it.
+
+  Measured by rebuilding the size consumers of one tree with and without the change: `application graph consumer`
+  48 455 → 48 515 B against a 49 000 ceiling, `public feature consumer` 39 835 → 39 884 B against 41 000. The three
+  Core lines did not move. No ceiling moved, and no public name, signature or type changed.
+
+- bb05f21: **The prose of `opetope/enabled-predicate` names the field the rule reads (D220, D411).** D411 renamed the field of
+  a contribution from `when` to `enabled`, and the rule that reads it from `opetope/when-predicate` to
+  `opetope/enabled-predicate`. The heading and the table of reported shapes moved with it; four sentences around them
+  did not, and they were the ones telling the reader which word to write. Both package READMEs now say:
+
+  - a contribution's `enabled` — not its `when` — answers the visibility fact of this instance, not the source
+    that carries it;
+  - the rule reads the `enabled` of a `slot`, `pipe` or `register` contribution, and any `enabled` whose function
+    destructures the evaluation context;
+  - a decision the predicate cannot change is hoisted out of `enabled`, or the line is silenced;
+  - a `when` is a different field and is left alone wherever it stands. The sentence used to set «a `when` outside a
+    contribution» against the `when` inside one, and since D411 a contribution has no `when` at all, so the
+    qualification had stopped dividing anything.
+
+  The word stays where it is still written: the `when` section of a feature declaration, the source value of
+  `scope.while`, the sentence that an effect's change filter is `filter` and not a `when` at all (D379), and the
+  historical rows of the retired-vocabulary table, which exist to name what a word used to be. Documentation only —
+  no rule, message, fix or configuration changes.
+
+- bb31983: **Three places where the text an author reads did not match what the code does (D442).** No law of the runtime
+  moves and no public name is added; what changes is what the author is told when they are wrong.
+
+  - **The lint rule names all three ways out of a lost write, not two of them.** D432 made the first write a run
+    loses after moving its own source reach the reporter as `LostWrite`, naming three remedies, and recorded that
+    `opetope/no-write-after-source-write` already named them «in the same words». It named two. The one it left out —
+    `execution.capture(state)` taken _before_ the moving write — is the only one that saves that write whole, and the
+    author reads the rule in the editor long before any run reports. The message now carries the runtime's sentence
+    word for word, both package READMEs say so, and `ci:source` reads the sentence out of the runtime and looks for
+    it in the rule, so the two cannot drift again. Spec §2.11 also stops saying such a defect «is found in
+    production»: it used to be, and since D432 the record finds it.
+
+  - **A `request` written as `undefined` is refused on the key, and the refusal says so.** Every option of a Resource
+    declaration is read from the key the record carries (D407), so `{ ...shared, request: on ? account : undefined }`
+    writes the word. Under `exactOptionalPropertyTypes` the compiler refused that record — but for `request` alone it
+    refused it in the wrong place: `request` is where `Request` is inferred, so the written `undefined` became part of
+    the type parameter, `identity` turned required, and the message asked for a record the author never wrote
+    (`Property 'identity' is missing … key: (request: string | undefined) => never`), naming neither the key nor
+    `undefined`. An author who follows that message writes an `identity` and keeps the defect. The refusal now stands
+    on the key and carries the clause the runtime prints, plus the second remedy the migration guides teach: «a key
+    written as `undefined` is a word this declaration wrote: leave the key out where the word is not meant, or branch
+    the declaration». Both surfaces spell it, out of one string. Nothing legal moves — a request written as a value,
+    as a `Readable` (including one that publishes `undefined`, which closes the materialization instead of writing a
+    word), a spread that carries the key only where it is meant, a branch on the record, and a declaration with no
+    `request` are all accepted as before. Two forms do change: a `request` whose type is `any` is now refused, where
+    it used to be accepted and answered `Resource<Data, any>`, and a `request` whose type is `unknown` is refused with
+    this clause instead of with the old demand for an `identity`.
+
+  - **`PaginationUnavailableReason` is on `@opetope/core/internal`.** The union standing in `reason` of the public
+    `PaginationState` and `PaginationOutcome` was a file-local alias on no entry at all, while the gate that records
+    that choice already called it an internal type. It is now where that comment says it is. It is not published: the
+    compiler does print `'retired'` to a consumer whose exhaustive `switch` breaks, which is the argument D364 and
+    D375 used, but the union is reachable through the public record that carries it —
+    `Extract<PaginationState<Cursor>, { kind: 'unavailable' }>['reason']` — which is the reason D375 left
+    `ResourceChannel` internal. Publishing it would cost the last type of the public budget, and D364 reserved that to
+    the owner.
+
+  Measured, isolated, by rebuilding the same tree with and without the change: all five size rows are byte-identical
+  (1 047 / 7 885 / 4 856 B on Core, 48 455 and 39 835 B on the runtime consumers), because a marker is a type and
+  types are erased. The type budget moves +11 / +70 / +117 instantiations on the three stress slices, to
+  11 706 / 87 138 / 159 488 against unchanged ceilings of 12 200 / 99 062 / 181 237. The form was chosen by
+  measurement and not by taste: the same instruction written as a fourth member of the declaration intersection costs
+  +71 / +1 429 / +2 795. `ci:public-surface` reads 59 types and 37 values before and after.
+
 ## 0.11.0
 
 No changes in this release.
@@ -155,11 +611,11 @@ No changes in this release.
 
 ### Patch Changes
 
-- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Call из
+- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Command из
   effect и сериализует независимые объекты через очередь по ключу. Stream умеет накапливать кадры в границах
   открытия. Контекст данных отделён от ключа, а ёмкость кэша перенесена из retention в самостоятельную опцию cache.
   Retention теперь задаётся литералом, model resource/stream принимает готовый Readable, а `queueBy` создаёт
-  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Call
+  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Command
   через `rethrowIfCancelled`.
 
 ## 0.9.2
@@ -228,7 +684,7 @@ opetope/no-subscribe-outside-models` in that application sits on a subscription
 
 - d7f346a: `opetope/no-command-in-deps` keeps a command hook out of a React dependency array.
 
-  A hook read from `useCommand`, from a key of `useCommands` or from a `Call` field of a `useModel` selection is a
+  A hook read from `useCommand`, from a key of `useCommands` or from a `Command` field of a `useModel` selection is a
   snapshot of the render it was read in: the object is rebuilt on every `inFlight` and `outcome` change, while `run`
   keeps one identity for the life of the binding. An application that wrote
   `useEffect(() => { load.run(); return () => { unload.run(); }; }, [load, unload])` therefore started the command,
@@ -320,7 +776,7 @@ No changes in this release.
 
 ### Minor Changes
 
-- 410f2f0: Run authentic Calls in headless model tests with `runCall` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
+- 410f2f0: Run authentic Calls in headless model tests with `runCommand` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
 
   Add the recommended `opetope/no-internal-imports` rule for static imports, re-exports, literal dynamic imports, unshadowed `require` and TypeScript import types. `configs.internalImports` uses this rule for JavaScript and TypeScript, including tests, without replacing the host's `no-restricted-imports`. The redundant `internalImportPattern` export is removed; allow trusted implementation files through the config or an explicit rule override.