rip-lang 3.16.0 → 3.16.2

package/docs/RIP-APP.md

@@ -24,21 +24,39 @@ shaped the way it is, and how to use it well.
 
 # Contents
 
-1. [The four-layer architecture](#1-the-four-layer-architecture)
-2. [Quick start — the 30-second wow](#2-quick-start)
-3. [The subsystems](#3-the-subsystems)
-   - [Stash](#stash)
-   - [createResource](#createresource)
-   - [Timing helpers](#timing-helpers)
-   - [Components store](#components-store)
-   - [createRouter](#createrouter)
-   - [createRenderer](#createrenderer)
-   - [launch](#launch)
-   - [ARIA helpers](#aria-helpers)
-4. [Lifecycle invariants — what fires when, what owns what](#4-lifecycle-invariants)
-5. [Async effects — `getEffectSignal` and cancellation](#5-async-effects)
-6. [Gotchas — things that have bitten us before](#6-gotchas)
-7. [When NOT to use Rip App](#7-when-not-to-use)
+- [Rip App — Application Framework](#rip-app--application-framework)
+- [Contents](#contents)
+  - [1. The four-layer architecture](#1-the-four-layer-architecture)
+  - [2. Quick start](#2-quick-start)
+    - [Real apps: bundles + file-based routing](#real-apps-bundles--file-based-routing)
+  - [3. The subsystems](#3-the-subsystems)
+    - [Stash](#stash)
+    - [Sources and render gates](#sources-and-render-gates)
+    - [createMutation](#createmutation)
+    - [createResource](#createresource)
+    - [Timing helpers](#timing-helpers)
+    - [Components store](#components-store)
+    - [createRouter](#createrouter)
+    - [createRenderer](#createrenderer)
+    - [launch](#launch)
+    - [ARIA helpers](#aria-helpers)
+  - [4. Lifecycle invariants](#4-lifecycle-invariants)
+    - [Component lifecycle order](#component-lifecycle-order)
+    - [User hooks](#user-hooks)
+    - [Effect ownership](#effect-ownership)
+    - [Effect cleanup-on-rerun](#effect-cleanup-on-rerun)
+    - [Parent chain (for context)](#parent-chain-for-context)
+    - [Layout and page parentage](#layout-and-page-parentage)
+    - [Factory blocks (for/if in render)](#factory-blocks-forif-in-render)
+    - [Keyed list reconciliation](#keyed-list-reconciliation)
+  - [5. Async effects](#5-async-effects)
+  - [6. Gotchas](#6-gotchas)
+    - [The bundle boundary matters](#the-bundle-boundary-matters)
+    - [Render-template name shadowing (fixed)](#render-template-name-shadowing-fixed)
+    - [Nested `for` loops can both name `i` (fixed)](#nested-for-loops-can-both-name-i-fixed)
+    - [Snapshot tests are brittle](#snapshot-tests-are-brittle)
+    - [No browser e2e tests](#no-browser-e2e-tests)
+  - [7. When NOT to use Rip App](#7-when-not-to-use-rip-app)
 
 ---
 
@@ -185,7 +203,7 @@ A deep reactive proxy with path navigation. Single-app state,
 JSON-persistable, fine-grained signal subscription per key.
 
 ```rip
-app = stash
+app = createStash
   user:
     name: "Alice"
     prefs:
@@ -205,7 +223,7 @@ app.keys 'user'                  # → ['name', 'prefs']
 app.join 'user', email: "..."    # shallow merge
 
 # Use raw object underneath
-plain = raw(app)                 # back to a plain JS object
+plain = unwrapStash(app)         # back to a plain JS object
 ```
 
 **Single-stash policy**: Rip App assumes one stash per page (the one
@@ -214,10 +232,97 @@ beforeunload-flush mechanism both rely on this. Apps needing
 isolated state silos should use plain `__state(...)` signals or
 namespace under different keys on `app.data`.
 
