@abide/abide 0.114.0 → 0.115.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @abide/abide
 
+## 0.115.0
+
+### Minor Changes
+
+- bdecaf9: offline-first calls — a kept copy stands in for the network, `synced` says whether what is held is what the producer made, a call's `offline` settles it where no answer came, and `outbox` holds the calls a browser queued until they deliver ([`28322d1`](https://github.com/briancray/abide/commit/28322d10f53305c5a3dd17823a9541f877e131eb))
+
+## 0.114.1
+
+### Patch Changes
+
+- ea48b1b: a server stack frame names the .abide column it was thrown at — bun 1.4.4 counts a call site's column from 1 ([`81bcd9b`](https://github.com/briancray/abide/commit/81bcd9b5dab56c14c6b9262361d0dfdb068fb3f5))
+
 ## 0.114.0
 
 ### Minor Changes

package/docs/REGISTRY.md

@@ -128,6 +128,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `s.busy` | `() => boolean` | Work is in flight for this value. | 3.1, 3.2, 3.3, 3.4, 3.7, 3.9, 5.15, 7.5, 7.8, 11.19, 11.20, 11.21, 11.22, 11.50 |
 | `s.ready` | `() => boolean` | There is a value to serve. | 3.1, 3.2, 3.3, 3.5, 3.6, 3.8, 7.8, 11.20, 11.54, 11.58 |
 | `s.error` | `() => Failures \| undefined` | The standing refusal. | 3.1, 3.2, 3.3, 3.5, 4.10, 4.11, 4.12 |
+| `s.synced` | `() => boolean` | What is held is what the producer made. | 3.1, 3.2, 3.3, 3.10, 3.11, 3.12, 3.13 |
 | `s.isError` | `<Name extends Failures['name']>(error: unknown, name: Name) => error is Extract<Failures, { name: Name }>` | Whether a caught failure is the one named. | 3.1 |
 
 ### Triggers
@@ -149,6 +150,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | --- | --- | --- | --- |
 | `k.busy` | `(pattern?: Partial<Args>) => boolean` | `busy` narrowed to matching entries. | 13.2, 13.3, 13.12 |
 | `k.ready` | `(pattern?: Partial<Args>) => boolean` | `ready` narrowed to matching entries. | 13.11, 13.12 |
+| `k.synced` | `(pattern?: Partial<Args>) => boolean` | `synced` narrowed to matching entries. | 13.12, 13.18 |
 | `k.invalidate` | `(pattern?: Partial<Args>) => void` | `invalidate` narrowed to matching entries. | 7.2, 7.3, 13.4, 13.12 |
 | `k.refresh` | `(pattern?: Partial<Args>) => void` | `refresh` narrowed to matching entries. | 7.4, 7.5, 13.4, 13.12 |
 
@@ -167,8 +169,9 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `Selection` | `Reactive<any, any, any, any> \| Keyed<any, any, any, any> \| Rpc<any, any, any, any> \| { tags: string[] }` | What is being asked about. | 13.1, 13.8, 13.9, 13.13, 31.14 |
-| `busy` | `(selection?: Selection, pattern?: Partial<Args>) => boolean` | Whether any entry in the selection has work in flight. | 13.2, 13.3, 13.5, 13.12 |
+| `busy` | `(selection?: Selection, pattern?: Partial<Args>) => boolean` | Whether any entry in the selection has work in flight. | 13.2, 13.3, 13.5, 13.12, 46.11 |
 | `ready` | `(selection?: Selection, pattern?: Partial<Args>) => boolean` | Whether every entry in the selection has a value to serve. | 13.3, 13.5, 13.11, 13.12 |
+| `synced` | `(selection?: Selection, pattern?: Partial<Args>) => boolean` | Whether every entry in the selection holds what its producer made. | 13.12, 13.18 |
 | `refresh` | `(selection?: Selection, pattern?: Partial<Args>) => void` | Stale-while-revalidate over the selection. | 13.4, 13.7, 13.10, 13.12, 13.14, 13.15, 13.16, 13.17 |
 | `invalidate` | `(selection?: Selection, pattern?: Partial<Args>) => void` | Marks the selection stale. | 13.4, 13.6, 13.10, 13.12, 13.15, 13.17 |
 
