@opetope/lint 0.11.0 → 0.12.0

package/README.md

@@ -7,6 +7,47 @@ checker, the runtime and dead-code analysis already answer stays with them (see
 The package depends on no other `@opetope/*` package and reads no types, so a host can lint sources it has not
 built yet.
 
+<!--examples
+import { derive } from '@opetope/core';
+import type {
+  Command,
+  ModelCommandContext,
+  ModelContext,
+  ModelStateWriter,
+  OwnedState,
+  Readable,
+  ResourceData,
+} from '@opetope/core';
+import { defineModel } from '@opetope/core';
+import { defineSlot, requiresModels, useCommand, useModel } from '@opetope/react';
+import { useEffect } from 'react';
+
+type Quote = Readonly<{ bid: number; pair: string }>;
+type Payload = Readonly<{ amount: number }>;
+/**
+ * `kind` is a plain string on purpose: an updater that spreads the previous value and writes a string literal into a
+ * field typed as a union of literals widens that literal and stops compiling, which is a defect of the writer's own
+ * signature rather than of this example (D419).
+ */
+type Sessions = Readonly<{ items: readonly string[]; kind: string }>;
+
+declare const amount: number;
+declare const busy: OwnedState<boolean>;
+declare const context: ModelContext;
+declare const ctx: ModelContext;
+declare const frames: Readable<string>;
+declare const host: Readonly<{ send(input: Payload, signal: AbortSignal): Promise<void> }>;
+declare const label: Readable<string>;
+declare const sessions: OwnedState<Sessions>;
+declare const total: OwnedState<number>;
+declare const update: ModelStateWriter['update'];
+
+const FormActions = defineModel<{ readonly submit: Command<void, void> }>('example.form.actions');
+const FormSlot = defineSlot('example.form.slot');
+declare const createActions: (context: ModelContext) => import('@opetope/core').ModelOf<typeof FormActions>;
+declare const Screen: Readonly<{ load: Command<void, void>; unload: Command<void, void> }>;
+-->
+
 ## Installation
 
 ```sh
@@ -35,18 +76,19 @@ export default [
 ```
 
 The plugin is both the default export and the named `opetopeLint`. The configuration registers it under the
-namespace `opetope`, so a rule is named `opetope/when-predicate`. Parsing requires `@typescript-eslint/parser`;
+namespace `opetope`, so a rule is named `opetope/enabled-predicate`. Parsing requires `@typescript-eslint/parser`;
 both it and `eslint` are peer dependencies.
 
 ## Configs
 
 ### `recommended`
 
-Every rule that holds wherever Opetope is written: `when-predicate`, `define-feature-property-order`,
+Every rule that holds wherever Opetope is written: `enabled-predicate`, `define-feature-property-order`,
 `require-literal-id`, `id-naming`, `no-internal-imports`, `no-snapshot-read-in-render`, `no-snapshot-in-update`,
-`no-redundant-const-tuple`, `no-command-in-deps`, `prefer-effect-current`, `capture-command-cleanup` and `require-declared-models` as errors. A rule that needs to know where a host keeps its files is off here and arrives
-through `layers`; `prefer-model-selection` is off because the number of hooks a component may keep is a taste a
-project settles for itself.
+`no-redundant-const-tuple`, `no-command-in-deps`, `prefer-effect-current`, `no-write-after-source-write`,
+`capture-command-cleanup`, `require-declared-models` and `no-retired-vocabulary` as errors. A rule that needs to know where a host keeps its
+files is off here and arrives through `layers`; `prefer-model-selection` is off because the number of hooks a
+component may keep is a taste a project settles for itself.
 