+### Sources and render gates
+
+Server data lives in the stash as **source** keys — cells that know how
+to load themselves. `app/stash.rip` becomes the app's data manifest:
+
+```rip
+import { source } from '@rip-lang/app'
+
+export stash =
+  cart: { items: [] }                                       # plain client state
+  user: source { fetch: -> User.parse(api.get!('user').json!()) }
+  products: source                                          # five minutes of freshness is plenty
+    fetch: -> Product.array.parse(api.get!('products').json!())   # validated Product[]
+    staleTime: '5 min'
+  order: source { fetch: (id:: string) -> Order.parse(api.get!("orders/#{id}").json!()) }
+```
+
+A source is **lazy** (loads on first touch, not at startup) and **not a
+promise** — it owns its in-flight load internally; its value is part of
+the stash's reactive fabric like any other key:
+
+- **Reading is reading.** An ungated read (`@app.data.user`) is honest —
+  `User | null` — and kicks the load without blocking; the null branch is
+  the skeleton branch. A gated binding (`user <~ @app.data.user` in a
+  route or layout) is loaded before the component constructs and types
+  non-null.
+- **Writing is assigning.** `@app.data.user = u` writes through to the
+  cell; every consumer updates in place. A write bumps the cell's
+  generation and aborts any in-flight load — an old fetch can never
+  clobber a newer write. `@app.data.user = null` means *invalidate*.
+- **Keyed families.** A `fetch` with a required first param is one cell
+  per key: `@app.data.order(id)` is an ungated keyed read; a route gates
+  with `order <~ @app.data.order(params.id)`. Entries live under an LRU
+  cap and revalidate like singletons.
+- **Freshness.** `staleTime` (ms, a duration string like `'5 min'`, or
+  `'forever'`) controls revalidation. The default `0` is
+  stale-while-revalidate: every gate serves the cached value instantly
+  and refetches in the background. A gate only ever *blocks* on unloaded
+  cells.
+- **Errors are never cached.** A failed initial load returns the cell to
+  unloaded (the next gate retries) and rejects the navigation into the
+  nearest `onError` boundary as `{ status, message, error, path }`. A
+  failed refetch keeps the last-good value and records the error on the
+  handle — mounted gates are never yanked (the live-binding invariant).
+- **The handle.** `app.data.source(path, key?)` returns reactive
+  `{ value, loading, error, refetch(), reset() }` for screens that render
+  *through* loading/error instead of gating.
+- **One reset.** `app.data.reset()` restores plain keys to their declared
+  defaults, unloads every source (aborting in-flight loads, clearing
+  keyed caches), and purges the persisted snapshot — signout in one call.
+- **Serialization is a projection.** `persistStash` persists plain keys
+  and skips source keys (server data is refetchable; the gate reloads on
+  restore). `app.data.peek(path)` is the non-triggering read for code
+  *about* the stash (serializers, devtools).
+- **Preloading.** Off by default; opt in with `serve({ preload: 'intent' })`
+  in the root entry. Once on, resting the pointer on (or focusing) a
+  router-owned link for ~50ms warms the gates the destination would *newly*
+  mount — a layout already mounted under the current route is skipped, so
+  hovering siblings never re-fetches shared shell data. Navigation joins
+  loads already in flight (one in-flight load per source). Sweeping past a
+  link cancels before it fires, and preload failures never surface — the
+  cell records them and navigation's own gate retries.
+
+Testing gated components needs no mocks: a write marks a cell loaded, so
+seed and construct — `app.data.user = fixtureUser`, then `new Profile(...)`.
+
+### createMutation
+
+The write-side primitive. Reads are per-key (`source`); writes are
+per-action — a mutation wraps the action and exposes reactive
+`pending` / `succeeded` / `error`. Invoke it directly with the payload
+(it *is* the action; there is no `.mutate`):
+
+```rip
+updateUser = createMutation ((data) -> User.parse(api.patch!('user', { json: data }).json!())),
+  onSuccess: (u) => @app.data.user = u           # write-back — every reader updates, no refetch
+  onError:   (e) => errors = parseApiError!(e)
+
+submit: (e) -> e.preventDefault(); updateUser(form)
+# render: the submit button reads updateUser.pending; banners read succeeded/error
+```
+
+Callbacks (and a source's `fetch:`) are plain options on a runtime call —
+nothing binds their `this`. Use `=>` for anything touching component
+members.
+
 ### createResource
 