@@ -209,7 +212,8 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `Rpc` | `<Value, Args, Failures, Produced = Value>(args?: Args, options?: { signal?: AbortSignal }) => Reactive<Value, Value, Failures \| Failed<'HttpError', undefined>, Produced>` | A handler reached over http, or in process on a server. | 16.3, 16.4, 16.8, 16.11, 16.25, 16.26, 16.27, 16.28, 16.29, 16.33, 16.43, 16.48, 16.49, 16.62, 41.5, 41.7, 41.12, 41.21, 41.22, 41.25, 41.26, 41.27, 16.79 |
+| `Rpc` | `<Value, Args, Failures, Produced = Value>(args?: Args, options?: { signal?: AbortSignal; offline?: (args: Args) => Value }) => Reactive<Value, Value, Failures \| Failed<'HttpError', undefined>, Produced>` | A handler reached over http, or in process on a server. | 16.3, 16.4, 16.8, 16.11, 16.25, 16.26, 16.27, 16.28, 16.29, 16.33, 16.43, 16.48, 16.49, 16.62, 41.5, 41.7, 41.12, 41.21, 41.22, 41.25, 41.26, 41.27, 16.79, 16.80, 16.85 |
+| `offline` | `(args: Args) => Value` | What a call settles to where a browser could not get its answer. | 16.81, 16.82, 16.83, 16.84 |
 | `Value` | `unknown` | What the addressed `Reactive` holds. | 16.3, 16.30 |
 | `Produced` | `unknown` | What it yields, per the unit rule. | 1.2, 16.3 |
 | `Args` | `Record<string, JsonValue> \| undefined` | The arguments, in the body on a mutation and in the URL on a `GET` or `DELETE`. | 11.24, 16.18, 19.15 |
@@ -218,8 +222,9 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `GET` | `<Value, Args, Failures, RungFailures, Produced = Value>(handler: (args?: Args) => Value, options?: RpcOptions<Args, RungFailures> & ReactiveOptions<Value, Value, Failures, Args>) => Rpc<Value, Args, Failures \| RungFailures, Produced>` | The plain-function overload, whose options build the value it becomes beside its address. | 16.1, 16.6, 16.7 |
 | `GET` | `<Value, Failures, RungFailures>(handler: Value \| PromiseLike<Value>, options?: RpcOptions<undefined, RungFailures> & ReactiveOptions<Value, Value, Failures>) => Rpc<Value, undefined, Failures \| RungFailures>` | The value overload, for what the handler owns outright. | 16.1, 16.6, 16.7 |
 | `POST` / `PUT` / `PATCH` / `DELETE` | same as `GET` | Declares a mutation. | 16.2, 16.7, 16.32, 16.68, 16.76, 16.38, 16.53 |
-| `rpc.busy` | `(pattern?: Partial<Args>) => boolean` | `busy` narrowed to the handler's matching entries. | 13.2, 13.3, 13.12 |
+| `rpc.busy` | `(pattern?: Partial<Args>) => boolean` | `busy` narrowed to the handler's matching entries. | 13.2, 13.3, 13.12, 46.11 |
 | `rpc.ready` | `(pattern?: Partial<Args>) => boolean` | `ready` narrowed to the handler's matching entries. | 13.11, 13.12 |
+| `rpc.synced` | `(pattern?: Partial<Args>) => boolean` | `synced` narrowed to the handler's matching entries. | 13.12, 13.18 |
 | `rpc.invalidate` | `(pattern?: Partial<Args>) => void` | `invalidate` narrowed to the handler's matching entries. | 7.2, 7.3, 13.4, 13.12 |
 | `rpc.refresh` | `(pattern?: Partial<Args>) => void` | `refresh` narrowed to the handler's matching entries. | 7.4, 7.5, 13.4, 13.12 |
 | `rpc.isError` | `<Name extends Failures['name']>(error: unknown, name: Name) => error is Extract<Failures, { name: Name }>` | Whether a caught failure is the one named. | 16.8 |
@@ -286,6 +291,9 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `cache-control: no-store` | `/__abide/openapi.json`, `/__abide/mcp` | Refuses caching for an answer about the app's surfaces. | 21.4 |
 | `cache-control: public, max-age=31536000, immutable` | the built bundle | A chunk addressed by its own content hash. | 21.5 |
 | `cache-control: public, max-age=0, must-revalidate` | a file under a `public` directory | A file at an address the build never chose. | 21.12 |
+| `cache-control: private, stale-while-revalidate=604800, stale-if-error=604800` | a page, a `GET`'s answer, where `ABIDE_OFFLINE` registers its worker | The default that lets a copy kept on the device stand in for the network. | 21.22, 21.11, 21.17 |
+| `cache-control: public, max-age=0, stale-while-revalidate=604800, stale-if-error=604800` | a file under a `public` directory, where `ABIDE_OFFLINE` registers its worker | The same, for a file at an address the build never chose. | 21.23 |
+| `clear-site-data: "cache"` | an answer carrying `abide-principal`, where pages are kept offline | Drops what the browser's own cache kept for the caller signed in before. | 21.24 |
 | `etag` | a file under a `public` directory | The answered bytes, addressed by their content. | 21.13, 21.14 |
 | `referrer-policy: strict-origin-when-cross-origin` | a page | The browsers' own default, written down. | 21.6 |
 | `vary` | wherever an answer depends on a request header | Names the header the answer varied on. | 21.7 |
@@ -381,6 +389,17 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | --- | --- | --- | --- |
 | `online` | `Reactive<boolean>` | Whether the caller can reach the app. | 23.7, 23.8, 18.33, 18.34 |
 
