@abide/abide 0.56.0 → 0.57.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # abide
 
+## 0.57.1
+
+### Patch Changes
+
+- 866c96d: degrade a mangled **SSR** payload to a cold boot (ADR-0051) ([`adfee02`](https://github.com/briancray/abide/commit/adfee024d570e8bf46230fac1fa2521fcaae056f))
+- 1abc943: Reuse the keyed-list (`{#for}`) reconcile scratch across passes so a steady-state reconcile allocates nothing
+
+    Each `each` reconcile built two fresh arrays per list change — `list.map(keyOf)` for the desired keys and `new Array(n)` for the resolved rows — then threw them away. On a list re-reconciled per keystroke that churn showed up as avoidable minor-GC pressure mid-interaction. The two buffers are now hoisted into persistent per-`each` scratch, reused every pass and cleared down to the live length on shrink (so no disposed-row references are retained). The `keyOf` pass is fused into the resolve loop — still exactly one `keyOf` call per item. Behaviour is unchanged: keyed diffing, in-place row updates, duplicate-key collapse, and prune-before-place all resolve identically; only the per-pass allocation is gone. The `[...source]` materialization for non-array iterables (generators must be drained) is unchanged.
+
+- e137242: `spreadAttrs` — swallow a per-key suspend on a `{...rest}` spread
+
+    A `{...rest}` spread guards its enumeration against a pending blocking `await` read, but not the per-key value read. When `source()` is a restProps proxy (the `<Button {...rest}>` case), its `get` invokes the underlying prop thunk, so a key whose expression reads a still-pending blocking cell suspends inside `bindKeys` — after the enumeration guard has already passed — and the `SuspenseSignal` escaped the render, killing the mount (seen as a crash on a cold client remount, e.g. navigating back to a page whose top-level blocking cells re-fetch and are briefly `pending()`). The per-key read now catches the suspend and binds the key as a deferred attribute (its `attr` effect swallows the signal and fills the value in on settle), matching `attr` and the deferred-enumeration branch; event handlers, whose thunks return a function without reading a cell, never suspend and stay on the listener path.
+
+- 7367a23: SSR hydration payload ships as inert JSON instead of executable JavaScript (ADR-0051)
+
+    The `window.__SSR__` boot payload now ships as `<script type="application/json">` parsed once by the deferred client bundle with `JSON.parse`, rather than a `window.__SSR__ = {…}` statement the browser had to compile and evaluate as a multi-MB program on the critical path. The global still exists for debugging — the bundle republishes it after parsing. Additionally, a json cache body is now seeded pre-parsed (`data`) rather than as a re-escaped JSON string nested in the payload, so it's single-encoded (roughly half the wire bytes and gzip for a json-heavy grid) and read without a second parse. Warm-seed semantics — zero refetch, zero hydration divergence — are unchanged.
+
+## 0.57.0
+
+### Minor Changes
+
+- d09e821: `errorTtl` — opt a failed RPC load into the negative cache
+
+    By default a failed load evicts immediately so the next read retries. Setting `errorTtl` on an endpoint's `cache` policy (or a producer's `cache()` options) retains the failure for that many milliseconds instead: reads within the window re-surface the same rejection with no network round-trip — backing off a failing or rate-limited backend rather than hammering it — then the entry hard-evicts and the next read retries. The function form `errorTtl: (status) => number | undefined` returns a per-status window (`status` is `0` for a network-level fault), or `undefined` to keep the immediate-retry default for that status (e.g. back off a 429/503, retry a 500 at once). A `Retry-After` response header overrides the configured window as the authoritative delay. A negative-cached error is never shipped in the SSR snapshot, so it can't warm-hydrate a poisoned client entry.
+
+### Patch Changes
+
+- 3ce8963: Fix an async-cell warm-seed ordering bug where a `linked` cell reading a blocking dependency could desync SSR and client
+
+    An async cell's warm-seed key is `${scope.id}:${index}`, where `index` is a per-scope counter drawn in construction order. Only a cell that actually becomes async draws one — and a `linked` seed becomes async (drawing an index) only when it _suspends_ by reading a still-pending blocking dependency, otherwise it resolves synchronously to a plain `state` and drew none. Because a blocking dependency is typically in flight on the server (the `linked` suspends → index drawn) but already warm-adopted on the client (the `linked` resolves synchronously → no index), every async cell declared _after_ the `linked` in the same scope keyed off-by-one across the handoff and warm-adopted the wrong cell's value (e.g. a grid cell rendering the layout string it followed). `linked` now reserves its ordinal on the synchronous path too, so it always occupies exactly one index — the same invariant `computed` already has from its static `async`-function routing — and downstream keys line up on both sides.
+
+- e8fb019: Type a bare no-`await` promise/stream `state.computed` seed as pending (`T | undefined`)
+
+    `state.computed(getRates())` (no `await`) routes to a STREAMING cell at runtime — it peeks `undefined` while pending — but the type-check shadow projected it as the resolved `T`, so an unguarded read (`rates.map(...)`) type-checked yet could hit `undefined` at first paint. It now projects through `$$cellValuePending` (`T | undefined`), matching the runtime and the semantically identical `state.computed(async () => getRates())` form. A blocking `state.computed(await getRates())` (suspends until resolved) and a genuinely sync seed are unchanged.
+
+    Consuming such a cell with `{#await rates}{:then data}` still binds `data` as the RESOLVED value: the shadow's `{#await}` lowering now strips the pending `undefined` off a bare pending-cell subject (mirroring the runtime's `$$awaitSubject`, ADR-0047), so the idiomatic await/then path stays free of `| undefined` noise. Direct reads should guard with `?.`/`??`.
+
 ## 0.56.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.56.0",
+    "version": "0.57.1",
     "type": "module",
     "sideEffects": false,
     "description": "Isomorphic multimodal HTTP framework built for humans and machines in a single Bun runtime",