 `configs.recommended.rules` in full, which is also what `@opetope/lint/oxlintrc.json` ships:
 
@@ -59,14 +101,16 @@ project settles for itself.
 | `no-command-in-deps`            | `error`       |                                             |
 | `no-internal-imports`           | `error`       | also scoped by `internalImports({ allow })` |
 | `no-redundant-const-tuple`      | `error`       |                                             |
+| `no-retired-vocabulary`         | `error`       |                                             |
 | `no-snapshot-in-update`         | `error`       |                                             |
 | `no-snapshot-read-in-render`    | `error`       |                                             |
 | `no-subscribe-outside-models`   | `off`         | `layers({ models })`                        |
+| `no-write-after-source-write`   | `error`       |                                             |
 | `prefer-effect-current`         | `error`       |                                             |
 | `prefer-model-selection`        | `off`         | the project, with its own `threshold`       |
 | `require-declared-models`       | `error`       |                                             |
 | `require-literal-id`            | `error`       |                                             |
-| `when-predicate`                | `error`       |                                             |
+| `enabled-predicate`             | `error`       |                                             |
 
 The three `off` rules are the three that need something only the project knows: which directories are which layer,
 and how many hooks one component may keep.
@@ -115,7 +159,7 @@ enable this rule or use the helper instead of merging an Opetope pattern into th
 Application code and tests import public Opetope entries. The rule rejects `@opetope/*/internal` and its deeper
 paths in imports, re-exports, literal `import()` calls, unshadowed `require()` calls, TypeScript import types and
 `import = require`. It includes type-only imports; an internal type is still coupled to the private ABI.
-Use `runCall` from `@opetope/core/testing` to run a real model Call, `openModel` from `@opetope/runtime/testing` to open one without a feature, and `command` from `@opetope/react/testing` to construct a fixture Call.
+Use `runCommand` from `@opetope/core/testing` to run a real model Command, `openModel` from `@opetope/runtime/testing` to open one without a feature, and `command` from `@opetope/react/testing` to construct a fixture Command.
 Tests do not receive an automatic exception. Trusted library implementation or host integration can use an explicit
 file override; the rule has no autofix because the correct public replacement depends on the imported operation.
 
@@ -123,17 +167,17 @@ file override; the rule has no autofix because the correct public replacement de
 not resolve aliases, computed import paths, re-export graphs or custom loaders. A locally shadowed `require` is not
 treated as Node's loader. Apply the config to every JavaScript/TypeScript source and test glob the project uses.
 
-### `when-predicate`
+### `enabled-predicate`
 
-A contribution's `when` answers the visibility fact of this instance, not the source that carries it (D220). The
-rule reads the `when` of a `slot`, `pipe` or `register` contribution, and any `when` whose function destructures the
-evaluation context `{ exports, imports, own, read }`, and reports three shapes:
+A contribution's `enabled` answers the visibility fact of this instance, not the source that carries it (D220). The
+rule reads the `enabled` of a `slot`, `pipe` or `register` contribution, and any `enabled` whose function
+destructures the evaluation context `{ exports, imports, own, read }`, and reports three shapes:
 
-| Written                                    | Reported                                                                      |
-| ------------------------------------------ | ----------------------------------------------------------------------------- |
-| `when: ({ imports }) => imports.x.allowed` | returns a source; fixed to `({ imports, read }) => read(imports.x.allowed)`   |
-| `when: async ({ read }) => read(x)`        | a predicate answers synchronously; no fix                                     |
-| `when: () => allowed`                      | a `Readable<boolean>` is passed as `when` directly, without a wrapper; no fix |
+| Written                                       | Reported                                                                         |
+| --------------------------------------------- | -------------------------------------------------------------------------------- |
+| `enabled: ({ imports }) => imports.x.allowed` | returns a source; fixed to `({ imports, read }) => read(imports.x.allowed)`      |
+| `enabled: async ({ read }) => read(x)`        | a predicate answers synchronously; no fix                                        |
+| `enabled: () => allowed`                      | a `Readable<boolean>` is passed as `enabled` directly, without a wrapper; no fix |
 
 The fix wraps the returned member expression in `read(...)` and adds `read` to the destructured context when it is
 absent. A named context is read through itself: `context => context.imports.x.allowed` becomes
@@ -142,8 +186,9 @@ absent. A named context is read through itself: `context => context.imports.x.al
 **The boundary.** The rule reads shapes, not types. `({ read }) => read(counter)` over a non-boolean source stays a
 type error, and so does a `read` of something that is not a `Readable`. Where a member access of the evaluation
 context is a plain value rather than a source, the predicate cannot change its answer, and the rule reports it as
-one written for a source; hoist that decision out of `when`, or silence the line. `when` outside a contribution —
-the positional `(current, previous)` of `effect`, or the source value of `scope.while` — is left alone.
+one written for a source; hoist that decision out of `enabled`, or silence the line. A `when` is a different field
+and is left alone wherever it stands — the source value of `scope.while` — and the change filter of an effect is not
+a `when` at all: it is `filter`, and D379 gave it that name so one word would not answer two questions.
 
