@abide/abide 0.48.0 → 0.50.0

package/AGENTS.md

@@ -26,7 +26,7 @@ src/server/rpc/getMessages.ts
       └─ OpenAPI        operation in /openapi.json
 ```
 
-An `inputSchema` (any Standard Schema library — zod, valibot, arktype,
+A `schemas.input` (any Standard Schema library — zod, valibot, arktype,
 unadapted) is the gate: it unlocks the CLI, and for read-only methods
 (GET/HEAD) the MCP tool. A mutating method (POST/PUT/PATCH/DELETE) never
 auto-exposes to MCP — it requires explicit `clients: { mcp: true }`.
@@ -76,35 +76,43 @@ For tests, add `preload = ["@abide/abide/preload"]` under `[test]` in
 ## Authoring contracts
 
 **RPC** — the handler receives the schema-validated args
-(`InferOutput<inputSchema>`); typed generics on the helper are a compile error
+(`InferOutput<schemas.input>`); typed generics on the helper are a compile error
 — type the parameter, let the body infer. Inside it, `request()` / `cookies()`
 / `server()` read the request scope. Return `json(data)` (or `jsonl` / `sse`
-for streams, `error` / `redirect`, or a raw `Response`). Options:
-`inputSchema`, `outputSchema`, `filesSchema` (validates uploaded `File` parts,
-kept out of the JSON-Schema projection), `clients: { browser, mcp, cli }`,
-`crossOrigin` (exempts a mutating rpc from the same-origin CSRF gate),
+for streams, `error` / `redirect`, or a raw `Response`). Options are namespaced
+(ADR-0020): `schemas: { input, output, files }` (`files` validates uploaded
+`File` parts, kept out of the JSON-Schema projection); `clients: { browser, mcp,
+cli }`; `crossOrigin` (exempts a mutating rpc from the same-origin CSRF gate);
 `timeout` (handler deadline in ms → 504 on every surface, composed into
-`request().signal`), `maxBodySize` (per-rpc 413 cap), `outbox` (durable
-delivery, mutating methods only). Query args on GET/HEAD/DELETE travel as
-strings — coerce in the schema (`z.coerce.number()`). A body rpc also accepts
+`request().signal`); `maxBodySize` (per-rpc 413 cap); on read helpers (GET/HEAD)
+`cache: { ttl, tags, throttle, debounce, shared }` (the endpoint's
+retention/refetch policy) and `stream: { n }` (replay depth). Kind-scoped by type:
+`cache`/`stream` on a write is a compile error. Query args on GET/HEAD/DELETE travel as
+strings — coerce in the schema (`z.coerce.number()`). Beyond scalars, a
+type-directed wire codec (ADR-0028/0029) revives a top-level arg field into the
+runtime value its declared type names — a numeric string → `number`/`bigint`, a
+`Date` from an ISO string, a `Set` from a JSON array, a `Map` from an entries
+array/object — resolved through the warm server program; reviving is fail-open
+(an unrevivable value passes through as its JSON form). A body rpc also accepts
 a `FormData` in place of typed args (the upload escape hatch): text fields
-validate as args, `File` parts validate against `filesSchema`.
-
-**Consuming an rpc** — the bare call `fn(args, opts?)` IS the smart read:
-cached, coalesced, reactive, stale-while-revalidate for replayable (GET/HEAD)
-reads; the second arg takes `{ ttl, tags, throttle, debounce, shared, n }`
-(retention and the refetch clock — not transport). `ttl` defaults to `0` on
-the server (coalesce-only — the request is the atomic unit, nothing is
-retained past it) and `Infinity` on the client (retain until invalidate/
-refresh). `shared: true` selects the process-level store instead of the
-request-scoped default (server) — it does not by itself retain, pair it with
-an explicit `ttl` (e.g. `{ shared: true, ttl: Infinity }`) to memoise across
-requests, for an external endpoint, never per-user data; on the client it is
-a no-op (one tab store). A read with no request in flight (e.g. a background
-job) also resolves against the process-level store. During SSR the same call
-resolves
-in-process and its value is baked into the HTML so hydration starts warm —
-there is no `cache()` wrapper; the bare call carries the caching. Around it:
+validate as args, `File` parts validate against `schemas.files`.