package/src/lib/server/runtime/createUiPageRenderer.ts

@@ -6,6 +6,7 @@ import { formatTraceparent } from '../../shared/formatTraceparent.ts'
 import { hasSeedableRequest } from '../../shared/hasSeedableRequest.ts'
 import { layoutChainForRoute } from '../../shared/layoutChainForRoute.ts'
 import { resolvedCellsSlot } from '../../shared/resolvedCellsSlot.ts'
+import { SSR_SCRIPT_ID } from '../../shared/SSR_SCRIPT_ID.ts'
 import { safeJsonForScript } from '../../shared/safeJsonForScript.ts'
 import { socketTailsSlot } from '../../shared/socketTailsSlot.ts'
 import type { CacheEntry } from '../../shared/types/CacheEntry.ts'
@@ -213,7 +214,11 @@ export function createUiPageRenderer({
             health,
             clientTimeout,
         } satisfies SsrPayload)
-        return `<script>window.__SSR__ = ${payload};</script>`
+        /* Inert JSON data, NOT a `window.__SSR__ = {…}` statement (ADR-0051): the browser never
+           compiles this multi-MB payload as JavaScript on the critical path — the deferred bundle
+           reads it with one `JSON.parse`. `safeJsonForScript` has already `<`-escaped every
+           `<`, so an embedded `</script>` can't close the tag early. */
+        return `<script type="application/json" id="${SSR_SCRIPT_ID}">${payload}</script>`
     }
 
