@opetope/lint 0.11.0 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,668 @@
 # @opetope/lint
 
+## 0.12.1
+
+### Patch Changes
+
+- 8aa4d85: **Four positions of a call name a command's input, and the member that says so is an intersection (D455).** The
+  `input` of `ModelCommandContext<Input>` and of `FeatureCommandContext<Within, Input>` was
+  `Input extends void ? {instruction} : Input`, which is not provably `Input` while `Input` is unresolved: a generic
+  helper could read the member and could not hand it to anything asking for exactly its own type parameter
+  (`TS2345: Argument of type 'T extends void ? {…} : T' is not assignable to parameter of type 'T'`, and a constraint
+  on `T` did not cure it). It is `Input & (Input extends void ? {instruction} : unknown)` now. An intersection is
+  assignable to each of its members, so the hand-off resolves; the second branch is `unknown`, which intersects away,
+  so a named input reads exactly as before and a call that named none is refused on the read exactly as before. No
+  public name is added or removed — 59 types and 37 values before and after — and every emitted JavaScript file is
+  byte-identical apart from the lint rule's message, so no size budget moves. The type slices move
+  11 736 → 11 756, 87 612 → 87 710 and 160 090 → 160 268 instantiations against ceilings of 12 200, 99 062 and
+  181 237, which stay where they were.
+
+  - **The instruction the refusal prints names four positions in order of cost, and says why there is no fifth.**
+    D444 wrote that the annotation of the destructured context was the one place an input could be named. It is the
+    most expensive of four. `Input` is inferred from every position of the call except the body: the result type of a
+    model factory names the input of every command in the literal it returns; an option whose callback is annotated
+    (`dedupe`, `memoize`, `concurrency: { by }`) names it where a call was writing an option anyway; a constant
+    annotated `Command<Input, Output>` names it and keeps `Output` checked; and the annotation of the context is what
+    is left. `command<Deposit>(…)` is not a position — one explicit type argument pins `Output` to its default, and
+    the body that answers a value is refused for answering one. A feature has the last two only: `own.command`
+    answers a ref carrying the feature's id, which no public name annotates.
+  - **The authoring documents now teach the cheap positions instead of the expensive one.** The spec, the cookbook,
+    the authoring guide, the primitives reference, the wave migration and the lint rule and its README were all
+    teaching the context annotation as the one route; the compiled examples that sit inside a factory with a result
+    type name nothing now, and the ones bound to a constant annotate the constant. The examples that keep the context
+    annotation say in a comment why it is the route left there.
+  - **Both directions are held by type tests.** A generic helper handing `context.input` to something asking for
+    exactly its parameter compiles, bare and constrained; a pair of identically shaped generic factories, one writing
+    a typed option and one not, both compile, which is what says the intersection is the cure and not the option; and
+    a call whose only option names nothing is refused on the read, with each assertion naming the diagnostic it
+    expects — `TS2339` at a member read, `TS2345` at a hand-off, `TS2322` at the pinned `Output`.
+
+- 8aec982: **A command's one waiting place is written as the record that names it: `concurrency: { pending: 'latest' }`
+  (D459).** The scalar `concurrency: 'latest'` named the input that wins and never named what it wins — «the latest»
+  reads as a place in a queue, as the body already running and as a cached answer, and only the first was true. The
+  shared form of the same fact never had that gap: `{ lane, pending: 'latest' }` says the place out loud, with the
+  `pending` an event and a live Resource already write for their own one waiting place. One fact was being written in
+  two vocabularies, and the shorter one left out the part that mattered. The word is removed rather than kept beside
+  the record, which makes this a breaking change to the authoring surface of a model command, of a model selection
+  and of a feature command.
+
+  - **Migrate by writing the place.** `concurrency: 'latest'` becomes `concurrency: { pending: 'latest' }` in
+    `ctx.command`, `ctx.select` and `own.command`. `concurrency: { lane, pending: 'latest' }` is unchanged: the lane
+    is the one parameter this record takes, and it is optional now instead of required. Nothing else about the option
+    moves — the same record, the same siblings, the same `dedupe` prohibition beside it.
+  - **No law moved with the spelling.** While call 1 runs, calls 2 and 3 take one waiting place: the body of 2 never
+    starts, its wait ends as `CommandError('cancelled', 'Command <id> replaced a waiting input.')`, and 3 runs when 1
+    finishes. A newer request never reaches the call in flight. The regression that holds this reads `signal.aborted`
+    inside the running body — after both newer requests were admitted and before the body returns — rather than
+    counting abort events, because the abort that follows a call's own end belongs to its cleanup and says nothing
+    about the policy. It was proved by substitution: with the kernel changed to cancel whatever is in flight, the
+    test fails on that line.
+  - **The retired word is answered with its replacement, not with a list of everything else.** The runtime throws
+    `Model command concurrency latest is now a record: write { pending: 'latest' }, or { lane, pending: 'latest' }.`
+    — and `Model select`, `Feature command` the same. Two neighbouring messages move with it: the choice sentence
+    loses the word — `concurrency must be queue, parallel, a lane of this surface or a record.` — and the record's own
+    refusal now says the lane is optional. A record that names `lane` and hands it `undefined` is still refused, by
+    the type under `exactOptionalPropertyTypes` and by the runtime, which reads the shape of the record by its keys.
+  - **The compiler names the replacement too, because the literal stays in the union.** The options record of a
+    command gained a third member — the retired word beside a key an author cannot write — so a refusal arrives as a
+    missing property carrying the instruction. Without it the union held no string at all, every word written there
+    widened to `string`, and one sentence answered a typo and a retired word alike. What the two now print, the same
+    on a model and on a feature: `{ concurrency: 'quee' }` is a `TS2820` that names the word and suggests `'queue'`,
+    which is better than it was before this change, and `{ concurrency: 'latest' }` is a `TS2345` whose elaboration
+    carries «`concurrency: "latest"` is now a record: write `{ pending: "latest" }`, or `{ lane, pending: "latest" }`».
+    A selection is the one surface where the compiler names the word written and not its replacement — its options
+    record is not a union — and there the runtime and the lint rule carry it.
+  - **`opetope/no-retired-vocabulary` reports it.** `concurrency: 'latest'` is a retired _value_ of a live key, the
+    shape `overflow: 'reject'` already had, so the rule now reads the values of a command's options record as well as
+    its keys and reports on the word that was written. A project that pins the rule's output by its own fixtures gains
+    one row.
+  - **What the gates read.** Instantiations are unchanged — 11 756, 87 710 and 160 268 against ceilings of 12 200,
+    99 062 and 181 237 — because a scalar became a record that already existed. The tightest size row, the headless
+    session consumer of `@opetope/devtools`, stays at 6.95 kB of 7.1 kB. The two runtime rows carry the new branch and
+    its message: the application graph consumer moves 48.56 → 48.66 kB of 49 kB and the public feature consumer
+    39.88 → 39.92 kB of 41 kB, measured by rebuilding the validator both ways. No budget moves.