-Async data with race protection, abort support, and reactive loading
-state.
+The standalone packaging of the same async cell, for **instance-local**
+async (a search box's per-instance results are component state, not app
+data). Same race protection, abort support, and reactive loading state.
 
 ```rip
 user = createResource ->
@@ -291,6 +396,7 @@ router = createRouter components,
 
 router.push '/users/42?tab=settings'
 router.replace '/login'
+router.push '/cart', noScroll: true   # don't reset scroll on this nav
 router.back()
 router.forward()
 
@@ -316,6 +422,65 @@ The renderer uses `router.current` to drive its mount effect. Each
 field is also a separate signal so subscribers can track only what
 they care about.
 
+#### Anchor opt-outs and active-link styling
+
+The router intercepts plain `<a>` clicks at the document level. Two
+per-anchor attributes adjust that behavior:
+
+| Attribute               | Effect                                                                                |
+| ----------------------- | ------------------------------------------------------------------------------------- |
+| `data-router-ignore`    | Skip SPA interception entirely. The browser performs a full navigation.               |
+| `data-router-noscroll`  | Take the SPA navigation, but don't reset scroll to `(0, 0)`.                          |
+
+Anchors with `target="_blank"`, `[download]`, cross-origin hrefs, or
+hrefs outside `base` are also skipped automatically.
+
+**Active-link highlighting.** On every navigation the router walks
+in-document anchors and sets `aria-current` on those that match the
+current path:
+
+- exact match → `aria-current="page"`
+- prefix match (`/blog` on `/blog/123`) → `aria-current="true"`
+- otherwise → attribute removed (only if the router set it)
+
+Style it with attribute selectors — no per-link boilerplate needed:
+
+```css
+nav a[aria-current="page"] { color: red; font-weight: bold; }
+nav a[aria-current="true"] { color: red; }
+```
+
+Setting `aria-current` manually on an anchor wins — the router only
+touches values it set itself.
+
+**Scroll restoration.** New navigations (`push` or a link click)
+reset scroll to `(0, 0)`. Back/forward (`popstate`) restores the
+scroll position the page had when you left it. Same-document fragment
+links (`#section`) defer to the browser.
+
+**Typed routes (compile-time).** In a typed project (one with
+`rip.strict: true` or `::` annotations), `rip check` synthesizes a
+`__RipRoutes` union from the file tree under `app/routes/` and
+threads it through three places:
+
+| Place                              | Type                                                                  | Catches                            |
+| ---------------------------------- | --------------------------------------------------------------------- | ---------------------------------- |
+| `<a href: "...">` in render blocks | `__RipRoutes` for `/`-prefixed literals; any string otherwise         | Typos in known routes              |
+| `router.push url, opts?`           | `__RipRoutes` (replaces base `string`)                                | Typos in programmatic navigation   |
+| `@params` in `routes/[id].rip`     | `{ id: string }` (replaces `Record<string, string>`)                  | Typos like `@params.bogus`         |
+
+Anchor `href` uses a `const`-generic conditional: a literal starting
+with `/` must satisfy `__RipRoutes`, while external schemes
+(`https://`, `mailto:`, `tel:`), fragments (`#anchor`), and dynamic
+`string` values fall through unchecked. Typos like `<a href: "/crat">`
+produce a single-line error naming the valid routes.
+`router.replace` is deliberately left at `string` — it's commonly
+used to mutate the current URL with query strings, where the built
+value can't satisfy a literal-route union. Catch-all routes
+(`[...rest].rip`) are excluded from `__RipRoutes` — they're runtime
+404 fallbacks, not navigation targets, so including them as
+`/${string}` would defeat typo-catching for every other route.
+
 ### createRenderer
 
 The render loop. Subscribes to `router.current`, mounts/unmounts
@@ -422,6 +587,8 @@ mount(target)                  ← only the renderer calls this directly
                                   Per-child push wrap: each child's _create runs with
                                   child as current, so the child's reactive bindings
                                   register on child._disposers, not parent's.
+       beforeMount()           ← user hook; signals/state ready, DOM not yet in tree
+                                  effects created here auto-register on this component
        _setup()                ← post-creation effects (rare; most go in _init)
        mounted()               ← user hook; DOM is in the tree now
      __popComponent
@@ -436,6 +603,20 @@ unmount({ removeDOM = true })  ← idempotent (_unmounted flag short-circuits se
      DOM removal (if requested)
 ```
 
+### User hooks
+
+The framework recognizes these hook names on any component. All are
+optional; the runtime calls each only if defined.
+
+| Hook            | When it fires                                              | Notes                                                                            |
+| --------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- |
+| `beforeMount`   | After `_create`, before DOM is attached                    | Effects created here auto-register on the component                              |
+| `mounted`       | After DOM attached                                         | Runs once per visit                                                              |
+| `beforeUnmount` | Before children unmount and disposers fire                 | Signals/effects still live                                                       |
+| `unmounted`     | After disposers fire and DOM is removed                    | Final notification; runs once per visit                                          |
+| `onError`       | A throw escapes any component method (render, hook, event) | Receives `{ status?, message?, error?, path? }`; the renderer walks the layout chain to find the nearest defining component |
+
+
 ### Effect ownership
 