     /* Per-route `<link rel=modulepreload>`s for the route's page + layout-chain chunks

package/src/lib/server/runtime/snapshotEntryFromCache.ts

@@ -41,6 +41,13 @@ export async function snapshotEntryFromCache(
     if (!response) {
         return undefined
     }
+    /* A failed load never seeds the client: negative caching (errorTtl) can leave an
+       error-status entry in the store at snapshot time, but shipping it would warm-hydrate
+       a poisoned entry. Skip it — the client live-fetches on the miss and runs its own
+       negative cache. (Before errorTtl, errors evicted at settle and never reached here.) */
+    if (!response.ok) {
+        return undefined
+    }
     if (store.entries.get(entry.key) !== entry) {
         return undefined
     }
@@ -80,15 +87,29 @@ export async function snapshotEntryFromCache(
             headers: response.headers,
         }),
     )
-    return {
+    const wire: CacheSnapshotEntry = {
         key: entry.key,
         url: entry.request.url,
         method,
         status: response.status,
         statusText: response.statusText,
         headers: Array.from(response.headers.entries()),
-        body,
     }
+    /* Ship a json body PARSED so it single-encodes in the payload rather than nesting a
+       re-escaped JSON string (ADR-0051 — the double-encoding that ~2.35×'d the wire). On a
+       parse failure ship the raw string under `body`: the client decodes it async exactly as
+       before (warmValueFromSnapshot's own try/catch), so a malformed-but-json-typed body still
+       round-trips rather than throwing here. A text body always ships raw. */
+    if (kind === 'json') {
+        try {
+            wire.data = JSON.parse(body)
+            return wire
+        } catch {
+            /* fall through to the raw-string form */
+        }
+    }
+    wire.body = body
+    return wire
 }
 
 async function readSettled(promise: Promise<Response>): Promise<Response | undefined> {

package/src/lib/shared/SSR_SCRIPT_ID.ts

@@ -0,0 +1,11 @@
+/*
+The id of the `<script type="application/json">` element the server emits the
+`window.__SSR__` payload into and the client (`startClient`) parses back out
+(ADR-0051). Shipping the payload as inert JSON data — not a `window.__SSR__ = {…}`
+executable statement — means the browser never COMPILES a multi-MB object literal
+as JavaScript on the critical path; the deferred client bundle reads it with one
+`JSON.parse` (a restricted grammar parsed several times faster than equivalent JS
+source). Both sides import this constant so the write id and read id can't drift.
+*/
+// @documentation plumbing
+export const SSR_SCRIPT_ID = 'abide-ssr'

package/src/lib/shared/cache.ts

@@ -280,8 +280,28 @@ function readThrough<Args, Return>(
         warnEphemeralTtl(key)
     }
     store.subscribe(key)
-    const existing = store.entries.get(key)
+    let existing = store.entries.get(key)
     recordRead(effectiveOptions?.shared ? activeCacheStore() : store, key, existing)
+    /*
+    Negative-cache short-circuit: a prior failed load retained under errorTtl
+    re-surfaces the same failure with no network until its window elapses — a
+    Response is re-served (raw) or re-decoded to throw the same HttpError, a
+    network Error is re-rejected. Past the deadline (the sweep may not have fired
+    yet) evict it here so the read below is a clean miss that retries.
+    */
+    if (existing?.errorResult !== undefined) {
+        if (existing.expiresAt !== undefined && existing.expiresAt > Date.now()) {
+            const failure = existing.errorResult
+            if (failure instanceof Response) {
+                return isRaw
+                    ? (Promise.resolve(failure.clone()) as Promise<Return | Response>)
+                    : (decodeResponse(failure.clone()) as Promise<Return | Response>)
+            }
+            return Promise.reject(failure)
+        }
+        evictIfCurrent(store, existing)
+        existing = undefined
+    }
     if (existing) {
         tagEntry(existing, effectiveOptions?.tags)
         attachPolicy(existing, effectiveOptions, () => remote(args as Args), retain)
@@ -380,6 +400,7 @@ function resolveEndpointCache<Args, Return>(
         shared: policy.shared,
         throttle: policy.throttle,
         debounce: policy.debounce,
+        errorTtl: policy.errorTtl,
     }
 }
 