+
+- be0613e: **The cell is the only place that says what a write is (D457).** `ModelStateWriter.update` was
+  `update<Value>(state: OwnedState<Value>, update: (previous: NoInfer<Value>) => Value)`, and a type parameter in the
+  result of a callback is an inference site: `Value` was not fixed while the body was checked, so the object literal
+  the updater returned had no contextual type and its fields widened — and the widened candidate then passed the
+  state, because `OwnedState` is covariant. `update(sessions, previous => ({ ...previous, kind: 'loading' }))` into a
+  cell whose `kind` is `'idle' | 'loading'` was therefore refused with a type nobody wrote,
+  `(previous: NoInfer<Sessions>) => { items: readonly string[]; kind: string }`, and the remedies were the author's:
+  `as const`, an annotated updater result, or a cell widened to `string`. The signature is
+  `update: NoInfer<(previous: Value) => Value>` now, so the state is the only inference site and the updater is
+  checked against the cell. No public name is added or removed — 59 types and 37 values before and after — and every
+  emitted JavaScript file is byte-identical, so no size budget moves; the three type slices write no state at all and
+  stand at 11 756, 87 710 and 160 268 instantiations against ceilings of 12 200, 99 062 and 181 237. Measured on 1 200
+  identical writes that compile under both signatures, the change costs 2 instantiations and 2 types.
+
+  - **Breaking: three writes that used to compile are refused now, all for the same reason.** A value wider than the
+    cell (`update(sessions, () => wider)` where `wider.kind` is `string`); a member of a discriminated union that
+    leaves out a field that member declares (`update(phase, () => ({ kind: 'loading' }))` where that member also
+    declares `since`); and a word outside a union of literals (`update(mode, () => 'stopped')` into
+    `OwnedState<'off' | 'on'>`). Each was accepted because the widened inference and the covariance of `OwnedState`
+    met, and each reached the cell through an updater that takes no parameter — the one shape whose inference
+    resolved before the body was checked. Each is a `TS2769` where it is written now. Recompiled with the previous
+    signature, the four new type tests report 15 refusals of correct writes and 12 asserted refusals that do not
+    fire.
+  - **An updater written at the call needs no `as const`, no annotated result and no widened field.** A literal it
+    returns keeps its type through a spread, in a nested record and in a member of a union; a mutable array and a
+    tuple in a cell keep their own mutability, which is why the `const` type parameter that also fixes the literals
+    was rejected. The value form of `update` is untouched, and so is the rule that a function in that position is the
+    updater. Diagnostics improve with the fix: the compiler prints `kind: "done"` instead of `kind: string`.
+  - **Two limits of that promise, both measured.** An updater hoisted into a constant widens at its own declaration,
+    where there is no contextual type at all, so it still needs an annotated result — before and after this change.
+    And the updater half performs no excess-property check, because TypeScript does not apply one to a literal
+    returned from a contextually typed function: a stray key written inside the updater now compiles, where it used
+    to be caught in passing by the false refusal whenever the literal also had something to widen. The value half
+    still catches it and names the key.
+  - **`StateCommit.update` and the reactive calculations are unchanged, and the type tests say why.** A commit's
+    `Value` is already one cell, and so is a pipe's, so neither `commit.update` nor `fold` has a callback result to
+    infer from. `derive`, `computed`, `fromMaybe`, `fromExternal` and the `project` of a collection do put a type
+    parameter in the result of a callback, and none of them has this defect: a widened result has nowhere to go
+    there, because no covariant container stands in the call for a supertype to pass through — the assignment of the
+    result refuses it. The `apply.change` of a live Resource is the one public callback left where the same widening
+    is live; it belongs to a separate change.
+  - **One workaround is gone.** The `@opetope/lint` README declared its example state with `kind: string` and a
+    comment saying the widening was a defect of the writer's own signature; the field is `'idle' | 'loading'` again
+    and the comment is gone. Spec §2.38 is the new compile-checked example, and it asserts all three closed holes.
+
+- 4e65393: **The published archive of every package loses `README.ru.md`, and `@opetope/runtime` loses the Russian pages of
+  its `docs/` as well (D456).** The Russian half of the documentation is removed: nineteen `*.ru.md` files,
+  **2 027 997 bytes**, which is 39.0 % of what `ci:docs` counts as a document and 35.1 % of every `*.md` in the tree.
+  Documentation is written once, in English, from here on. No public name, no `exports` entry and no subpath moves —
+  a `.ru.md` was never a resolvable specifier, only a file read by its path — and no line of shipped JavaScript
+  changes, which is why this is a patch. The composition of what is published does change, and this is the line that
+  says so.
+
+  - **What goes.** `CONTRIBUTING.ru.md`, `README.ru.md`, the README of the minimal React example, the nine guides of
+    `docs/` — agent guide, cookbook, devtools, how-it-works, primitives, releases, both migration guides and the
+    spec — and the `README.ru.md` of all seven packages. `docs/decisions.md` stays Russian and keeps no pair, as it
+    never had one. The nine copies under `packages/runtime/docs/` are generated by packaging and leave on their own.
+  - **The rule that required a pair is cancelled, with its gate.** `CLAUDE.md` said «README and user guides have
+    English/Russian pairs, updated together» with four exceptions; it now says a document is written once, in
+    English, and gets no second copy. `ci:docs` no longer looks for a `*.ru.md` beside a document and no longer
+    compares the heading skeleton of a pair, and its report reads «links and example section order passed».
+  - **One gate is lost outright, and nothing replaces it.** The fixture generator held every English example against
+    its Russian twin as the same program — syntax without comments and without JSX text — which is how D441 caught a
+    real drift in a spec §2 block, a string literal that differed in one copy. The defect class that stops being
+    caught is a silent edit to a detail of an example that still compiles: a string literal, a number, the order of
+    two arguments of the same type. `ci:type` accepts any literal of the right type, `ci:docs` reads section order
+    and links rather than values, `ci:asserted-refusals` holds pragmas, and the generator's own `--check` compares a
+    fixture with the very document it was lifted from, so one `fixtures:generate` makes any such edit the new
+    baseline. The twin was the only place in this repository where one program was written twice and the two
+    writings were compared. It also never knew which copy was right — in the one case it fired, the wrong copy was
+    the Russian one — and it protected above all the copy that nothing compiled.
+  - **Where the archive change is written down, so it cannot drift from its gate.** The composition of an archive is
+    stated in six places and all six are rewritten: the `files` of the seven manifests; the required-file list and
+    the archive-member allowlist of the pack archive check; the fixture of that check's own unit test; the
+    allowlists of the two real pack smoke tests; and what packaging demands of each package before it packs. The
+    requirement that `@opetope/runtime` ship `docs/spec.ru.md` is gone; `docs/spec.md` is required exactly as before.
