@abide/abide 0.110.4 → 0.111.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @abide/abide
 
+## 0.111.0
+
+### Minor Changes
+
+- f9b3789: ABIDE_OFFLINE — a built app keeps its pages and bundle in a service worker and installs as a web app, a call that reaches no server refuses 503 and a stale value goes on serving, and the socket mux redials when the browser comes back online ([`ee0428a`](https://github.com/briancray/abide/commit/ee0428a958fc70bf13eb10f2d8df2d7b8f3232df))
+
+### Patch Changes
+
+- f9b3789: a request is never reaped by the idle timeout while it is being answered, an idle connection is reaped after 10 seconds, and every event stream beats every 15 seconds ([`14eea6e`](https://github.com/briancray/abide/commit/14eea6e7ae0b72eb194c16e17ca4e7c4498baf46))
+- f9b3789: the client bundle is built in the NODE_ENV of its mode, not of the process that started the build ([`c94a975`](https://github.com/briancray/abide/commit/c94a975f38da935b0f62e52789cefe07d5e887ba))
+- 0838a38: fix: a `blob:` or `data:` URL passes the URL-attribute scheme check (RULEBOOK 32.20), so `<image href={objectUrl}>` or `<img src={dataUrl}>` shows its image instead of being written empty
+- 110aa66: a `ttl` of `Infinity`, or past the 2^31 - 1 ms `setTimeout` holds, no longer re-arms its timer every millisecond for the life of the value: `Infinity` arms none, and a longer `ttl` arms at the cap and re-arms from there
+
 ## 0.110.4
 
 ### Patch Changes

package/docs/REGISTRY.md

@@ -134,7 +134,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `s.invalidate` | `() => void` | Drop the cache behind the value. | 7.1, 7.2, 7.3, 7.6, 7.7, 7.9, 7.10, 7.12, 7.13, 7.14, 7.15, 7.16, 7.17, 11.51 |
+| `s.invalidate` | `() => void` | Drop the cache behind the value. | 7.1, 7.2, 7.3, 7.6, 7.7, 7.9, 7.10, 7.12, 7.13, 7.14, 7.15, 7.16, 7.17, 7.19, 11.51 |
 | `s.refresh` | `() => void` | Reload while continuing to serve what is held. | 4.12, 7.1, 7.4, 7.5, 7.6, 7.11, 7.18, 11.51, 5.24 |
 