 ### `define-feature-property-order`
 
@@ -188,11 +233,15 @@ available to the contribution subtree without this declaration (D158, D250).
 
 ```tsx
 import { defineFeature } from '@opetope/runtime';
-import { requiresModels, useModel } from '@opetope/react';
+import { requiresModels, useCommand, useModel } from '@opetope/react';
 
 const Form = () => {
-  const actions = useModel(FormActions);
-  return null;
+  const submit = useCommand(useModel(FormActions).submit);
+  return (
+    <button disabled={submit.inFlight} onClick={() => void submit.run()}>
+      Submit
+    </button>
+  );
 };
 const DeclaredForm = requiresModels([FormActions])(Form);
 
@@ -358,13 +407,13 @@ useEffect(() => {
 
 The rule reads the dependency array of `useEffect`, `useLayoutEffect`, `useInsertionEffect`, `useCallback`,
 `useMemo` and `useImperativeHandle`, and reports an element that is a command hook binding taken whole: the
-variable of a `useCommand`, a key or a destructured name of `useCommands`, and a field of a `useModel` selection
-the same code reads `run` on. `x.run` and the statuses `x.inFlight` and `x.outcome` are members of that object rather
-than the object, and they stay.
+variable of a `useCommand`, and a key or a destructured name of a `useModel` selection the same code reads `run` on.
+`x.run` and the statuses `x.inFlight` and `x.outcome` are members of that object rather than the object, and they
+stay.
 
-The record itself is the worse shape and carries its own report: `useCommands` builds a new object on every render,
-and so does `useModel` with a selection, so `[hooks]` and `[order]` change on every render rather than on every
-status. The answer is the field the callback reads — `hooks.save.run`.
+The record itself is the worse shape and carries its own report: `useModel` with a selection builds a new object on
+every render, so `[hooks]` and `[order]` change on every render rather than on every status. The answer is the field
+the callback reads — `hooks.save.run`.
 
 The fix is written where the answer is one: a callback that reaches the binding through a single `run` gets that
 path in place of the element, whatever the element was written past — an `as`, a `satisfies` or a `!` is replaced
@@ -374,8 +423,8 @@ because which of them the dependency means is the author's to say. A callback th
 written elsewhere, one that keeps the object itself, takes it apart, or reads a member outside those four — gets the
 report and no suggestion at all.
 
-**The boundary.** Names are resolved by import within one module, not by spelling: `useCommand`, `useCommands` and
-`useModel` are the imports of `@opetope/react`, the six hooks are React's own, and a local alias of either —
+**The boundary.** Names are resolved by import within one module, not by spelling: `useCommand` and `useModel` are
+the imports of `@opetope/react`, the six hooks are React's own, and a local alias of either —
 `import { useEffect as effect }` — is the same import. React is the module named `react` exactly; an `@opetope/*`
 name is also taken from a relative import, which is how a package re-exports its own entry through a barrel, so a
 neighbouring `./scheduling` is React's no more than `@host/scheduling` is. React's hooks are read through a
@@ -400,18 +449,33 @@ Neither is a subscription written where a declared node opens its work and owns
 such a callback returns belongs to that node and is drained with the generation that opened it, so the rule stays
 silent there — this is the shape its own message asks for (D299):
 
-| Callback                                       | Where                       | Ingress |
-| ---------------------------------------------- | --------------------------- | ------- |
-| `resource.live({ connect })`                   | the `connect` member        | yes     |
-| `event(from, subscribe, run)`                  | second argument             | yes     |
-| `scope.while` / `scope.switch` / `scope.keyed` | `open`, second argument     | yes     |
-| `attach(source, { open })`                     | the `open` member           | yes     |
-| `attach(source, { open, close })`              | the `close` member          | no      |
-| `apply`, `load`, `run`, `when`, `key`          | modifiers of the same calls | no      |
+| Callback                                | Where                       | Ingress |
+| --------------------------------------- | --------------------------- | ------- |
+| `resource.live({ connect })`            | the `connect` member        | yes     |
+| `event(source, subscribe, run)`         | second argument             | yes     |
+| `scope.while` / `scope.switch`          | `open`, second argument     | yes     |
+| `scope.each(source, key, open)`         | `open`, third argument      | yes     |
+| `attach(source, { open })`              | the `open` member           | yes     |
+| `attach(source, { open, close })`       | the `close` member          | no      |
+| `apply`, `load`, `run`, `filter`, `key` | modifiers of the same calls | no      |
 
 `resource.load` opens no subscription and has no ingress at all, so a `subscribe` written in its `load` is reported
 like any other hand-written one (D349).
 
+<!--example
+import { defineFeature, defineHostContract } from '@opetope/runtime';
+
+type Exchange = Readonly<{
+  repository: Readonly<{ subscribe(pair: string, emit: (quote: Quote) => boolean, signal: AbortSignal): () => void }>;
+}>;
+
+const exchangeContract = defineHostContract<Exchange>('example.exchange.platform');
+const bookFeature = defineFeature('example.book', {
+  imports: { exchange: exchangeContract },
+/* … */
+});
+-->
+
 ```ts
 own: ({ imports, resource }) => ({
   book: resource.live({
@@ -420,7 +484,7 @@ own: ({ imports, resource }) => ({
     lifetime: 'owner',
     source: imports.exchange,
   }),
-});
+}),
 ```
 
 Inside counts all the way down — a nested arrow, a `function` body, an `await` on the subscription itself, a
@@ -441,32 +505,139 @@ is a named function without the `ModelContext` annotation.
 
 ### `prefer-effect-current`
 
-The `run` of an effect is already given the value it was started for. Reading the same source through
-`source.getSnapshot()` inside that run reads it a second time and says nothing about which run this is, so the rule
-rewrites it to `execution.current` (D296, D323):
+The `run` of an effect is already given the value it was started for — as its first parameter, since D379. Reading
+the same source through `source.getSnapshot()` inside that run reads it a second time and says nothing about which
+run this is, so the rule rewrites it to that parameter (D296, D323, D379):
 