+  - **The numbers the gates print.** `ci:docs` reads 28 documents instead of 46 — nineteen leave and this changeset
+    is itself a document — with 4 pending changesets instead of 3 and 424 decision identifiers instead of 423. Its
+    feature examples halve, 64 to 32: that gate lints every fenced example that declares a feature, and it was
+    linting both copies of each one. Packaging prepares 10 documents instead of 19, and the merge-marker scan reads
+    1101 text files instead of 1117 — seventeen of the nineteen removed files live under a scanned root, and this
+    changeset is one file back. The document examples do not move at all: 38 spec §2 blocks and 132 blocks of 11
+    other documents, 2 fragments, 14 asserted refusals, exactly as before, because only the English block was ever
+    lifted into a fixture.
+
+- e12b0b6: **An event takes its handler second: `event(source, run, subscribe, options?)` (D458).** The natural declaration was
+  refused although its payload was already annotated — `emit` typed as
+  `(payload: EventPayloadNotNamed | undefined) => boolean`, and `run` as taking the marker. The cause is the order of
+  the arguments and nothing else. TypeScript types a call's arguments in order and leaves a context-sensitive callback
+  out of the first inference pass; in the second it walks them left to right, and resolves the type parameters a
+  callback's own type refers to before giving that callback a contextual type. `subscribe` stood second and its one
+  unannotated parameter is a context carrying `Payload`, so `Payload` answered its default on the way past, before the
+  annotation on `run` was ever read. With `run` second, its unannotated parameter is a run context, which carries no
+  payload at all, so nothing about it resolves `Payload` and one annotation is the whole naming site. This is a
+  breaking change to the authoring surface of both a model and a feature.
+
+  - **Migrate by swapping the two callbacks.** `ctx.event(source, subscribe, run, options?)` becomes
+    `ctx.event(source, run, subscribe, options?)`, and `own.event` of a feature the same. Nothing else about the node
+    moves: the same four arguments, the same options record, the same `request`, the same delivery policies. A call
+    left in the old order does not compile silently — each callback is checked against the other's signature.
+  - **One annotation on `run` is now the whole naming site, whatever it does with its context.** The condition the
+    previous decision recorded — that a run annotating its payload and destructuring its context names nothing — was
+    true only while `subscribe` stood first. It is gone, and so is the shape it forced: the polling recipe of the
+    cookbook and the spec no longer annotate a context they only destructure. The marker's instruction narrowed with
+    it, from «annotate every parameter of `run`, the payload first — a `run` that leaves its context unannotated names
+    nothing — or annotate a `delivery.by` parameter» to «annotate the first parameter of `run`, or annotate a
+    `delivery.by` parameter», and the diagnostics gate holds those words.
+  - **The node now reads like every other one.** `effect`, `scope.while` and `scope.switch` all take the working
+    callback straight after the source; the event was the one node with a second callback wedged between them. The
+    rule the spec states for the whole vocabulary — the source first, the work next, modifiers last — is true here
+    without an exception now.
+  - **No single-signature cure exists, and that was measured rather than assumed.** On TypeScript 7.0.2, 6.0.2 and
+    6.0.3: carrying the payload through a separate inferred parameter as `Parameters<Run>[0]` answers `never`;
+    `NoInfer` on `emit` and `NoInfer` over the whole `subscribe` type both fail, because a reference to the parameter
+    is still a reference; a separate `Emitted extends Payload` fails; and a conditional `emit` that widens to
+    `unknown` or `any` stops the complaint at `emit` and poisons the inference instead. While `subscribe` stands
+    before `run` and mentions the payload, the order is the only lever there is.
+  - **`@opetope/lint` moves with it.** The ingress of an event is the third argument now, so
+    `opetope/no-subscribe-outside-models` reads it there; a project that pins the rule's behaviour by its own fixtures
+    updates them the same way an application updates its calls.
+  - **What the gates read.** Instantiations are unchanged — 11 756, 87 710 and 160 268 against ceilings of 12 200,
+    99 062 and 181 237 — because a reorder adds no type. The tightest size row, the headless session consumer of
+    `@opetope/devtools`, stays at 6.95 kB of 7.1 kB: the only emitted JavaScript that changes is one `TypeError`
+    message, `Model event run and subscribe must be functions.`, and the argument index the lint rule carries.
+
+## 0.12.0
+
+### Minor Changes
+
+- 34bdbfb: **A retired word is named, not rewritten: `opetope/no-retired-vocabulary` (D404).** The rule reports every word the
+  D365–D401 wave retired, together with the word that replaced it: `invalidate()` → `reset()`; `backpressure` →
+  `delivery`, with `kind` → `pending` and `key` → `by` inside the record; `activity` of a `loading` state → `failure`;
+  `scope.keyed(source, open, { key })` → `scope.each(source, key, open)`; `skipInitial` → `initial`, `when` of an
+  effect → `filter` or `initial`, `onDispose` → `finalize`; `externalReadable` → `fromExternal`;
+  `Call`/`ctx.call`/`runCall` → `Command`/`ctx.command`/`runCommand`; `policy`/`queueBy`/`lane` → `concurrency`;
+  `ctx.calls`/`own.calls`/`useCommands` → `ctx.select`/`own.select`/`useModel(Declaration, select)`; `once` →
+  `memoize`. It joins `configs.recommended` and the shipped `oxlintrc.json` as an error.
+
+  ```ts
+  ctx.command(run, { policy: 'latest' });
+  //                 ^ `policy` is now `concurrency`: one word for the order the runs take …
+  ctx.effect(draft, save, { skipInitial: true });
+  //                        ^ `skipInitial` is now `initial`, and the polarity is inverted …
+  ```
+
+  - **There is no autofix, and that is the decision.** Several of these renames are not one to one: `policy`,
+    `queueBy` and `lane` collapse into one `concurrency` whose shape depends on which of the three a record wrote
+    together, `when` at an effect becomes `filter` **or** `initial` depending on what the predicate asks, and
+    `skipInitial` → `initial` inverts the polarity. A fix that guessed wrong would rewrite a consumer's source
+    silently, which is worse than refusing, so each report names the word, names the replacement, and says so where
+    the replacement is a choice.
+  - **The severity is `error` because every one of these words is already a compile error on this release** — there
+    are no aliases — so the rule cannot redden a build that was green; what it adds is the one message that names the
+    replacement. The cases where the compiler is silent, such as an options record assembled beside the call, are
+    exactly the ones a warning would lose, and `--quiet`, which both linters are run with here, prints no warnings at
+    all. A consumer who wants one pass softer writes the rule into its own `rules` after `extends`.
+  - **Ownership is proved by symbol, never by spelling.** A retired member is reported only on a declaring context of
+    this library — a parameter annotated `ModelContext` of `@opetope/core`, or an `own` section of a `defineFeature`
+    of `@opetope/runtime` — a retired name only where an `@opetope/*` module exports it, and `activity` only inside a
+    narrowing that proves the state is `loading`. `Call` in «Margin Call» and in translation keys, the `{ once: true }`
+    of `addEventListener`, a host's own `policy` option, `Navigator.reset()` and `when` at a feature, at a
+    contribution and at `scope.while` are all left alone.