+## `outbox`
+
+| Name | Signature | Meaning | Rules |
+| --- | --- | --- | --- |
+| `outbox` | `<Chosen extends Selection>(selection?: Chosen, pattern?: Partial<Args>) => QueuedCall[]` | The calls a browser has queued and not delivered, the refused ones included. | 46.1, 46.2, 46.3, 46.4, 46.5, 46.6, 46.7, 46.8, 46.9, 46.10, 46.14, 46.15, 46.16, 46.17, 46.20, 18.35 |
+| `rpc.outbox` | `(pattern?: Partial<Args>) => QueuedCall[]` | `outbox` narrowed to the handler's calls. | 46.1, 13.12 |
+| `QueuedCall` | `{ id: string; method: 'GET' \| 'POST' \| 'PUT' \| 'PATCH' \| 'DELETE'; url: string; args: Record<string, JsonValue> \| undefined; queuedAt: number; attempts: number; value: Reactive<Value, Value, Failed<string, unknown>>; retry: () => void; discard: () => void }` | One call `outbox` holds. | 46.1, 46.10 |
+| `call.value` | `Reactive<Value, Value, Failed<string, unknown>>` | The value a queued call settled. | 46.5, 46.7, 46.18, 46.19 |
+| `call.retry` | `() => void` | Sends a queued call again. | 46.6, 46.12 |
+| `call.discard` | `() => void` | Drops a queued call. | 46.13 |
+
 ## `reachable`
 
 | Name | Signature | Meaning | Rules |
@@ -606,7 +625,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `Component` | `interface Component {}` | A component bound to its props. | 32.17, 34.16, 35.4 |
-| `render` | `(component: Component) => Promise<Uint8Array>` | What produces a document. | 29.10, 35.4, 35.5, 35.6, 35.15, 35.16, 41.1, 41.2, 41.3, 41.4, 41.9, 41.13, 41.16, 41.17, 41.18, 41.19, 41.20, 41.28, 35.11, 41.29 |
+| `render` | `(component: Component) => Promise<Uint8Array>` | What produces a document. | 29.10, 35.4, 35.5, 35.6, 35.15, 35.16, 41.1, 41.2, 41.3, 41.4, 41.9, 41.13, 41.16, 41.17, 41.18, 41.19, 41.20, 41.28, 35.11, 41.29, 41.30 |
 
 ## Sinks
 
@@ -637,7 +656,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `ABIDE_MAX_REQUEST_BODY_SIZE` | `number` | The default ceiling on a mutation's body. | 16.13, 16.54, 16.55, 16.78 |
 | `ABIDE_MAX_SOCKET_MESSAGE_SIZE` | `number` | The ceiling on a frame received over the socket mux, in bytes. | 18.28 |
 | `ABIDE_MAX_SOCKET_SUBSCRIPTIONS` | `number` | How many values one connection to the socket mux may follow. | 18.31, 18.32 |
-| `ABIDE_OFFLINE` | `boolean` | Whether the app keeps its pages and its bundle on the device, for when the network is gone. | 45.1, 45.2, 45.3, 45.4, 45.5, 45.6, 45.7, 45.8, 45.9, 45.10, 45.11, 45.12, 45.13, 45.14, 45.15, 45.16 |
+| `ABIDE_OFFLINE` | `boolean` | Whether the app keeps its pages and its bundle on the device, for when the network is gone. | 45.1, 45.2, 45.3, 45.4, 45.5, 45.6, 45.7, 45.8, 45.9, 45.10, 45.11, 45.12, 45.13, 45.14, 45.15, 45.16, 45.17, 45.18, 45.19, 45.20, 45.21, 45.22, 45.23 |
 | `ABIDE_STOP_TIMEOUT` | `number` | How long `App.stop` drains, in ms. | 42.17, 42.18 |
 | `ABIDE_MAX_STREAM_BUFFER_SIZE` | `number` | The cap on a stream transcript held in memory. | 36.18 |
 | `ABIDE_MAX_LOG_BUFFER_COUNT` | `number` | How many lines `log.records` is trimmed back to. | 28.1 |

