@opetope/react 0.10.1 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,347 @@
 # @opetope/react
 
+## 0.12.0
+
+### Minor Changes
+
+- 34bdbfb: **An options record is exact by its keys, and the guard that was weaker than no guard is gone (D406).** Exactness is
+  checked against the set of keys the argument carries, never against the record the compiler infers from it. The old
+  form asked the record to witness itself — `Actual & NoExtraKeys<Actual, Shape> & Shape` — and a record assigned to a
+  name first and sharing no key with the shape gave that inference nothing: the guard collapsed and took the weak-type
+  check down with it, so the guarded surface admitted what the bare shape refused.
+
+  ```ts
+  // the record a migration carries: assigned first, sharing no key with the options of this node
+  const carriedOver = { concurency: 'queue' as const };
+
+  // before: `own.command`, `own.effect`, `own.event` and both `own.scope` forms accepted this in silence
+  // after: refused where it is written, and the message names the key
+  command(orders, () => undefined, carriedOver);
+  ```
+
+  - Measured on the auditor's own probe: six misspelled records on six feature nodes, **one refusal before and six
+    after**, with no correct declaration in this repository changing.
+  - The gate now stands on every authoring record that had one, on `ctx.command`, `ctx.effect`, `ctx.event` and both
+    `ctx.scope` forms, which had none, and on the top-level record of `resource.load`/`resource.live` on both
+    surfaces. The nested records of the Resource family (`identity`, `apply`, `delivery`, `pagination`) keep the
+    runtime refusal of D345 and no type gate: the decision measures why.
+  - `queueBy` on a feature used to print `concurrency: { by }`, which is a member of a model command and of nothing
+    else, so the author walked from one refusal into the next. It now names the queue a feature has and the surface
+    that mints the keyed one, and a negative beside the positive holds that the advice compiles.
+  - A stack navigator refuses `persistence` and `defaultScreen` — the words of switch mode — instead of accepting and
+    ignoring them. The union of the two option records had no forbidding field, so an assigned record simply matched
+    the branch with fewer words and the host persistence contract was never called. `createNavigator` refuses the same
+    keys at run time, so a caller without types hears it too.
+  - Breaking: `ExactInput` and `NoExtraKeys` are gone from `@opetope/core/internal`; `ExactKeys` is the one gate. A
+    record with a key its node does not name stops compiling, as do a feature `queueBy` and a stack navigator carrying
+    switch-mode words.
+  - Measured: both runtime size rows are byte-identical — 48 067 B for the application graph consumer and 39 500 B for
+    the public feature consumer. The navigator's run-time refusal is isolated at **+70 B**: the navigator consumer is
+    1 943 B without it and 2 013 B with it.
+  - Measured: the compiler does less work than before, not more. Type-stress instantiations are 11 647 / 85 822 /
+    156 926 over the three slices against a recorded baseline of 11 582 / 90 074 / 165 874 — inferring a key set is
+    cheaper than inferring the record, and the decision records which spelling of the gate costs what.
+
+- 34bdbfb: **A word of a Resource declaration is its key, not its value — this is a breaking change (D407).** Every option of
+  `resource.load` and `resource.live`, and the host `grace` of `openFeature` and `openApplication`, is now read from
+  the key the record carries. A record keeps a key whose value is `undefined`, so a record built by a conditional
+  spread was until now indistinguishable from one that never wrote the word — and it was accepted in silence.
+
+  ```ts
+  // refused now, and silently a singleton before: the key is written, so the request is written
+  ctx.resource.load({ ...shared, request: keyed ? account : undefined });
+
+  // write the two declarations instead; the half they share is still written once
+  keyed ? ctx.resource.load({ ...shared, request: account }) : ctx.resource.load(shared);
+  ```
+
+  What a written `undefined` used to mean, and what it means now:
+
+  | Written                                                 | Was, in silence                                            | Is now                                                           |
+  | ------------------------------------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------- |