+
+**Consuming an rpc** — the bare call `fn(args)` IS the smart read: cached,
+coalesced, reactive, stale-while-revalidate for replayable (GET/HEAD) reads.
+There are no call-site options (ADR-0020) — all retention/refetch policy is
+declared once on the endpoint's `cache`/`stream`. `ttl` defaults to `Infinity`:
+an entry is retained for its store's lifetime — the request on the server (a
+non-shared read dies with the request), the tab on the client (until
+invalidate/refresh); a write coalesces only (ttl 0, the mutation idiom).
+`shared` selects the process-level store instead of the request-scoped default
+(server); with the default `Infinity` ttl it memoises across requests (an
+explicit `ttl` bounds it) — for an external endpoint, never per-user data; on
+the client it is a no-op (one tab store). A read with no request in flight (e.g.
+a background job) resolves against the process-level store and coalesces only
+(so it can't leak forever). During SSR the same call — any method — resolves
+in-process and its value is baked into the HTML so hydration starts warm without
+a re-fetch (an inline write seeds too, ADR-0036; only unprompted refetch stays
+GET/HEAD) — there is no `cache()` wrapper; the bare call carries the caching. Around it:
 `fn.raw(args, init?)` returns the raw `Response` (per-call transport options —
 `signal`, `headers`, `keepalive`, … — live here); `fn.refresh(args?)`
 refetches keeping the stale value visible; `fn.patch(args?, updater)` mutates
@@ -113,24 +121,16 @@ it synchronously; `fn.pending(args?)` / `fn.refreshing(args?)` are reactive
 probes; `fn.error(args?)` is the rpc's last typed error; `fn.watch(args?,
 handler)` pipes each resolved value to a handler (client-only; SSR-inert);
 `fn.isError(e, kind?)` type-guards a caught error against the rpc's declared
-error kinds; `fn.outbox()` exposes a durable rpc's parked-write queue. A
+error kinds. A
 handler that returns `jsonl()`/`sse()` makes the bare call return a
-`Subscribable` (`for await` it) — detected at build, nothing to declare;
+`NamedAsyncIterable` (`for await` it) — detected at build, nothing to declare;
 awaiting a streaming call is a compile error.
 
 **Typed errors** — declare a constructor with
 `error.typed(name, status, schema?)` and `return` it from the handler; the
 client's `HttpError` then carries `kind` (the name) and `data` (the schema's
 payload), narrowed via `rpc.isError`. The framework reserves
-`kind: 'validation'` (422, `data: ValidationErrorData`) and `kind: 'queued'`
-(a durable call parked while unreachable; `data` is the parked `OutboxEntry`).
-
-**Durable outbox** — an `outbox: true` (mutating) rpc still fetches and throws
-normally, but an unreachable server (transport failure or 502/503/504/52x)
-parks the request for replay as a side-effect and throws `kind: 'queued'`;
-once a backlog exists new calls park straight to the tail so writes stay
-ordered. Nothing auto-drains: replay via `rpc.outbox.retry()` or the global
-`outbox.retry()`; cancel via an entry's `controller.abort()`.
+`kind: 'validation'` (422, `data: ValidationErrorData`).