 ```js
 // before
-ctx.effect(quotes, execution => publish(quotes.getSnapshot()));
+ctx.effect(quotes, current => publish(quotes.getSnapshot()));
 // after
-ctx.effect(quotes, execution => publish(execution.current));
+ctx.effect(quotes, current => publish(current));
 ```
 
-The fix writes the word the run already has: the name of the context for `execution => …`, and the local name
-`current` was destructured under for `({ current }) => …`. A run that named neither has no word to write, so the
-report stands alone.
+The fix writes the word the run already has: the name the author bound the first parameter under, whatever it is. A
+run that destructured the value itself, or took no parameter at all, has no word for the whole of it, so the report
+stands alone.
 
-**The two cases it reports without rewriting.** Past the first `await` of the run, `current` is the value this run
-started with and the snapshot is the value of the moment; a change of the source normally restarts the run, so the
-two normally agree — and «normally» is not a licence to rewrite. Under `when` they legitimately differ: the filter
-admits some values and skips others, so the source moves without restarting the run (D168, D296). A modifier record
-this rule cannot read — one assembled elsewhere — is treated as if it carried the predicate.
+**The two cases it reports without rewriting.** Past the first `await` of the run, the parameter is the value this
+run started with and the snapshot is the value of the moment; a change of the source normally restarts the run, so
+the two normally agree — and «normally» is not a licence to rewrite. Under `filter` they legitimately differ: the
+predicate admits some values and skips others, so the source moves without restarting the run (D168, D296, D379). A
+modifier record this rule cannot read — one assembled elsewhere — is treated as if it carried the predicate.
 
 A read inside a nested callback of the run — a `timers.delay`, a subscription handler — is left alone: that code
 runs later than the run does, and the value of that moment is the one it wants. Like every rule that rewrites code,
 this one resolves its context exactly: the `effect` it acts on is the one declared on a `ModelContext` parameter or
 on the context of a `model(Declaration, factory)` written inside a `defineFeature` of `@opetope/runtime` (D309).
 
+### `no-write-after-source-write`
+
+A write of an effect run into a cell its own source reads changes the value that source publishes, and the
+notification is synchronous: the run is aborted inside that write, so every write of the run after it is dropped and
+an `invoke` after it is refused. The first of those dropped writes reaches the reporter as `LostWrite`, once per run
+and saying the rest went with it (D432); the refused `invoke` is still silent, and so is every other way a write is
+lost. The rule reports the write that moves the source when another write of the same run can follow it
+(spec §2.11, D288, D365, D432, D447):
+
+```ts
+// reported: the deposit is never written down, because releasing the key ended the run
+const key = context.state<string | null>('idempotency-1');
+const deposit = context.state<string | null>(null);
+const source = derive([frames, key], (frame, held) => `${frame}:${String(held)}`);
+
+context.effect(source, (_current, { update }) => {
+  update(key, null);
+  update(deposit, 'deposit-1');
+});
+```
+
+A command the run `invoke`s writes under the same authority. `invoke` hands the command the cancellation of the run,
+so one abort ends them both, and a write of that command into a cell the run's source reads ends the run exactly as
+the run's own write does. A write the run reaches after that is dropped and recorded as `LostWrite` like any other
+(D447) — but the run is usually _awaiting_ that call when the abort lands, and then the promise it awaits is
+cancelled and the body reaches no write at all. Nothing is dropped there for the runtime to record, so this rule is
+the only finder of that shape, and it reports the call where it is written:
+
+```ts
+// reported: the write that releases the key is the command's, and the deposit below the call is never reached
+const key = context.state<string | null>('idempotency-1');
+const deposit = context.state<string | null>(null);
+const source = derive([frames, key], (frame, held) => `${frame}:${String(held)}`);
+const release = context.command(({ update }: ModelCommandContext<void>) => {
+  update(key, null);
+});
+
+context.effect(source, async (_current, { invoke, update }) => {
+  await invoke(release);
+  update(deposit, 'deposit-1');
+});
+```
+
+Whether the drop shows in the data is a second question, and it is why such a defect used to be found in production
+rather than in a test: the loop opens a successor run for the new value where `filter` admits it, and a successor
+that repeats the write hides the loss — the cell ends up correct through the second run. The loss stands whole where
+the successor does not repeat that write, which is what a guard does (`if (held === null) return`), and where no
+successor opens at all, which is what a `filter` that rejects the new value does (D329). The record arrives in every
+one of those shapes, the hidden one included: it speaks about the write that was dropped, not about the value the