+  | `request: undefined`                                    | a singleton, and the key of every cache entry with it      | `… request must be a value or a Readable.`                       |
+  | `enabled: undefined`                                    | a Resource nothing gates                                   | `… enabled must be a Readable.`                                  |
+  | `grace: undefined`                                      | the host's window, and accepted beside `lifetime: 'owner'` | the refusal of the word beside an owner, of the number otherwise |
+  | `identity: undefined`                                   | no key and no scope: one shared materialization            | `… identity must be a plain object record.`                      |
+  | `identity: { key: undefined }`                          | the request naming itself, or nothing on a singleton       | `… identity.key must be a function.`, or the refusal of the word |
+  | `identity: { scope: undefined }`                        | a materialization shared where one was scoped              | `… identity.scope must be a Readable.`                           |
+  | `load: undefined` on `live`                             | no load channel, and `apply.load` refused for it           | `… load must be a function.`                                     |
+  | `cache: undefined`                                      | no cache                                                   | `… cache must be a plain object record.`                         |
+  | `pagination: undefined`                                 | no pagination capability                                   | `… pagination must be a plain object record.`                    |
+  | `delivery: undefined`                                   | the default delivery                                       | `… delivery must be a plain object record.`                      |
+  | `delivery.overflow: undefined`                          | the answer of a full capacity D351 wrote                   | `… delivery overflow must be flush-oldest or reject.`            |
+  | `delivery.pending: undefined`                           | the field the record owes, reported as missing             | `Unknown model resource delivery undefined.`                     |
+  | `apply: { load: undefined }` beside `load`              | `apply.load is required beside load.`                      | `… apply.load must be a function.`                               |
+  | `grace: undefined` on `openFeature` / `openApplication` | the `0` of a host without the word                         | the refusal of the number                                        |
+
+  Each refusal is this node's own sentence for a value the word cannot take — the sentence the request of an `event`
+  has printed for the same mistake since D395 — followed by the clause that names the remedy the sentence alone
+  cannot: `A key written as undefined is a word this declaration wrote: leave the key out where the word is not
+meant.` Where the key is owed rather than optional — `apply.load` beside a load channel, `pending` inside a
+  `delivery` — the refusal names the debt and offers no such remedy.
+
+  `createScenario` of `@opetope/react` forwards the same word, and forwarded it by value: a `grace` written as
+  `undefined` there was dropped into the `0` of a host that wrote no window at all. It now travels to
+  `openApplication` and is refused there, beside the `conditions` and `imports` of the same record, which already
+  asked the key.
+
+  **Rewrite by building the record, not the value.** Branch on the record (`flag ? f({ ...shared, word }) : f(shared)`),
+  or spread a record that carries the key only when it is meant (`...(flag ? { word } : {})`). A conditional value
+  (`word: flag ? v : undefined`) is the form that breaks, and it is the form this decision exists to refuse.
+
+- aaaa92c: **One word for a command, one for its order (D385–D389).** The primitive is `Command<Input, Output>`: the type was
+  the last place the vocabulary still said `Call`, while the hook was already `useCommand`, the record `CommandHook`,
+  the outcome `CommandOutcome` and the fixture `command(...)`. `CallError` is `CommandError`, `runCall` is
+  `runCommand`, `RunCallOptions` is `RunCommandOptions`, `CallTimeoutError` is `CommandTimeoutError` and
+  `CallInputArgs` is `CommandInputArgs`. There are no aliases.
+
+  - **A body takes one argument, its context (D386).** `ctx.command(({ input, update }) => …)` and
+    `own.command(within, ({ input, source, signal }) => …)`. `Input` and `Output` default to `void`, so the
