@abide/abide 0.49.0 → 0.50.0

package/AGENTS.md

@@ -26,7 +26,7 @@ src/server/rpc/getMessages.ts
       └─ OpenAPI        operation in /openapi.json
 ```
 
-An `inputSchema` (any Standard Schema library — zod, valibot, arktype,
+A `schemas.input` (any Standard Schema library — zod, valibot, arktype,
 unadapted) is the gate: it unlocks the CLI, and for read-only methods
 (GET/HEAD) the MCP tool. A mutating method (POST/PUT/PATCH/DELETE) never
 auto-exposes to MCP — it requires explicit `clients: { mcp: true }`.
@@ -76,35 +76,43 @@ For tests, add `preload = ["@abide/abide/preload"]` under `[test]` in
 ## Authoring contracts
 
 **RPC** — the handler receives the schema-validated args
-(`InferOutput<inputSchema>`); typed generics on the helper are a compile error
+(`InferOutput<schemas.input>`); typed generics on the helper are a compile error
 — type the parameter, let the body infer. Inside it, `request()` / `cookies()`
 / `server()` read the request scope. Return `json(data)` (or `jsonl` / `sse`
-for streams, `error` / `redirect`, or a raw `Response`). Options:
-`inputSchema`, `outputSchema`, `filesSchema` (validates uploaded `File` parts,
-kept out of the JSON-Schema projection), `clients: { browser, mcp, cli }`,
-`crossOrigin` (exempts a mutating rpc from the same-origin CSRF gate),
+for streams, `error` / `redirect`, or a raw `Response`). Options are namespaced
+(ADR-0020): `schemas: { input, output, files }` (`files` validates uploaded
+`File` parts, kept out of the JSON-Schema projection); `clients: { browser, mcp,
+cli }`; `crossOrigin` (exempts a mutating rpc from the same-origin CSRF gate);
 `timeout` (handler deadline in ms → 504 on every surface, composed into
-`request().signal`), `maxBodySize` (per-rpc 413 cap), `outbox` (durable
-delivery, mutating methods only). Query args on GET/HEAD/DELETE travel as
-strings — coerce in the schema (`z.coerce.number()`). A body rpc also accepts
+`request().signal`); `maxBodySize` (per-rpc 413 cap); on read helpers (GET/HEAD)
+`cache: { ttl, tags, throttle, debounce, shared }` (the endpoint's
+retention/refetch policy) and `stream: { n }` (replay depth). Kind-scoped by type:
+`cache`/`stream` on a write is a compile error. Query args on GET/HEAD/DELETE travel as
+strings — coerce in the schema (`z.coerce.number()`). Beyond scalars, a
+type-directed wire codec (ADR-0028/0029) revives a top-level arg field into the
+runtime value its declared type names — a numeric string → `number`/`bigint`, a
+`Date` from an ISO string, a `Set` from a JSON array, a `Map` from an entries
+array/object — resolved through the warm server program; reviving is fail-open
+(an unrevivable value passes through as its JSON form). A body rpc also accepts
 a `FormData` in place of typed args (the upload escape hatch): text fields
-validate as args, `File` parts validate against `filesSchema`.
-
-**Consuming an rpc** — the bare call `fn(args, opts?)` IS the smart read:
-cached, coalesced, reactive, stale-while-revalidate for replayable (GET/HEAD)
-reads; the second arg takes `{ ttl, tags, throttle, debounce, shared, n }`
-(retention and the refetch clock — not transport). `ttl` defaults to `0` on
-the server (coalesce-only — the request is the atomic unit, nothing is
-retained past it) and `Infinity` on the client (retain until invalidate/
-refresh). `shared: true` selects the process-level store instead of the
-request-scoped default (server) — it does not by itself retain, pair it with
-an explicit `ttl` (e.g. `{ shared: true, ttl: Infinity }`) to memoise across
-requests, for an external endpoint, never per-user data; on the client it is
-a no-op (one tab store). A read with no request in flight (e.g. a background
-job) also resolves against the process-level store. During SSR the same call
-resolves
-in-process and its value is baked into the HTML so hydration starts warm —
-there is no `cache()` wrapper; the bare call carries the caching. Around it:
+validate as args, `File` parts validate against `schemas.files`.
+
+**Consuming an rpc** — the bare call `fn(args)` IS the smart read: cached,
+coalesced, reactive, stale-while-revalidate for replayable (GET/HEAD) reads.
+There are no call-site options (ADR-0020) — all retention/refetch policy is
+declared once on the endpoint's `cache`/`stream`. `ttl` defaults to `Infinity`:
+an entry is retained for its store's lifetime — the request on the server (a
+non-shared read dies with the request), the tab on the client (until
+invalidate/refresh); a write coalesces only (ttl 0, the mutation idiom).
+`shared` selects the process-level store instead of the request-scoped default
+(server); with the default `Infinity` ttl it memoises across requests (an
+explicit `ttl` bounds it) — for an external endpoint, never per-user data; on
+the client it is a no-op (one tab store). A read with no request in flight (e.g.
+a background job) resolves against the process-level store and coalesces only
+(so it can't leak forever). During SSR the same call — any method — resolves
+in-process and its value is baked into the HTML so hydration starts warm without
+a re-fetch (an inline write seeds too, ADR-0036; only unprompted refetch stays
+GET/HEAD) — there is no `cache()` wrapper; the bare call carries the caching. Around it:
 `fn.raw(args, init?)` returns the raw `Response` (per-call transport options —
 `signal`, `headers`, `keepalive`, … — live here); `fn.refresh(args?)`
 refetches keeping the stale value visible; `fn.patch(args?, updater)` mutates
@@ -113,24 +121,16 @@ it synchronously; `fn.pending(args?)` / `fn.refreshing(args?)` are reactive
 probes; `fn.error(args?)` is the rpc's last typed error; `fn.watch(args?,
 handler)` pipes each resolved value to a handler (client-only; SSR-inert);
 `fn.isError(e, kind?)` type-guards a caught error against the rpc's declared
-error kinds; `fn.outbox()` exposes a durable rpc's parked-write queue. A
+error kinds. A
 handler that returns `jsonl()`/`sse()` makes the bare call return a
-`Subscribable` (`for await` it) — detected at build, nothing to declare;
+`NamedAsyncIterable` (`for await` it) — detected at build, nothing to declare;
 awaiting a streaming call is a compile error.
 
 **Typed errors** — declare a constructor with
 `error.typed(name, status, schema?)` and `return` it from the handler; the
 client's `HttpError` then carries `kind` (the name) and `data` (the schema's
 payload), narrowed via `rpc.isError`. The framework reserves
-`kind: 'validation'` (422, `data: ValidationErrorData`) and `kind: 'queued'`
-(a durable call parked while unreachable; `data` is the parked `OutboxEntry`).
-
-**Durable outbox** — an `outbox: true` (mutating) rpc still fetches and throws
-normally, but an unreachable server (transport failure or 502/503/504/52x)
-parks the request for replay as a side-effect and throws `kind: 'queued'`;
-once a backlog exists new calls park straight to the tail so writes stay
-ordered. Nothing auto-drains: replay via `rpc.outbox.retry()` or the global
-`outbox.retry()`; cancel via an entry's `controller.abort()`.
+`kind: 'validation'` (422, `data: ValidationErrorData`).