@@ -565,61 +586,76 @@ function registerEntry(
     function deleteIfCurrent() {
         evictIfCurrent(store, entry)
     }
-    promise.then((result) => {
-        /*
+    promise.then(
+        (result) => {
+            /*
         Mark settled so SSR snapshot serialization can tell awaited entries
         (resolved by the time render() returns → inline) from {#await} ones
         (still pending → stream). Set before the ttl branches below since a
         ttl=0 server entry stays in the store for the snapshot.
         */
-        entry.settled = true
-        /* The reload finished — this entry now holds fresh data, no longer refreshing. */
-        entry.refreshing = false
-        store.markLifecycle(key)
-        /*
+            entry.settled = true
+            /* The reload finished — this entry now holds fresh data, no longer refreshing. */
+            entry.refreshing = false
+            store.markLifecycle(key)
+            /*
         An error-status Response is a failed load, not a value to retain: fetch
         resolves (it only rejects on a network fault) on a 4xx/5xx, so without
         this the entry would be served as a hit for the whole ttl, even after the
-        backend recovers. Evict it so the next read retries — mirroring fireRefetch,
-        which already guards revalidation results with the same `!result.ok` check.
+        backend recovers. Evict it so the next read retries — unless the endpoint
+        opted into the negative cache (errorTtl), which retains the failure for a
+        bounded window (see retainErroredEntry). Mirrors fireRefetch, which guards
+        revalidation results with the same `!result.ok` check.
         */
-        if (result instanceof Response && !result.ok) {
-            deleteIfCurrent()
-            return
-        }
-        /*
+            if (result instanceof Response && !result.ok) {
+                retainErroredEntry(store, entry, options, result.status, result)
+                return
+            }
+            /*
         A post-invalidate reload registers with refreshing=true; an invalidation
         firing while it was in flight parked its refetch on policy.pending
         (fireRefetch bails when refreshing). This settle path — not fireRefetch —
         cleared the flag, so drain the parked refetch here or it's lost and the
         entry keeps data that predates the invalidation.
         */
-        if (entry.invalidation?.pending) {
-            reschedulePendingRefetch(store, entry, entry.invalidation)
-        }
-        /*
+            if (entry.invalidation?.pending) {
+                reschedulePendingRefetch(store, entry, entry.invalidation)
+            }
+            /*
         Smart retained read: the display value is kept unconditionally — never
         hard-evicted on settle. ttl marks a staleness deadline (the next read past
         it revalidates in the background, stale stays visible, refreshing() true)
         instead of eviction; ttl 0/undefined retain with no staleness clock.
         */
-        if (entry.retain) {
-            materializeRetained(store, entry, result)
-            if (ttl !== undefined && ttl > 0) {
-                stampStaleDeadline(entry, ttl)
+            if (entry.retain) {
+                materializeRetained(store, entry, result)
+                if (ttl !== undefined && ttl > 0) {
+                    stampStaleDeadline(entry, ttl)
+                }
+                return
             }
-            return
-        }
-        if (ttl === 0) {
-            if (!keepZeroTtlForRequest) {
-                deleteIfCurrent()
+            if (ttl === 0) {
+                if (!keepZeroTtlForRequest) {
+                    deleteIfCurrent()
+                }
+                return
             }
-            return
-        }
-        if (ttl !== undefined) {
-            armTtlExpiry(store, entry, ttl)
-        }
-    }, deleteIfCurrent)
+            if (ttl !== undefined) {
+                armTtlExpiry(store, entry, ttl)
+            }
+        },
+        (error) => {
+            /* A network-level fault (fetch rejects — no Response, so no status/Retry-After):
+           negative-cache it under the status-0 window if opted in, else evict-and-retry. */
+            retainErroredEntry(
+                store,
+                entry,
+                options,
+                0,
+                error instanceof Error ? error : new Error(String(error)),
+            )
+        },
+    )
     return entry
 }
 
@@ -636,6 +672,75 @@ function evictIfCurrent(store: CacheStore, entry: CacheEntry): void {
     }
 }
 