+  - The rule is written for one migration pass and never fires after it. Its silence is not proof that a migration is
+    complete: a Resource reached through a model record, a state narrowed in a `switch`, and an options record
+    assembled in another module stay with the compiler, which since D401 prints the replacement for every word it can
+    name.
+
+- aaaa92c: **A collection scope is `each`, and its key is written where it belongs (D378).** `scope.keyed(source, open, { key })`
+  is now `scope.each(source, key, open)`, in a model and in `own` alike. Nothing about the node changes — the same
+  controller, the same replace → drain → open order, the same refusals and the same key identity.
+
+  ```ts
+  // before
+  ctx.scope.keyed(rows, (row, { signal }) => watch(row.id, signal), { key: row => row.id });
+  // after
+  ctx.scope.each(
+    rows,
+    row => row.id,
+    (row, { signal }) => watch(row.id, signal),
+  );
+  ```
+
+  `keyed` named the mechanism rather than the relationship its two neighbours name: `while` says «as long as»,
+  `switch` says «instead of», and `keyed` only said that there are keys inside — which is also what `keyedLane`, a
+  keyed Resource and a keyed delivery say, where a key tells apart the parallel queues of one node instead of deciding
+  how many children exist. `each` says what the node does: one child per element.
+
+  - The key moved into the signature because it is required, and a required member of a modifier record is not a
+    modifier: of the nodes that have one calling form, `scope.keyed` was the only one whose trailing record was
+    mandatory. D279 is not repealed — its principle holds and D378 names this one exception to its letter. The keyed
+    form of a command, `call(run, { lane: ctx.keyedLane<Key>(), queueBy })`, keeps its required record and is
+    unaffected: there the record selects which scheduling form the node has, so what is required is required by the
+    chosen form rather than by the node.
+  - `Value` is still inferred from the source alone. Both callbacks read it through `NoInfer`, so an annotation on the
+    key or on the child is checked against the list rather than widening it; a compiled type test records that.
+  - The messages of the node carry the word the author wrote: `Feature each scope contains duplicate key d.`,
+    `Model each scope source must contain a readonly array.`
+  - `@opetope/lint` knows the new argument index: for `scope.each` the callback that opens is the third argument, so
+    `opetope/no-subscribe-outside-models` stays silent exactly where it did.
+  - There is no alias: a `scope` object has no `keyed` member at all.
+
+- bb05f21: **The advice a library gives has to be one an author can carry out (D444).** Three places where it was not. Nothing
+  runs differently: no public name, no lifecycle law and no runtime branch changes, and the four size consumers are
+  byte-identical to the ones before this change.
+
+  **The `call` → `command` report named a replacement that does not compile.** The rule said the body «takes one
+  argument, its context, and reads the declared input off it as `input`» and never said that the input is named by
+  **annotating** that context — and there is no other place to name it, because TypeScript has no partial inference.
+  Measured on a consumer tree migrated to the letter of that report: the lint run is **green, 0 messages**, and `tsc`
+  is **red with 4 errors**, every one of them standing on code the author wrote correctly — at an `invoke`, at a host
+  call, at the shape a factory returns — and the last of them reading backwards, `Type 'Deposit' is not assignable to
+type 'void'`. The report names both annotations now,
+  `({ input, update }: ModelCommandContext<Deposit>)` and `({ input, source }: FeatureCommandContext<typeof within,
+Deposit>)`, and so do both language pairs of the lint README. The type says it too: reading an input off a context
+  the body never annotated is refused **on the read**, with that annotation printed, instead of answering `void` and
+  letting the refusal land somewhere else. The `void` default, the result type and both inference forms D386 promises
+  are untouched.
+
+  **The order the upgrade guide argued from could not be carried out.** «Taken against the tree as it stands before
+  any rename, the same report is what it is» — measured, it is not: on a pre-wave tree carrying a real D288 defect the
+  first lint run reports seven `opetope/no-retired-vocabulary` and **nothing else**. Four rules of the six read a
+  shape this wave introduced and say nothing until it is written: `no-write-after-source-write` reads the writer off
+  the effect run's second parameter, `capture-command-cleanup` off a command body's one parameter, `enabled-predicate`
+  reads the field `enabled`, and `no-command-in-deps` names the record `useModel(Declaration, select)` answers.
+  `prefer-effect-current` reports in both shapes and writes its fix only on the new one. The guide names that limit in
+  both pairs and gives a two-pass order: the four shape renames first — all four named by the first run or by `tsc`,
+  and none of them moving a write, a commit or a dependency array — then the lint again, and that is the run the rest
+  of the guide is about. Teaching the rules the old shape was weighed and refused: the pre-wave effect run and a legal
+  new run destructuring a value that carries `update` are the same syntax, so a rule taught the old one reports
+  correct new code.
+
+  **Six retired words were refused without a replacement.** `skipInitial`, `when` and `onDispose` at an effect,
+  `backpressure` at an event, `when` at a contribution and `from` at `defineCondition`. Five of them answered one
+  sentence — «is not a field this record names» — which is true of a word that never existed and false of a word that
+  did, and on `skipInitial`, the one rename of the wave a word-for-word transfer gets wrong in silence, it advised
+  deleting the word; the sixth, `from`, named the word and not the replacement. Each record names its retired word now, in the form `policy` and `once` already use, and `skipInitial` names
+  the inverted polarity as well. A retired word whose value is a callback is spelled as a callback, so the predicate
+  an author wrote keeps its contextual type: on the same probe the six words cost **10 errors before and 7 after**,
+  and the three that went were implicit-`any` noise around the instruction.
+
+- aaaa92c: **An effect run takes its value first, and its modifiers are `initial`, `filter` and `finalize` (D379).** The run is
+  `(current, context)` instead of one context that carried `current` inside it, and the three tail options are renamed.
+  No branch of the runtime changes: the same loop, the same supersession, the same failures, the same release order.
+
+  ```ts
+  // before
+  ctx.effect(draft, async execution => save(execution.current, execution.signal), {
+    skipInitial: true,
+    when: (current, previous) => current.text !== previous?.text,
+    onDispose: ({ source }) => close(source),
+  });
+  // after
+  ctx.effect(draft, async (current, { signal }) => save(current, signal), {
+    filter: (current, previous) => current.text !== previous?.text,
+    finalize: ({ source }) => close(source),
+    initial: false,
+  });
+  ```
+
+  - Position 1 of a body is what the body is about, everywhere else in the vocabulary: `call` takes `(input, context)`
+    and the child of a scope takes `(value, context)`. The effect run hid its subject inside the context; the `run` of
+    an event still does, carrying `payload` as a member, and this release does not change it. That context is one of
+    the places an event's payload is named (D324, D347), so moving the subject there moves an inference site — its own
+    decision, with its own measurement — and an event's `subscribe` cannot follow at all, since its subject is `emit`,
+    a channel rather than one value.