 
 **Socket** — `socket<T>(opts)` or `socket({ schema, … })` (with a schema, `T`
 infers and publishes validate). Options: `tail` (retained frames, default 1 —
@@ -138,8 +138,9 @@ infers and publishes validate). Options: `tail` (retained frames, default 1 —
 `clientPublish` (accept browser/HTTP publishes, off by default), `clients`
 (mcp/cli exposure; a schema flips both on by default). The socket IS the
 `AsyncIterable` — iterating is the live stream, no replay. Members:
-`broadcast(msg)` (isomorphic publish — server fans out in-process + to remote
-subscribers, client sends a validated `pub` frame), `tail(count?)` (a
+`publish(msg)` (isomorphic — mirrors Bun's `server.publish()`; server fans out
+in-process + to remote subscribers, client sends a validated `pub` frame),
+`tail(count?)` (a
 subscription seeded with retained frames), `peek()` (latest retained frame),
 `refresh()` (drop local frames and re-pull the server tail; server-side
 no-op), `watch(handler)` ≡ `watch(socket, handler)` (client-only, SSR-inert),
@@ -195,7 +196,8 @@ Bindings and directives (the attribute kinds `readAttributes` parses):
 
 | Form | Spec |
 | --- | --- |
-| `{expr}` | Text interpolation, escaped; a snippet or `html`-branded value mounts as nodes |
+| `{expr}` | Text interpolation, escaped; a snippet or `html`-branded value mounts as nodes. Type-directed (ADR-0032): a `Promise`/`AsyncIterable`-typed `{expr}` (or an async sub-expression) lifts to a peek-cell — `undefined` while pending (composes with `??`/`?.`), then the resolved value / latest frame; a plain value binds directly |
+| `{await expr}` | Explicit **blocking** await — renders the awaited value inline during SSR. Valid in every position (ADR-0032): content, an attribute, an `{#if}`/`{#switch}` subject, a `{#for}` source |
 | `name={expr}` | Attribute/prop bound to an expression |
 | `name="a {expr} b"` | Interpolated attribute — a literal `{` in a quoted value always interpolates (write `&lbrace;` for a literal brace) |
 | `{...expr}` | Spread — props onto a component, attributes onto a native element (rejected on `<template>`) |
@@ -203,6 +205,7 @@ Bindings and directives (the attribute kinds `readAttributes` parses):
 | `bind:value={cell}` | Two-way input/select/textarea binding. `<input type="number"/"range">` writes back a number; `<select>` re-applies against late-mounting options and `<select multiple>` binds an array of selected values |
 | `bind:value={{ get, set }}` | Writable-computed binding: read via `get()`, write via `set(next)` |
 | `bind:checked={cell}` / `bind:group={cell}` | Checkbox boolean / radio-group value (SSR emits boolean attributes bare — `checked`, `open`, `selected` on the matching option) |
+| `bind:prop={target}` (on a component) | Two-way prop binding — the same `target` forms as an element bind (an lvalue or `{ get, set }`). The child reads `prop` normally; if it writes `prop` or forwards it to another `bind:`, those writes flow back to `target`. Bindability is usage-inferred (no child-side marker): a prop only read stays read-only, and a `bind:prop` whose child never writes is simply one-way |
 | `class:name={cond}` | Toggles a class; merges with a reactive `class` base in one effect |
 | `style:property={value}` | Sets one style property; merges with a reactive `style` base |
 | `attach={fn}` | Runs `fn(element)` at build time; an optional returned teardown runs on dispose |
@@ -220,6 +223,15 @@ error):
 | `{#try}…{:catch e}…{:finally}…{/try}` | Synchronous error boundary around a build/reactive throw |
 | `{#snippet name(args)}…{/snippet}` | Declares a reusable builder, called as an interpolation: `{name(args)}`; a snippet value passes through props like any other value |
 
+A `Promise`/`AsyncIterable` (or an async sub-expression) lifts to a peek-cell in
+**every** position (ADR-0032) — content, an attribute, an `{#if}`/`{#switch}`
+subject, a plain `{#for}` source — reading `undefined` while pending, so
+`{getFoo() ?? 'Loading…'}` shows the fallback, `{#if getFoo()}` takes the else
+branch, and a pending `{#for}` renders empty. A leading `await` makes it
+SSR-blocking (resolved inline); no `await` streams (pending shell, resolves on the
+client). The one rejection is a raw `AsyncIterable` driving a plain `{#for}` —
+iterate its frames with `{#for await}`.
+
 Components are capitalised tags (`<Panel prop={x}>…</Panel>`); nested content
 becomes the component's `children` prop — an ordinary declared prop of type
 `Snippet`, read with `const { children } = props<{ children: Snippet }>()`
@@ -248,7 +260,7 @@ if/each/await/switch/…>` control flow (use `{#…}` blocks).
 ### RPC — `@documentation rpc`
 
 - `@abide/abide/server/GET` — GET rpc helper: `export const x = GET(handler, opts?)` inside `src/server/rpc/`; the bundler rewrites it to the server dispatcher or the browser proxy — calling it outside an rpc module throws.
-- `@abide/abide/server/POST` — POST rpc helper (mutating: accepts `outbox`, JSON/FormData body).
+- `@abide/abide/server/POST` — POST rpc helper (mutating: JSON/FormData body).
 - `@abide/abide/server/PUT` — PUT rpc helper (mutating).
 - `@abide/abide/server/PATCH` — PATCH rpc helper (mutating).
 - `@abide/abide/server/DELETE` — DELETE rpc helper (mutating; args travel in the query string).
@@ -300,7 +312,7 @@ if/each/await/switch/…>` control flow (use `{#…}` blocks).
 
 Probes report, never act — reading one opens no fetch and no stream.
 
-- `@abide/abide/shared/pending` — `pending(selector?, args?)`: reactive "no value yet" probe over calls and streams (global, per-rpc, per-call, tagged, per-subscribable; a durable rpc's parked writes count too).
+- `@abide/abide/shared/pending` — `pending(selector?, args?)`: reactive "no value yet" probe over calls and streams (global, per-rpc, per-call, tagged, per-subscribable).
 - `@abide/abide/shared/refreshing` — `refreshing(selector?, args?)`: "holding a value while a fresher one is in flight" — the SWR reload / stream-reconnect badge.
 - `@abide/abide/shared/peek` — `peek(fn, args?)` / `peek(socket)`: the retained value (or latest frame), synchronously, `T | undefined`; reactive inside a tracking scope.
 - `@abide/abide/shared/done` — `done(subscribable)`: true once a stream closed (stream-only; a cache read's "done" is `!pending && !refreshing`).
@@ -308,7 +320,7 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 ### Errors — `@documentation response`
 
-- `@abide/abide/shared/HttpError` — thrown by rpc calls on non-2xx; carries `status`, `statusText`, the raw `response`, and — for typed/validation/queued errors — `kind` + `data`.
+- `@abide/abide/shared/HttpError` — thrown by rpc calls on non-2xx; carries `status`, `statusText`, the raw `response`, and — for typed/validation errors — `kind` + `data`.
 - `@abide/abide/shared/ValidationErrorData` — the `data` shape of a `kind: 'validation'` failure: the raw Standard Schema `issues` plus a `fields` (field → first message) map.
 
 ### Schema projection — `@documentation rpc`
@@ -354,10 +366,6 @@ Probes report, never act — reading one opens no fetch and no stream.
 
 - `@abide/abide/ui/navigate` — `navigate(path, params?, options?)`: typed programmatic navigation off the route map; params interpolate through `url()` (base-correct). Options `{ replace, keepScroll }`. The module also exports `navigatePath(path, options?)` (already-resolved paths — the router's own entry, no re-basing) and the `NavigateOptions` type.
 
-### Outbox — `@documentation ui`
-
-- `@abide/abide/ui/outbox` — the global reactive outbox: `outbox()` lists every durable rpc's undelivered entries (each tagged with its `rpc`), member `outbox.retry()` drains every queue. Empty list server-side. Types `GlobalOutbox`, `GlobalOutboxEntry`.
-
 ### UI plumbing — `@documentation plumbing`
 
 Compiler/runtime machinery — published so generated code, the type shadow, and
@@ -370,14 +378,18 @@ tests can import it, not for app code.
 - `@abide/abide/ui/router` — `router(...)`: the client router — fills layout/page chains into comment-marker outlet boundaries, intercepts in-app links, buckets/restores scroll per history entry.
 - `@abide/abide/ui/startClient` — `startClient(...)`: the client entry — reads every `__SSR__` field into its shared slot (cache seed, health seed, client timeout, resume manifest), hydrates the chain, starts the router.
 - `@abide/abide/ui/renderToStream` — `renderToStream(render)`: out-of-order SSR streaming — shell first, then one `<abide-resolve>` fragment per streaming await block in completion order; blocking (`then`-head) awaits render inline.
-- `@abide/abide/ui/remoteProxy` — `remoteProxy(method, url, opts?)`: the browser-side rpc stub the bundler emits (fetch, decode, HttpError, outbox parking, streaming); the `DurableOptions` type rides along.
+- `@abide/abide/ui/remoteProxy` — `remoteProxy(method, url, opts?)`: the browser-side rpc stub the bundler emits (fetch, decode, HttpError, streaming); the `RemoteProxyOptions` type rides along.
 - `@abide/abide/ui/socketProxy` — `socketProxy(name)`: the browser-side socket stub — the identical `Socket<T>` shape over the page's lazily-opened multiplexed ws channel.
 - `@abide/abide/ui/runtime/escapeKey` — JSON-Pointer-escapes one reactive-doc path key (`~`→`~0`, `/`→`~1`).
+- `@abide/abide/ui/runtime/withPath` — pushes one `escapeKey`-escaped render-path segment for the duration of a synchronous `build`, relative to the ambient path (the render-path identity a layout layer / child mount composes); restores after. A reactively-rebuilt block uses `withPathFrom` with a captured base instead.
+- `@abide/abide/ui/runtime/renderPath` — the render-path a `<Child/>` mounts under: composes a child's ordinal onto the ambient path (`withPath(ordinal, …)`) to produce the `abide:await:CHILDPATH` boundary id, computed identically on both sides so the streamed-child adopter never drifts. Server-emit-only.
+- `@abide/abide/ui/runtime/blockId` — allocates an await/try block id namespaced by the ambient render-path (`${path}:${n}`, per-path document-order counter), so sibling child renders can run concurrently during SSR without their block ids interleaving; the bare (`path === ''`) case keeps the plain `0,1,2…` form.
 - `@abide/abide/ui/runtime/nextBlockId` — the next await/try block id in the current render pass (document order, shared across inlined children).
 - `@abide/abide/ui/runtime/enterRenderPass` — marks entry into a render/mount; the outermost resets the block-id counter.
 - `@abide/abide/ui/runtime/exitRenderPass` — unwinds `enterRenderPass`'s depth.
 - `@abide/abide/ui/dom/mount` — mounts a top-level page/layout into a host under an ownership scope; returns the unmount.
 - `@abide/abide/ui/dom/mountChild` — mounts a nested child component as a comment-marker range (dev builds also register it with the hot bridge).