+cell ended up with (D432).
+
+There is no fix: which of the two writes the author meant to keep is the author's to say, and the message names three
+ways out — make the write into the source the run's last write, or keep what the run accumulates out of its source and
+read it with `getSnapshot()`, which also saves the second run, or take `execution.capture(state)` before the moving
+write, which is the one that saves this write whole although it saves nothing written after it. It names them in the
+words the `LostWrite` record prints, and `ci:source` holds the two texts equal, because the author reads the rule
+before any run reports (D319, D432, D442, D447).
+
+**What it proves before it reports.** Three things, and a fourth where the moving write is a command's; it says
+nothing where it cannot prove one of them.
+
+_The declaration._ The `effect` is declared on a context of this library — the `effect` of a `ModelContext`
+parameter, or of the context of `model(Declaration, factory)` written inside a `defineFeature` of `@opetope/runtime`
+(D309). The run is the function the declaration takes, written there or bound to a name in this module.
+
+_The cell is part of the source._ Either the source is that cell, or it is a `derive` of `@opetope/core` — written
+where the declaration takes it, or held by a name in this scope — whose dependencies name the cell, and whose
+selector publishes the value of that dependency. That last clause is the carve-out of the law itself: a write that
+leaves the published value equal ends nothing, so a selector that only asks a question about its dependency —
+`held === null ? 'none' : 'some'`, `!held`, `typeof held`, `held ? a : b` — publishes the same word for one key as
+for another, and the rule stays silent over it. So does a selector that drops the dependency, and a selector this
+file cannot read.
+
+_The write can run after it._ The writes are the writer of this run, read under the same names as
+`capture-command-cleanup` reads a command's: `execution.update(…)`, `({ update })` or `({ update: write })` in the
+parameter list, and `const { update } = execution` in the body. The later write has to stand in the same block, in a
+later statement, with no unconditional exit of the run between the two: `if (held === null) { update(key, null);
+return; }` has a write below the `if` that cannot run after this one, and it is not reported. A `break` or a
+`continue` is not such an exit, because the code below it runs.
+
+_The command makes that write._ Where the moving write is a call rather than a write, the call is an `invoke` of the
+run, read under the same names as the writer, and its first argument is a name this module holds a
+`context.command(body)` in — declared on the context of a model, because the `command` of a feature's `own` takes its
+body second and is handed no writer (D385, D386). The body is the function that declaration takes, written there or
+bound to a name in this module, and at least one write through the context of that body names a cell of this source.
+A later write of the run has to follow the call by the same rule as it follows a write.
+
+**The boundary.** Silence is not proof that a write lands. Beyond the shapes above, the rule does not read: a
+source assembled in another function, a source read off an object (`deps.sources`, the shape of the latch recipe), a
+cell that arrived as a parameter, a `derive` over a `derive`, and a writer held by a closure. It reads only `update`
+as the moving write, so a commit into the source — the same law, `update` or commit alike — is not reported; neither
+is the third form of that loss, a `capture` taken _after_ the moving write, which throws the run's own cancellation
+and is reported nowhere. Two writes of one statement are not a sequence — the branches of an `if`, the arms of a
+ternary, the halves of a `try`, the sides of a comma — and neither are two writes of one `switch` case. A write in a
+nested callback of the run is left alone, because the run is already over when a timer or a disposer runs and its
+dropped write has its own reason. A loop whose write into the source goes last loses the first write of the next turn,
+and the rule misses that one.
+
+The call has a boundary of its own, and it is the boundary of one step. A command that arrived as a dependency
+(`invoke(deps.release)`), one whose declaration is in another module, one declared on a context this file cannot
+resolve, and one whose body is assembled elsewhere name nothing this rule can read. It reads one step only: a command
+that moves the source through a second command it invokes, or through a `capture` of a cell of the source, is not
+reported, and neither is a command whose body writes the source through a writer it took from somewhere other than
+its own context. And the `invoke` of a run whose loss is the call itself — a run with no write after that call —
+is not reported either, because nothing there is lost: the `await` does not return, and the run had nothing left to
+do (D447).
+
 ### `capture-command-cleanup`
 
 The writer of a command lives as long as its caller (D288). A write in the `finally` or the `catch` of a `try` that
@@ -476,7 +647,7 @@ and names the word that does land, a commit taken before the `await` (D319, D330
 