+  - `previous` stays on the context. It is not the subject of the run but a circumstance of it, beside `signal`,
+    `timers` and `source`; a run that needs both writes `(current, { previous })`. D379 names the price — in a run that
+    reads both, the pair now spans two levels — and the measurement behind the choice.
+  - `when` is `filter`. The same word names a feature's and a slot's condition of existence, and as an effect option it
+    was never that: it selects values without gating the node's lifetime.
+  - `skipInitial: true` is `initial: false`, and the modifier now defaults to `true`. The old name promised to skip the
+    initial _value_; D296 says that value is observed either way and only the _run_ is skipped.
+  - `onDispose` is `finalize`: an effect has two releases — the disposer a run returns, and the one the node itself
+    gets once — and an `on*` prefix did not tell them apart. No word of the authoring vocabulary carries that prefix
+    any more.
+  - `opetope/prefer-effect-current` now rewrites `source.getSnapshot()` to the run's first parameter, under whatever
+    name the author bound it; `opetope/no-write-after-source-write` reads the writer off the context in its new
+    position. There are no aliases: the three retired words are refused as unknown fields of the record.
+
+- dae5079: **The one section order now reaches the body file, and a selection from a required import says why it takes no
+  options (D434, D435).** Two named limits of the wave, both of them a refusal that was missing rather than a
+  behaviour that was wrong. Nothing runs differently: the runtime checks the same records in the same order, and
+  every call that compiled still compiles.
+
+  - **`opetope/define-feature-property-order` reads both callees.** It compared the callee with `defineFeature`, and
+    the body form's callee is `defineFeature.body`, so the three sections of every body file were unordered — a
+    `{ exports, own }` body passed in silence under a rule that stands at `error` in `recommended`. Both callees are
+    now read against the one order of spec §2.1 and D280, `imports`, `requires`, `own`, `exports`, `provides`,
+    `when`, `body`, of which a body writes a subsequence. **Breaking for a consumer** whose `defineFeature.body(…)`
+    is written in another order: it becomes an `error`, with the same autofix that reorders the header form. A key
+    no body takes, a spread, and `defineFeature.body(header)` are still left to the type checker.
+  - **The message names the sections of the callee it reports.** It enumerated all seven; a body takes three, and the
+    other four are not keys an author can write there. The body form now reads `own, exports, provides`. The
+    `messageId` and the options schema are unchanged, so a configuration that names either keeps working.
+  - **`own.select` beside a required import answers with an instruction instead of `never`.** `whenMissing` answers
+    an absence only an `optional(…)` import can have, and scheduling belongs to `own.command`, so there is no legal
+    options record there at all — and the parameter typed `never` printed back the key the author had written,
+    correct as written, refused against a word that says nothing about the record. The key set is inferred and
+    mapped to the sentence, the way every other unnamed word of this family is, and the sentence says there is
+    nothing to write here and that the call is two arguments long. An empty record and an explicit `undefined` are
+    named too, instead of asking for a `whenMissing` that the next line would refuse.
+  - **Where the report lands moved, for `own.select` only.** It now points at the word inside the options record
+    rather than at the whole argument. Source that pins a refusal to a line — a `@ts-expect-error` above a
+    multi-line call — moves the directive to the line of the word. No call shape changes.
+
+- aaaa92c: **One word for a command, one for its order (D385–D389).** The primitive is `Command<Input, Output>`: the type was
+  the last place the vocabulary still said `Call`, while the hook was already `useCommand`, the record `CommandHook`,
+  the outcome `CommandOutcome` and the fixture `command(...)`. `CallError` is `CommandError`, `runCall` is
+  `runCommand`, `RunCallOptions` is `RunCommandOptions`, `CallTimeoutError` is `CommandTimeoutError` and
+  `CallInputArgs` is `CommandInputArgs`. There are no aliases.
+
+  - **A body takes one argument, its context (D386).** `ctx.command(({ input, update }) => …)` and
+    `own.command(within, ({ input, source, signal }) => …)`. `Input` and `Output` default to `void`, so the
+    `_input: void` placeholder is gone from every command that takes none. A typed input is declared once, by
+    annotating the destructured context: `({ input, update }: ModelCommandContext<Deposit>)` or
+    `({ input, source }: FeatureCommandContext<typeof polling, Deposit>)`. Both types are new public exports. Give a
+    model factory a result type — `function createCounter(context: ModelContext): ModelOf<typeof Counter>`, the form
+    the examples use: inside an inline arrow handed straight to `openModel(Decl, ctx => …)` or `model(Decl, ctx => …)`
+    the expected type is not instantiated yet, so a body that names no input reads as `Command<never, …>` instead of
+    taking the `void` default.
+  - **`concurrency` replaces `policy`, `queueBy` and `lane` (D387).** One word that also takes the queue node itself:
+    `'parallel' | 'queue' | 'latest' | lane | { by } | { by, lane } | { lane, pending: 'latest' }`. A lane is a
+    reference commands share, which is why the word accepts it; `'parallel'` beside a lane and a bare `by` without a
+    queue are now unwritable rather than refused. `dedupe` stays a sibling option and `'latest'` still refuses it.
+    A selection writes the same word with the members it can answer for — the keyed record is not one of them, and
+    a feature has no keyed queue either, so both are refused with the reason. The retired `policy`, `queueBy`, `lane`
+    and `once` are named by each options record, so they are refused in a written literal and in an assigned record
+    alike — on `ctx.command`, on `own.command` and on `ctx.select`, which also refuses `memoize` and `dedupe`.
+  - **Declaring and selecting are two words (D388).** `ctx.command(run, options?)` declares;
+    `ctx.select(source, 'name' | ['a', 'b'], options?)` selects what a dependency already declares — one name answers
+    one command, a list answers a record. `ctx.calls` and `own.calls` are gone, and so is `useCommands`: a record of command consumers
+    comes from `useModel(Declaration, select)`, which has an owner and a lifetime. `bind` of `@opetope/runtime` is
+    unchanged.
+  - **`once` is `memoize` (D389).** The cache keeps its behaviour and loses a name the platform already owns:
+    `addEventListener(type, handler, { once: true })` means "then stop", which is not what this option ever did.
+
+  `@opetope/lint` follows the vocabulary: `opetope/capture-command-cleanup` reads the context off the body's one
+  parameter and recognises `concurrency: 'parallel'`, and `opetope/no-command-in-deps` names the selection a record
+  comes from.
+
+- 34bdbfb: **One word for one thing, and one sentence for one question (D410, D411).** A vocabulary pass over the public API:
+  the refusals that asked one question in five sentences now ask it in one, the position a signature calls `source`
+  is called `source` everywhere, and eight words that named one behaviour twice are one word apiece. No branch of the
+  runtime changes: the same checks run in the same order.