+- `@abide/abide/ui/dom/mountStreamedChild` — the client mount for a HOISTABLE child (ADR-0039): a dual-mode adopter that probes the hydration cursor to tell whether the server inlined the child (settled) or streamed it (`abide:await:CHILDPATH` boundary, already swapped in), then adopts the range in place — falling back to a create-mount on a client navigation or an unfilled boundary. Registers with the hot bridge like `mountChild`.
 - `@abide/abide/ui/dom/mountSlot` — mounts a component's passed-children content as a marker-bounded range.
 - `@abide/abide/ui/dom/outlet` — a layout's outlet: an empty `<!--abide:outlet-->…<!--/abide:outlet-->` boundary the router fills.
 - `@abide/abide/ui/dom/hydrate` — adopts server-rendered DOM instead of rebuilding: runs the build with a claim cursor over the existing nodes.
@@ -388,7 +400,6 @@ tests can import it, not for app code.
 - `@abide/abide/ui/dom/appendText` — a reactive `{expr}` text node under a parent.
 - `@abide/abide/ui/dom/appendTextAt` — a reactive text node mounted at a skeleton anchor (text interleaved with element siblings).
 - `@abide/abide/ui/dom/appendSnippet` — mounts a `{snippet(args)}` interpolation's builder into a marker-bounded range.
-- `@abide/abide/ui/dom/text` — a text node whose content tracks a reactive read.
 - `@abide/abide/ui/dom/attr` — binds an element attribute to a read (boolean true → bare attribute, false/nullish → removed).
 - `@abide/abide/ui/dom/on` — attaches an event listener whose removal is registered with the ownership scope.
 - `@abide/abide/ui/dom/attach` — runs an `attach={fn}` attachment and registers its optional teardown.
@@ -399,12 +410,20 @@ tests can import it, not for app code.
 - `@abide/abide/ui/dom/switchBlock` — `{#switch}` runtime (also `{#if}` chains with `{:else if}` branches).
 - `@abide/abide/ui/dom/awaitBlock` — `{#await}` runtime: pending → resolved/error branch swap, teardown-generation guarded.
 - `@abide/abide/ui/dom/tryBlock` — `{#try}` runtime: synchronous error boundary around a subtree build.
-- `@abide/abide/ui/dom/applyResolved` — consumes a streamed SSR `<abide-resolve>` chunk, swapping it into its await boundary (the bundle-side counterpart of the doc stream's inline scripts).
 - `@abide/abide/ui/dom/mergeProps` — composes a child's props from explicit thunk runs, spread layers, and the trailing children layer.
 - `@abide/abide/ui/dom/spreadProps` — wraps a `{...source}` spread layer so every key resolves to a live value thunk.
 - `@abide/abide/ui/dom/restProps` — the live unconsumed-props object behind `const { …, ...rest } = props()`.
+- `@abide/abide/ui/dom/bindProp` — the parent half of a component `bind:prop`: annotates a prop's value thunk with a `set` write-back channel.
+- `@abide/abide/ui/dom/bindableProp` — the child half: the writable cell a component gets for a prop it writes or forwards (pass-through to the parent when bound, a local reseeding cell when not).
 - `@abide/abide/ui/dom/spreadAttrs` — spreads an object's keys onto a native element (`<div {...rest}>`), keys enumerated once.
+- `@abide/abide/ui/dom/mutateDocContainer` — the lowering for an in-place mutating container method on a reactive doc (`model.items.splice(…)`, `.sort()`, a Set `.add()`, a Map `.set()`, …): clones the array/Map/Set, applies the mutation to the copy, and writes it back through `replace` so a real patch fires (readers wake, the render tree re-derives); returns the native method's result unchanged.
 - `@abide/abide/ui/dom/readCall` — guarded method call on a reactive-doc read (the `model.draft.trim()` lowering).
+- `@abide/abide/ui/dom/readCell` — unified read for a `linked`/async-`computed` reference (the `$$readCell(NAME)` lowering): peeks an async cell, reads `.value` off a sync one.
+- `@abide/abide/ui/dom/cellPending` — whether a control-flow subject (`{#if}`/`{#switch}`) is a still-loading async cell (no value, no error) so the block renders no branch while pending instead of flashing its `{:else}`; a plain/settled value is never pending.
+- `@abide/abide/ui/settleAsyncCells` — the SSR Tier-2 await-barrier (the `await $$settleAsyncCells()` lowering emitted between a component's cell declarations and its template): drains + awaits the request-scoped in-flight async-cell promises so their resolved values bake into the first-pass HTML.
+- `@abide/abide/ui/flight` — the SSR flight-starter (`$$flight(() => expr)`): hoists a hoistable await's promise into the synchronous render prefix so independent flights overlap instead of serializing; normalises a synchronous loader throw to a rejected promise and carries a synchronous `.settled` snapshot for `finalizeStreamedChildren`. Server-emit-only.
+- `@abide/abide/ui/isolateCellBarrier` — runs a hoisted child render (`$$isolateCellBarrier`) under its own async-cell barrier list (ALS-backed on the server) so its cell registrations and `$$settleAsyncCells` drain stay isolated from concurrent siblings and the page; an inert passthrough on the client. Server-emit-only.
+- `@abide/abide/ui/finalizeStreamedChildren` — the ADR-0039 when-to-stream decision run once after a component's body walk (`await $$finalizeStreamedChildren(...)`): fills each hoistable child's reserved output slot — inlining a settled flight byte-identically to the pre-ADR path, rethrowing a rejected one, or emitting an `abide:await:CHILDPATH` boundary + streaming `SsrAwait` for a still-pending one. Server-emit-only.
 
 ## Build / tooling
 
@@ -443,7 +462,7 @@ tests can import it, not for app code.
 
 | Route | Serves |
 | --- | --- |
-| `/openapi.json` | The OpenAPI document projected from every rpc's method, URL, and schemas |
+| `/openapi.json` | The OpenAPI document projected from every rpc's method, URL, and schemas. The 200 response body comes from `schemas.output` or, absent one, the handler's return type projected to JSON Schema (ADR-0030 D2); each `error.typed(...)` branch the handler can return surfaces as its own status response (ADR-0030) |
 | `/__abide/mcp` | The MCP endpoint (tools from rpcs/sockets, prompts, resources); auth flows from the inbound request |
 | `/__abide/health` | Liveness + identity JSON: framework version, app name/version, plus the app `health(request)` hook's fields; answered ahead of `app.handle` |
 | `/__abide/identity` | Compatibility alias for the same payload with the legacy `abide: true` marker |
@@ -451,7 +470,6 @@ tests can import it, not for app code.
 | `/__abide/sockets/<name>` | A socket's HTTP face: `GET` = retained tail as JSON (SSE stream under `Accept: text/event-stream`; `?tail=N` caps/seeds), `POST` = publish gated by `clientPublish`; 404 unless the socket is exposed to mcp/cli |
 | `/__abide/cli` | `GET` = shell install script; `/__abide/cli/<platform>` streams the thin-CLI tarball (cli + server binaries, `.env` baked with `ABIDE_APP_URL`/`ABIDE_APP_TOKEN`) |
 | `/__abide/inspector` | The `@abide/inspector` UI, mounted only under `ABIDE_ENABLE_INSPECTOR=true` |
-| `/__abide/hot/<moduleId>` | Dev-only component hot-module endpoint backing `.abide` HMR |
 
 ## Environment variables
 

package/CHANGELOG.md

@@ -1,5 +1,182 @@
 # abide
 
+## 0.50.0
+
+### Minor Changes
+
+- 8fb06cf: Async values — `state` holds, `computed`/`linked` track, and a reactive `{#try}` (ADR-0019)
+
+    `state` is now a pure value-taker; `computed`/`linked` track an async source. A `computed(await …)` / `linked(await …)` seed unwraps its promise into an async cell, and a seed producing a stream (`NamedAsyncIterable`) auto-tracks its frames. Async cells wear the probe family (`peek`/`pending`/`refreshing`/`error`/`refresh`, standalone + instance) and have no `.value` — sync → `.value`, async → probes. `AsyncState` adds `set()`, latching a local write until the next reseed.
+
+    `computed(EXPR)` / `linked(EXPR)` now accept a bare expression (wrapped into a thunk unless it is already a `() => …`); a top-level `await` lowers to an eager `async () => …` so independent cells load in parallel, not in a waterfall.
+
+    `{#try}` is a fully reactive error boundary — it catches a throw from a _later_ re-run (where async errors live), not just the initial render, and heals back to the guarded content when the failing cell recovers (`refresh()` or a dependency change), no manual retry.
+
+    Also renames the internal `Subscribable<T>` type to `NamedAsyncIterable<T>` (shape unchanged).
+
+- b790726: Async template interpolation — `{await foo()}`, `{foo()}`, `{getStream()}` (ADR-0019 follow-up)
+
+    A template interpolation now understands async expressions, chosen by the expression's type (resolved through the shadow TypeChecker at build time — zero runtime cost, dev/prod consistent):
+
+    - `{await foo()}` — awaits the promise, **blocking** (bakes into the SSR HTML). Syntactic; desugars to a blocking `{#await … then}` block.