+    `_input: void` placeholder is gone from every command that takes none. A typed input is declared once, by
+    annotating the destructured context: `({ input, update }: ModelCommandContext<Deposit>)` or
+    `({ input, source }: FeatureCommandContext<typeof polling, Deposit>)`. Both types are new public exports. Give a
+    model factory a result type — `function createCounter(context: ModelContext): ModelOf<typeof Counter>`, the form
+    the examples use: inside an inline arrow handed straight to `openModel(Decl, ctx => …)` or `model(Decl, ctx => …)`
+    the expected type is not instantiated yet, so a body that names no input reads as `Command<never, …>` instead of
+    taking the `void` default.
+  - **`concurrency` replaces `policy`, `queueBy` and `lane` (D387).** One word that also takes the queue node itself:
+    `'parallel' | 'queue' | 'latest' | lane | { by } | { by, lane } | { lane, pending: 'latest' }`. A lane is a
+    reference commands share, which is why the word accepts it; `'parallel'` beside a lane and a bare `by` without a
+    queue are now unwritable rather than refused. `dedupe` stays a sibling option and `'latest'` still refuses it.
+    A selection writes the same word with the members it can answer for — the keyed record is not one of them, and
+    a feature has no keyed queue either, so both are refused with the reason. The retired `policy`, `queueBy`, `lane`
+    and `once` are named by each options record, so they are refused in a written literal and in an assigned record
+    alike — on `ctx.command`, on `own.command` and on `ctx.select`, which also refuses `memoize` and `dedupe`.
+  - **Declaring and selecting are two words (D388).** `ctx.command(run, options?)` declares;
+    `ctx.select(source, 'name' | ['a', 'b'], options?)` selects what a dependency already declares — one name answers
+    one command, a list answers a record. `ctx.calls` and `own.calls` are gone, and so is `useCommands`: a record of command consumers
+    comes from `useModel(Declaration, select)`, which has an owner and a lifetime. `bind` of `@opetope/runtime` is
+    unchanged.
+  - **`once` is `memoize` (D389).** The cache keeps its behaviour and loses a name the platform already owns:
+    `addEventListener(type, handler, { once: true })` means "then stop", which is not what this option ever did.
+
+  `@opetope/lint` follows the vocabulary: `opetope/capture-command-cleanup` reads the context off the body's one
+  parameter and recognises `concurrency: 'parallel'`, and `opetope/no-command-in-deps` names the selection a record
+  comes from.
+
+- 34bdbfb: **One word for one thing, and one sentence for one question (D410, D411).** A vocabulary pass over the public API:
+  the refusals that asked one question in five sentences now ask it in one, the position a signature calls `source`
+  is called `source` everywhere, and eight words that named one behaviour twice are one word apiece. No branch of the
+  runtime changes: the same checks run in the same order.
+
+  **Breaking, word by word.** Every row is a source change with no alias; `opetope/no-retired-vocabulary` reports each
+  one and names the replacement.
+
+  | Before                                                         | After                                               |
+  | -------------------------------------------------------------- | --------------------------------------------------- |
+  | `defineCondition(id, { from, select })`                        | `defineCondition(id, { select, source })`           |
+  | `slot(target, value, { when })`, same at `pipe`, `register`    | `slot(target, value, { enabled })`                  |
+  | `resource.live({ delivery: { overflow: 'reject' } })`          | `resource.live({ delivery: { overflow: 'drop' } })` |
+  | `outcome.status === 'ok' \| 'failed' \| 'cancelled'`           | `outcome.kind === 'ok' \| 'failed' \| 'cancelled'`  |
+  | `ResourceActivity` from `@opetope/devtools`                    | `ResourceNodeActivity` from `@opetope/devtools`     |
+  | `ResourceDisposer` from `@opetope/core/internal`               | `Disposer` from `@opetope/core/internal`            |
+  | `NavigatorPolicy` from `@opetope/navigation`                   | `NavigatorCatalogue`                                |
+  | `surface.policy`                                               | `surface.catalogue`                                 |
+  | `ApplicationConditionBinding` from `@opetope/runtime/internal` | the same name, from `@opetope/runtime`              |
+
+  `@opetope/lint` renames the rule that read that field: `opetope/when-predicate` is `opetope/enabled-predicate`,