 
 **Socket** — `socket<T>(opts)` or `socket({ schema, … })` (with a schema, `T`
 infers and publishes validate). Options: `tail` (retained frames, default 1 —
@@ -138,8 +138,9 @@ infers and publishes validate). Options: `tail` (retained frames, default 1 —
 `clientPublish` (accept browser/HTTP publishes, off by default), `clients`
 (mcp/cli exposure; a schema flips both on by default). The socket IS the
 `AsyncIterable` — iterating is the live stream, no replay. Members:
-`broadcast(msg)` (isomorphic publish — server fans out in-process + to remote
-subscribers, client sends a validated `pub` frame), `tail(count?)` (a
+`publish(msg)` (isomorphic — mirrors Bun's `server.publish()`; server fans out
+in-process + to remote subscribers, client sends a validated `pub` frame),
+`tail(count?)` (a
 subscription seeded with retained frames), `peek()` (latest retained frame),
 `refresh()` (drop local frames and re-pull the server tail; server-side
 no-op), `watch(handler)` ≡ `watch(socket, handler)` (client-only, SSR-inert),
@@ -189,13 +190,14 @@ cells read/written through `.value`.
 | `state.share(key, value)` / `state.shared(key)` | members of `state` | Put a named value on the ambient scope / read the closest ancestor's |
 | `watch(source, handler)` | `@abide/abide/ui/watch` | The single reaction primitive (client-only, stripped from SSR). Sources: a bare thunk `watch(() => …)` (auto-tracked effect), a state cell, a cell array, a socket/stream (`handler(frame)` per frame with reconnect replay), an rpc (`watch(fn, args?, handler)` — runs the smart read, `handler(value)` on each change). Returns a scope-tied disposer |
 | `html(str)` / `` html`…` `` | `@abide/abide/ui/html` | Brands trusted raw HTML so `{expr}` inserts nodes instead of escaped text; plain `{value}` always escapes |
-| `props()` | ambient (no import) | The prop reader: `const { name = fallback, ...rest } = props()`; a page's props are its route params |
+| `props()` | `@abide/abide/ui/props` | The prop reader, resolved by import binding (alias-safe) like `state`: `const { name = fallback, ...rest } = props()`; a page/layout's declared props are additive with its route-param shape. `children` is an ordinary declared prop (`const { children } = props<{ children: Snippet }>()`), not ambient |
 
 Bindings and directives (the attribute kinds `readAttributes` parses):
 
 | Form | Spec |
 | --- | --- |
-| `{expr}` | Text interpolation, escaped; a snippet or `html`-branded value mounts as nodes |
+| `{expr}` | Text interpolation, escaped; a snippet or `html`-branded value mounts as nodes. Type-directed (ADR-0032): a `Promise`/`AsyncIterable`-typed `{expr}` (or an async sub-expression) lifts to a peek-cell — `undefined` while pending (composes with `??`/`?.`), then the resolved value / latest frame; a plain value binds directly |
+| `{await expr}` | Explicit **blocking** await — renders the awaited value inline during SSR. Valid in every position (ADR-0032): content, an attribute, an `{#if}`/`{#switch}` subject, a `{#for}` source |
 | `name={expr}` | Attribute/prop bound to an expression |
 | `name="a {expr} b"` | Interpolated attribute — a literal `{` in a quoted value always interpolates (write `&lbrace;` for a literal brace) |
 | `{...expr}` | Spread — props onto a component, attributes onto a native element (rejected on `<template>`) |
@@ -203,6 +205,7 @@ Bindings and directives (the attribute kinds `readAttributes` parses):
 | `bind:value={cell}` | Two-way input/select/textarea binding. `<input type="number"/"range">` writes back a number; `<select>` re-applies against late-mounting options and `<select multiple>` binds an array of selected values |
 | `bind:value={{ get, set }}` | Writable-computed binding: read via `get()`, write via `set(next)` |
 | `bind:checked={cell}` / `bind:group={cell}` | Checkbox boolean / radio-group value (SSR emits boolean attributes bare — `checked`, `open`, `selected` on the matching option) |