 ### Effects
@@ -209,7 +209,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `Rpc` | `<Value, Args, Failures, Produced = Value>(args?: Args, options?: { signal?: AbortSignal }) => Reactive<Value, Value, Failures \| Failed<'HttpError', undefined>, Produced>` | A handler reached over http, or in process on a server. | 16.3, 16.4, 16.8, 16.11, 16.25, 16.26, 16.27, 16.28, 16.29, 16.33, 16.43, 16.48, 16.49, 16.62, 41.5, 41.7, 41.12, 41.21, 41.22, 41.25, 41.26, 41.27 |
+| `Rpc` | `<Value, Args, Failures, Produced = Value>(args?: Args, options?: { signal?: AbortSignal }) => Reactive<Value, Value, Failures \| Failed<'HttpError', undefined>, Produced>` | A handler reached over http, or in process on a server. | 16.3, 16.4, 16.8, 16.11, 16.25, 16.26, 16.27, 16.28, 16.29, 16.33, 16.43, 16.48, 16.49, 16.62, 41.5, 41.7, 41.12, 41.21, 41.22, 41.25, 41.26, 41.27, 16.79 |
 | `Value` | `unknown` | What the addressed `Reactive` holds. | 16.3, 16.30 |
 | `Produced` | `unknown` | What it yields, per the unit rule. | 1.2, 16.3 |
 | `Args` | `Record<string, JsonValue> \| undefined` | The arguments, in the body on a mutation and in the URL on a `GET` or `DELETE`. | 11.24, 16.18, 19.15 |
@@ -235,7 +235,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | --- | --- | --- | --- |
 | `description` | `string` | The human description carried onto every generated surface. | 16.28 |
 | `middleware` | `Middleware<{ request: Request; args: () => Args }, Value \| Failures>[]` | The rungs run per call. | 16.11, 16.12, 16.16, 16.17, 16.18, 16.19, 16.20 |
-| `timeout` | `number` | How long the call may stay open, and the floor under the request's idle timeout. | 16.22, 16.23, 16.56, 16.57, 16.58, 16.59, 16.60, 16.61, 16.77 |
+| `timeout` | `number` | How long the call may go without progress. | 16.22, 16.58, 16.59, 16.60, 16.61, 16.77 |
 | `clients` | `Clients` | Which surfaces carry this handler. | 16.37, 20.3 |
 | `crossOrigin` | `boolean \| string[]` | Whether other origins may call it, or follow it over the mux. | 16.24, 18.2, 21.19 |
 | `maxBodySize` | `number` | The largest request body a mutation will accept, in bytes. | 16.13, 16.54, 16.55 |
@@ -249,7 +249,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `json` | `<T>(value: T) => T` | A value as JSON, fixed, with `undefined` sent as `null`. | 17.7, 17.9, 17.10 |
 | `redirect` | `(to: string, status?: RedirectStatus) => undefined` | A navigation. | 16.52, 17.3 |
 | `jsonl` | `<T>(values: Values<T>) => Values<T>` | One JSON value per line, fixed. | 16.44, 16.75, 17.6, 17.7 |
-| `sse` | `<T>(values: Values<T>) => Values<T>` | The same machine framed as server-sent events, fixed. | 16.45, 16.75, 17.6, 17.7 |
+| `sse` | `<T>(values: Values<T>) => Values<T>` | The same machine framed as server-sent events, fixed. | 16.45, 16.57, 16.75, 17.6, 17.7 |
 | `bytes` | `(values: Values<Uint8Array>) => Values<Uint8Array>` | A stream of binary chunks, fixed. | 16.34, 16.75, 17.6, 17.7 |
 | `RedirectStatus` | `301 \| 302 \| 303 \| 307 \| 308` | The statuses a `redirect` may carry. | 17.3 |
 | `refuse` | `(status: number, message?: string) => Failed<'HttpError', undefined>` | An undeclared refusal at a status. | 15.5, 15.9, 15.10, 15.16, 15.19, 15.20, 16.40, 17.4, 17.5, 17.8 |
@@ -293,7 +293,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `access-control-allow-origin` | an rpc answer to another origin | The origin a handler admitted. | 21.19, 16.24 |
 | `allow: GET, HEAD` | a page, a public file or the bundle, asked by another method | The methods the address answers. | 15.17 |
 | `server-timing` | an rpc answer; `Middleware` and a `timing` span on any answer | The handler's duration, named `Direct`, `Seeded` from the render's run, `Cached` from a held `global` production, or `Started` to a stream's first chunk; the rungs' time; and each `timing` span. | 21.15, 21.20, 21.21, 24.6 |
-| `etag` | a `GET` answered from a `global` value | The version of the production answered. | 18.5, 18.6, 18.7, 18.9, 18.19, 18.20, 18.22, 18.23 |
+| `etag` | a `GET` answered from a `global` value | The version of the production answered. | 18.5, 18.6, 18.7, 18.9, 18.19, 18.20, 18.22, 18.23, 16.57 |
 