+    - `{foo()}` where `foo()` is a `Promise<T>` — **streaming** (real Tier-3 out-of-order SSR); desugars to a streaming `{#await}` block.
+    - `{getStream()}` where the expression is any `AsyncIterable<T>` (a socket, a streaming rpc, or a plain async generator) — renders the **latest frame**, live, as a stream cell.
+    - A `Promise`/`AsyncIterable` in a value slot that can't be rendered (an attribute, an `{#if}`/`{#switch}` head, a sync `{#each}` iterable) is a **compile error** with a hint, never a silent `[object Promise]`. `{#for await}` stays the sanctioned async-iterable position.
+
+    Errors compose with `{#try}`: a catch-less `{#await}` / `{#for await}` (and these new bare forms) now bubbles a rejection to the nearest enclosing `{#try}` instead of an unhandled rejection.
+
+    The type-directed lowering fails open to a plain read on any type-resolution hiccup, so it can never break a build; a component with no async interpolations is unaffected.
+
+- 53ad08f: Endpoint-declared cache policy; namespace the rpc opts (ADR-0020). All cache/stream policy moves onto the rpc definition and the smart bare call becomes `fn(args)` with no call-site options. Opts are namespaced and kind-scoped by type: `schemas: { input, output, files }`, `cache: { ttl, tags, throttle, debounce, shared }` and `stream: { n }` on read helpers, `outbox` on mutating helpers (a `cache` on a write, or `outbox` on a read, is a compile error). `cache.tags` accepts an arg-derived function. `swr` is removed — SWR is unconditional for replayable reads. `ttl` now defaults to Infinity: an entry is retained for its store's lifetime (the request on the server, the tab on the client), and `shared` alone memoises across requests; a write coalesces only. Endpoint policy also ships to the client so client-side reads honor the declared ttl/refetch clock/tags.
+
+    BREAKING: `inputSchema`/`outputSchema`/`filesSchema` → `schemas: { … }`; call-site cache options (`fn(args, { ttl, tags, … })`) → endpoint `cache: { … }`, and the smart bare call drops its second argument (`fn(args)`). `.raw(args, init)` keeps per-call transport options unchanged.
+
+- 5b2df3f: Type-directed async-cell classification (ADR-0023). A no-marker `computed`/`linked` stream seed now routes by the seed's checker type instead of a syntax heuristic: a stream produced by _any_ expression shape (`computed(obj.stream)`, a conditional) auto-tracks, where before only a bare call/identifier did, and a provably-sync seed skips the runtime probe. Resolved through the warm shadow program and **fails open** to the previous syntactic routing when no program is available; the `await`-marker path is unchanged.
+- 8a61f5b: SSR auto-streaming for pending bare async reads (ADR-0024). A triggered point read still pending at render-return now streams its value into the HTML (shell first, then a resolve chunk) instead of shipping buffered — the server triggers the read and drains it as it settles. A pending read is bounded by its own endpoint `timeout` (which 504s the in-process handler during SSR, shipping a `{ key, miss }` so the client refetches) — there is no separate SSR-stream deadline. A page with no async reads still ships buffered; the Tier-2 blocking barrier and Tier-3 `{#await}` streaming are unchanged.
+- bc83c22: Surface a handler's typed error branches into the generated OpenAPI (ADR-0030)
+
+    A handler's `error.typed(name, status, schema?)` return branches now flow into the generated OpenAPI spec the same way the success body reaches the 200. The warm server program's new `errorSchemasForModule` query walks the handler's return union, reads each `TypedError` brand's numeric status and projects its `data` type to JSON Schema; errors sharing a status combine under `anyOf`, and a nullary error surfaces its status with no body. The resolved map is baked at build time as `errorJsonSchemas` (paralleling `outputJsonSchema`) and `buildOpenApiSpec` merges each into `responses[status]` — never clobbering the 200. So one plainly-typed handler return documents the full contract: the 200 success body plus every typed error's status and payload, nothing declared twice.
+
+    `error.typed` now captures the status as a literal type (`Status extends number`) so the brand carries the exact code — a backward-compatible tightening of its return type.
+
+- 43289e5: Handler-input-typed RPC surface (ADR-0030 input side). The input-side mirror of the return-typed output surface: the warm server program (ADR-0025) gains an `inputSchemaForModule` query that projects the endpoint's input args to JSON Schema through `jsonSchemaForType` — the SAME `Args` bag `inputCoercionForModule` reads (the exported RemoteFunction's first call-signature parameter, `FormData` dropped), with File/Blob members excluded exactly as `filesSchema` stays out of `inputSchema`. The resolved schema is baked into `RpcRegistryEntry.inputJsonSchema`, and the OpenAPI parameters/request body, MCP `inputSchema`, and inspector input surface fall back to it when the author declared no `schemas.input` VALIDATOR (which still overrides it on every surface). This is a SHAPE description only — it is never wired into runtime validation, so it can't produce a 422; an author who wants runtime narrowing still declares `schemas.input`. A build-projected `inputJsonSchema` also makes a plainly-typed read handler advertisable to MCP/CLI without a hand-written `schemas.input` (shape-only, no runtime gate) — the same role a declared input schema plays. Fails open to `undefined` (no warm program / unresolvable Args / File-only body), so a surface behaves exactly as before.
+- fcbdeb2: error-recovering template parser ([`13244a4`](https://github.com/briancray/abide/commit/13244a43f0d73f7873cafc7e351285b89db2b245))
+- fcbdeb2: render-path survives a render's awaits via a server ALS pathStore (ADR-0033) ([`16d76fc`](https://github.com/briancray/abide/commit/16d76fc8c52d047740e9b1b520a8d045c5fb7ac8))
+- fcbdeb2: hoist independent SSR awaits to the render prefix (ADR-0034) ([`20f017c`](https://github.com/briancray/abide/commit/20f017ceb0646c71d8e9d1f352665801b259419f))
+- fcbdeb2: asyncIterable interpolation → stream cell (ADR-0019 stage D) ([`3293e45`](https://github.com/briancray/abide/commit/3293e45355ded950d487c63d1b5e6c9868e8fadc))
+- fcbdeb2: async-cell classify accepts any async iterable (ADR-0019) ([`41d78e7`](https://github.com/briancray/abide/commit/41d78e791d4260f23ceefc691c7504f3a7f4edec))
+- fcbdeb2: catch→catch updates err in place in reactive {#try} (ADR-0019 D3) ([`439dbd3`](https://github.com/briancray/abide/commit/439dbd3843845a9e74c0334b5cbc3d990897bdcb))
+- fcbdeb2: catch-less {#await}/{#for await} bubbles to enclosing {#try} (ADR-0019) ([`5f8dea8`](https://github.com/briancray/abide/commit/5f8dea8912af37ef20c8eb2a684cb20d4584ff89))
+- fcbdeb2: blocking Tier-2 barrier bakes async-cell values into HTML (ADR-0019) ([`659ed41`](https://github.com/briancray/abide/commit/659ed41cecadd8d5c2e74d2d3a11556d5ac9ff63))
+- fcbdeb2: async (sub)expressions lift to a peek-cell in every template position (ADR-0032) ([`72aaef6`](https://github.com/briancray/abide/commit/72aaef680dffd12b8ff9596c7ec9064b651b3445))
+- fcbdeb2: value-position guard for async interpolations (ADR-0019 stage E) ([`748fcb0`](https://github.com/briancray/abide/commit/748fcb00b6eb35b50650e0320f512e43e419a0ef))
+- fcbdeb2: Breaking: ttl defaults to Infinity — store lifetime, not ttl, ends a read (ADR-0020) ([`7715fd8`](https://github.com/briancray/abide/commit/7715fd8d368c8bd65a533452cbf8ba782355c26f))
+- fcbdeb2: render-path identity for async cells — warm-seed across SSR→client ([`8f123b3`](https://github.com/briancray/abide/commit/8f123b37cf07f6f836dfe034a4b2f68f8559d013))
+- fcbdeb2: type-directed interpolation — warm checker + promise→streaming (ADR-0019 stages B+C) ([`91cb6c6`](https://github.com/briancray/abide/commit/91cb6c65670709f53b2b90d300fcb4b84a95540a))
+- fcbdeb2: interpolation type classifier (ADR-0019, type-directed lowering stage A) ([`9351b18`](https://github.com/briancray/abide/commit/9351b18eadfe6cc4b6e9a690a84204a67e58a964))
+- fcbdeb2: Breaking: endpoint-declared cache policy; namespace rpc opts (ADR-0020) ([`95fa41c`](https://github.com/briancray/abide/commit/95fa41c81ccb62b8f16881a96a878ab6be2872bd))
+- fcbdeb2: reactive {#try} error boundary — both directions (ADR-0019 D3) ([`9b38fe6`](https://github.com/briancray/abide/commit/9b38fe65cc512e245eb6fe6a32ec8cd705a5227d))
+- fcbdeb2: warm-seed a streamed child's late async cells (ADR-0039) ([`a8acee3`](https://github.com/briancray/abide/commit/a8acee3ccf8a1c8f5d6813a844c7129615b3beb5))
+- fcbdeb2: ship endpoint cache/stream policy to the client stub (ADR-0020) ([`ae56080`](https://github.com/briancray/abide/commit/ae5608044e92057be224ee7967ce209bf9dc1005))
+- fcbdeb2: source-agnostic async cells for computed/linked (ADR-0019 D1) ([`bc04cbe`](https://github.com/briancray/abide/commit/bc04cbef933d72243c4d5d082431453e418ef2ee))
+- fcbdeb2: value-aware throwing peek for async-cell reads (ADR-0019 D3.2) ([`c19af9b`](https://github.com/briancray/abide/commit/c19af9b7e18e8d03cc24f8f2dd527ac346ff3476))