+  and its message ids are `enabledIsAsync`, `enabledReturnsBareSource` and `enabledReturnsSource`. A configuration
+  that named the old rule has to name the new one; `configs.recommended` and the shipped `oxlintrc.json` fragment
+  already do.
+
+  Two of these are record keys, so a source with `sort-keys` reorders the literal as well as renaming the key:
+  `{ from, select }` becomes `{ select, source }`, and `{ Component, when }` becomes `{ Component, enabled }`.
+  `{ status: 'ok', value }` becomes `{ kind: 'ok', value }`, which sorts unchanged, while
+  `{ reason, status: 'cancelled' }` becomes `{ kind: 'cancelled', reason }`, which does not.
+
+  **Why each one.** `source` is the word every context already answers the position with, and `from*` stays the
+  prefix of a factory that names where a `Readable` comes from (`fromExternal`, `fromMaybe`). `enabled` is the truth
+  the runtime reads while a node exists — one word at a contribution and at a Resource — while `when` keeps the other
+  mechanism, the declared `Condition`s an application resolves before the node exists; `scope.while(source, open,
+{ when })` and an effect's `filter` are untouched. `drop` is what a full capacity does with the value that does not
+  fit, at both nodes that admit a producer; `flush-oldest` is still the default of a keyed delivery and still the
+  answer for a producer that may lose nothing. `kind` is the discriminant eleven settled answers already carried.
+  `NavigatorCatalogue` is named for its job, beside `NavigatorPersistence`, because a policy is data (D291) and this
+  is four callbacks a navigator asks.
+
+  **Not breaking, and worth reading.** Every options record now refuses an unknown field with the sentence spec §3
+  promised — `<subject> <node> <record> contains unknown field <key>.` — and says which field it owes with
+  `<subject> <node> <record> requires <key>.` Five sentences became one, and the three that never printed the field
+  at all (`requires exact data fields`, `own.attach takes open, or open and close, and nothing else`) now print it. A
+  node that reads a source says so in two sentences per surface instead of three, and the word of the position is the
+  author's. `own.select` lost two of its four overloads: a call that writes the options record has one candidate of
+  its arity now, so a fault in that record is reported as the record's own refusal instead of
+  `Argument of type '"echo"' is not assignable to parameter of type 'never'`, and the record names the five words a
+  selection does not take — `concurrency`, `dedupe`, `lane`, `memoize`, `policy` — each with what to write instead.
+
+  **Measured.** Runtime size consumers, rebuilt: `application graph consumer` 48 248 B against a ceiling of 49 000
+  (48 318 before), `public feature consumer` 39 579 B against 41 000 (39 712 before). Type stress: 11 695 / 87 068 /
+  159 371 instantiations, unchanged to the digit. No ceiling moved.
+
+- aaaa92c: **The destructive verb is `reset()` (D373).** `Resource.invalidate()` is now `Resource.reset()`, and the verb of the
+  React hook is renamed with it: `useResource(resource)` answers `{ pagination, refresh, reset, retry, state }`. Nothing
+  about the operation changes — it clears the whole cache, drops the current data, opens a new epoch and restarts every
+  configured channel, exactly as D355 wrote it.
+
+  The old name promised the opposite of what it did. `invalidate` means «mark stale, keep the data» everywhere else —
+  TanStack Query's `invalidateQueries` keeps the cached data until a new answer arrives, and Apollo's `INVALIDATE`
+  marks a field stale without removing its value — so an author who came from there wrote it expecting a background
+  refresh over the rows still on screen and got an empty state instead.
+
+  - `resource.reset()` and `useResource(resource).reset.run()` are the current names; there is no alias, and a
+    Resource object has no `invalidate` member at all.
+  - A host that implements the `Resource` contract itself renames its member too: the runtime recognises a Resource
+    field of a model shape by the names of its verbs.
+  - `invalidate` now names no operation of a Resource. It is left free for a future operation that would mark data
+    stale and keep them — an intent recorded in D373, not a promise of one.
+
+### Patch Changes
+
+- Updated dependencies [bb31983]
+- Updated dependencies [bb31983]
+- Updated dependencies [bb31983]
+- Updated dependencies [dae5079]
+- Updated dependencies [dae5079]