+| `bind:prop={target}` (on a component) | Two-way prop binding — the same `target` forms as an element bind (an lvalue or `{ get, set }`). The child reads `prop` normally; if it writes `prop` or forwards it to another `bind:`, those writes flow back to `target`. Bindability is usage-inferred (no child-side marker): a prop only read stays read-only, and a `bind:prop` whose child never writes is simply one-way |
 | `class:name={cond}` | Toggles a class; merges with a reactive `class` base in one effect |
 | `style:property={value}` | Sets one style property; merges with a reactive `style` base |
 | `attach={fn}` | Runs `fn(element)` at build time; an optional returned teardown runs on dispose |
@@ -220,10 +223,25 @@ error):
 | `{#try}…{:catch e}…{:finally}…{/try}` | Synchronous error boundary around a build/reactive throw |
 | `{#snippet name(args)}…{/snippet}` | Declares a reusable builder, called as an interpolation: `{name(args)}`; a snippet value passes through props like any other value |
 
+A `Promise`/`AsyncIterable` (or an async sub-expression) lifts to a peek-cell in
+**every** position (ADR-0032) — content, an attribute, an `{#if}`/`{#switch}`
+subject, a plain `{#for}` source — reading `undefined` while pending, so
+`{getFoo() ?? 'Loading…'}` shows the fallback, `{#if getFoo()}` takes the else
+branch, and a pending `{#for}` renders empty. A leading `await` makes it
+SSR-blocking (resolved inline); no `await` streams (pending shell, resolves on the
+client). The one rejection is a raw `AsyncIterable` driving a plain `{#for}` —
+iterate its frames with `{#for await}`.
+
 Components are capitalised tags (`<Panel prop={x}>…</Panel>`); nested content
-renders where the component calls `{children()}` — the single fill point
-(`{#if children}{children()}{:else}…{/if}` for a fallback; there are no named
-slots and no `<slot>` element). A layout's `{children()}` is the route outlet.
+becomes the component's `children` prop — an ordinary declared prop of type
+`Snippet`, read with `const { children } = props<{ children: Snippet }>()`
+and called as `{children()}` — the single fill point (`{#if children}
+{children()}{:else}…{/if}` for a fallback; there are no named slots and no
+`<slot>` element). Slotted content (`<Panel>…</Panel>`) and an explicit
+`children={aSnippet}` attribute set the same prop — slotted content rides in
+as the trailing prop layer, so it wins over an explicit `children` attribute
+on the same tag (`mergeProps`, last layer wins per key). A layout's
+`{children()}` is the route outlet.
 
 `<script>` and `<style>` are **not component-root-only**: either may sit
 inside a control-flow branch, scoped to that branch. A nested `<script>`
@@ -233,15 +251,16 @@ there — imports live in the leading `<script>`). A **root** `<style>` is
 component-scoped; a nested `<style>` scopes to its sibling subtree only.
 
 Removed forms throw migration errors at parse time: the `<slot>` element (use
-`{children()}`), `<template name>` snippets (use `{#snippet}`), and all
-`<template if/each/await/switch/…>` control flow (use `{#…}` blocks).
+a declared `children: Snippet` prop, called `{children()}`), `<template
+name>` snippets (use `{#snippet}`), and all `<template
+if/each/await/switch/…>` control flow (use `{#…}` blocks).
 
 ## Server surface — `abide/server/*`
 
 ### RPC — `@documentation rpc`
 
 - `@abide/abide/server/GET` — GET rpc helper: `export const x = GET(handler, opts?)` inside `src/server/rpc/`; the bundler rewrites it to the server dispatcher or the browser proxy — calling it outside an rpc module throws.
-- `@abide/abide/server/POST` — POST rpc helper (mutating: accepts `outbox`, JSON/FormData body).
+- `@abide/abide/server/POST` — POST rpc helper (mutating: JSON/FormData body).
 - `@abide/abide/server/PUT` — PUT rpc helper (mutating).
 - `@abide/abide/server/PATCH` — PATCH rpc helper (mutating).