+- fcbdeb2: computed/linked wrap + await lowering (ADR-0019 D2) ([`c1dc57d`](https://github.com/briancray/abide/commit/c1dc57dcfab12bd11081e157a653b97cd951db70))
+- fcbdeb2: revive Date/Set/Map/bigint input args via a type-directed wire codec (ADR-0029) ([`c70e2f7`](https://github.com/briancray/abide/commit/c70e2f73d9946763f5fa8a1853942d6174cccb0e))
+- fcbdeb2: {await expr} interpolation → blocking await block (ADR-0019) ([`d11cbc2`](https://github.com/briancray/abide/commit/d11cbc2e995fdce6c1003b1db4ead6996431078e))
+- fcbdeb2: client rpc transform via module graph + reachability guard (ADR-0022 D2/D3) ([`ddf1fd2`](https://github.com/briancray/abide/commit/ddf1fd215cca169421cb0d5bcfba0a728ec196d8))
+- fcbdeb2: computed(getStream()) compile auto-track via trackedComputed (ADR-0019 D1) ([`e964253`](https://github.com/briancray/abide/commit/e964253dbb9d21e9a57acf0f2f94026561cdca86))
+- fcbdeb2: stream non-cache streaming-cell values, adopt post-hydration (ADR-0035 phase 1) ([`f553731`](https://github.com/briancray/abide/commit/f5537310af6396ea9359e5dc8f7fddafe301c4a1))
+- fcbdeb2: render-boundary streaming foundation + ADR-0039 ([`f83d828`](https://github.com/briancray/abide/commit/f83d82865eeb6a3e4ccc1cb824f24a9180755a89))
+- fcbdeb2: project handler input type into mcp/cli/openapi surfaces (ADR-0030 input side) ([`fd13fa1`](https://github.com/briancray/abide/commit/fd13fa185ba2617f350d416199016bd523c14d0d))
+- 6749824: Client-side input validation, always on (ADR-0026). When an rpc endpoint declares `schemas: { input }`, the client `remoteProxy` now validates the typed args against that schema before the fetch and, on a definitive failure, throws an `HttpError` shaped identically to the server's 422 (`kind: 'validation'`, the same field-error `data`) — no round-trip. A validator that _throws_ (a non-portable / async-resource refinement that can't run in the browser) falls through to the server instead of failing the call, so adding a schema can never break a request. Server validation stays authoritative and unconditional — the client check is a UX optimization only. No configuration: it runs whenever an input schema is present.
+- b0cb79a: Remove the durable outbox and other unreachable surface — a tighter core
+
+    **Breaking:** the durable-delivery outbox is gone. The `@abide/abide/ui/outbox` export (`outbox()`, `outbox.retry()`, `GlobalOutbox`), the `outbox: true` rpc option (POST/PUT/PATCH/DELETE), the reserved `kind: 'queued'` error, and `OutboxEntry` are all removed. A mutating rpc now simply fetches and throws; durable local-first delivery is left to userspace (wrap the call, park failures in your own persisted queue via `fn.raw`). `RemoteFunction` loses its `Durable` type parameter and `.outbox` face; `remoteProxy`'s `DurableOptions` is renamed `RemoteProxyOptions`.
+
+    Removing outbox also drops the client persistence stack it was the only caller of (`persist`, `localStoragePersistence`, `PersistenceStore`/`PersistHandle`) and a whole build-time type-query (`outboxForModule`) from the warm server program.
+
+    Alongside it, several never-wired internals were deleted: the withdrawn `Scope` capability methods (`record`/`persist`/`broadcast`/`undo`/`redo`/`canUndo`/`canRedo`) and their `history`/`sync` backends, the unused `Scope.child`/`Scope.root` tree helpers, and the per-patch `PatchEvent.inverse` pre-image (computed on every mutation but read by nothing since the journal left). No behavioural change for app code that didn't use these.
+
+### Patch Changes
+
+- d5c3a04: Route the rpc method + `outbox` build transforms through the warm server program (ADR-0025 phase 2)
+
+    Phase 1 warmed one per-root `ts.Program` over the server module graph and used it only for streaming detection (gated on a build-cost budget). Phase 2 lifts that budget — the ~0.5 s cold cost is paid once per root, amortized, and always fail-open — and routes the two remaining text-scanners through the same warm program:
+
+    - **HTTP method** now resolves off the export helper's _symbol_ (following import aliases and re-exports), so `export const x = read(fn)` where `import { GET as read }` correctly types as `GET` in the generated `rpc.d.ts`, where the `RPC_EXPORT` regex read nothing.
+    - **`outbox`** now resolves off the opts object's property _type_, lifting "must be an inline literal" to "must be statically known" — an imported const (`outbox: OUTBOX_ENABLED`) resolves to its literal `true` instead of erroring, and an `outbox:` mention inside the handler body is ignored.
+
+    Every query fails open to today's regex/char-scan (no warm program, an unresolvable node, or a checker throw → byte-identical to before), so this can only harden, never break, a build. The hand-rolled scanners remain as that fallback and as the residual span-finder for splicing.
+
+    Also adds a one-line build-start log (`[abide] building client bundle…`, one-shot builds only) so the program-warming pause at the start of `abide build`/`compile` isn't mistaken for a hang.
+
+- 831ae88: Streaming rpc detection resolves through a warm `ts.Program` (ADR-0025). Whether a handler streams (returns `jsonl()`/`sse()`) is now decided by the handler's **return type** via a warm per-project-root program, instead of scanning the handler body for the call name — which fixes the wrapper-indirection blind spot where a handler returning a stream through a helper function was misclassified as a point read on the client. Built once per project root (a one-time boot cost, reused across every rpc in the build) and **fails open** to the previous char-scan.
+- 95b4b13: Server-side type-directed query/form coercion (ADR-0028). A GET or form-encoded request delivers every field as a string, so a plain `z.object({ n: z.number() })` used to 422 on `?n=2`. The warm server program (ADR-0025) now reads the endpoint's wire `Args` type and stamps a build-time `coerce` plan of exactly which fields are numeric/boolean; `parseArgs` coerces those string values to their typed value before validation. Only fields the type declares numeric/boolean are coerced, so a string field that merely looks numeric (an id, a zip code, `'1.0'`) stays a string; a self-coercing schema's loose input is left for the schema to coerce; and with no warm program every field stays a string exactly as before (fail-open). Closes the long-standing `parseArgs` query-coercion TODO and completes the server half of client-side validation (ADR-0026).
+- aa21b7c: Type-directed wire codec — output/response path (ADR-0029)
+
+    A handler's structured RETURN values now round-trip to the client instead of being lost or crashing. Previously `json()` serialized via plain `JSON.stringify`, which dropped a `Set`/`Map` to `{}` and threw a 500 on a `bigint`.
+
+    - **Server encode (all clients).** `json()` now serializes through a value-directed wire replacer: a `Set` crosses as a JSON array, a `Map` as an array of `[key, value]` entries, a `bigint` as a digit string, a `Date` as an ISO string. The wire stays honest, tag-free JSON, so curl / OpenAPI SDKs read it and it matches the generated schema.
+    - **Client decode (abide clients).** The warm server program resolves the handler's success-body type to a per-field output plan (`date`/`bigint`/`set`/`map`) and bakes it onto the client `remoteProxy` stub. The proxy revives those fields off a decoded response, so a `Set`/`Map`/`bigint`/`Date` return arrives as the real runtime type. A genuine array is untouched; no plan / an unrevivable value fails open to the honest-JSON form.
+    - **Projector coherence.** The `ts.Type` → JSON Schema projection now maps `Set<T>` → `array` and `Map<K,V>` → an array of `[K,V]` tuples, so the generated OpenAPI 200 matches the actual bytes.
+
+    Deferred: nested/recursive descent, streaming-frame (`jsonl`/`sse`) encoding, and server-side in-process revival.
+
+- 52a7e5c: Type-directed structured input wire codec (ADR-0029). Generalizes ADR-0028's scalar query coercion to structured value kinds: the same warm server program now classifies a top-level `Args` field as a `Date`/`Set`/`Map` (by symbol identity through the checker) or a `bigint` (by type flag) and stamps it into the endpoint's build-time `coerce` plan. `parseArgs` revives each declared field from its plain-JSON wire form before validation — an ISO string → `Date`, a numeric string → `bigint`, a JSON array → `Set`, a JSON entries array (or object) → `Map` — so a `Date` GET argument or a non-abide JSON client's structured body reaches the handler as the right runtime type instead of a raw string/array. Top-level fields only; the wire stays tag-free (type-directed, not tag-directed) so a plain-JSON / OpenAPI client still reads it. Fail-open throughout: no plan, an unrevivable value, or an already-typed value (the abide client's own ref-json body, which already round-trips these kinds) passes through as today's behavior — never a throw. The symmetric response/output codec is deferred (the response path serializes with plain `Response.json`, which needs a server-side encode step first).