 # Generated surfaces
 
@@ -321,9 +321,9 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | --- | --- | --- | --- |
 | `assistant` | `(messages: AssistantMessage[], provider: Provider, options?: AssistantOptions) => AsyncGenerator<AssistantEvent>` | A conversation with a model, as the events it produces. | 44.1, 44.2, 44.3, 44.4, 44.21 |
 | `AssistantMessage` | `{ role: 'user' \| 'assistant'; content: string }` | One turn of the transcript a caller sends. | 44.3, 44.4 |
-| `AssistantEvent` | `{ type: 'text'; text: string } \| { type: 'tool'; id: string; name: string } \| { type: 'input'; id: string; input: unknown } \| { type: 'result'; id: string; text: string; failed: boolean } \| { type: 'done'; stop: string; usage: { input: number; output: number } }` | What a conversation produces: text, a tool call as it starts, its input once written, its result, and the end. | 44.2, 44.11, 44.29 |
+| `AssistantEvent` | `{ type: 'text'; text: string } \| { type: 'tool'; id: string; name: string } \| { type: 'input'; id: string; input: unknown } \| { type: 'result'; id: string; text: string; failed: boolean } \| { type: 'done'; stop: string; usage: { input: number; output: number } }` | What a conversation produces: text, a tool call as it starts, its input once written, its result, and the end. | 44.2, 44.11, 44.28 |
 | `AssistantOptions` | `{ mcp?: boolean; maxTurns?: number }` | What `assistant` takes beside a provider. | 44.6, 44.8, 44.11 |
-| `Provider` | `{ run(messages: AssistantMessage[], tools: Toolbox, limits: { maxTurns: number; signal: AbortSignal }): AsyncGenerator<AssistantEvent> }` | What runs a conversation. | 44.2, 44.29 |
+| `Provider` | `{ run(messages: AssistantMessage[], tools: Toolbox, limits: { maxTurns: number; signal: AbortSignal }): AsyncGenerator<AssistantEvent> }` | What runs a conversation. | 44.2, 44.28 |
 | `Toolbox` | `{ list: ToolDefinition[]; call(name: string, input: unknown): Promise<{ text: string; failed: boolean }> }` | The app's MCP tools, called as the asker. | 44.6, 44.7 |
 | `ToolDefinition` | `{ name: string; description: string; inputSchema: unknown; annotations: { readOnlyHint: boolean; destructiveHint: boolean; idempotentHint: boolean }; outputSchema: unknown }` | A tool as the app's MCP surface lists it. | 20.14, 20.16, 20.19, 44.6 |
 
@@ -338,12 +338,12 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | 44.5, 44.13, 44.17, 44.18, 44.19, 44.24, 44.25, 44.28, 44.31 |
-| `ClaudeCodeConfig` | `{ model?: string; fallbackModel?: string; systemPrompt?: string; appendSystemPrompt?: string; effort?: 'low' \| 'medium' \| 'high' \| 'xhigh' \| 'max'; maxBudgetUsd?: number; betas?: string[]; disallowedTools?: string[]; tools?: string[] }` | The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. | 44.16, 44.30 |
-| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.33 |
-| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | 44.20, 44.22, 44.33 |
+| `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | 44.5, 44.13, 44.17, 44.18, 44.19, 44.24, 44.25, 44.27, 44.30 |
+| `ClaudeCodeConfig` | `{ model?: string; fallbackModel?: string; systemPrompt?: string; appendSystemPrompt?: string; effort?: 'low' \| 'medium' \| 'high' \| 'xhigh' \| 'max'; maxBudgetUsd?: number; betas?: string[]; disallowedTools?: string[]; tools?: string[] }` | The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. | 44.16, 44.29 |
+| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; expires: number }` | The command that pairs a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.32 |
+| `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | 44.20, 44.22, 44.32 |
 | `BridgeStatus` | `{ paired: boolean; command: string \| undefined }` | Whether a bridge is paired, and the command that pairs one where none is. | 44.20 |
-| `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | 36.7, 44.14, 44.15, 44.19, 44.23, 44.26, 44.27, 16.78 |
+| `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | 36.7, 44.14, 44.15, 44.19, 44.23, 44.26, 16.57, 16.78 |
 
 # Ambient values
 
@@ -379,7 +379,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `online` | `Reactive<boolean>` | Whether the caller can reach the app. | 23.7, 23.8 |
+| `online` | `Reactive<boolean>` | Whether the caller can reach the app. | 23.7, 23.8, 18.33, 18.34 |
 