 - `@abide/abide/server/DELETE` — DELETE rpc helper (mutating; args travel in the query string).
@@ -293,7 +312,7 @@ Removed forms throw migration errors at parse time: the `<slot>` element (use
 
 Probes report, never act — reading one opens no fetch and no stream.
 
-- `@abide/abide/shared/pending` — `pending(selector?, args?)`: reactive "no value yet" probe over calls and streams (global, per-rpc, per-call, tagged, per-subscribable; a durable rpc's parked writes count too).
+- `@abide/abide/shared/pending` — `pending(selector?, args?)`: reactive "no value yet" probe over calls and streams (global, per-rpc, per-call, tagged, per-subscribable).
 - `@abide/abide/shared/refreshing` — `refreshing(selector?, args?)`: "holding a value while a fresher one is in flight" — the SWR reload / stream-reconnect badge.
 - `@abide/abide/shared/peek` — `peek(fn, args?)` / `peek(socket)`: the retained value (or latest frame), synchronously, `T | undefined`; reactive inside a tracking scope.
 - `@abide/abide/shared/done` — `done(subscribable)`: true once a stream closed (stream-only; a cache read's "done" is `!pending && !refreshing`).
@@ -301,7 +320,7 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 ### Errors — `@documentation response`
 
-- `@abide/abide/shared/HttpError` — thrown by rpc calls on non-2xx; carries `status`, `statusText`, the raw `response`, and — for typed/validation/queued errors — `kind` + `data`.
+- `@abide/abide/shared/HttpError` — thrown by rpc calls on non-2xx; carries `status`, `statusText`, the raw `response`, and — for typed/validation errors — `kind` + `data`.
 - `@abide/abide/shared/ValidationErrorData` — the `data` shape of a `kind: 'validation'` failure: the raw Standard Schema `issues` plus a `fields` (field → first message) map.
 
 ### Schema projection — `@documentation rpc`
@@ -325,7 +344,7 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 ### Templating — `@documentation templating`
 
-- `@abide/abide/shared/snippet` — `snippet(payload)`: brands a snippet payload so a `{expr}` interpolation mounts it (client: a DOM builder; server: the rendered string); the compiler wraps `{#snippet}` bodies in this. Also exports the `Snippet<P>` type and `snippetPayload(value)` (the payload, or undefined for plain values).
+- `@abide/abide/shared/snippet` — `snippet(payload)`: brands a snippet payload so a `{expr}` interpolation mounts it (client: a DOM builder; server: the rendered string); the compiler wraps `{#snippet}` bodies in this. Also exports the `Snippet<Args>` type — a callable `(...args: Args) => SnippetValue`, generic over its call arguments (`children` is `Snippet`, invoked `children()`; a row snippet is `Snippet<[Item]>`, invoked `row(item)`) — plus `SnippetValue` (the internal payload brand) and `snippetPayload(value)` (a branded value's payload, or undefined for plain values).
 
 ### Shared plumbing — `@documentation plumbing`
 
@@ -337,6 +356,7 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 - `@abide/abide/ui/state` — the `state` primitive: `state(initial, transform?)` writable cell, `state.computed(fn)` read-only derived, `state.linked(fn, transform?)` writable-reseeded, `state.share(key, value)` / `state.shared(key)` ambient context. In `.abide` files the compiler lowers reads/writes to plain variable syntax; in `.ts` the cell is read/written through `.value`.
 - `@abide/abide/ui/watch` — `watch(source, handler)`: the single reaction primitive over a thunk, cell, cell array, socket/stream, or rpc (see the grammar table). Client-only; the compiler strips author calls from SSR, and the `socket.watch` / `fn.watch` instance sugar is SSR-inert.
+- `@abide/abide/ui/props` — `props<T>()`: the prop reader, resolved by import binding (alias-safe) like `state`; a required import — there is no ambient `props()`. Destructure declared props off it (`const { name, ...rest } = props<T>()`); a page/layout's declared `T` is additive with its auto-typed route-param shape. `children` is an ordinary declared prop, not ambient: `const { children } = props<{ children: Snippet }>()` (`Snippet` from `@abide/abide/shared/snippet`).