+- 8b9505d: Handler-return-typed RPC output surface (ADR-0030 D2). A `ts.Type` → JSON-Schema projector (`jsonSchemaForType`) generates an rpc's OpenAPI 200 / MCP `outputSchema` / inspector output shape from the handler's return type when no `schemas.output` validator is declared — the complement of `jsonSchemaForSchema` (which projects a runtime validator). It covers the subset abide's `json()`/`jsonl()` emit (primitives, string-literal `const`/`enum`, objects with `required`, `Record` → `additionalProperties`, arrays, tuples, unions with optional-stripping, `Date` → `date-time`, `bigint` → string per ADR-0029) and fails OPEN — an unsupported/unresolvable type projects to permissive `{}` (omitted at the top level), with a mandatory cycle guard so a recursive type can't infinite-loop; it never throws, so a projection gap can't break a build.
+
+    The warm server program gains a `returnBodySchemaForModule` query that resolves the same success-body `ts.Type`(s) as `returnBodyForModule` and runs the projector. Since the OpenAPI/MCP/inspector surfaces render off the runtime rpc registry (not the build-time program), the resolver plugin BAKES the projected schema into the server `defineRpc` call — stamped as `outputJsonSchema`, exactly like the ADR-0028 `coerce` plan — so the registry entry carries it at runtime. A declared `schemas.output` validator still overrides the projection (a runtime narrowing the type can't express); with neither, the surface omits the response schema exactly as before.
+
+- 32a2203: Handler-return-typed RPC surface foundation (ADR-0030). The warm server program (ADR-0025) gains a `returnBodyForModule` query: it reads the endpoint's success-BODY type off the handler's return type the same way streaming detection already reads it — unwrap `Promise`, drop the `TypedError` branches, take each success `TypedResponse<Body>` body (the type-side mirror of `RpcHelper`'s `SuccessBody<R>`). A streaming endpoint reports its per-FRAME type (the `AsyncIterable` element) and `streaming: true`, so a surface can describe one streamed item. Like every other server-program query it fails open to `undefined`. This is the output-side sibling of ADR-0028's `inputCoercionForModule` — the handler's return becomes the single source for the generated surfaces so a plainly-typed handler needs no redundant `schemas.output`. Consumer wiring (OpenAPI 200 / MCP `outputSchema` / `.d.ts`) is deferred: those surfaces want JSON Schema and the only projector today (`jsonSchemaForSchema`) runs off a runtime Standard-Schema object, not a TS type — a TS-type→JSON-Schema projector is the follow-up. Client typing needs nothing here: the caller's `Return` already flows natively from the imported rpc module (ADR-0022).
+- 3160daa: Factor the post-DCE metafile walk into a reusable analysis seam and add a bundle-budget diagnostic (ADR-0031 D2). The client build's `build.onEnd` reachability pass is now `bundleGraphFromMetafile` — one walk of `Bun.build`'s metafile into a `BundleGraph` (`{ modules, importerChain }`) that both the side-crossing guard (unchanged behavior) and a new consumer read. First consumer: a non-blocking bundle-budget warning — a project `src/` module that survives tree-shaking into the client bundle over 512 KiB earns an `abideLog.warn` with its import chain, so an accidentally-huge input becomes observable without a new bundler pass. Never fails the build; the only hard `onEnd` failure remains a real client-reachable `$server/*` violation. ADR-0031 D1 (sharpening the post-await tracking lint with the script-region classifier) is deferred: the spike found the classifier precise but the current warning already never fires on the inert captures it was meant to stop flagging.
+- 43289e5: Render-path identity now holds for async cells nested in control flow and across a render's awaits (ADR-0033), fixing warm-seed misses that made such cells refetch and flash on hydrate. Two parts. First, `generateSSR` pushes the same render-path segment the client pushes inside `{#each}`/`{#if}`/`{#switch}` (keyed key / keyless row index for each; `then`/`else` or switch branch-index) — previously only child components got a segment, so a cell in a loop/branch composed a divergent scope id server-vs-client. Second, the render-path base itself now survives a render's `await`s: `withPath`/`withPathFrom` set `CURRENT_PATH` and restored it synchronously, but an SSR render's `build()` returns a pending promise awaited outside the wrapper, so the base was restored the instant a render yielded — any scope created past that await (a 2nd sibling child, anything after a page-level cell barrier, a child two awaits deep) composed against an ancestor's path. The swappable `ambientPathBacking` widens from `{get,set}` to `{run,get}`; the server backs `run` with a dedicated `AsyncLocalStorage` (`pathStore`) whose value is inherited by the render's post-await continuations, and `CURRENT_PATH.current` becomes read-only. The client keeps its synchronous save/restore (its mount is synchronous). No codegen change; `CURRENT_SCOPE` was audited and does not share the bug.
+- a6c5749: Independent SSR awaits now render in parallel, not in series (ADR-0034). An independent blocking `{await X}` and streaming `{#await Y}` used to render in the SUM of their latencies: the blocking await halts the sequential render walk, and the streaming flight is a deferred thunk drained only after `render()` returns, so a streaming read behind a blocking await couldn't start until it settled. The SSR back-end now hoists each _hoistable_ await's promise-START into the synchronous render prefix (server-only, via a new plumbing `$$flight` helper) so independent flights overlap — an await is hoistable when its promise references only component-scope names (no `{#for}`/`{:then}`/snippet binder, no async cell), is not inside a conditional branch, and is statically-single. The block's boundary markers, `$ctx` block-id, the RESUME/streaming wire, and the entire client build are untouched, so hydration is byte-identical and the client stays fully reactive. On the kitchen-sink `templating/async` page this cuts SSR from ~842ms to ~427ms (max, not sum). Transparent: no code change for app authors; a page with a single or no async await is unaffected.
+- a6c5749: Non-cache streaming peeks stop flashing `loading…` on hydrate (ADR-0035). A bare async peek whose loader is a plain (non-cache) promise — `{loadProfile(attempt)?.name}` — shipped pending in the SSR shell and the client cold-re-ran its seed on hydrate, so it showed `loading…` for the full latency even though the server had already computed the value. Unlike a `{#await}` block (streams its resolved HTML fragment) or a cache-backed peek (streams its cache entry via `__abideResolve`), a plain-promise peek had no server→client value channel. It now does: a streaming cell records its settled value in a per-request partition, the page renderer streams it after the shell as an `__abideResolve({ cellKey, value })` chunk keyed by the cell's render-path id, and the client adopts it as a POST-hydration reactive update (deferred a microtask so it lands after the pending markup is claimed — no `assertClaimedText` desync). Values (not promises) are recorded so a cell that stays pending all request can never hang the response; only cells settled by the drain are streamed (a page with a blocking `{await}` or barrier — the common case — is covered; a pure-streaming-peek page cold-runs as before). Reactivity and the RESUME/`$resume` wire are untouched. Transparent behaviour improvement; no API or config change.
+- 56b948e: An inline (bare smart read) rpc call now seeds the SSR warm snapshot regardless of HTTP method, so it hydrates warm instead of re-firing after render (ADR-0036). Previously only GET entries rode the warm snapshot: a non-GET rpc consumed inline in render position — e.g. `{html(highlightCode({ code, lang })?.html)}` where `highlightCode` is a POST (POST so the large `code` payload rides the body, not a multi-KB query string) — ran the handler in-process during SSR **and** re-fetched on the client after hydration, firing the call twice per page load (a second POST can 500 on a unique constraint / double-mutate). The `{ GET }` gate conflated two concerns: _seeding_ the SSR-computed body (safe for any method — the value already exists) and _re-firing_ the stored request unprompted on invalidate/refresh/staleness (safe only for GET). They're now decoupled: seeding is gated on "the entry carries a wire request" (any method), while re-firing stays GET-only — `REPLAYABLE_METHODS` is unchanged, so a write is still coalesce-only (re-submittable), never SWR-retained, and never auto-replayed from the snapshot. A seeded write is read warm once during hydration; a later reactive re-read re-issues it live with real args. Keying already includes canonical-JSON body args, so each inline write seeds under its own distinct key. Verified: an inline POST hydrates warm with zero post-hydration refetch. No API or config change.
