rtti: option is a nullary schema denoting absence — stage 2 of option-as-omission - #1748

…on-as-omission

Absence stops being a spelling of `undefined` and becomes a member of the
set: a member that may be omitted is `or(option, t)`, `{}` and
`{ a: undefined }` are distinct sets, and every reader, `subset`, both
renderers and the JSON Schema derivation agree on which is which.

- `option` is a new nullary tag; `visit` gains the case and both
  schema-form readers an `option` handler that rejects normally, so
  `orVisit` tries the other members of `or(option, t)` for a present value.
- Absence is decided by the container loops before dispatch: a declared
  member with no own or inherited key succeeds iff its schema admits
  absence (`admitsAbsence`, traversing nested `or`s with a visited set);
  a prototype-supplied member is still held to the present part.
- `parse` omits an absent member: the struct kind drops the key, the array
  kind rebuilds by slice-then-map, so a trailing absent run shortens the
  result and an interior hole survives — the old JSON round-trip defect of
  materialized `undefined` is gone.
- Data form: `absentBit` as the fifth unit bit, excluded from `unknown`;
  `toData(option)` via an explicit `thunkUnion` case; inline rests are
  stripped of the bit (referenced ones exempt — `subset` resolves them
  rather than masking, which the absence-only cycle shows would be
  unsound); `trimPrefix` drops a trailing declared position restating its
  rest; the declared-member top is `or(option, unknown)`; `objectMayOmit`,
  `objectPresentSet` and a split `arraySetSubset` move to the bit; the
  data reader gets the same before-dispatch absence test.
- Renderers: `Ts<>` renders an omittable member optional with absence
  stripped (`readonly a?: number`, `readonly [1, number?]` — exact under
  `exactOptionalPropertyTypes`), an interior tuple position as
  `T | undefined`, `array(option)` as `readonly []`; the runtime printer
  matches; `toJsonSchema` derives `required`/`minItems` from the bit while
  `stripUndefined` stays keyed on `undefined`. `Absent`, `_TsRaw` and
  `CheckRaw` are the raw-shape surface `Phantom` annotations need.
- Every `option(t)` call site migrated to `or(option, t)` — deliberately
  narrowing: a present `undefined` is no longer accepted at those members —
  and the direct `or(…, undefined)` optionality spellings audited
  (`mcp/cas`, `media/json/schema`); `protocol/mcp`'s `_noParams` checks a
  read top-level value, so it carries `undefined` the value.
- Docs and JSDoc swept; `parse-omits-undefined-members` dissolved and the
  `option-as-omission` todo completed, both deleted.

Changelog:

- **BREAKING CHANGES:** rtti's `option` is a nullary schema denoting
  absence; `option(t)` becomes `or(option, t)`, which also narrows —
  the faithful translation of the old set is `or(option, t, undefined)`.
  `parse` no longer materializes an absent member.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

…m` short-circuits `_IsAbsentOnly`

Two review findings on #1748:

- `parse`'s tuple rebuild called `slice`/`map` on the input, so an
  accepted `Array` subclass overriding either could hand back a result
  that fails the schema it was parsed against, or throw past the `Result`
  API. The rebuild is now built from the parsed entries alone — hole-run
  segments folded with `concat` on a trusted plain array, which appends a
  spreadable argument element by present element and so keeps the holes —
  and the value is never consulted. Pinned in `host.proof.mjs` with an
  array whose prototype supplies a hostile `slice` and a throwing `map`.
- `_IsAbsentOnly` (behind `ArrayTs`) walked a phantom-wrapped schema's
  thunk, re-expanding a recursive union into itself — TS2589 where the
  annotation exists to prevent it. It now reads the `Phantom` annotation
  first, as `_AdmitsAbsence` and `Ts` do: the annotation is
  `_TsRaw`-shaped, so absent-only is `Exclude<O, undefined | Absent>`
  being `never`. Pinned with a recursive `X = or(option, number, X)`
  wrapped and used as an array element, and an absence-only annotation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

…argument spread

Review finding on #1748, on the previous fix: accumulating segments with a
per-entry spread was quadratic — about 13.5 s for a 15,000-position tuple
where the parent took 0.37 s — and the one `concat(...segments)` call
overflowed the engine's argument limit on a large enough prefix, throwing
past the `Result` API.