 Every `__effect(fn)` call automatically registers its disposer with

package/docs/RIP-DUCKDB.md

@@ -31,6 +31,7 @@ you're in the right place.
 6. [When you genuinely need to mutate a referenced indexed column](#6-when-you-genuinely-need-to-mutate)
 7. [Escape hatches](#7-escape-hatches)
 8. [Should I use DuckDB for OLTP at all?](#8-should-i-use-duckdb-for-oltp-at-all)
+9. [Transactions, sequences, and migration edges](#9-transactions-sequences-and-migration-edges)
 
 ---
 
@@ -184,7 +185,7 @@ was originally documented from:
 ```coffee
 Partner = schema :model
   name!  string
-  slug!# string
+  slug! string @unique
 
 Patient = schema :model
   mrn?       string
@@ -461,12 +462,74 @@ DuckDB is a fine fit when:
 - You want analytics queries to live in the same engine as the
   transactional data
 
+### Turning a mutation-shaped workload into an append-shaped one
+
+A workload that looks write-heavy on paper is often append-heavy in
+disguise. The standard move — shared by change feeds, event logs,
+audit trails, and sync protocols (Replicache / Zero-style) — is an
+**append-only log with a monotonic version column** beside the entity
+tables: a write appends a new row instead of mutating an indexed
+parent in place, and readers pull `WHERE version > :cursor`. This
+plays directly to DuckDB's strengths (append-heavy writes, fast
+monotonic range scans) and routes around the one real weak spot from
+§1 — in-place updates to indexed / FK rows, which an append never
+performs. The trade is the usual one for log-structured designs: the
+log grows and wants periodic compaction (prune history below the
+lowest live reader cursor, `CHECKPOINT` to flush), and "current state"
+becomes a view or materialization over the log rather than the rows
+themselves. When a write-heavy feature can be expressed this way, the
+"poor fit" case above (routinely mutating indexed identifiers) often
+stops applying — and harbor's single-port `/sql` with NDJSON streaming
+is a natural transport for serving the resulting feed.
+
 For a project where you're not sure: prototype with DuckDB, watch
 the FK behavior, and switch to PostgreSQL or SQLite if you find
 yourself reaching for the escape hatches more than once or twice.
 
 ---
 
+## 9. Transactions, sequences, and migration edges
+
+Findings from running the Rip Schema transaction and migration
+machinery against live DuckDB (via duckdb-harbor) — each one shapes
+runtime or differ behavior:
+
+**FK-referenced tables are frozen for DDL too.** The §1 rule isn't
+just about UPDATE/DELETE — most `ALTER TABLE` operations (add column,
+drop column, type changes) on a table referenced by another table's FK
+fail with `Dependency Error: Cannot alter entry "users" because there
+are entries that depend on it`. Changing such a table means recreating
+the referencing tables around it. The migration differ classifies
+these steps as **`blocked`** in `rip schema status` and refuses to
+write them into a migration file — the rebuild is a human decision.
+Unreferenced tables alter normally.
+
+**No `SAVEPOINT`.** DuckDB supports flat transactions only. A nested
+`schema.transaction!` therefore *joins* the outer transaction rather
+than creating an independently-rollbackable unit — one rollback undoes
+the whole nest. Don't design flows that need partial rollback.
+
+**Sequences are non-transactional.** `nextval()` consumed inside a
+rolled-back transaction is not returned — a failed `create!` leaves a
+gap in the `id` sequence. Gaps are normal and harmless; never write
+code that assumes ids are contiguous, and never predict "the next id"
+from the last one you saw.
+
+**Harbor sessions work in every auth mode.** Transactions ride
+duckdb-harbor's session protocol (`POST /sql/sessions/new`, then
+per-statement `session_id`). Own-session lifecycle is scoped as
+`__HARBOR_SELF__:sessions:create` / `:delete` — allowed by default for
+any caller, including unauthenticated local-dev mode
+(`harbor_serve(..., token := NULL)`), where sessions are owned by the
+synthetic `harbor.local-dev` principal. A 403 from
+`schema.transaction!` means a custom `harbor_authorization_function`
+explicitly denies the `__HARBOR_SELF__:sessions:` scope — add a branch
+matching it. (Earlier harbor versions misfiled session creation as an
+admin action; that required `RIP_DB_TOKEN` plus an admin grant and is
+the reason older notes here said transactions need a token.)
+
+---
+
 ## See also
 
 - [`docs/RIP-SCHEMA.md`](./RIP-SCHEMA.md) — the schema/ORM documentation,

package/docs/RIP-INTRO.md

@@ -78,7 +78,7 @@ Read as families, not atoms:
 |---|---|---|
 | Existence / safety | `x?` · `x ?? y` · `a?.b` · `a?.[0]` · `a?.()` · `a?[0]` · `a?(x)` · `el?.prop = v` · `?!` (presence / Houdini) · `?? throw` | Nothing-safe access and guards |