 ## `reachable`
 
@@ -465,13 +465,13 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `abide:principal` | `debug` `warning` | A principal set or cleared. | 28.8 |
 | `abide:health` | `warning` | An `onHealth` that threw or answered a non-object. | 25.2, 28.8 |
 | `abide:mcp` | `debug` `warning` | A handler withheld from MCP, a tool call answered, or a tool published with no description. | 20.3, 20.9, 20.18, 28.8 |
-| `abide:assistant` | `debug` | One line per conversation, once it ends. | 44.32 |
+| `abide:assistant` | `debug` | One line per conversation, once it ends. | 44.31 |
 | `abide:openapi` | `warning` | A handler whose schema had no JSON Schema export. | 20.11, 28.8 |
 | `abide:render` | `warning` | An `error.abide` that itself failed. | 28.8 |
 | `abide:refuse` | `warning` | A message formatter that threw. | 15.13, 28.8 |
 | `abide:reactive` | `warning` | A failed revalidation over a value still being served. | 4.12, 28.8 |
 | `abide:watch` | `warning` | A `watch` effect or `Disposer` that threw. | 12.6, 28.8 |
-| `abide:hydrate` / `abide:navigate` | `warning` | The browser lane. | 28.8, 41.10, 41.15, 41.24 |
+| `abide:hydrate` / `abide:navigate` | `warning` | The browser lane. | 28.8, 41.10, 41.15, 41.24, 45.10 |
 
 ## `csp`
 
@@ -500,7 +500,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `navigate` | `(url?: URL \| string, options?: { replace?: boolean, keepScroll?: boolean }) => Promise<void>` | Navigates. | 30.7, 30.9, 30.10, 30.11, 30.12, 30.13, 30.14, 30.15, 30.16, 30.17, 30.18, 30.20, 30.21, 30.22, 30.23, 30.24, 30.25, 30.27, 30.29, 30.30, 30.31 |
+| `navigate` | `(url?: URL \| string, options?: { replace?: boolean, keepScroll?: boolean }) => Promise<void>` | Navigates. | 30.7, 30.9, 30.10, 30.11, 30.12, 30.13, 30.14, 30.15, 30.16, 30.17, 30.18, 30.20, 30.21, 30.22, 30.23, 30.24, 30.25, 30.27, 30.29, 30.30, 30.31, 30.32, 45.12 |
 
 # `.abide` files
 
@@ -606,7 +606,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `Component` | `interface Component {}` | A component bound to its props. | 32.17, 34.16, 35.4 |
-| `render` | `(component: Component) => Promise<Uint8Array>` | What produces a document. | 29.10, 35.4, 35.5, 35.6, 35.15, 35.16, 41.1, 41.2, 41.3, 41.4, 41.9, 41.13, 41.16, 41.17, 41.18, 41.19, 41.20, 41.28, 35.11 |
+| `render` | `(component: Component) => Promise<Uint8Array>` | What produces a document. | 29.10, 35.4, 35.5, 35.6, 35.15, 35.16, 41.1, 41.2, 41.3, 41.4, 41.9, 41.13, 41.16, 41.17, 41.18, 41.19, 41.20, 41.28, 35.11, 41.29 |
 
