Thread ctx and extraErr through DeriveClient/DeriveClientRL/DeriveClientFn so derived clients have open Om rows without unsafeCoerce on the record. Arguments (path params, headers, body) are properly constrained. Om context and error rows are open — no # expand needed at call sites. Only the Om value inside impl is coerced (Record () ctx, closed open err), which is safe because clients never read context and Variant widening is a no-op at runtime. Add 5 compile-fail tests proving wrong args are rejected: - wrong field name, wrong field type, extra field, missing field, bogus sig