+
+  **Breaking, word by word.** Every row is a source change with no alias; `opetope/no-retired-vocabulary` reports each
+  one and names the replacement.
+
+  | Before                                                         | After                                               |
+  | -------------------------------------------------------------- | --------------------------------------------------- |
+  | `defineCondition(id, { from, select })`                        | `defineCondition(id, { select, source })`           |
+  | `slot(target, value, { when })`, same at `pipe`, `register`    | `slot(target, value, { enabled })`                  |
+  | `resource.live({ delivery: { overflow: 'reject' } })`          | `resource.live({ delivery: { overflow: 'drop' } })` |
+  | `outcome.status === 'ok' \| 'failed' \| 'cancelled'`           | `outcome.kind === 'ok' \| 'failed' \| 'cancelled'`  |
+  | `ResourceActivity` from `@opetope/devtools`                    | `ResourceNodeActivity` from `@opetope/devtools`     |
+  | `ResourceDisposer` from `@opetope/core/internal`               | `Disposer` from `@opetope/core/internal`            |
+  | `NavigatorPolicy` from `@opetope/navigation`                   | `NavigatorCatalogue`                                |
+  | `surface.policy`                                               | `surface.catalogue`                                 |
+  | `ApplicationConditionBinding` from `@opetope/runtime/internal` | the same name, from `@opetope/runtime`              |
+
+  `@opetope/lint` renames the rule that read that field: `opetope/when-predicate` is `opetope/enabled-predicate`,
+  and its message ids are `enabledIsAsync`, `enabledReturnsBareSource` and `enabledReturnsSource`. A configuration
+  that named the old rule has to name the new one; `configs.recommended` and the shipped `oxlintrc.json` fragment
+  already do.
+
+  Two of these are record keys, so a source with `sort-keys` reorders the literal as well as renaming the key:
+  `{ from, select }` becomes `{ select, source }`, and `{ Component, when }` becomes `{ Component, enabled }`.
+  `{ status: 'ok', value }` becomes `{ kind: 'ok', value }`, which sorts unchanged, while
+  `{ reason, status: 'cancelled' }` becomes `{ kind: 'cancelled', reason }`, which does not.
+
+  **Why each one.** `source` is the word every context already answers the position with, and `from*` stays the
+  prefix of a factory that names where a `Readable` comes from (`fromExternal`, `fromMaybe`). `enabled` is the truth
+  the runtime reads while a node exists — one word at a contribution and at a Resource — while `when` keeps the other
+  mechanism, the declared `Condition`s an application resolves before the node exists; `scope.while(source, open,
+{ when })` and an effect's `filter` are untouched. `drop` is what a full capacity does with the value that does not
+  fit, at both nodes that admit a producer; `flush-oldest` is still the default of a keyed delivery and still the
+  answer for a producer that may lose nothing. `kind` is the discriminant eleven settled answers already carried.
+  `NavigatorCatalogue` is named for its job, beside `NavigatorPersistence`, because a policy is data (D291) and this
+  is four callbacks a navigator asks.
+
+  **Not breaking, and worth reading.** Every options record now refuses an unknown field with the sentence spec §3
+  promised — `<subject> <node> <record> contains unknown field <key>.` — and says which field it owes with
+  `<subject> <node> <record> requires <key>.` Five sentences became one, and the three that never printed the field
+  at all (`requires exact data fields`, `own.attach takes open, or open and close, and nothing else`) now print it. A
+  node that reads a source says so in two sentences per surface instead of three, and the word of the position is the
+  author's. `own.select` lost two of its four overloads: a call that writes the options record has one candidate of
+  its arity now, so a fault in that record is reported as the record's own refusal instead of
+  `Argument of type '"echo"' is not assignable to parameter of type 'never'`, and the record names the five words a
+  selection does not take — `concurrency`, `dedupe`, `lane`, `memoize`, `policy` — each with what to write instead.
+
+  **Measured.** Runtime size consumers, rebuilt: `application graph consumer` 48 248 B against a ceiling of 49 000
+  (48 318 before), `public feature consumer` 39 579 B against 41 000 (39 712 before). Type stress: 11 695 / 87 068 /
+  159 371 instantiations, unchanged to the digit. No ceiling moved.
+
+### Patch Changes
+
+- dae5079: **A refusal names a remedy the author can execute, and a gate holds what the tree prints (D415).** Four debts the
+  wave D365–D414 left behind, each reproduced before it was fixed and measured after. No branch of the runtime
+  changes.
+
+  **The instruction of `EventPayloadNotNamed` carries its condition.** `run` names the payload of an event only while
+  it is not context-sensitive, and a callback becomes context-sensitive as soon as one parameter it writes has no
+  annotation. The old text said «annotate the first parameter of `run`», which for a `run` that also destructures its
+  context names nothing and earns a second refusal — the shape the cookbook's `polling` recipe was written in. The
+  marker now reads «name the event payload: annotate every parameter of `run`, the payload first — a `run` that
+  leaves its context unannotated names nothing — or annotate a `delivery.by` parameter», the recipe is written in the
+  form it names, and spec §2.23 compiles that form. A source that compares the marker text line by line updates the
+  line; the shape of author code is unchanged.
+
+  **`ctx.select` refuses the record and not the key.** Its four overloads are two, differing by how many arguments
+  they take, the way D410 collapsed `own.select`. A misspelled or retired field of the one-name form used to print
+  `Argument of type '"load"' is not assignable to parameter of type 'never'`, naming the key the author got right; it
+  now prints the instruction the record carries. Both call forms and every written type argument list are accepted as
+  before.
+
+  **spec §3 names the three sentences an owed field actually has**, instead of promising one that two nodes of six
+  hold: a record all of whose keys are required says `requires <key>.`, a key that has to be a callback says
+  `<key> must be a function.` — which names its type as well — and a key owed only because a sibling was written says
+  which sibling.
+
+  **`opetope/no-retired-vocabulary` names the last three migrations it was missing.** `ApplicationExecution` and
+  `ApplicationImportBinding` of `@opetope/runtime/internal` are reported beside `ApplicationConditionBinding`, and
+  `surface.policy` is reported on a surface `defineSurface` of `@opetope/navigation/react` declared — the word the
+  message of `NavigatorPolicy` already named and the rule never fired on. The shared message id is
+  `runtimeInternalEntry`, renamed from `conditionBindingEntry` because it answers three names now.
+
+  Size: `application graph consumer` 48 248 B against 49 000, `public feature consumer` 39 579 B against 41 000 —
+  byte for byte what D410 measured. Type stress: 11 695 / 87 068 / 159 371 against ceilings 12 034 / 99 062 /
+  181 237, to the digit the recorded baseline, which is not rewritten.