 ```ts
 // reported: once the caller is cancelled, `busy` stays `true`
-ctx.call(async (input, { signal, update }) => {
+ctx.command(async ({ input, signal, update }: ModelCommandContext<Payload>) => {
   update(busy, true);
   try {
     await host.send(input, signal);
@@ -486,7 +657,7 @@ ctx.call(async (input, { signal, update }) => {
 });
 
 // the cleanup lands while the model lives
-ctx.call(async (input, { capture, signal, update }) => {
+ctx.command(async ({ capture, input, signal, update }: ModelCommandContext<Payload>) => {
   update(busy, true);
   const done = capture(busy);
   try {
@@ -502,14 +673,15 @@ for a reason — a late write of a cancelled call must not overwrite what a newe
 both ways out. A cleanup that must run for a cancelled call goes through `capture(state)` taken before the `await`; an
 answer that must not land after cancellation — a failure, a result — belongs in a `catch` after
 `rethrowIfCancelled(cause)`. Where a caller cancels one run to start the next — a search its consumer issues again, a
-Call an effect run invokes and a newer value cancels — the older run's write is exactly the one that should not land,
+Command an effect run invokes and a newer value cancels — the older run's write is exactly the one that should not land,
 and a disable comment says so.
 
-Under `policy: 'parallel'` the report does not advise a commit. Calls of such a command overlap, so a cancelled call's
-captured cleanup would clear a flag another call still holds — a flag shared by parallel calls is racy either way —
-and the report says to keep that state per call, or to leave progress to the consumer's `inFlight`. The rule sees the
-policy only when `{ policy: 'parallel' }` is written on the `call` itself; a modifier record assembled elsewhere reads
-as the default queue, where the lane waits for the physical body and a captured cleanup lands in order.
+Under `concurrency: 'parallel'` the report does not advise a commit. Runs of such a command overlap, so a cancelled
+call's captured cleanup would clear a flag another call still holds — a flag shared by parallel calls is racy either
+way — and the report says to keep that state per call, or to leave progress to the consumer's `inFlight`. The rule
+sees the order only when `{ concurrency: 'parallel' }` is written on the `command` itself; a modifier record assembled
+elsewhere reads as the default queue, where the lane waits for the physical body and a captured cleanup lands in
+order (D387).
 
 The rule is a heuristic over syntax, and it proves nothing about a write it does not report. It reads the writer of a
 command body under these names: `execution.update(…)`; `({ update })` or `({ update: write })` in the parameter list;
@@ -526,9 +698,9 @@ is the author's statement that what follows must not run for a cancelled call, a
 and nothing is reported. A flag that must clear on cancellation is therefore written in `finally` through
 `capture(state)`. A guard in a `finally` saves nothing and is still reported, and so is a check of `signal.aborted`
 that neither throws nor returns. `effect`, `event` and the other reactions are left alone: a newer value is what
-cancelled their run, and dropping its write is the point (D288). The context is resolved exactly: the `call` of a
+cancelled their run, and dropping its write is the point (D288). The context is resolved exactly: the `command` of a
 `ModelContext` parameter or of the context of `model(Declaration, factory)` inside a `defineFeature` of
-`@opetope/runtime` (D309); a feature's own `call` hands its body no writer.
+`@opetope/runtime` (D309); a feature's own `command` hands its body no writer.
 
 ### `prefer-model-selection`
 
@@ -544,6 +716,85 @@ without a selection, and it counts each granted model separately: two models in
 the same variable name in two components is two counts. There is no fix — the shape of the selection is the
 author's to write.
 