 
 ### Templating — `@documentation templating`
 
@@ -346,10 +366,6 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 - `@abide/abide/ui/navigate` — `navigate(path, params?, options?)`: typed programmatic navigation off the route map; params interpolate through `url()` (base-correct). Options `{ replace, keepScroll }`. The module also exports `navigatePath(path, options?)` (already-resolved paths — the router's own entry, no re-basing) and the `NavigateOptions` type.
 
-### Outbox — `@documentation ui`
-
-- `@abide/abide/ui/outbox` — the global reactive outbox: `outbox()` lists every durable rpc's undelivered entries (each tagged with its `rpc`), member `outbox.retry()` drains every queue. Empty list server-side. Types `GlobalOutbox`, `GlobalOutboxEntry`.
-
 ### UI plumbing — `@documentation plumbing`
 
 Compiler/runtime machinery — published so generated code, the type shadow, and
@@ -362,14 +378,18 @@ tests can import it, not for app code.
 - `@abide/abide/ui/router` — `router(...)`: the client router — fills layout/page chains into comment-marker outlet boundaries, intercepts in-app links, buckets/restores scroll per history entry.
 - `@abide/abide/ui/startClient` — `startClient(...)`: the client entry — reads every `__SSR__` field into its shared slot (cache seed, health seed, client timeout, resume manifest), hydrates the chain, starts the router.
 - `@abide/abide/ui/renderToStream` — `renderToStream(render)`: out-of-order SSR streaming — shell first, then one `<abide-resolve>` fragment per streaming await block in completion order; blocking (`then`-head) awaits render inline.
-- `@abide/abide/ui/remoteProxy` — `remoteProxy(method, url, opts?)`: the browser-side rpc stub the bundler emits (fetch, decode, HttpError, outbox parking, streaming); the `DurableOptions` type rides along.
+- `@abide/abide/ui/remoteProxy` — `remoteProxy(method, url, opts?)`: the browser-side rpc stub the bundler emits (fetch, decode, HttpError, streaming); the `RemoteProxyOptions` type rides along.
 - `@abide/abide/ui/socketProxy` — `socketProxy(name)`: the browser-side socket stub — the identical `Socket<T>` shape over the page's lazily-opened multiplexed ws channel.
 - `@abide/abide/ui/runtime/escapeKey` — JSON-Pointer-escapes one reactive-doc path key (`~`→`~0`, `/`→`~1`).
+- `@abide/abide/ui/runtime/withPath` — pushes one `escapeKey`-escaped render-path segment for the duration of a synchronous `build`, relative to the ambient path (the render-path identity a layout layer / child mount composes); restores after. A reactively-rebuilt block uses `withPathFrom` with a captured base instead.
+- `@abide/abide/ui/runtime/renderPath` — the render-path a `<Child/>` mounts under: composes a child's ordinal onto the ambient path (`withPath(ordinal, …)`) to produce the `abide:await:CHILDPATH` boundary id, computed identically on both sides so the streamed-child adopter never drifts. Server-emit-only.
+- `@abide/abide/ui/runtime/blockId` — allocates an await/try block id namespaced by the ambient render-path (`${path}:${n}`, per-path document-order counter), so sibling child renders can run concurrently during SSR without their block ids interleaving; the bare (`path === ''`) case keeps the plain `0,1,2…` form.
 - `@abide/abide/ui/runtime/nextBlockId` — the next await/try block id in the current render pass (document order, shared across inlined children).
 - `@abide/abide/ui/runtime/enterRenderPass` — marks entry into a render/mount; the outermost resets the block-id counter.
 - `@abide/abide/ui/runtime/exitRenderPass` — unwinds `enterRenderPass`'s depth.