+
+- bb31983: **Five debts the wave named out loud, closed together (D437).** None of them was found by reading the code: each was
+  written down as a limit or a debt by the decision that left it, and left because the files it needed were being
+  edited on another branch. No authoring word moves, no runtime behaviour changes, and no package `src` outside the
+  lint rule's message is in this diff.
+
+  - **`opetope/no-write-after-source-write` stops saying «in silence».** D432 made the first write such a run loses
+    reach the reporter as `LostWrite`, once per run and saying the rest went with it, so the rule's message and its
+    section in both READMEs were describing a silence that is no longer whole. All three are corrected in one hand:
+    the drop is still a drop, the refused `invoke` after it is still silent, and so is every other way a write is
+    lost — a newer value, a cancelled caller, a generation fence, a closed model. The README also stops implying that
+    a successor which hides the loss from the cell hides it from the record; it does not.
+  - **The example gate of `ci:docs` reads both callees that declare sections.** D434 recorded it as a named limit:
+    blocks were selected by `\bdefineFeature\s*\(`, which does not match `defineFeature.body(`, so a document block
+    declaring only a body reached the packaged order rule through nothing. The selection is
+    `\bdefineFeature(?:\.body)?\s*\(` now, spec §5.8 carries both forms in both languages, and the gate reads 60
+    feature examples where it read 58. Nothing was passing through the hole — both bodies of the repository hold the
+    order — so the change is proved by injection instead.
+  - **`docs/resource-migration.md` joins the compiled examples (D419).** Nine blocks are lifted into checked
+    fixtures, which makes eleven documents whose examples `ci:type` reads — the second migration guide to join, under
+    the «was» mechanism the first one brought with it. Three of its blocks are «before» blocks and cannot compile: each
+    carries `// @ts-expect-error` on the line that shows the removed form, so the count of asserted refusals is five
+    for one guide, three for this one and zero for the other nine. Nothing in the guide was wrong: the six live
+    blocks compiled as written.
+  - **The comment over four rows of `selected-call-diagnostics.test.mjs` stopped being true.** It pinned the shape
+    D435 has since replaced — a parameter of type `never`, a report anchored at the argument. It now quotes what the
+    tree prints.
+  - **The type ceiling of slice `01` is raised by the owner, 12 034 → 12 200.** The slice measures 11 695
+    instantiations, which left 2.8 % under the ceiling where D400 named 3.9 % over the measurement as its alarm; the
+    raise restores 4.1 % under the ceiling and 4.3 % over the measurement. No other ceiling moves, no bundle byte
+    changes, and the granted headroom may not be cited as an argument: it is given, not measured.
+
+- aaaa92c: **The write a run loses after moving its own source (D365).** A write of an effect run into a cell its own source
+  reads changes the value that source publishes, and the notification is synchronous: the run is aborted inside that
+  write, so every write of the run after it is dropped and an `invoke` after it is refused. That is the law of spec
+  §2.11 and of a late write (D288), and neither changes here. The drop was silent when this was written; D432, later in
+  the same release, sends the first of the dropped writes to the reporter as `LostWrite`, and the refused `invoke`
+  stays silent. What was missing is the reason the defect reaches production instead of a test, and the tool that
+  catches it.
+
+  - **`opetope/no-write-after-source-write`**, `error` in `configs.recommended` and in the shipped `oxlintrc.json`. It
+    reports the write that moves the effect's own source when another write of the same run can follow it, and it
+    proves three things first: the effect is declared on a context of this library; the cell the write names is part of
+    the source — the cell itself, or a `derive` of `@opetope/core` whose dependencies name it **and whose selector
+    publishes the value of that dependency**, which is the law's own carve-out for a write that leaves the published
+    value equal; and the later write stands in the same block, in a later statement, with no `return` or `throw` of the
+    run between the two. A source assembled in another function, a source read off an object, a cell that arrived as a
+    parameter, a `derive` over a `derive` and a commit as the moving write are all outside what it reads, and its
+    README lists them. There is no fix: make the write into the source the run's last write, or keep what the run
+    accumulates out of its source and read it with `getSnapshot()`.
+  - **The successor run is now written down** in spec §2.11, in spec §4 «Effect runs» and in `primitives` §4.1 step 8:
+    the loop opens a successor run for the new value **where `when` admits it**, and a successor that repeats the write
+    hides the loss, so the cell ends up correct through the second run. The loss stands whole where a guard makes that
+    successor return early, and where a `when` that rejects the new value leaves no successor at all (D329). A third
+    form is recorded with it: a `capture` taken after the moving write throws the run's own cancellation, and nothing
+    is reported for it either.
+  - **A repeated commit names its cure**: `State commit has already been used.` became
+    `State commit has already been used. Capture per write.` — legitimate by the same section, which says two commits
+    of one target in one call are what a command with two mutually exclusive places to write needs.
+
+  This change moves no budget by itself. Measured against a clean rebuild of `af278de`: the runtime
+  `public feature consumer` is 38 771 → 38 784 B and the `application graph consumer` 47 394 → 47 403 B. The two
+  runtime ceilings are ratcheted once for the whole wave this ships in, over a measurement of the merged tree
+  (D372).
+
+- bb05f21: **A lost write is heard by the whole authority of a run, not by one writer (D447).** D432 made the most expensive
+  defect of this library audible: a write of a run into a cell its own source reads ends that run inside the write, and
+  the writes after it are dropped where everything still looks repaired. It heard only the writer that made the moving
+  write — so the shape the library itself recommends stayed mute. When one operation is shared by an effect and a
+  command (D288), the effect invokes the command, the command makes the write, and the command has nothing more to
+  write: the run lost the money and nobody said anything.
+
+  - **The authority is the run and the commands it `invoke`s.** A command inherits the cancellation of the run that
+    started it, so one abort ends them both, and the moving write may be made by any of them. The first write that
+    authority drops reaches the reporter as `LostWrite`, once, with the same three remedies as before.
+  - **Nothing outside that authority changed.** A write dropped by a newer value, a cancelled caller, a generation
+    fence or a closed model is as silent as it was — the abort each of them carries is its own, and the runtime proves
+    the authority by the identity of the abort, not by a guess about timing. This is still the half of D288 that stands.
+  - **The record's sentence moved with the law**: «the run had already ended inside an earlier write under its own
+    authority into a cell its source reads». A test that pinned the old sentence word for word needs the new one.
+  - **`opetope/no-write-after-source-write` now reports the call**, not just the write: an `invoke` of a command that
+    writes a cell the run's source reads, where another write of the run follows it. That form is the one the runtime
+    usually cannot report — the run is awaiting that very call when the write lands, so its promise is cancelled and
+    the body reaches no write at all — which is why the editor has to name it.
+
+  Measured by rebuilding the size consumers of one tree with and without the change: `application graph consumer`
+  48 455 → 48 515 B against a 49 000 ceiling, `public feature consumer` 39 835 → 39 884 B against 41 000. The three
+  Core lines did not move. No ceiling moved, and no public name, signature or type changed.