 ## Sinks
 
@@ -633,10 +633,11 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `ABIDE_PRINCIPAL_TTL` | `number` | The principal cookie's life, in ms. | 26.15, 26.16 |
 | `ABIDE_APP_TOKEN` | `string \| null` | The bearer the remote CLI sends. | 36.6 |
 | `ABIDE_APP_URL` | `string \| null` | Names an app somewhere else, for the remote CLI. | 36.6 |
-| `ABIDE_RPC_TIMEOUT` | `number` | The default ms a call may go without progress. | 16.22, 16.56, 16.58 |
+| `ABIDE_RPC_TIMEOUT` | `number` | The default ms a call may go without progress. | 16.22, 16.58 |
 | `ABIDE_MAX_REQUEST_BODY_SIZE` | `number` | The default ceiling on a mutation's body. | 16.13, 16.54, 16.55, 16.78 |
 | `ABIDE_MAX_SOCKET_MESSAGE_SIZE` | `number` | The ceiling on a frame received over the socket mux, in bytes. | 18.28 |
 | `ABIDE_MAX_SOCKET_SUBSCRIPTIONS` | `number` | How many values one connection to the socket mux may follow. | 18.31, 18.32 |
+| `ABIDE_OFFLINE` | `boolean` | Whether the app keeps its pages and its bundle on the device, for when the network is gone. | 45.1, 45.2, 45.3, 45.4, 45.5, 45.6, 45.7, 45.8, 45.9, 45.10, 45.11, 45.12, 45.13, 45.14, 45.15, 45.16 |
 | `ABIDE_STOP_TIMEOUT` | `number` | How long `App.stop` drains, in ms. | 42.17, 42.18 |
 | `ABIDE_MAX_STREAM_BUFFER_SIZE` | `number` | The cap on a stream transcript held in memory. | 36.18 |
 | `ABIDE_MAX_LOG_BUFFER_COUNT` | `number` | How many lines `log.records` is trimmed back to. | 28.1 |
@@ -657,7 +658,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `**/public/**` | The files answered as authored, at their path below that directory. | 23.15, 23.16, 23.18, 36.11, 36.12, 36.13, 36.14, 36.15, 36.17, 21.12, 21.13, 21.14, 38.18, 38.19 |
 | `src/public/favicon.ico` | The file answered at `/favicon.ico`. | 36.11 |
 | `src/public/robots.txt` | The file answered at `/robots.txt`. | 36.11 |
-| `src/public/icon.png` · `src/public/icon.icns` | The files answered at `/icon.png` and `/icon.icns`, and the desktop app's icon. | 36.11, 38.79 |
+| `src/public/icon.png` · `src/public/icon.icns` | The files answered at `/icon.png` and `/icon.icns`, and the desktop app's icon. | 36.11, 38.79, 45.15 |
 | `src/**/` | A directory of the app's, a segment of the route of every file directly in it. | 23.14, 23.17, 23.22 |
 | `**/index.abide` | The page at its directory's route. | 19.1, 23.3, 23.4, 23.14, 23.18 |
 | `**/<name>.abide` | The page at its directory's route and then `<name>`. | 19.1, 23.3, 23.4, 23.14, 23.21 |
@@ -706,7 +707,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `App` | `interface App` | What a host, a test or a script holds the app as. | 42.12, 42.13 |
 | `App.fetch` | `(request: Request) => Promise<Response>` | The whole request path, entered in process. | 42.5, 42.6 |
 | `App.run` | `<Result>(fn: () => Result \| Promise<Result>, options?: { request?: Request }) => Promise<Result>` | One scope around a function, and nothing else. | 42.7, 42.8, 11.38 |
-| `App.listen` | `(options?: { port?: number; hostname?: string; unix?: string }) => Promise<void>` | The socket, bound. | 42.9, 18.28, 18.29, 18.30 |
+| `App.listen` | `(options?: { port?: number; hostname?: string; unix?: string }) => Promise<void>` | The socket, bound. | 42.9, 16.23, 16.56, 18.28, 18.29, 18.30 |
 | `App.stop` | `() => Promise<void>` | The drain and the teardown. | 42.10, 42.11, 42.15, 42.17, 37.4 |
 | `App[Symbol.asyncDispose]` | `() => Promise<void>` | `App.stop`, under the name `await using` calls. | 42.14 |
 
@@ -829,7 +830,7 @@ rows a runner prints, and an adapter for an abide app.
 | `abide run <file> [args…]` | Runs a script under the abide runtime. | 38.2, 38.57 |
 | `abide check [dir…]` | The type-checker over a `.abide` tree. | 38.3, 38.31, 38.32, 38.33, 38.40, 38.105 |
 | `abide routes [--json]` | Every address the app answers, the file answering it, and where each hook is filed. | 38.108 |
-| `abide dev [--port <n>]` | Watches the project and keeps the app up. | 37.8, 37.9, 38.4, 38.14, 38.15, 38.16, 38.17, 38.19, 38.24, 38.25, 38.26, 38.28, 38.30, 38.35, 38.36, 38.37, 38.38, 38.41, 38.43, 38.58, 38.63, 38.64, 38.65, 38.94, 38.96, 38.97 |
+| `abide dev [--port <n>]` | Watches the project and keeps the app up. | 16.23, 16.56, 37.8, 37.9, 38.4, 38.14, 38.15, 38.16, 38.17, 38.19, 38.24, 38.25, 38.26, 38.28, 38.30, 38.35, 38.36, 38.37, 38.38, 38.41, 38.43, 38.58, 38.63, 38.64, 38.65, 38.94, 38.96, 38.97 |
 | `abide build` | Builds the client into content-hashed chunks and a manifest. | 38.43, 38.5, 38.18, 38.25, 38.26, 38.27, 38.30, 38.66, 38.94 |
 | `abide start [--port <n>]` | Boots the built app. | 37.8, 37.10, 37.11, 37.12, 38.6, 38.100, 38.20, 38.21, 38.22, 38.23, 38.25, 38.26, 38.27, 38.28, 38.29, 38.58, 38.67, 38.68, 38.95, 38.97, 38.110 |
 | `abide [--url <origin>] [--port <n>]` | The interactive shell — on the built app it boots, or on the running app `--url` names. | 37.8, 37.10, 37.11, 37.12, 38.6, 38.7, 38.53, 38.54, 38.55, 38.58, 38.59, 38.60, 38.62 |