+- Updated dependencies [bb31983]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [dae5079]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [bb05f21]
+- Updated dependencies [dae5079]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [bb05f21]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [bb31983]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [dae5079]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [dae5079]
+- Updated dependencies [bb05f21]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [dae5079]
+- Updated dependencies [dae5079]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [bb05f21]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [bb31983]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [dae5079]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [aaaa92c]
+- Updated dependencies [dae5079]
+- Updated dependencies [bb05f21]
+- Updated dependencies [dae5079]
+- Updated dependencies [bb31983]
+- Updated dependencies [bb31983]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [bb05f21]
+- Updated dependencies [34bdbfb]
+- Updated dependencies [34bdbfb]
+  - @opetope/runtime@0.12.0
+  - @opetope/core@0.12.0
+
+## 0.11.0
+
+### Minor Changes
+
+- 6f23026: **A retirement stops a source, it never breaks it (D364).** `Readable.subscribe` promises «I call you, you read
+  me», and `State.close()` was the only operation in the framework that notified and then refused the read. Every
+  foreign listener that followed the protocol literally therefore threw, the framework collected that throw into an
+  `AggregateError`, and reported it on behalf of a consumer that had done nothing wrong — with a Resource in the
+  picture, with a plain `ctx.state` cell and no Resource at all, and across an `optional` weak edge where a consumer
+  legitimately outlives its provider. D362 and D363 taught the framework's own nodes to read a close as a lifetime
+  fact; neither could reach a listener that is not a framework node.
+
+  - **The law.** A Resource says `idle('retired')`, a cell keeps its last value, and a read never fails because a
+    lifetime ended. `createState.close()` stops accepting writes, lets its listeners go and answers its last value
+    for ever; it notifies nobody, because nothing changed, and a later `subscribe` is inert. The controller of a
+    Resource publishes one terminal record at its fence and **seals** its publisher behind it, so a retired Resource
+    answers that record for as long as a consumer holds it and its controller's publisher retains none of the listener
+    closures it handed out. The terminal word belongs to the object whose life ended: a Resource a model owns says
+    `retired`, while a feature's `own` or exported Resource is a reference that outlives the instance, so the
+    retirement of its controller reaches it as a detachment and it answers `unleased` — one frame, and its verbs
+    answer the word its state answers.
+  - **One new type name, `ResourceIdleReason`, exported from `@opetope/core` and re-exported by `@opetope/runtime`.**
+    The compiler prints `'retired'` to a consumer whose exhaustive branch on `state.reason` breaks, and a union that
+    has no name to import is hand-copied instead — which is the one artefact that keeps compiling when a member is
+    added. The pagination reasons became one internal type and stay off the public surface.
+  - **Two new words, both inhabitants of types that already existed.** `ResourceIdleReason` gains `'retired'` — the
+    word the verbs of a retired Resource already answer, which made `state.getSnapshot()` the only member of the
+    object that refused the question the rest of it answered. `PaginationState` gains `unavailable('retired')` and
+    `PaginationOutcome` `skipped('retired')`: `resource-not-ready` reads as «not yet» and invites a retry loop, and
+    `end` would render «everything is loaded» over a Resource that is gone.
+  - **`ReadableError` is removed**, with `isClosedReadable`, the followed/unfollowed classification of a committed
+    failure, the close branches of `effect`, `scope` and the Resource inputs, the `unreadable` selection decision, both
+    catches of the feature `own` facade, and `keepLastOnClose`, the selection's closed-source memory and
+    `useResource`'s `lastGoodSnapshot` in `@opetope/react`. A write after the stop raises a `TypeError`; model writes
+    are already dropped in silence, so the only reachable caller is a test holding `testReadable`. An exhaustive
+    `switch` or a record over `state.reason` breaks at compile time, which is the migration this release asks for.