+### `no-retired-vocabulary`
+
+The words the D365–D411 wave retired, each named together with the word that replaced it. The rule is written for
+one migration pass: this release ships no alias for any of them, so a source that still writes one has not been
+migrated, and once it has been the rule never fires again.
+
+| Retired                                                                                                             | Is now                                                      | Decision |
+| ------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | -------- |
+| `invalidate()` of a Resource                                                                                        | `reset()`                                                   | D373     |
+| `backpressure` of an event                                                                                          | `delivery`                                                  | D374     |
+| `kind` inside a delivery record                                                                                     | `pending`                                                   | D374     |
+| `key` inside a delivery record                                                                                      | `by`                                                        | D374     |
+| `activity` of a `loading` state                                                                                     | `failure`                                                   | D375     |
+| `scope.keyed(source, open, { key })`                                                                                | `scope.each(source, key, open)`                             | D378     |
+| `skipInitial`                                                                                                       | `initial`, with the polarity inverted                       | D379     |
+| `when` of an effect                                                                                                 | `filter` **or** `initial`                                   | D379     |
+| `onDispose`                                                                                                         | `finalize`                                                  | D379     |
+| `externalReadable`                                                                                                  | `fromExternal`                                              | D380     |
+| `Call`, `ctx.call`, `runCall`                                                                                       | `Command`, `ctx.command`, `runCommand`                      | D385     |
+| `policy`, `queueBy`, `lane`                                                                                         | `concurrency`                                               | D387     |
+| `ctx.calls`, `own.calls`, `useCommands`                                                                             | `ctx.select`, `own.select`, `useModel(Declaration, select)` | D388     |
+| `once`                                                                                                              | `memoize`                                                   | D389     |
+| `from` of `defineCondition`                                                                                         | `source`                                                    | D411     |
+| `when` of a contribution                                                                                            | `enabled`                                                   | D411     |
+| `overflow: 'reject'` of a live Resource                                                                             | `overflow: 'drop'`                                          | D411     |
+| `status` of a `CommandOutcome`                                                                                      | `kind`                                                      | D411     |
+| `ResourceActivity` of `@opetope/devtools`                                                                           | `ResourceNodeActivity`                                      | D411     |
+| `ResourceDisposer`                                                                                                  | `Disposer`                                                  | D411     |
+| `NavigatorPolicy`, `surface.policy`                                                                                 | `NavigatorCatalogue`, `surface.catalogue`                   | D411     |
+| `ApplicationConditionBinding`, `ApplicationExecution` and `ApplicationImportBinding` of `@opetope/runtime/internal` | the same names, from `@opetope/runtime`                     | D411     |