 | Dammit / await | `fetch! url` · `user.save!` · `User.find! 1` | One glyph: "call it and await" |
-| Void / required | `def process!` (suppresses implicit return) · `name! string` (required field) · `email!#` (required + unique) | Same `!` glyph, context-disambiguated |
+| Void / required | `def process!` (suppresses implicit return) · `name! string` (required field) · `email! email @unique` (required + unique) | Same `!` glyph, context-disambiguated |
 | Math | `//` floor div · `%%` true mod · `1 < x < 10` chained compare · `arr[-1]` negative index · `"-" * 40` string repeat | Math you can read |
 | Regex | `str =~ /re/` with `_[1]` captures · `str[/re/, 1]` · `///...///` heregex | Pattern matching as an expression |
 | Assignment sugar | `.=` method-assign (`x .= trim()`) · `?.=` optional-chain assign · `*>obj = {a:1}` merge-assign | "Mutate this thing" |
@@ -188,7 +188,7 @@ Status = schema
 # DB-backed model
 User = schema :model
   name!   string
-  email!# email
+  email! email @unique
   role?   "admin" | "user"
   @timestamps
   @has_many Order
@@ -363,7 +363,7 @@ A close second is **non-reactive reads due to aliasing / stash access patterns**
 | `fetch!` | dammit — call + await |
 | `def fn!` | void — suppress implicit return |
 | `name! string` | required field (in `schema` body) |
-| `email!#` | required + unique (in `schema :model` body) |
+| `email! email @unique` | required + unique (in `schema :model` body) |
 | `MAX =! 100` | readonly const |
 
 ### The `?` family
@@ -383,7 +383,7 @@ A close second is **non-reactive reads due to aliasing / stash access patterns**
 | Line form | Example |
 |---|---|
 | Field (type implicit string) | `name! 1..50` |
-| Field + modifiers | `email!# email` (required + unique) |
+| Field + modifiers | `email! email @unique` (required + unique) |
 | Field + range | `password! 8..100` |
 | Field + literal union | `sex? "M" \| "F" \| "U"` |
 | Inline field transform | `email!, -> it.email.toLowerCase()` |

package/docs/RIP-LANG.md

@@ -346,12 +346,12 @@ Multiple lines
 | `[-n]` | Negative index | `arr[-1]` | `arr.at(-1)` |
 | `*` | String repeat | `"-" * 40` | `"-".repeat(40)` |
 | `<` `<=` | Chained comparison | `1 < x < 10` | `(1 < x) && (x < 10)` |
-| `\|>` | Pipe | `x \|> fn` or `x \|> fn(y)` | `fn(x)` or `fn(x, y)` |
 | `.=` | Method assign | `x .= trim()` | `x = x.trim()` |
 | `*>` | Merge assign | `*>obj = {a: 1}` | `Object.assign(obj, {a: 1})` |
 | `not in` | Not in | `x not in arr` | Negated membership test |
 | `not of` | Not of | `k not of obj` | Negated key existence |
 | `<=>` | Two-way bind | `value <=> name` | Bidirectional reactive binding (render blocks) |
+| `<~` | Render-ready | `user <~ @app.data.user` | Load-before-render binding (component bodies) |
 | `*{ }` | Map literal | `*{/pat/: val}` | `new Map([[/pat/, val]])` |
 | `:name` | Symbol literal | `:redo` | `Symbol.for("redo")` — Ruby-style interned symbol |
 
@@ -700,32 +700,6 @@ arr[i]           # → arr[i]      — variable index
 
 Only literal negative numbers trigger the `.at()` transform. Variable indexes pass through as-is.
 
-## Pipe Operator (`|>`)
-
-Pipes a value into a function as its first argument. Chains left-to-right:
-
-```coffee
-# Simple reference — value becomes the sole argument
-5 |> double                      # → double(5)
-10 |> Math.sqrt                  # → Math.sqrt(10)
-"hello" |> console.log           # → console.log("hello")
-
-# Multi-arg — value is inserted as the FIRST argument
-5 |> add(3)                      # → add(5, 3)
-data |> filter(isActive)         # → filter(data, isActive)
-"World" |> greet("!")            # → greet("World", "!")
-
-# Chaining — reads left-to-right like a pipeline
-5 |> double |> add(1) |> console.log
-# → console.log(add(double(5), 1))
-
-# Works with dotted methods
-users |> Array.from              # → Array.from(users)
-data |> JSON.stringify(null, 2)  # → JSON.stringify(data, null, 2)
-```
-
-This is the **Elixir-style** pipe — strictly better than F#'s (which only supports bare function references) and cleaner than Hack's (which requires a `%` placeholder). No special syntax to learn; if the right side is a call, the left value goes first.
-
 ---
 
 # 4. Functions
@@ -907,6 +881,7 @@ Rip's reactive features are **language-level operators**, not library imports.
 | `:=` | State | "gets state" | Reactive state variable |
 | `~=` | Computed | "always equals" | Computed value (auto-updates) |
 | `~>` | Effect | "always calls" | Side effect on dependency change |
+| `<~` | Render-ready | "loads from" | Server-backed state, loaded before render (component bodies) |
 | `=!` | Readonly | "equals, dammit!" | Constant (`const`) |
 
 ## Reactive Behavior
@@ -968,6 +943,35 @@ ticker ~>
   -> clearInterval interval  # Cleanup function
 ```
 