 - `@abide/abide/ui/dom/mount` — mounts a top-level page/layout into a host under an ownership scope; returns the unmount.
 - `@abide/abide/ui/dom/mountChild` — mounts a nested child component as a comment-marker range (dev builds also register it with the hot bridge).
+- `@abide/abide/ui/dom/mountStreamedChild` — the client mount for a HOISTABLE child (ADR-0039): a dual-mode adopter that probes the hydration cursor to tell whether the server inlined the child (settled) or streamed it (`abide:await:CHILDPATH` boundary, already swapped in), then adopts the range in place — falling back to a create-mount on a client navigation or an unfilled boundary. Registers with the hot bridge like `mountChild`.
 - `@abide/abide/ui/dom/mountSlot` — mounts a component's passed-children content as a marker-bounded range.
 - `@abide/abide/ui/dom/outlet` — a layout's outlet: an empty `<!--abide:outlet-->…<!--/abide:outlet-->` boundary the router fills.
 - `@abide/abide/ui/dom/hydrate` — adopts server-rendered DOM instead of rebuilding: runs the build with a claim cursor over the existing nodes.
@@ -380,7 +400,6 @@ tests can import it, not for app code.
 - `@abide/abide/ui/dom/appendText` — a reactive `{expr}` text node under a parent.
 - `@abide/abide/ui/dom/appendTextAt` — a reactive text node mounted at a skeleton anchor (text interleaved with element siblings).
 - `@abide/abide/ui/dom/appendSnippet` — mounts a `{snippet(args)}` interpolation's builder into a marker-bounded range.
-- `@abide/abide/ui/dom/text` — a text node whose content tracks a reactive read.
 - `@abide/abide/ui/dom/attr` — binds an element attribute to a read (boolean true → bare attribute, false/nullish → removed).
 - `@abide/abide/ui/dom/on` — attaches an event listener whose removal is registered with the ownership scope.
 - `@abide/abide/ui/dom/attach` — runs an `attach={fn}` attachment and registers its optional teardown.
@@ -391,12 +410,20 @@ tests can import it, not for app code.
 - `@abide/abide/ui/dom/switchBlock` — `{#switch}` runtime (also `{#if}` chains with `{:else if}` branches).
 - `@abide/abide/ui/dom/awaitBlock` — `{#await}` runtime: pending → resolved/error branch swap, teardown-generation guarded.
 - `@abide/abide/ui/dom/tryBlock` — `{#try}` runtime: synchronous error boundary around a subtree build.
-- `@abide/abide/ui/dom/applyResolved` — consumes a streamed SSR `<abide-resolve>` chunk, swapping it into its await boundary (the bundle-side counterpart of the doc stream's inline scripts).
 - `@abide/abide/ui/dom/mergeProps` — composes a child's props from explicit thunk runs, spread layers, and the trailing children layer.
 - `@abide/abide/ui/dom/spreadProps` — wraps a `{...source}` spread layer so every key resolves to a live value thunk.
 - `@abide/abide/ui/dom/restProps` — the live unconsumed-props object behind `const { …, ...rest } = props()`.
+- `@abide/abide/ui/dom/bindProp` — the parent half of a component `bind:prop`: annotates a prop's value thunk with a `set` write-back channel.
+- `@abide/abide/ui/dom/bindableProp` — the child half: the writable cell a component gets for a prop it writes or forwards (pass-through to the parent when bound, a local reseeding cell when not).
 - `@abide/abide/ui/dom/spreadAttrs` — spreads an object's keys onto a native element (`<div {...rest}>`), keys enumerated once.
+- `@abide/abide/ui/dom/mutateDocContainer` — the lowering for an in-place mutating container method on a reactive doc (`model.items.splice(…)`, `.sort()`, a Set `.add()`, a Map `.set()`, …): clones the array/Map/Set, applies the mutation to the copy, and writes it back through `replace` so a real patch fires (readers wake, the render tree re-derives); returns the native method's result unchanged.