+- 126474d: SSR await/try block ids are now keyed by render-path instead of a single flat counter (ADR-0037), making block-id allocation congruent SSR↔client even under concurrent renders. Previously every `await`/`try` block drew from one monotonic counter shared across a component and the children it inlines (`$ctx.next++` server / `RENDER.blockId` client), which only stayed congruent because sibling child renders ran strictly sequentially — the blocker to parallelizing them. A block id is now `${render-path}:${n}` (a per-path counter), reusing the ADR-0033 AsyncLocalStorage render-path so each child's ids live in their own namespace; a pathless render (a top-level page with an empty route key, or a bare test component) keeps the plain `0,1,2…` form, so the common case is unchanged. DOM adoption was already positional (boundary-marker ids are not compared, only the `RESUME` manifest key is), so the id widened `number → string` with no parser change. This is a transparent refactor — id allocation order is unchanged, so behaviour is identical and the full hydration suite stays green. On that foundation, **sibling `<Child/>` renders now run in parallel during SSR** (ADR-0037 Phase 2): a hoistable top-level-spine child render (childless, prefix-evaluable props, no `bind:`) starts in the render prefix as an isolated `$$flight` and is awaited at its position, so independent cards render in ~max not ~sum of their latencies while the HTML still assembles in source order. Each hoisted render runs under its own async-cell barrier list (`isolateCellBarrier`, a server-only per-render AsyncLocalStorage) so concurrent siblings never `splice(0)`-drain each other's cells. Transparent — same HTML, same hydration; only independent child work overlaps. No API or config change.
+- dc064ac: A route's layout layers now render in parallel during SSR (ADR-0038). Previously `renderChain` rendered the layout chain (outermost layout → … → page) sequentially, so a route with N layouts each doing an independent I/O read flushed its shell in the sum of their latencies. Now the layers render via `Promise.all`, each under `isolateCellBarrier` (so their async-cell barriers don't cross-drain) and its distinct route-key `withPath` (so path-keyed block ids stay collision-free) — the html fold and state/awaits/resume aggregation run after all settle and are order-independent, so output and hydration are byte-identical, just faster. A lone page with no layouts still renders directly (no wrapping overhead, same bare-read streaming timing). Server-only; reuses the ADR-0037 primitives. Verified with a timing test (three layers ~40ms each render in ~max not ~sum) and the full hydration suite. No API or config change.
+- 3bfdcb6: A slow hoistable child component now STREAMS its fragment during SSR instead of blocking the shell (ADR-0039). Previously every hoistable `<Child/>` was awaited inline, so a page's shell couldn't flush until its slowest child settled. Now `generateSSR` reserves each hoistable child's output slot and, after the walk, `finalizeStreamedChildren` decides per render: a child whose isolated flight has already SETTLED inlines its html byte-identically to before (so an all-fast page is completely unchanged — one microtask, no macrotask, same wire), while a still-PENDING child gets an empty `abide:await:CHILDPATH` boundary in the shell and streams its `<abide-resolve>` fragment when it settles. The boundary id is the child's render-path, congruent with the client. The client emits a dual-mode `mountStreamedChild` for the same children: it probes the hydration cursor and adopts either an inlined `[ … ]` range or a swapped-in streamed boundary, with a plain create-mode mount on client navigation. Verified: three ~40ms sibling cards stream in ~max not ~sum, a streamed child hydrates with no desync, and fast/existing children stay byte-identical. Remaining refinement: warm-seeding a streamed child's late-resolving async cells (a blocking `{#await}` inside it already adopts via its resume delta). No API change.
+- fcbdeb2: clear stale rows on eachAsync reseed ([`0173073`](https://github.com/briancray/abide/commit/01730732141c7a7f54001a4a9ba35b6749757412))
+- fcbdeb2: reap embedded server on failed boot, bound readiness probe, escape plist XML ([`04cee1c`](https://github.com/briancray/abide/commit/04cee1c0f60098b55f69321d407886bbf23fae53))
+- fcbdeb2: green up main — biome lint errors block the release run ([`0833487`](https://github.com/briancray/abide/commit/08334878be6191f7994543997a4b8403f36c4ebe))
+- fcbdeb2: single source of truth for the proxied server subdirs ([`094892b`](https://github.com/briancray/abide/commit/094892b7de07751277bf735271080971daaa2384))
+- fcbdeb2: guard streamed cancel race that logged a stray "Controller is already closed" ([`0bbc93c`](https://github.com/briancray/abide/commit/0bbc93cea4192cb2104e6ff83dd231c858d25fd4))
+- fcbdeb2: one schema resolver for all surfaces — fixes CLI drift ([`1083327`](https://github.com/briancray/abide/commit/10833276b5ddb00d1267f6736cc375de732c15a2))
+- fcbdeb2: stop the SSE face dropping Set/Map/bigint; unify the wire codec ([`17ca2d2`](https://github.com/briancray/abide/commit/17ca2d219450af1300ef25182eb16c4db6f5c7ca))
+- fcbdeb2: mint the warm-seed cell key through one shared warmSeedKey ([`233787e`](https://github.com/briancray/abide/commit/233787e0c330e8c43926fcc46df6de77ece3116c))
+- fcbdeb2: rename Socket.broadcast() to publish() to match Bun ([`250c883`](https://github.com/briancray/abide/commit/250c883a035cf9748129d4aa3e17b65a5a5a6189))
+- fcbdeb2: fold REACTIVE_CALLEES into signal-ref lowering ([`269b762`](https://github.com/briancray/abide/commit/269b7623d422f4b1e556e46e8f8c7b68017f874d))
+- fcbdeb2: rename Subscribable to NamedAsyncIterable ([`2d17ed2`](https://github.com/briancray/abide/commit/2d17ed23b9c3c5c18adb56feadaf1882c4d991c3))
+- fcbdeb2: share one lenient percent-decode helper ([`3b7f320`](https://github.com/briancray/abide/commit/3b7f32088b514f49dd088893ebd7318c4cc0b8bb))
+- fcbdeb2: drive LSP tokens from the parse, delete both lexers ([`4301e97`](https://github.com/briancray/abide/commit/4301e97abd8b612ebcfb6639426447947046c6b5))
+- fcbdeb2: swap streamed SSR fragments via an inline script, dropping the resolved-frame runtime path ([`431aee3`](https://github.com/briancray/abide/commit/431aee3c406b8181e039a86b04c74192b4222964))
+- fcbdeb2: drop the separate SSR-stream deadline; endpoint timeout governs (ADR-0024) ([`48e45d9`](https://github.com/briancray/abide/commit/48e45d9cf7c922cb9a846829f7ef5b2acee527de))
+- fcbdeb2: thread rpc build stamps as one named RpcBuildStamps payload ([`493a6ac`](https://github.com/briancray/abide/commit/493a6ac0467e6d77ef180e807d769747270c1fd4))
+- fcbdeb2: one-shot cell warm-seed + structural render-path key alignment ([`4a5383f`](https://github.com/briancray/abide/commit/4a5383f64ebadc511a8f55809f899b98d0a734d2))
+- fcbdeb2: migrate disconnected.abide to {#if}/{#for} block syntax ([`57bd904`](https://github.com/briancray/abide/commit/57bd904fd84250c7e1cfd97d84483907fc25cbf3))
+- fcbdeb2: pin the runtime and shadow front-ends to one async-lift plan ([`58e9691`](https://github.com/briancray/abide/commit/58e9691eea870650bf219a33cef2b523f3c5dc10))
+- fcbdeb2: replace reachable's poll registry with a TTL memoize ([`5bd426e`](https://github.com/briancray/abide/commit/5bd426ef4701b2da11531cc30779bd2a953cac20))
+- fcbdeb2: restore in-place HMR for streamed children; review cleanups ([`5eec25d`](https://github.com/briancray/abide/commit/5eec25d0fb27d688e2caa0f180968de5fbefe9c2))
+- fcbdeb2: remove the inspector Reactive tab + PATCH_BUS ([`64e4da9`](https://github.com/briancray/abide/commit/64e4da957144fea6f7a6ecbd4415bf1db219f7c3))
+- fcbdeb2: sync AGENTS.md/README to the ADR-0020 rpc API; format touched files ([`6dcc3dd`](https://github.com/briancray/abide/commit/6dcc3dd5a21cb334bf742e0fd6ef461013eb3cfb))
+- fcbdeb2: refresh getHello templates for NamedAsyncIterable + schemas.input/output ([`7233a9b`](https://github.com/briancray/abide/commit/7233a9b11e663655f87f32e08b5ea98d20cdba7d))
+- fcbdeb2: cache parsed SourceFiles across shadow programs ([`7241ca2`](https://github.com/briancray/abide/commit/7241ca244e1c6bd84dfb94d3c20ff1cfe70cc752))
+- fcbdeb2: remove component hot-module replacement ([`7469c1d`](https://github.com/briancray/abide/commit/7469c1d1b1f2c175c2facfe4288ad81b0f89d063))
+- fcbdeb2: stop stale-worker 500s; move codegen off the boot hot path ([`7c5b241`](https://github.com/briancray/abide/commit/7c5b2417c3ba6737d897c264837ca66a79282a99))
+- fcbdeb2: sort imports ([`7fcd071`](https://github.com/briancray/abide/commit/7fcd0714ce337359bc11347fa243dff64ed682de))
+- fcbdeb2: share block-keyword vocabulary so LSP highlighting can't drift ([`95ac19a`](https://github.com/briancray/abide/commit/95ac19a058574f8bba36aae64d20791c84a4e820))