+
+**One row cannot be executed from the word alone, and the report says the rest of it.** `ctx.call` becomes
+`ctx.command`, and with it a body of `(input, context) => …` becomes a body that takes its context alone — which
+leaves the input with nowhere to be named, because TypeScript has no partial inference and `command<Deposit>(…)` is
+not a route. The one place is the annotation of the destructured context,
+`({ input, update }: ModelCommandContext<Deposit>)` in a model and
+`({ input, source }: FeatureCommandContext<typeof within, Deposit>)` in a feature, so the report names that
+annotation beside the word. A rename carried out to the letter without it leaves this rule silent and the build red,
+with every refusal standing on code the author wrote correctly (D444).
+
+**There is no autofix, and that is the decision rather than an omission (D404).** Several of these rows are not one
+to one. `policy`, `queueBy` and `lane` collapse into a single `concurrency` whose shape depends on which of the
+three a record wrote together: `{ by }`, `{ by, lane }` and `{ lane, pending: 'latest' }` are three different values
+built from the same three words. `when` at an effect becomes `filter` **or** `initial`, and which one is a question
+about what the predicate asks — `filter: (_current, previous) => previous !== undefined` is not a filter at all, it
+is `initial: false`, and the authoring guide says so. `skipInitial` becomes `initial` with the polarity inverted, so
+the one row that looks purely mechanical is the one that compiles and means the opposite. A fix that guessed wrong
+would rewrite a consumer's source silently, which is worse than refusing, so every report here names the retired
+word, names its replacement, and says outright where the replacement is a choice.
+
+**The boundary.** Ownership is proved by symbol and never by spelling. A retired member is reported only on a
+declaring context of this library — a parameter annotated `ModelContext` of `@opetope/core`, or the `own` section
+written where a `defineFeature` of `@opetope/runtime` takes it — resolved through an alias or a destructured member
+the same way `no-subscribe-outside-models` resolves the ingress of a declared node. A retired name is reported only
+where an `@opetope/*` module is the one that exports it, and where the name is retired at one entry and live at
+another the module is asked exactly: `ResourceActivity` is still what `@opetope/core` calls the background work of
+a `ready` state, and the three names of `@opetope/runtime/internal` are still names on the entry an author takes
+them from. A
+contribution's gate is reported on the `provides` section a `defineFeature` of `@opetope/runtime` takes, the way a
+declared node is reported on `own`; the `status` of a settled answer only on the `outcome` of a `useCommand` of
+`@opetope/react`, and the `policy` of a surface only on the value a `defineSurface` of `@opetope/navigation/react`
+declared. A Resource is the value a `resource.load` or
+`resource.live` of such a context declared, or the record `useResource` of `@opetope/react` answers; its state is
+that record's `state`, or a `getSnapshot()` of it. `activity` is reported only inside a
+narrowing that proves the state is `loading` — an `if`, a ternary or the left half of an `&&`, written about the
+same expression — because a `ready` state still carries the field.
+
+The silence is the point. `Call` inside `'Margin Call'` and inside the translation keys of a catalogue, the
+`{ once: true }` of `addEventListener`, a host's own `policy` option or `policy` of somebody else's object, `Navigator.reset()` and a
+`delivery` field of
+somebody else's record are all left alone, as is `when` at a feature and at `scope.while`, where the word is not
+retired at all, and a `status` of somebody else's record. So is what the rule cannot see: a Resource reached through a model record instead
+of through the declaration that built it, a state narrowed in a `switch` or inside a helper, and an options record
+assembled in another module. Its silence is therefore not proof that a migration is complete — the compiler, which
+now prints the replacement for every word it can name, is the other half (D401, D444). Six of the rows above are
+words an options record used to carry, and each of those records names its retired word so the refusal carries the
+replacement: `skipInitial`, `when` and `onDispose` at an effect, `backpressure` at an event, `when` at a
+contribution and `from` at `defineCondition`.
+
 ## Coexistence with key sorting
 
 A host that sorts object keys alphabetically will disagree with `define-feature-property-order`, because the