package/docs/RULEBOOK.md

@@ -83,6 +83,7 @@ These are immutable. A change to them is a change to what this document is.
 - [42. The app object](#42)
 - [43. The measurement harness](#43)
 - [44. The assistant](#44)
+- [45. Offline](#45)
 
 ## Terms
 
@@ -307,8 +308,8 @@ window held MUST start one reload when the window closes.
 
 6.2 `ttl` on a value with no producer MUST be inert.
 
-6.3 An implementation MUST hold one expiry timer per value declaring `ttl`, armed at the deadline of
-the production it serves.
+6.3 An implementation MUST hold at most one expiry timer per value declaring `ttl`, armed no later
+than the deadline of the production it serves, and none where that deadline is never reached.
 
 6.4 A `ttl` expiry timer MUST NOT hold the process open.
 
@@ -366,6 +367,9 @@ producer.
 
 7.18 `s.refresh` on a wired `Reactive` MUST refresh every subscriber's copy.
 
+7.19 A load over a value `s.invalidate` marked that is refused with `HttpError` at 503 MUST leave the
+value it held being served.
+
 # 8. Stores
 
 8.1 A `Store` MUST provide both `get` and `set`.
@@ -897,9 +901,10 @@ declared.
 
 16.21 A throw from a `Middleware` rung MUST escape the whole onion rather than unwind through it.
 
-16.22 `timeout` MUST raise the request's idle timeout, and MUST only raise it.
+16.22 `timeout` and `ABIDE_RPC_TIMEOUT` MUST default to no bound.
 
-16.23 A request's `timeout` floor MUST be the maximum over every handler that ran in it.
+16.23 A request MUST NOT be ended by the idle timeout of the server `App.listen` or `abide dev` binds
+from when it has been received whole until its answer, a stream's last chunk included, has been sent.
 
 16.24 `crossOrigin` MUST default to false, and where it is declared abide MUST answer the `OPTIONS`
 preflight itself. An `OPTIONS` naming no `access-control-request-method` is no preflight, and MUST be
@@ -997,10 +1002,11 @@ MUST refuse with `aborted` at status 499, and MUST abort the request carrying it
 16.55 A mutation's body over the ceiling `maxBodySize` or `ABIDE_MAX_REQUEST_BODY_SIZE` sets MUST
 be refused 413, whether its length was declared or streamed.
 
-16.56 Where neither `timeout` nor `ABIDE_RPC_TIMEOUT` is set, a call MUST NOT raise the request's
-idle timeout.
+16.56 A connection to the server `App.listen` or `abide dev` binds MUST be ended once it goes 10
+seconds without a byte while no request over it is being answered.
 
-16.57 A `timeout` of `Infinity` MUST leave the request's idle timeout off.
+16.57 An answer typed `text/event-stream` MUST carry a comment every 15 seconds for as long as it is
+open.
 
 16.58 Where a handler names no `timeout`, `ABIDE_RPC_TIMEOUT` MUST be its `timeout`.
 
@@ -1069,6 +1075,9 @@ call MUST wait on that window as 5.15 has it.
 16.78 A body `/__abide/mcp` or `/__abide/bridge` reads over the ceiling `ABIDE_MAX_REQUEST_BODY_SIZE`
 sets MUST be refused 413, whether its length was declared or streamed.
 