+- fcbdeb2: drop the runtime-helper binding backstop ([`9ba3513`](https://github.com/briancray/abide/commit/9ba3513432dd5639f93c0a61555d70ba510ff359))
+- fcbdeb2: share the anchored-branch skeleton across await and try blocks ([`a301f0e`](https://github.com/briancray/abide/commit/a301f0e101e314ef904f4f26cd157937de2a8bd2))
+- fcbdeb2: green up main CI — biome lint + strict-consumer typecheck ([`a39e030`](https://github.com/briancray/abide/commit/a39e0307e69e738717d9827464141a85a99dd1e4))
+- fcbdeb2: remove the client→inspector BroadcastChannel bridge ([`a4920ea`](https://github.com/briancray/abide/commit/a4920ea3d969bd0812e4146acb80b775ba8807cf))
+- fcbdeb2: surface diagnostics when the .abide source can't be read ([`a6b1881`](https://github.com/briancray/abide/commit/a6b188138e354fee2b4adb6ae80c4882d78c28c4))
+- fcbdeb2: log streaming rpc handler errors server-side ([`a81d99d`](https://github.com/briancray/abide/commit/a81d99d442ae1f1ba73a98e5c5dc2a51078ba2d2))
+- fcbdeb2: bound the stream-swap node removal to the matching close marker ([`aa3bce6`](https://github.com/briancray/abide/commit/aa3bce6bcb5ddfe1d29f76d8abae3e58d2b4a89d))
+- fcbdeb2: revive wire fields in cache()/peek(); evict idle lifecycle channels ([`b1ffe5a`](https://github.com/briancray/abide/commit/b1ffe5a7676066e71af4ce3bfc7124ddb9ab4bd9))
+- fcbdeb2: consolidate framework plain-text responses ([`b8cbb72`](https://github.com/briancray/abide/commit/b8cbb721e7cb6fbe86016db197d942ec413fc211))
+- fcbdeb2: hoist three duplicated constants to shared origins ([`d0ee9df`](https://github.com/briancray/abide/commit/d0ee9dfeb35582646e33bb317f4c219141fad4d1))
+- fcbdeb2: push render-path segments for each/if/switch rows and branches ([`d2d927a`](https://github.com/briancray/abide/commit/d2d927ac814622e4b258db944d75c930d64733c7))
+- fcbdeb2: guard linked seed arg for noUncheckedIndexedAccess (consumer tsconfig) ([`d643b2b`](https://github.com/briancray/abide/commit/d643b2b467a1ec03b493af8f38a4e3e1f5b74bde))
+- fcbdeb2: satisfy noUncheckedIndexedAccess in the template parser ([`dad539d`](https://github.com/briancray/abide/commit/dad539dd039f2ae44e159c2b544a9d27953b780b))
+- fcbdeb2: fold hydratingSlot + wakeHydrationPeeks into hydrationWindow ([`dd9c682`](https://github.com/briancray/abide/commit/dd9c682d732f9d89c3412018f9c5656b58025ddc))
+- fcbdeb2: move URL-shape route decisions behind createAppRouteResolver ([`e639324`](https://github.com/briancray/abide/commit/e63932426d81268f9fbc75806a7e26263f310ca0))
+- fcbdeb2: refresh AGENTS/README for the wire codec, typed-error OpenAPI surface, and inline {await} ([`eecfe14`](https://github.com/briancray/abide/commit/eecfe145389e8c11f7e83c8d2babbc4ea3e92732))
+- fcbdeb2: remove the dead scope-label plumbing ([`f068887`](https://github.com/briancray/abide/commit/f0688875b77677b670b145ce90982e93e9a1a545))
+- fcbdeb2: gate refresh/invalidate reload on a live tracking reader ([`f0af782`](https://github.com/briancray/abide/commit/f0af782936a87a18cbb4f70c3926315cf6180b31))
+- fcbdeb2: one origin for the rpc/socket shim global names ([`f0baaaf`](https://github.com/briancray/abide/commit/f0baaaffc04d55b32b906fff454221f27b190366))
+- fcbdeb2: one wire-field decoder for input and output ([`f16f005`](https://github.com/briancray/abide/commit/f16f005933509dc5b1e1ee824a3bdca5cf036acd))
+- fcbdeb2: extract the /__abide/* plumbing router from createServer ([`f8f5e22`](https://github.com/briancray/abide/commit/f8f5e227eff0149766281cd254193544099a638b))
+- fcbdeb2: props type honors the destructure annotation — types work like TS (ADR-0022 D4) ([`fd3f74f`](https://github.com/briancray/abide/commit/fd3f74ffa9e938f1c87ec648fe1e4ccad20bde9b))
+- afccb13: `abide check` now counts slotted content toward a required `children` prop. The shadow's completeness check treated `children` like any other prop, so `<Card>text</Card>` mounting a component that declares `children: Snippet` was falsely flagged as missing `children` — forcing `children?` optional as a workaround. Slotted content now satisfies the requirement (matching the runtime, which lowers it to the `children` layer), while a childless `<Card />` is still flagged. All other completeness and excess-prop checks are unchanged.
+- 7e4309e: `bind:prop` now works on components, mirroring `bind:attr` on elements. `<Child bind:value={target} />` passes the prop with a two-way write-back channel — `target` takes the same forms an element bind does (an lvalue, or a `{ get, set }` accessor). The child reads the prop as usual; if it writes the prop (`value += 1`) or forwards it to another `bind:` (`<input bind:value={value} />`), those writes flow back to the parent's `target`.
+
+    There is no child-side marker: bindability is inferred from usage. A prop the child only reads stays a cheap read-only derive (unchanged); one it writes/forwards is upgraded to a writable cell that is a pass-through to the parent when bound, and a local reseeding cell when not (so a component still works standalone). Previously `bind:` on a component was a silent no-op passed through under a `bind:`-prefixed prop key.
+
+- 4020519: Reactive-doc `Set`/`Map` mutations now emit a patch. The doc codec already serializes `Map` and `Set`, but a mutating method on a doc-held collection (`model.tags.add(x)`, `model.byId.set(k, v)`, `.delete`/`.clear`) lowered to a bare in-place call that mutated the live tree by reference and fired no patch — so readers never re-rendered and undo/persistence/sync never saw the change. These now route through the same clone-apply-replace path the in-place array methods use (`$$mutateDocArray` generalized to `$$mutateDocContainer`, covering Array, Map and Set); the mutating method names are disjoint across the three kinds, so the container kind is decided at runtime with no compile-time type check.
+- eaa1829: `done()` / `peek()` are null-tolerant, so a probe fed a pending peek-lift no longer 500s
+
+    Under ADR-0032 a promise/iterable subexpression peek-lifts to `undefined` while pending, so writing a probe inline in a template — `{done(getFeed())}` / `{peek(getFeed())}` — hands the probe `undefined` on the first render pass. `done()` now returns `false` and `peek()` returns `undefined` on a nullish argument instead of throwing on `subscribable.name`, turning that pending render from an SSR 500 into a graceful empty state. Probing in script (`const closed = state.computed(() => done(feed))`) remains the correct idiom for an accurate stream probe, since a lifted `AsyncIterable` peek yields the latest frame, not the source.
+
 ## 0.49.0
 
 ### Minor Changes

package/README.md

@@ -30,7 +30,7 @@ cd examples/kitchen-sink && bun run dev
 
 An RPC is one exported handler per file under `src/server/rpc/` — the file path
 is the URL. The export wraps the handler in an HTTP-method helper (`GET`,
-`POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`); a Standard Schema `inputSchema`
+`POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`); a Standard Schema `schemas.input`
 (zod, valibot, arktype — no adapter) validates the args and projects the CLI
 flags, the MCP tool, and the OpenAPI operation from the one declaration.
 
@@ -44,10 +44,12 @@ import { listMessages } from '$server/store'
 export const getMessages = GET(
     async ({ room, limit }) => json(await listMessages(room, limit)),
     {
-        inputSchema: z.object({
-            room: z.string(),
-            limit: z.coerce.number().default(50),
-        }),
+        schemas: {
+            input: z.object({
+                room: z.string(),
+                limit: z.coerce.number().default(50),
+            }),
+        },
     },
 )
 ```
@@ -83,7 +85,7 @@ over `fetch` in the browser. Around it:
 - `getMessages.pending(args?)` / `.refreshing(args?)` / `.error(args?)` —
   reactive probes
 - a handler that returns `jsonl()`/`sse()` makes the bare call return a
-  `Subscribable` you `for await` — detected at build time, nothing to declare
+  `NamedAsyncIterable` you `for await` — detected at build time, nothing to declare
 
 > Query args travel as strings — use `z.coerce.*` for numbers and booleans on
 > GET/HEAD. The per-RPC `timeout` option is a server-side handler deadline
@@ -110,7 +112,7 @@ export const chat = socket({
 })
 ```
 
-`chat.broadcast(msg)` publishes from either side — schema-validated on the
+`chat.publish(msg)` publishes from either side — schema-validated on the
 server, and client publishes are gated by `clientPublish`. `for await (const
 msg of chat)` is the live stream; `chat.peek()` reads the latest retained
 frame; `chat.refresh()` re-pulls the server tail after a reconnect. A schema
@@ -205,6 +207,9 @@ template grammar:
         {room} — {shout}
     </h1>
 
+    <!-- {await expr} awaits inline (blocking); a Promise-typed {expr} would stream -->
+    <p>total messages: {await getMessages({ room }).then((all) => all.length)}</p>
+
     {#await getMessages({ room })}
         <p>loading…</p>
     {:then messages}