package/docs/RULEBOOK.md

@@ -84,6 +84,7 @@ These are immutable. A change to them is a change to what this document is.
 - [43. The measurement harness](#43)
 - [44. The assistant](#44)
 - [45. Offline](#45)
+- [46. Outbox](#46)
 
 ## Terms
 
@@ -202,6 +203,14 @@ subscribe it to the value.
 
 3.9 A value with no producer MUST report `s.busy` false.
 
+3.10 A `set` or a `patch` on a value with a body that moves what it holds MUST make `s.synced` false.
+
+3.11 A production the value's body, or the server a copy follows, makes MUST make `s.synced` true.
+
+3.12 A value with no body MUST report `s.synced` true.
+
+3.13 A value MUST report `s.synced` false where a value it read or adopts does.
+
 # 4. Writes and gates
 
 4.1 `s.set` MUST accept a settled value or a load, and `reactive` MUST accept the same two.
@@ -739,6 +748,9 @@ every value a mutation's `declare` built.
 13.17 A bare `invalidate` or `refresh`, or one over a set of `tags`, MUST NOT invalidate a value a
 mutation's `declare` built while its write is in flight.
 
+13.18 `synced` over a selection MUST be true where every entry in it is synced, and a bare `synced`
+where every value it sweeps is.
+
 # 14. Tracking
 
 14.1 A `Reactive` MUST be tracked only where something downstream will be rebuilt from it.
@@ -1087,6 +1099,26 @@ sets MUST be refused 413, whether its length was declared or streamed.
 16.79 An `Rpc` call in a browser that gets no answer, and whose `signal` has not aborted, MUST refuse
 with `HttpError` at 503.
 
+16.80 A `GET` call in a browser MUST be sent with `cache` `force-cache` where the page has loaded no
+answer for its args and the worker `ABIDE_OFFLINE` turns on answers the page, and with `no-cache`
+otherwise.
+
+16.81 A call in a browser given `offline` that gets no answer, or an answer at 502, 503 or 504, MUST
+settle to what `offline` returns for its args, as a write made here (3.10), save a `GET` whose copy
+already holds an answer for them.
+
+16.82 A mutation call that 16.81 settles MUST be queued in `outbox`, and MUST refuse as it was
+answered where `outbox` cannot keep it.
+
+16.83 A mutation call given `offline` MUST be queued in `outbox`, and not sent, while `outbox` holds
+a call not yet delivered.
+
+16.84 `offline` MUST be inert on a server.
+
+16.85 A call in a browser answered from a copy the worker `ABIDE_OFFLINE` turns on kept MUST settle
+as a write made here (3.10), and a `GET`'s copy that 16.81 or this settles MUST be loaded again once
+`online` is true.
+
 # 17. Response helpers
 
 17.1 Every body helper MUST take `Values<T>`.
@@ -1214,6 +1246,9 @@ again at once where `online` becomes true or the page becomes visible.
 
 18.34 A browser's connection to the socket mux MUST NOT be opened again while `online` is false.
 
+18.35 A subscriber's copy of a `GET` written here (3.10) MUST NOT take a value or a patch sent to it
+while `outbox` holds a call not yet delivered, and MUST read the value again once it holds none.
+
 # 19. Mount paths and schemas
 
 19.1 A route MUST be answered for each method by one file at most, a page answering `GET` and `HEAD`
@@ -1356,7 +1391,8 @@ app at boot, naming the handler.
 