+/*
+A failed load is retained (negative cache), not evicted, only when the endpoint
+opted in with `errorTtl` for this status — otherwise it evicts so the next read
+retries (the default). With a window the failure is buffered so reads within it
+re-surface it with no network: a Response is stored as a pristine clone the read
+path re-clones per serve (never consuming errorResult itself), a network Error is
+stored as-is and re-rejected. `armTtlExpiry` hard-evicts at the deadline, so the
+next read retries. A `Retry-After` header overrides the configured window as the
+authoritative delay.
+*/
+function retainErroredEntry(
+    store: CacheStore,
+    entry: CacheEntry,
+    options: CacheOptions | undefined,
+    status: number,
+    failure: Response | Error,
+): void {
+    const configured = errorTtlFor(options, status)
+    /* Not opted in for this status → default evict-and-retry (Retry-After is honoured
+       only under an explicit errorTtl, so no existing endpoint's behaviour shifts). */
+    if (configured === undefined) {
+        evictIfCurrent(store, entry)
+        return
+    }
+    const window =
+        failure instanceof Response ? (retryAfterMs(failure.headers) ?? configured) : configured
+    if (window <= 0) {
+        evictIfCurrent(store, entry)
+        return
+    }
+    if (store.entries.get(entry.key) !== entry) {
+        return
+    }
+    entry.errorResult = failure instanceof Response ? failure.clone() : failure
+    entry.settled = true
+    armTtlExpiry(store, entry, window)
+}
+
+/* Resolves the endpoint's `errorTtl` against a failed status: a number applies to
+   any status, a function returns a per-status window (or undefined to keep the
+   immediate-retry default for that status). `status` is 0 for a network fault. */
+function errorTtlFor(options: CacheOptions | undefined, status: number): number | undefined {
+    const policy = options?.errorTtl
+    if (typeof policy === 'function') {
+        return policy(status)
+    }
+    return policy
+}
+
+/* Parses a `Retry-After` header to ms — a delta-seconds integer or an HTTP-date —
+   clamped to >= 0. Returns undefined when absent or unparseable so the caller falls
+   back to the configured errorTtl. */
+function retryAfterMs(headers: Headers): number | undefined {
+    const value = headers.get('retry-after')
+    if (value === null) {
+        return undefined
+    }
+    const seconds = Number(value)
+    if (Number.isFinite(seconds)) {
+        return seconds > 0 ? seconds * 1000 : 0
+    }
+    const when = Date.parse(value)
+    if (Number.isNaN(when)) {
+        return undefined
+    }
+    const delta = when - Date.now()
+    return delta > 0 ? delta : 0
+}
+
 /* Arms the ttl > 0 expiry sweep; `expiresAt` re-checks at fire time so a refreshed deadline survives. */
 function armTtlExpiry(store: CacheStore, entry: CacheEntry, ttl: number): void {
     entry.expiresAt = Date.now() + ttl