+## Render-Ready State (`<~`)
+
+The fourth creation form completes the reactivity grid: `<~` binds a
+component member to a server-backed stash key (a `source` — see the
+App framework docs) and declares that the key must be **loaded before
+the component renders**. The binding is therefore non-null — no `if user`
+guards, no loading flags:
+
+```coffee
+export Profile = component
+  user <~ @app.data.user               # loaded before render → non-null
+  form := { ...user }                  # synchronous — the value is present
+  order <~ @app.data.order(params.id)  # keyed source: one cell per id
+  theme <~ @app.data.settings.theme    # subpath: loads the nearest source
+```
+
+Rules, all enforced at compile time or deterministically at mount:
+
+- `<~` is only valid at the top of a **component body**, and only in
+  routes and layouts (a reusable child takes gated values as props).
+- The right-hand side must be a literal `@app.data.…` path — the compiler
+  hoists it into a static gate-set the renderer reads before construction.
+- A keyed gate's key expression may only reference `params` / `query`.
+- The path must resolve to a `source` key — gating a plain key is an error.
+
+An **ungated** read of the same key (`user ~= @app.data.user`) is the
+progressive-rendering form: it types as `T | null`, kicks the load without
+blocking, and the null branch is the skeleton branch.
+
 ## Auto-Unwrapping
 
 Reactive variables automatically unwrap in most contexts:
@@ -1593,12 +1597,11 @@ App = component
 
 ```coffee
 App = component
-  beforeMount = -> p "about to mount"
-  mounted     = -> p "mounted"
-  updated     = -> p "updated"
+  beforeMount   = -> p "about to mount"
+  mounted       = -> p "mounted"
   beforeUnmount = -> p "about to unmount"
-  unmounted   = -> p "unmounted"
-  onError     = (err, comp) -> p "caught: #{err.message}"
+  unmounted     = -> p "unmounted"
+  onError       = (err) -> p "caught: #{err.message}"
 ```
 
 **Effects:**
@@ -1880,7 +1883,7 @@ Status = schema
 # DB-backed model with ORM and migrations
 User = schema :model
   name!   string
-  email!# email
+  email! email @unique
   @timestamps
   @has_many Order
   beforeValidation: -> @email = @email.toLowerCase()
@@ -2369,11 +2372,6 @@ Each would need design discussion before building.
   `user ~>? fetch!("/api/users/#{id}").json!` gives `user.loading`,
   `user.error`, `user.data`. Park until real-world usage shows demand.
 
-- **Pipe operator (`|>`) — Hack-style placeholder** — Currently Rip uses
-  Elixir-style first-arg insertion. A `%` placeholder for arbitrary position
-  (`data |> fn(1, %, 3)`) could be added later if needed. Current design
-  covers 95%+ of cases.
-
 ---
 
 ## Resources