+
+- bb05f21: **The prose of `opetope/enabled-predicate` names the field the rule reads (D220, D411).** D411 renamed the field of
+  a contribution from `when` to `enabled`, and the rule that reads it from `opetope/when-predicate` to
+  `opetope/enabled-predicate`. The heading and the table of reported shapes moved with it; four sentences around them
+  did not, and they were the ones telling the reader which word to write. Both package READMEs now say:
+
+  - a contribution's `enabled` — not its `when` — answers the visibility fact of this instance, not the source
+    that carries it;
+  - the rule reads the `enabled` of a `slot`, `pipe` or `register` contribution, and any `enabled` whose function
+    destructures the evaluation context;
+  - a decision the predicate cannot change is hoisted out of `enabled`, or the line is silenced;
+  - a `when` is a different field and is left alone wherever it stands. The sentence used to set «a `when` outside a
+    contribution» against the `when` inside one, and since D411 a contribution has no `when` at all, so the
+    qualification had stopped dividing anything.
+
+  The word stays where it is still written: the `when` section of a feature declaration, the source value of
+  `scope.while`, the sentence that an effect's change filter is `filter` and not a `when` at all (D379), and the
+  historical rows of the retired-vocabulary table, which exist to name what a word used to be. Documentation only —
+  no rule, message, fix or configuration changes.
+
+- bb31983: **Three places where the text an author reads did not match what the code does (D442).** No law of the runtime
+  moves and no public name is added; what changes is what the author is told when they are wrong.
+
+  - **The lint rule names all three ways out of a lost write, not two of them.** D432 made the first write a run
+    loses after moving its own source reach the reporter as `LostWrite`, naming three remedies, and recorded that
+    `opetope/no-write-after-source-write` already named them «in the same words». It named two. The one it left out —
+    `execution.capture(state)` taken _before_ the moving write — is the only one that saves that write whole, and the
+    author reads the rule in the editor long before any run reports. The message now carries the runtime's sentence
+    word for word, both package READMEs say so, and `ci:source` reads the sentence out of the runtime and looks for
+    it in the rule, so the two cannot drift again. Spec §2.11 also stops saying such a defect «is found in
+    production»: it used to be, and since D432 the record finds it.
+
+  - **A `request` written as `undefined` is refused on the key, and the refusal says so.** Every option of a Resource
+    declaration is read from the key the record carries (D407), so `{ ...shared, request: on ? account : undefined }`
+    writes the word. Under `exactOptionalPropertyTypes` the compiler refused that record — but for `request` alone it
+    refused it in the wrong place: `request` is where `Request` is inferred, so the written `undefined` became part of
+    the type parameter, `identity` turned required, and the message asked for a record the author never wrote
+    (`Property 'identity' is missing … key: (request: string | undefined) => never`), naming neither the key nor
+    `undefined`. An author who follows that message writes an `identity` and keeps the defect. The refusal now stands
+    on the key and carries the clause the runtime prints, plus the second remedy the migration guides teach: «a key
+    written as `undefined` is a word this declaration wrote: leave the key out where the word is not meant, or branch
+    the declaration». Both surfaces spell it, out of one string. Nothing legal moves — a request written as a value,
+    as a `Readable` (including one that publishes `undefined`, which closes the materialization instead of writing a
+    word), a spread that carries the key only where it is meant, a branch on the record, and a declaration with no
+    `request` are all accepted as before. Two forms do change: a `request` whose type is `any` is now refused, where
+    it used to be accepted and answered `Resource<Data, any>`, and a `request` whose type is `unknown` is refused with
+    this clause instead of with the old demand for an `identity`.
+
+  - **`PaginationUnavailableReason` is on `@opetope/core/internal`.** The union standing in `reason` of the public
+    `PaginationState` and `PaginationOutcome` was a file-local alias on no entry at all, while the gate that records
+    that choice already called it an internal type. It is now where that comment says it is. It is not published: the
+    compiler does print `'retired'` to a consumer whose exhaustive `switch` breaks, which is the argument D364 and
+    D375 used, but the union is reachable through the public record that carries it —
+    `Extract<PaginationState<Cursor>, { kind: 'unavailable' }>['reason']` — which is the reason D375 left
+    `ResourceChannel` internal. Publishing it would cost the last type of the public budget, and D364 reserved that to
+    the owner.
+
+  Measured, isolated, by rebuilding the same tree with and without the change: all five size rows are byte-identical
+  (1 047 / 7 885 / 4 856 B on Core, 48 455 and 39 835 B on the runtime consumers), because a marker is a type and
+  types are erased. The type budget moves +11 / +70 / +117 instantiations on the three stress slices, to
+  11 706 / 87 138 / 159 488 against unchanged ceilings of 12 200 / 99 062 / 181 237. The form was chosen by
+  measurement and not by taste: the same instruction written as a fourth member of the declaration intersection costs
+  +71 / +1 429 / +2 795. `ci:public-surface` reads 59 types and 37 values before and after.
+
 ## 0.11.0
 
 No changes in this release.
@@ -155,11 +818,11 @@ No changes in this release.
 
 ### Patch Changes
 
-- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Call из
+- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Command из
   effect и сериализует независимые объекты через очередь по ключу. Stream умеет накапливать кадры в границах
   открытия. Контекст данных отделён от ключа, а ёмкость кэша перенесена из retention в самостоятельную опцию cache.
   Retention теперь задаётся литералом, model resource/stream принимает готовый Readable, а `queueBy` создаёт
-  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Call
+  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Command
   через `rethrowIfCancelled`.
 
 ## 0.9.2
@@ -228,7 +891,7 @@ opetope/no-subscribe-outside-models` in that application sits on a subscription
 
 - d7f346a: `opetope/no-command-in-deps` keeps a command hook out of a React dependency array.
 
-  A hook read from `useCommand`, from a key of `useCommands` or from a `Call` field of a `useModel` selection is a
+  A hook read from `useCommand`, from a key of `useCommands` or from a `Command` field of a `useModel` selection is a
   snapshot of the render it was read in: the object is rebuilt on every `inFlight` and `outcome` change, while `run`
   keeps one identity for the life of the binding. An application that wrote
   `useEffect(() => { load.run(); return () => { unload.run(); }; }, [load, unload])` therefore started the command,
@@ -320,7 +983,7 @@ No changes in this release.
 
 ### Minor Changes
 
-- 410f2f0: Run authentic Calls in headless model tests with `runCall` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
+- 410f2f0: Run authentic Calls in headless model tests with `runCommand` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
 
   Add the recommended `opetope/no-internal-imports` rule for static imports, re-exports, literal dynamic imports, unshadowed `require` and TypeScript import types. `configs.internalImports` uses this rule for JavaScript and TypeScript, including tests, without replacing the host's `no-restricted-imports`. The redundant `internalImportPattern` export is removed; allow trusted implementation files through the config or an explicit rule override.