package/src/lib/shared/cacheEntryFromSnapshot.ts

@@ -15,7 +15,12 @@ the first cache() read adopts its call site's ttl (see CacheEntry).
 */
 export function cacheEntryFromSnapshot(entry: CacheSnapshotEntry): CacheEntry {
     const headers = new Headers(entry.headers)
-    const response = new Response(entry.body, {
+    /* Body text for async readers / shareable clones. A json body arrives PARSED as `data`
+       (ADR-0051): re-stringify it (compact JSON — value-identical to the server body, whose
+       `json()` also emits compact JSON) so a later `.json()`/`.text()`/`.clone()` still works.
+       A text (or parse-failed json) body arrives raw as `body`. */
+    const bodyText = 'data' in entry ? JSON.stringify(entry.data) : (entry.body ?? '')
+    const response = new Response(bodyText, {
         status: entry.status,
         statusText: entry.statusText,
         headers,
@@ -26,7 +31,7 @@ export function cacheEntryFromSnapshot(entry: CacheSnapshotEntry): CacheEntry {
         request: new Request(entry.url, { method: entry.method }),
         ttl: undefined,
         expiresAt: undefined,
-        value: warmValueFromSnapshot(entry.status, headers, entry.body),
+        value: warmValueFromSnapshot(entry, headers, bodyText),
         settled: true,
         hydrated: true,
     }
@@ -42,19 +47,23 @@ non-2xx, 204 (the status gate below), streaming, binary (the DEFER sentinel) —
 yields no warm value and defers to the async path, which throws HttpError /
 returns the streaming error / blobs exactly as a live call would.
 */
-function warmValueFromSnapshot(status: number, headers: Headers, body: string): unknown {
+function warmValueFromSnapshot(entry: CacheSnapshotEntry, headers: Headers, body: string): unknown {
     /* Status gate is side-specific: an error/204 has no warm value here, but the live
        read throws HttpError / returns undefined for the same status — so it stays out of
        the shared kind mapping. */
-    if (status === 204 || status < 200 || status >= 300) {
+    if (entry.status === 204 || entry.status < 200 || entry.status >= 300) {
         return undefined
     }
     const kind = contentBodyKind(contentTypeOf(headers))
     const value = bodyValueForKind(
         kind,
-        /* The body may still be malformed JSON; fall back to the async path rather than
-           throwing a SyntaxError synchronously during hydration. */
+        /* Pre-parsed json body (`data`, ADR-0051) IS the value — no second parse. A raw json
+           body may still be malformed; fall back to the async path rather than throwing a
+           SyntaxError synchronously during hydration. */
         () => {
+            if ('data' in entry) {
+                return entry.data
+            }
             try {
                 return JSON.parse(body)
             } catch {

package/src/lib/shared/types/CacheEntry.ts

@@ -73,6 +73,15 @@ export type CacheEntry = {
     its drop-on-ttl / drop-on-invalidate behaviour.
     */
     retain?: boolean
+    /*
+    A retained failed load (negative cache — opt in with `errorTtl`). Holds a
+    pristine Response clone (re-served per read by cloning it, never consumed) or
+    the network Error, so reads within the window re-surface the same failure with
+    no network round-trip. `expiresAt` (armed via the ttl sweep) hard-evicts it when
+    the window elapses, so the next read retries. Unset on a successful entry; its
+    presence is what the read path checks to short-circuit to the retained error.
+    */
+    errorResult?: Response | Error
 }
 
 /* Per-key invalidate coalescing: the throttle/debounce policy plus the timer/in-flight state. */

package/src/lib/shared/types/CacheOptions.ts

@@ -31,6 +31,17 @@ and coalesces a background refetch (leading-edge-then-coalesce, or
 fire-after-quiet respectively) instead of dropping the entry. Set one, not both.
 SWR is otherwise unconditional for replayable remote reads; there is no `swr`
 toggle.
+
+`errorTtl` opts a failed load into the negative cache: without it a failure
+evicts immediately so the next read retries (the default); with it, the failure
+is retained for that many ms — reads within the window re-surface the same
+rejection with no network round-trip, backing off a failing/rate-limited backend
+instead of hammering it — then hard-evicts so the next read retries. A function
+form receives the failed response's HTTP status (0 for a network-level fault with
+no response) and returns a per-status window, or `undefined` to fall back to the
+immediate-retry default for that status (e.g. back off a 429/503, retry a 500 at
+once). A `Retry-After` header on the response overrides the number as the
+authoritative delay. Off (evict-and-retry) when unset.
 */
 export type CacheOptions = {
     ttl?: number
@@ -38,4 +49,5 @@ export type CacheOptions = {
     shared?: boolean
     throttle?: number
     debounce?: number
+    errorTtl?: number | ((status: number) => number | undefined)
 }

package/src/lib/shared/types/CachePolicy.ts

@@ -1,10 +1,10 @@
 /*
 Endpoint cache policy, declared once on the rpc definition (ADR-0020). Same value
 shape as the producer-side `CacheOptions` (`ttl` / `tags` / `throttle` / `debounce`
-/ `shared`, no `swr` — SWR is unconditional for replayable reads), except `tags`
-also accepts an arg-derived function so the group can vary by call. That makes the
-type generic over the rpc's `Args`: `(args) => ['rates:' + args.base]` is typed
-against the endpoint's own argument shape.
+/ `shared` / `errorTtl`, no `swr` — SWR is unconditional for replayable reads),
+except `tags` also accepts an arg-derived function so the group can vary by call.
+That makes the type generic over the rpc's `Args`: `(args) => ['rates:' + args.base]`
+is typed against the endpoint's own argument shape.
 