 - `@abide/abide/ui/dom/readCall` — guarded method call on a reactive-doc read (the `model.draft.trim()` lowering).
+- `@abide/abide/ui/dom/readCell` — unified read for a `linked`/async-`computed` reference (the `$$readCell(NAME)` lowering): peeks an async cell, reads `.value` off a sync one.
+- `@abide/abide/ui/dom/cellPending` — whether a control-flow subject (`{#if}`/`{#switch}`) is a still-loading async cell (no value, no error) so the block renders no branch while pending instead of flashing its `{:else}`; a plain/settled value is never pending.
+- `@abide/abide/ui/settleAsyncCells` — the SSR Tier-2 await-barrier (the `await $$settleAsyncCells()` lowering emitted between a component's cell declarations and its template): drains + awaits the request-scoped in-flight async-cell promises so their resolved values bake into the first-pass HTML.
+- `@abide/abide/ui/flight` — the SSR flight-starter (`$$flight(() => expr)`): hoists a hoistable await's promise into the synchronous render prefix so independent flights overlap instead of serializing; normalises a synchronous loader throw to a rejected promise and carries a synchronous `.settled` snapshot for `finalizeStreamedChildren`. Server-emit-only.
+- `@abide/abide/ui/isolateCellBarrier` — runs a hoisted child render (`$$isolateCellBarrier`) under its own async-cell barrier list (ALS-backed on the server) so its cell registrations and `$$settleAsyncCells` drain stay isolated from concurrent siblings and the page; an inert passthrough on the client. Server-emit-only.
+- `@abide/abide/ui/finalizeStreamedChildren` — the ADR-0039 when-to-stream decision run once after a component's body walk (`await $$finalizeStreamedChildren(...)`): fills each hoistable child's reserved output slot — inlining a settled flight byte-identically to the pre-ADR path, rethrowing a rejected one, or emitting an `abide:await:CHILDPATH` boundary + streaming `SsrAwait` for a still-pending one. Server-emit-only.
 
 ## Build / tooling
 
@@ -435,7 +462,7 @@ tests can import it, not for app code.
 
 | Route | Serves |
 | --- | --- |
-| `/openapi.json` | The OpenAPI document projected from every rpc's method, URL, and schemas |
+| `/openapi.json` | The OpenAPI document projected from every rpc's method, URL, and schemas. The 200 response body comes from `schemas.output` or, absent one, the handler's return type projected to JSON Schema (ADR-0030 D2); each `error.typed(...)` branch the handler can return surfaces as its own status response (ADR-0030) |
 | `/__abide/mcp` | The MCP endpoint (tools from rpcs/sockets, prompts, resources); auth flows from the inbound request |
 | `/__abide/health` | Liveness + identity JSON: framework version, app name/version, plus the app `health(request)` hook's fields; answered ahead of `app.handle` |
 | `/__abide/identity` | Compatibility alias for the same payload with the legacy `abide: true` marker |
@@ -443,7 +470,6 @@ tests can import it, not for app code.
 | `/__abide/sockets/<name>` | A socket's HTTP face: `GET` = retained tail as JSON (SSE stream under `Accept: text/event-stream`; `?tail=N` caps/seeds), `POST` = publish gated by `clientPublish`; 404 unless the socket is exposed to mcp/cli |
 | `/__abide/cli` | `GET` = shell install script; `/__abide/cli/<platform>` streams the thin-CLI tarball (cli + server binaries, `.env` baked with `ABIDE_APP_URL`/`ABIDE_APP_TOKEN`) |
 | `/__abide/inspector` | The `@abide/inspector` UI, mounted only under `ABIDE_ENABLE_INSPECTOR=true` |
-| `/__abide/hot/<moduleId>` | Dev-only component hot-module endpoint backing `.abide` HMR |
 
 ## Environment variables