+16.79 An `Rpc` call in a browser that gets no answer, and whose `signal` has not aborted, MUST refuse
+with `HttpError` at 503.
+
 # 17. Response helpers
 
 17.1 Every body helper MUST take `Values<T>`.
@@ -1191,6 +1200,11 @@ unsent, and MUST NOT be sent the frames after it.
 18.32 A subscription to a `GET` naming an id its connection already follows MUST replace that one, and
 MUST NOT count toward 18.31's bound.
 
+18.33 A browser's connection to the socket mux that closed while a `GET` is followed MUST be opened
+again at once where `online` becomes true or the page becomes visible.
+
+18.34 A browser's connection to the socket mux MUST NOT be opened again while `online` is false.
+
 # 19. Mount paths and schemas
 
 19.1 A route MUST be answered for each method by one file at most, a page answering `GET` and `HEAD`
@@ -1715,7 +1729,7 @@ fragment it carries names.
 and no public file of the app is served at.
 
 30.27 A `navigate` whose request fails, or whose route's chunks fail to load, MUST leave the address
-to the document.
+to the document, save where 30.32 holds.
 
 30.28 A `Query` record and the args an `Rpc` carries in its URL MUST be written in one spelling: a
 member left `undefined` omitted, a list its member repeated, an empty list its name with no `=`, and
@@ -1730,6 +1744,9 @@ the document, MUST land at that scroll.
 30.31 A `navigate` that a later `navigate` overtakes before it mounts MUST abort the request it made
 to `middleware`.
 
+30.32 A `navigate` that is not a history step, whose request gets no answer while `online` is false,
+MUST leave the page and the address where they stand, save where 45.12 holds.
+
 # 31. Reading and writing by name
 
 31.1 Inside a `.abide` file a name bound to a `Reactive` MUST be read wherever 31.3 does not hold it.
@@ -1826,7 +1843,7 @@ body.
 MUST NOT be built as a string.
 
 32.20 An interpolation in a URL-typed attribute MUST be scheme-checked, and a scheme outside
-`http:`, `https:`, `mailto:`, `tel:` or a relative reference MUST be dropped and warned on
+`http:`, `https:`, `mailto:`, `tel:`, `blob:`, `data:` or a relative reference MUST be dropped and warned on
 `abide:render`, naming the attribute and not the value.
 
 32.21 A control block MUST bind each reactive read and probe call in its subject once for the body.
@@ -2912,6 +2929,8 @@ adopts the page, however early its answer arrived.
 41.28 A `render` MUST let the turn's queued microtasks run between setting up a `<Name/>` whose setup
 made an `Rpc` call and building that component's markup.
 
+41.29 A `render` answering a request whose `sec-fetch-dest` is `empty` MUST NOT fill the seed buffer.
+
 # 42. The app object
 
 42.1 `createApp` MUST build the route table and compose every `Middleware` rung, per 16.14.
@@ -3091,7 +3110,7 @@ it, once, and MUST NOT pair once it has expired.
 removed when the run ends, and with no built-in tool and no setting source the visitor did not pass
 it after `--`.
 
-44.16 A bridge MUST lay each option a site sets but `tools` (44.30) on as Claude Code's flag of that
+44.16 A bridge MUST lay each option a site sets but `tools` (44.29) on as Claude Code's flag of that
 name, MUST fail a turn whose config sets any option `ClaudeCodeConfig` does not name, and MUST lay
 an option the visitor passed after `--` over the site's.
 
@@ -3123,25 +3142,72 @@ token, each wait twice the last, until it is refused or 60 seconds have passed.
 44.26 `/__abide/bridge` MUST hold a pairing whose stream dropped for 60 seconds, and a `GET` bearing
 its token within them MUST resume the stream with every frame the dropped one had not sent.
 
-44.27 `/__abide/bridge` MUST send a comment on a pairing's stream every 15 seconds for as long as
-the stream is open.
-
-44.28 A bridge whose stream from `/__abide/bridge` carries no line for 45 seconds MUST end it and
+44.27 A bridge whose stream from `/__abide/bridge` carries no line for 45 seconds MUST end it and
 redial it as 44.25 says.
 