 21.2 Every response MUST carry `traceresponse`, a refusal included.
 
-21.3 A page, an rpc answer and a refusal MUST default to `cache-control: private, no-store`.
+21.3 A page, an rpc answer and a refusal MUST default to `cache-control: private, no-store`, save
+where 21.22 has it.
 
 21.4 `/__abide/openapi.json` and `/__abide/mcp` MUST answer `cache-control: no-store`. `/__abide/health`
 and `/__abide/principal` are answered as handlers (25.3) and carry 21.3's `private, no-store`.
@@ -1374,10 +1410,11 @@ app MUST NOT be required to state the duration a second time.
 
 21.10 A write through `response` MUST override every header and the status the answer carries.
 
-21.11 The `max-age` 21.8 derives MUST replace 21.3's `no-store`, and 21.3 MUST decide the rest
-of that header.
+21.11 The `max-age` 21.8 derives MUST replace 21.3's `no-store`, or lead 21.22's directives, and the
+rest of that header MUST be the one 21.3 or 21.22 gives.
 
-21.12 A file under a `public` directory MUST answer `cache-control: public, max-age=0, must-revalidate`.
+21.12 A file under a `public` directory MUST answer `cache-control: public, max-age=0, must-revalidate`,
+save where 21.23 has it.
 
 21.13 A file under a `public` directory MUST answer an `etag` derived from its bytes.
 
@@ -1390,7 +1427,8 @@ held answered it, `Started` where it is a stream timed to its first chunk, and `
 
 21.16 The `max-age` 21.8 derives MUST be what is left of the answered production's `ttl`.
 
-21.17 A `GET` over a `global` `reactive` whose `ttl` is `Infinity` MUST keep 21.3's `no-store`.
+21.17 A `GET` over a `global` `reactive` whose `ttl` is `Infinity` MUST keep the `cache-control` 21.3
+or 21.22 gives it.
 
 21.18 A page MUST default to `content-security-policy: frame-ancestors 'none'`.
 
@@ -1401,6 +1439,17 @@ time those rungs took apart from what they wrapped.
 
 21.21 The `Direct` duration 21.15 carries MUST NOT include the time 21.20 counts.
 
+21.22 Where 45.1 has a page register the worker `ABIDE_OFFLINE` turns on, a page, and the answer of
+a `GET` of the app's own that is neither a refusal nor a stream 16.32 frames, MUST default to `cache-control: private,
+stale-while-revalidate=604800, stale-if-error=604800`.
+
+21.23 Where 45.1 has a page register the worker `ABIDE_OFFLINE` turns on, a file under a `public`
+directory MUST answer `cache-control: public, max-age=0, stale-while-revalidate=604800,
+stale-if-error=604800`.
+
+21.24 Where 45.1 has a page register the worker `ABIDE_OFFLINE` turns on, an answer carrying the
+`abide-principal` header 26.24 has it carry MUST carry `clear-site-data: "cache"`.
+
 # 22. Request-scoped ambients
 
 22.1 `request`, `response` and `server` MUST throw outside a request.
@@ -2954,7 +3003,10 @@ adopts the page, however early its answer arrived.
 41.28 A `render` MUST let the turn's queued microtasks run between setting up a `<Name/>` whose setup
 made an `Rpc` call and building that component's markup.
 
-41.29 A `render` answering a request whose `sec-fetch-dest` is `empty` MUST NOT fill the seed buffer.
+41.29 A `render` answering a request whose `sec-fetch-dest` is `empty` MUST NOT fill the seed buffer,
+save one whose `abide-keep` header names `open`.
+
+41.30 A `render` answering a request carrying `abide-keep` MUST write 41.20's script.
 
 # 42. The app object
 
@@ -3207,12 +3259,11 @@ and the command it yields MUST pair that one.
 45.2 The worker `ABIDE_OFFLINE` turns on MUST be served below `/__abide`, and MUST be allowed the
 scope of the app's mount.
 
-45.3 The worker `ABIDE_OFFLINE` turns on MUST answer a page, and every other `GET` of the app's own
-origin, with the network's answer, and with the copy it saved of that address where the network
-gives none.
+45.3 The worker `ABIDE_OFFLINE` turns on MUST save an answer to a page, or to any other `GET` of the
+app's own origin, only where its `cache-control` lets a private cache store it.
 
-45.4 The worker `ABIDE_OFFLINE` turns on MUST save only an answer of 200 that is neither a stream
-16.32 frames nor a binary 16.34 types.
+45.4 The worker `ABIDE_OFFLINE` turns on MUST save only an answer of 200, to the address it asked
+rather than one a redirect led to, that is neither a stream 16.32 frames nor a binary 16.34 types.
 