The segments are now collected on the module's O(1)-prepend list and joined
pairwise: each round halves the segment count with one-argument `concat`
calls, so the rebuild is one linear pass plus a logarithmic number of
halving rounds and no call takes a variable argument list at all. Pinned
with an odd segment count and with thousands of alternating present/absent
positions, every hole and member asserted. (The remaining cost at that
scale sits in `undeclaredMembers`' pre-existing linear `declared.some`
scan, which predates this PR and matches the parent's 0.37 s.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

…lared` scan is quadratic

The entry is rewritten as four short list items — what changed and why, at
release-note altitude — so the pull request body's `Changelog:` section can
hold exactly the same items, as CONTRIBUTING.md requires. The rationale,
measurements and migration detail stay in the pull request description and
the module docs, where the changelog README sends them.

Review of #1748 also measured a superlinear end-to-end parse at 100k+ tuple
positions on both heads. Root-caused to `undeclaredMembers`' per-member
`declared.some` linear scan — quadratic on dense tuples, predating this
branch — and recorded as `fjs/rtti/todo/undeclared-members-declared-scan.md`
with measurements and the O(1)-membership fix sketch, rather than widening
this pull request.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

`changelog/README.md` bounds an *entry* — one list item; a pull request
with several entries puts them all in its one file — at about three
wrapped lines, ~250 characters. Two of the four ran past that; now every
item is within it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

Reading a member of the value can run arbitrary code — an accessor — and
the rebuild runs after every read, so by then that code may have replaced
anything reached by dynamic lookup: an `Array.prototype` method, the
array iterator, `Object.fromEntries`, the `Array` binding, or the
species lookup inside every array method — even a captured `concat`
builds through the receiver's species. A getter that patched
`Array.prototype.concat` steered the tuple rebuild into `['ok', []]`
for `[1, 2]` against `[number, number]`.

The rebuilds now walk the entry cons list the loop already builds —
plain literals, property reads only — and place members with
`Object.defineProperty` captured at module load, which consults nothing
patchable; `eachEntry` walks by index for the same reason, `for..of`
dispatching the patchable iterator. The intermediate array and the
pairwise `concat` join are gone with the dispatch. Pinned in
`host.proof.mjs` across all three container kinds.

The verdict path still dispatches overridable operations after a read —
recorded as `fjs/rtti/todo/hostile-accessor-hermetic-read-path.md`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

A getter on a later declared member can install an earlier, already
omitted declared key on `Object.prototype` (or an omitted position on
`Array.prototype`), and then every fresh container inherits it: the
member is present by the same HasProperty rule the readers dispatch on,
so no plain container the rebuild could hand back denotes the value that
was checked — `parse` returned `['ok', { b: 2 }]` whose payload fails
the very schema it was parsed against.

The declared-member kinds now check the omission's postcondition after
the rebuild: every declared key the entries omitted must still be absent
from what was built — `in` plus `Object.hasOwn` captured at module
load, both internal operations, so the check itself dispatches nothing
overridable — and refuse otherwise, per DESIGN.md §10. Pinned in
`host.proof.mjs` for the struct, tuple and rest kinds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

…n member

`Absent | unknown` *is* `unknown`: a union-carried marker drowns when
the annotation's present part renders as the top — `Ts<{}>` is native
`unknown`, `StructTs`'s intersection identity — so
`or(option, {})` behind a `Phantom` silently rendered its member
required while the readers accept `{}`, and the union-shaped `CheckRaw`
passed anyway, `_TsRaw` collapsing identically on both sides.

The annotation now spells absence as the new `AbsentOr<Present>` wrapper
— the same shape the runtime keeps, the data form's absent bit riding
beside the union rather than in it — which survives any present type.
`_AdmitsAbsence`, `_IsAbsentOnly`, `Ts` and `_TsRaw` read the
wrapper first, and `CheckRaw` pins the flag half separately against the
schema's structural answer, so the unwrapped spelling now fails the pin
even at the top instead of passing silently. An absent-only root is
`AbsentOr<never>`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp

The pollution refusal lived in `parse` alone, so the readers disagreed
on exactly that input class: a getter installing an omitted key on
`Object.prototype` was refused by `parse` while `validate` and the
data form handed back a value that no longer denotes what was checked —
and a value one reader accepts and another rejects is a bug in whichever
walk differs, by `host.proof.mjs`'s own table.

Every declared-member walk now records each member's presence and re-asks
it last (`presenceUnchanged` in the shared kernel), after everything
that reads the value, refusing on any flip in either direction — an
omitted key made present by pollution, or a checked own key deleted by a
later accessor. Pinned across all three readers, both directions, all
declared-member kinds.

The one deliberate residual split is a value with **no prototype**:
pollution cannot flip its own absence, so the hands-back readers return
it — still a faithful member of the set — while `parse`, whose every
plain container now inherits the omitted key, refuses per DESIGN.md §10.
Pinned as such. The changelog entry the hardening was missing is added.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8fxzY1KUThQy8GMWNoGWp