+  - **Inspection.** The frame schema is `opetope.devtools-frame/5`: the `readable` failure subject leaves the union
+    with the class that produced it, and the decoder accepts only `/5`. The subscriber count of a Resource is frozen
+    when its publisher seals instead of being zeroed, so the row of a fenced materialization reads «fenced, and N
+    consumers were still following it».
+  - **What did not change.** A producer failure is not a lifetime fact: `resource.state` still refuses a read after
+    `publisher.fail` and after a broken `nextCursor`, a `derive` still throws whatever its calculation threw, and
+    every such refusal still reaches the reader and is reported once. The weak-edge `Maybe` still says `none` before
+    the provider's cells stop, and that is the channel to read.
+  - **What it costs.** Stale is quiet where it was loud, and a React reader of `resource.state` renders one more —
+    idle — frame while a tree is torn down, where the close used to be swallowed and the last frame stood. A consumer
+    that keeps a handle on a stopped cell keeps its last value: measured at 7.99 MB over an 8 MB source, released in
+    full when the handle goes, and bounded by the consumer's own reference. A Resource is the opposite: the fence
+    releases its `Data`, its cache and its pagination anchor before the terminal record is published, so holding
+    `resource.state` for ever costs nothing. The disposer `subscribe` answers is built outside the cell now, so a
+    consumer that kept only the disposer — and had therefore let the `Readable` go — no longer pins the last value
+    through it.
+
+### Patch Changes
+
+- 0eb82ba: **A close is recognized as this source's own, and its memory belongs to the mount (D363).** D362 shipped in 0.10.1
+  applied in fewer places than it claimed, and the predicate behind it could not tell three different things apart.
+
+  - **The scope input of a Resource.** An independent `identity.scope` was read inside the same `try` as
+    `resourceKeyOf` and `scopeOf`, so its close became a broken selector: one `ReadableError` in the reporter, and —
+    with no materialization current — a published `idle('missing-request')`, which moved the state a close must never
+    move. The source is read in its own `try` now; a throwing selector is still `broken`, with one record per
+    transition.
+  - **`useSelector` with an inline selector.** The memory of «what this reader last read» lived inside a `useMemo`
+    whose deps include the selector, so `useReadable` was safe and `useSelector(readable, inline)` — the documented
+    form — rebuilt the reader with an empty memory and failed mid-render after a close. The memory of `useSelector`
+    and of a `useModel` selection now lives in the ref the mount already holds, so a memo React discarded changes
+    nothing.
+  - **A source a node never read.** An `effect`, a `scope` or a Resource whose source was already closed when it
+    opened swallowed that close: the run never started, no child and no materialization ever opened, and nothing was
+    said anywhere. A close with nothing to keep is now reported, as React already did — the law is about not
+    reporting the end of work the runtime itself is ending.
+  - **A close raised inside a calculation.** A `derive` whose computation reads an unrelated closed `Readable` raised
+    a bare close that every observer swallowed, turning a programming fault into silence. Such a failure travels on
+    as `A calculation read a closed readable state.` with the close in its `cause`; a close that came out of a source the
+    node follows is unchanged.
+  - **Two copies of Core.** The predicate was `instanceof`, so a vendored copy beside an installed one raised a close
+    that was reported as a foreign failure. It now asks the shape the `Readable` contract already promises — an
+    `Error` named `ReadableError` with code `closed` — so the close of either copy is the same fact.
+  - **Two React readers that swallowed everything.** `useResource` and the passive reads of a selection caught every
+    refusal with a bare `catch`, including a failed publisher cell and a broken `nextCursor`. They apply the same
+    predicate now and rethrow anything else.
+  - **The selection fast path** records a closed source once instead of re-reading it on every render, so a mount
+    whose source closed stops rebuilding its selection — and stops allocating a failure per read — for the rest of
+    its life.
+
+- Updated dependencies [6f23026]
+- Updated dependencies [0eb82ba]
+  - @opetope/core@0.11.0
+  - @opetope/runtime@0.11.0
+
 ## 0.10.1
 