 45.5 The worker `ABIDE_OFFLINE` turns on MUST save every file of the build's bundle as it installs.
 
@@ -3248,3 +3299,78 @@ the size it is drawn at.
 
 45.16 The worker `ABIDE_OFFLINE` turns on MUST leave to the network the request 30.15 makes, a
 request carrying `range`, and one accepting `text/event-stream`.
+
+45.17 The worker `ABIDE_OFFLINE` turns on MUST answer a request with the copy it saved of its address,
+and not ask the network, while that copy is fresh by its `cache-control`.
+
+45.18 The worker `ABIDE_OFFLINE` turns on MUST answer a request with the copy it saved of its address,
+and ask the network for the copy it saves next save where the request's `cache` is `force-cache`,
+while that copy is stale by no more than its `stale-while-revalidate`.
+
+45.19 The worker `ABIDE_OFFLINE` turns on MUST answer a request 45.17 and 45.18 leave to the network
+with the network's answer, and with the copy it saved of that address where the network gives none
+and that copy is stale by no more than its `stale-if-error`.
+
+45.20 The worker `ABIDE_OFFLINE` turns on MUST answer a request that is not a navigation, and whose
+`cache` is `no-cache`, `reload` or `no-store`, with the network's answer alone.
+
+45.21 The worker `ABIDE_OFFLINE` turns on MUST ask the network past the browser's own cache.
+
+45.22 The worker `ABIDE_OFFLINE` turns on MUST mark an answer it gives from a copy it saved with an
+`abide-kept` header naming that copy's `date`.
+
+45.23 The worker `ABIDE_OFFLINE` turns on MUST ask for a page it saves with an `abide-keep` header,
+naming `open` where its answer is the one a navigation opens.
+
+# 46. Outbox
+
+46.1 `outbox` MUST answer, oldest first, every call queued in it that was neither delivered nor
+discarded, narrowed to the handler a selection names and the args a pattern matches.
+
+46.2 `outbox` MUST keep its calls across a reload, in IndexedDB where the browser has it.
+
+46.3 `outbox` MUST send its calls oldest first, one at a time.
+
+46.4 A call `outbox` sends that gets no answer, or an answer at 502, 503 or 504, MUST stay in
+`outbox`, and MUST hold back the calls after it until it is sent again.
+
+46.5 A call `outbox` sends that is refused MUST stay in `outbox`, its `value` refused as the server
+refused it, and MUST NOT hold back the calls after it.
+
+46.6 A call `outbox` sends that is refused at 401 MUST hold back every call after it until
+`principal` changes or a call's `retry` is called.
+
+46.7 A call `outbox` delivers MUST leave it, and its `value` MUST take its answer as 3.11 has it.
+
+46.8 `outbox` MUST send as a page loads, where `online` becomes true, where the page becomes visible,
+and after a send that got no answer, waiting from one second to sixty, doubling.
+
+46.9 Every tab of an app MUST show one `outbox`, and one tab at a time MUST send from it.
+
+46.10 A call queued in `outbox` MUST carry one `idempotency-key` header on every send, its first
+included.
+
+46.11 `busy` over a handler MUST be true while a call `outbox` sends for it is in flight, and a bare
+`busy` while any call `outbox` sends is.
+
+46.12 A queued call's `retry` MUST send it again at once, and MUST clear its `value`'s refusal as a
+write made here (3.10).
+
+46.13 A queued call's `discard` MUST drop it from `outbox`, sent or not.
+
+46.14 `outbox` MUST ask the browser to keep the app's storage once it queues a call.
+
+46.15 On a server `outbox` MUST answer no calls.
+
+46.16 `outbox` over a selection that names no handler MUST answer no calls.
+
+46.17 Reading `outbox` MUST subscribe the reader to the calls it answers.
+
+46.18 Each call `outbox` answers MUST carry, as `value`, the `Reactive` its call settled, rebuilt from
+what was kept where the page holds none.
+
+46.19 A `value` 46.18 rebuilds MUST hold the stand-in its call settled to, where the browser could
+keep it, as a write made here (3.10).
+
+46.20 A page MUST NOT open the store 46.2 keeps `outbox` in where `outbox` held no call when it last
+changed.