 - `ttl` — retention/staleness in ms. Default Infinity: the entry is retained for its
   store's lifetime — the request on the server (a non-shared read dies with the request,
@@ -15,6 +15,11 @@ against the endpoint's own argument shape.
 - `shared` — opt the entry into the process-level store (never per-user data — the store
   is keyed by method+url+args, not by user). With the default Infinity ttl this memoises
   across requests; an explicit ttl bounds it. A client no-op (one tab store).
+- `errorTtl` — negative-cache window in ms: retain a failed load for that long (reads
+  within it re-surface the rejection with no network) instead of the default
+  evict-and-retry, then hard-evict. A function of the failed status (0 = network fault)
+  returns a per-status window or `undefined` to keep the immediate-retry default for that
+  status; a `Retry-After` header overrides the number. Off when unset.
 */
 export type CachePolicy<Args> = {
     ttl?: number
@@ -22,4 +27,5 @@ export type CachePolicy<Args> = {
     throttle?: number
     debounce?: number
     shared?: boolean
+    errorTtl?: number | ((status: number) => number | undefined)
 }

package/src/lib/shared/types/CacheSnapshotEntry.ts

@@ -6,6 +6,15 @@ Any entry called inline during render (any method) with a textual Content-Type i
 emitted, so the client hydrates warm instead of re-firing the call after render;
 binary bodies don't survive a JSON round-trip. The seeded value is read warm once
 — it is never auto-replayed (that stays GET-only, see REPLAYABLE_METHODS).
+
+The body travels in ONE of two shapes, never both (ADR-0051): a json-kind body
+ships PARSED as `data` — a live JSON value nested directly in the payload — so the
+whole snapshot serialises once (the payload's own `JSON.stringify`) instead of the
+body being pre-serialised to a string and then re-escaped as a nested string
+literal (the double-encoding that ~2.35×'d the wire and forced the client to parse
+the body a second time). A text-kind body — or a json body the server couldn't
+parse — ships raw as `body`. The client re-derives which from the presence of
+`data` (`cacheEntryFromSnapshot`).
 */
 export type CacheSnapshotEntry = {
     key: string
@@ -14,5 +23,10 @@ export type CacheSnapshotEntry = {
     status: number
     statusText: string
     headers: Array<[string, string]>
-    body: string
+    /* Raw body text — present for a text-kind body, or a json body that failed to parse
+       server-side (shipped raw, decoded async client-side as before). Absent when `data` is. */
+    body?: string
+    /* Pre-parsed json-kind body, single-encoded. Present iff the body was json and parsed;
+       `'data' in entry` is the discriminator (a `null` json body still keys present). */
+    data?: unknown
 }