 ### Patch Changes
@@ -183,7 +525,7 @@
 
   **`ResourceHook` (D321).** `useResource(resource)` answers `{ snapshot, refresh, retry }`, and a field of a
   `useModel` selection whose value is a request answers the same hook and takes the same lease. Nine models of one
-  application had wrapped `resource.refresh()` in a `Call<void, void>` for nothing but the `inFlight` of a button.
+  application had wrapped `resource.refresh()` in a `Command<void, void>` for nothing but the `inFlight` of a button.
   Recognition asks the same question the type asks: `Resource` is a structural contract (D199), so a host adapter that
   satisfies it is classified and leased exactly like a materialization the runtime built, which stays the fast path.
   `read(resource)` still answers the snapshot and leases nothing. One pair of controllers per resource identity keeps
@@ -215,11 +557,11 @@
 
 ### Patch Changes
 
-- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Call из
+- b964772: Модель подтверждает мутации принадлежащего ей Resource, получает явный исход обновления, выполняет Command из
   effect и сериализует независимые объекты через очередь по ключу. Stream умеет накапливать кадры в границах
   открытия. Контекст данных отделён от ключа, а ёмкость кэша перенесена из retention в самостоятельную опцию cache.
   Retention теперь задаётся литералом, model resource/stream принимает готовый Readable, а `queueBy` создаёт
-  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Call
+  приватную keyed queue команды или использует явно переданную общую lane. Effect переносит отмену вложенного Command
   через `rethrowIfCancelled`.
 - Updated dependencies [b964772]
   - @opetope/core@0.9.3
@@ -239,7 +581,7 @@
 
 - d7f346a: A command hook is `{ run, inFlight, outcome }`, and an owned attachment step is `step(key, run, cleanup)`.
 
-  `CommandHook.handler` is removed, from `useCommand`, from every key of `useCommands` and from the `Call` fields of a
+  `CommandHook.handler` is removed, from `useCommand`, from every key of `useCommands` and from the `Command` fields of a
   `useModel` selection. It bought one arrow in JSX and nothing the types did not already hold: `onClick={logout.run}`
   never compiled, because a `MouseEvent` is not a `void` input. A command without input now binds as
   `onClick={() => void logout.run()}` (D292).
@@ -314,17 +656,17 @@ after <attempts> attempts — ` and carrying a non-enumerable `eventually` recor
   `timeoutMs`, so an expiry does not read like a single failed assertion. A throw that is not an `Error` is rethrown
   untouched.
 
-  `runCall(target, input?, { signal, timeoutMs })` takes a deadline on that one run. `run` is the top-level execution
+  `runCommand(target, input?, { signal, timeoutMs })` takes a deadline on that one run. `run` is the top-level execution
   the consumer owns (D292), so the deadline cancels the way that consumer cancels — by aborting the signal this run
-  supplied — and rejects with a `CallTimeoutError` naming the call and the deadline. A `signal` stands beside it and
+  supplied — and rejects with a `CommandTimeoutError` naming the call and the deadline. A `signal` stands beside it and
   the first of the two to abort supplies the reason, so a cancelled outcome is never reported as a timeout.
 
-  `command(run)` is now published by `@opetope/core/testing` as a `Call` fixture with no binding: the body is
+  `command(run)` is now published by `@opetope/core/testing` as a `Command` fixture with no binding: the body is
   positional and receives the signal of the run, and there is no lane, queue, dedupe or retirement — so no `inFlight`
   to read, no fence, and two runs of one fixture overlap. A model opened with `openModel` takes it as a dependency,
-  which removes the second model a test used to open for one Call. `@opetope/react/testing` keeps its own `command`,
+  which removes the second model a test used to open for one Command. `@opetope/react/testing` keeps its own `command`,
   which is this one plus the contribution binding a mount reads, and also re-exports `yieldTurn`, `eventually` and
-  `CallTimeoutError`.
+  `CommandTimeoutError`.
 
   `settled` and `waitFor` accept the `ApplicationExecution` an `openApplication` returned. An application contributes
   the models of every generation it holds right now and a fifth fact of its own: the instances whose retirement has
@@ -334,7 +676,7 @@ after <attempts> attempts — ` and carrying a non-enumerable `eventually` recor
 
   Migration: `flush()` (a `setImmediate` or `setTimeout(0)` helper) → `yieldTurn()`; a local generic
   `waitFor<Value>(read, predicate)` → the library `waitFor`, which returns the value; a local `eventually` → the
-  library one, whose expiry carries the last assertion failure; `AbortSignal.timeout(500)` in `runCall` →
+  library one, whose expiry carries the last assertion failure; `AbortSignal.timeout(500)` in `runCommand` →
   `{ timeoutMs: 500 }`; `command` from `@opetope/react/testing` in a test that renders nothing →
   `command` from `@opetope/core/testing`; and a hand-written poll loop for an application → `settled(application)`.
 
@@ -362,9 +704,9 @@ auth.getTokens()) === null)` — belongs in `eventually`, which awaits its block
 
 - 0318472: Give every package a testing entry, and open a model without a feature.
 