-44.29 A `Provider` MUST yield a tool call's `tool` event when the model starts writing the call,
+44.28 A `Provider` MUST yield a tool call's `tool` event when the model starts writing the call,
 and its `input` event, with the same `id`, once the call is written.
 
-44.30 A built-in tool MUST be available to a turn only where the site's `tools` names it and the
+44.29 A built-in tool MUST be available to a turn only where the site's `tools` names it and the
 visitor's `--tools` does, MUST be approved without asking unless the visitor passed `--allowedTools`,
 and the bridge MUST say once each tool the site asked for that the visitor did not grant.
 
-44.31 A bridge stopped by `SIGTERM`, `SIGINT` or `SIGHUP` MUST end every Claude Code run it started
+44.30 A bridge stopped by `SIGTERM`, `SIGINT` or `SIGHUP` MUST end every Claude Code run it started
 before it exits.
 
-44.32 A conversation MUST write one `debug` line on `abide:assistant` when its events end, naming
+44.31 A conversation MUST write one `debug` line on `abide:assistant` when its events end, naming
 its stop reason, the transcript's length, the tool calls it made, its usage and how long it took,
 and naming it `unfinished` where it ended without a `done`.
 
-44.33 A command `claudeCode.bridgeCommand` or `claudeCode.bridge` mints with `tools` MUST grant
+44.32 A command `claudeCode.bridgeCommand` or `claudeCode.bridge` mints with `tools` MUST grant
 those built-in tools after its `--` as `--tools`, and one minted without `tools` MUST carry no `--`.
+
+# 45. Offline
+
+45.1 Where `ABIDE_OFFLINE` is on, a page `abide build` built MUST register the worker
+`ABIDE_OFFLINE` turns on, and a page `abide dev` serves MUST NOT.
+
+45.2 The worker `ABIDE_OFFLINE` turns on MUST be served below `/__abide`, and MUST be allowed the
+scope of the app's mount.
+
+45.3 The worker `ABIDE_OFFLINE` turns on MUST answer a page, and every other `GET` of the app's own
+origin, with the network's answer, and with the copy it saved of that address where the network
+gives none.
+
+45.4 The worker `ABIDE_OFFLINE` turns on MUST save only an answer of 200 that is neither a stream
+16.32 frames nor a binary 16.34 types.
+
+45.5 The worker `ABIDE_OFFLINE` turns on MUST save every file of the build's bundle as it installs.
+
+45.6 The worker `ABIDE_OFFLINE` turns on MUST answer a file of the build's bundle from what it
+saved.
+
+45.7 The worker `ABIDE_OFFLINE` turns on MUST drop everything it saved where an answer it is handed
+carries `abide-principal`, where `principal` changes in any tab, and where a form is submitted.
+
+45.8 The worker `ABIDE_OFFLINE` turns on, of a new build, MUST drop everything the one before it
+saved, and every file of the bundle the new build does not name.
+
+45.9 The address of the worker `ABIDE_OFFLINE` turns on MUST answer a worker that drops what was
+saved and unregisters itself, under `abide dev` and where `ABIDE_OFFLINE` is off.
+
+45.10 The worker `ABIDE_OFFLINE` turns on that fails to register MUST warn on `abide:hydrate`.
+
+45.11 The worker `ABIDE_OFFLINE` turns on MUST answer a page the network gives no answer for, and
+that it saved no copy of, 503 with a page saying so.
+
+45.12 A `navigate` 30.32 would leave standing MUST be left to the document where the worker
+`ABIDE_OFFLINE` turns on saved its address's page.
+
+45.13 The worker `ABIDE_OFFLINE` turns on MUST save, as it activates, the page of every window it
+then controls.
+
+45.14 `ABIDE_OFFLINE` MUST be off where `config` holds it as `false`, or as text reading `false` or
+`0` in any case, and on otherwise.
+
+45.15 Where `ABIDE_OFFLINE` is on and the app's public `/icon.png` is a PNG, every page MUST link a
+web app manifest naming the app, with the app's mount as its scope and its start, and that icon at
+the size it is drawn at.
+
+45.16 The worker `ABIDE_OFFLINE` turns on MUST leave to the network the request 30.15 makes, a
+request carrying `range`, and one accepting `text/event-stream`.