-  `@opetope/core/testing` publishes `testReadable` (the state cell a model receives as `ctx.state`), `runCall` — moved
+  `@opetope/core/testing` publishes `testReadable` (the state cell a model receives as `ctx.state`), `runCommand` — moved
   here from `@opetope/react/testing`, because it reaches the existing invoker and knows about neither a renderer nor a
-  feature — and `CallInputArgs`, so a test can wrap `runCall` without naming `./internal` (D285).
+  feature — and `CommandInputArgs`, so a test can wrap `runCommand` without naming `./internal` (D285).
 
   `@opetope/runtime/testing` adds `openModel(Decl, dependencies?, create, { reporter })`, which opens one model with
   the same kernel, lanes and retirement the feature path builds and none of what a feature adds (D286), and
@@ -435,9 +777,9 @@ auth.getTokens()) === null)` — belongs in `eventually`, which awaits its block
 
   Keep derive({ from, select }) for explicit sources and preserve the existing reactive scheduling and lifetime behavior. Migrate framework consumers and add a compile-checked model example in the English and Russian guides.
 
-- 538cdfe: Replace singleFlight with dedupe on custom Calls. Use dedupe: true to share one pending or running execution per Call and generation, or a key function to share equivalent inputs. Retain the first input and independent caller cancellation. Remove the former name without a compatibility alias.
+- 538cdfe: Replace singleFlight with dedupe on custom Calls. Use dedupe: true to share one pending or running execution per Command and generation, or a key function to share equivalent inputs. Retain the first input and independent caller cancellation. Remove the former name without a compatibility alias.
 
-  Reject both forms of dedupe with policy: latest in types and at runtime. Different keys keep one FIFO under queue and run independently under parallel. Preserve once caching before deduplication and keep scheduling options on Call declarations rather than React hooks. Add a compile-checked model example and update the English and Russian guides.
+  Reject both forms of dedupe with policy: latest in types and at runtime. Different keys keep one FIFO under queue and run independently under parallel. Preserve once caching before deduplication and keep scheduling options on Command declarations rather than React hooks. Add a compile-checked model example and update the English and Russian guides.
 
 - Updated dependencies [538cdfe]
 - Updated dependencies [538cdfe]
@@ -475,14 +817,14 @@ auth.getTokens()) === null)` — belongs in `eventually`, which awaits its block
   runtime nodes or adding ownership relations. Preserve diagnostic group names in the tooltip and inspector.
 
 - a6a5f73: Remove the redundant `Command` type synonym and the `CommandOutcome` re-export from
-  `@opetope/react/integration`. Import `Call` from `@opetope/core` and the UI `CommandOutcome`
+  `@opetope/react/integration`. Import `Command` from `@opetope/core` and the UI `CommandOutcome`
   from `@opetope/react`. Alpha releases keep one current API without compatibility aliases.
 
 ### Patch Changes
 
 - a6a5f73: Allow nested `invoke(target)` without an input placeholder for Calls accepting `void` or `undefined`, including
   model, feature and attachment execution contexts. Keep required inputs inferred from the target, preserve generic
-  forwarding, and share the no-input rule with React `run` and testing `runCall`. Calls accepting `never` cannot be
+  forwarding, and share the no-input rule with React `run` and testing `runCommand`. Calls accepting `never` cannot be
   invoked without input.
 - a6a5f73: Allow omitting `conditions` from `openApplication` and `createScenario` when no enabled feature requires a host-bound condition. Missing external bindings and explicitly invalid condition records still fail validation.
 - Updated dependencies [a6a5f73]
@@ -496,7 +838,7 @@ auth.getTokens()) === null)` — belongs in `eventually`, which awaits its block
 
 ### Minor Changes
 
-- 410f2f0: Run authentic Calls in headless model tests with `runCall` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
+- 410f2f0: Run authentic Calls in headless model tests with `runCommand` from `@opetope/react/testing`, preserving their existing policies, cancellation, errors and owner lifetime.
 
   Add the recommended `opetope/no-internal-imports` rule for static imports, re-exports, literal dynamic imports, unshadowed `require` and TypeScript import types. `configs.internalImports` uses this rule for JavaScript and TypeScript, including tests, without replacing the host's `no-restricted-imports`. The redundant `internalImportPattern` export is removed; allow trusted implementation files through the config or an explicit rule override.