package/src/lib/ui/compile/compileShadow.ts

@@ -82,7 +82,6 @@ export function compileShadow(
     propsType = 'Record<string, any>',
     classify?: InterpolationClassifier,
 ): CompiledShadow {
-    const builder = createBuilder(classify)
     const leadingScript = source.match(LEADING_SCRIPT)
     const scriptBody = leadingScript?.[1] ?? ''
     /* Body starts just past the opening `<script …>`; template just past `</script>`. */
@@ -98,7 +97,12 @@ export function compileShadow(
         importedReactives,
         propsLocalName,
         watchLocalName,
+        pendingCellNames,
     } = analyzeScript(scriptBody, scriptStart, classify)
+    /* Built AFTER the script analysis so the `pendingCellNames` set (the `$$cellValuePending`
+       cells) can ride onto the builder — the `{#await}` emit reads it to strip a bare
+       pending-cell subject's pending `undefined` off its resolved binding (ADR-0047 fidelity). */
+    const builder = createBuilder(classify, pendingCellNames)
     builder.raw(shadowPreamble(importedReactives))
     /* Every `computed`/`linked` scope line reads through this: it invokes the seed thunk and
        unwraps a promise/stream to the value a BARE cell read peeks (ADR-0019/0032) — so an async
@@ -117,6 +121,14 @@ export function compileShadow(
     builder.raw(
         'declare function $$cellValuePending<R>(seed: () => R): (R extends AsyncIterable<infer F> ? F : Awaited<R>) | undefined\n',
     )
+    /* `{#await <pendingCell>}` awaits the CELL (ADR-0047 `$$awaitSubject`) — it shows pending then
+       binds the RESOLVED value, never the pending `undefined`. So a bare pending-cell subject's
+       resolved/`:then` binding must drop the `| undefined` the `$$cellValuePending` peek carries;
+       `$$awaitCell` strips exactly `undefined` (`Exclude`, so a genuine `null` in the value survives).
+       Emitted only when a pending cell exists (else the `{#await}` emit never references it). */
+    if (pendingCellNames.size > 0) {
+        builder.raw('declare function $$awaitCell<V>(v: V): Exclude<V, undefined>\n')
+    }
     /* The peek helpers the async-interpolation wrap targets (ADR-0032): `$$peek` unwraps a promise
        sub-expression to its resolved value (`undefined` while pending) and `$$peekStream` reads an
        async iterable's latest frame, so `getFoo()?.name`/`{#if getFoo()}` type-check against the
@@ -245,6 +257,9 @@ type Builder = {
     /* A fresh shadow-local binding name (`__<base>_<n>`) — for synthesised bindings
        like an await's resolved value, kept distinct so nested blocks never collide. */
     unique: (base: string) => string
+    /* The `$$cellValuePending` (STREAMING) cells declared in the leading script — a bare
+       `{#await <name>}` over one strips the pending `undefined` off its resolved binding. */
+    pendingCellNames: ReadonlySet<string>
     result: () => CompiledShadow
 }
 
@@ -252,7 +267,10 @@ type Builder = {
    emitted verbatim from the original script), offset-relative to the line start. */
 type ScopeLine = { text: string; segments: ShadowMapping[] }
 
-function createBuilder(classify?: InterpolationClassifier): Builder {
+function createBuilder(
+    classify?: InterpolationClassifier,
+    pendingCellNames: ReadonlySet<string> = new Set(),
+): Builder {
     let code = ''
     let uniqueCounter = 0
     const mappings: ShadowMapping[] = []
@@ -302,6 +320,7 @@ function createBuilder(classify?: InterpolationClassifier): Builder {
         }
     }
     const builder: Builder = {
+        pendingCellNames,
         unique(base) {
             return `__${base}_${uniqueCounter++}`
         },
@@ -379,6 +398,9 @@ type ScriptAnalysis = {
        overload so the `watch(cell, handler)` form type-checks (the cell is projected to its
        value, so the real State/socket/rpc overloads never match it). */
     watchLocalName: string | undefined
+    /* The STREAMING (`$$cellValuePending`) cell names — a bare `{#await <name>}` over one awaits
+       the cell and strips its pending `undefined` for the resolved binding (ADR-0047). */
+    pendingCellNames: Set<string>
 }
 
 /* Pushes a diagnostic for every author binding whose name starts with the reserved `$$`
@@ -506,6 +528,7 @@ function analyzeScript(
     const scope: ScopeLine[] = []
     const propsShapes: string[] = []
     const diagnostics: ShadowDiagnostic[] = []
+    const pendingCellNames = new Set<string>()
     if (scriptBody.trim() === '') {
         return {
             imports,
@@ -516,6 +539,7 @@ function analyzeScript(
             importedReactives: new Set(),
             propsLocalName: undefined,
             watchLocalName: undefined,
+            pendingCellNames,
         }
     }
     const file = ts.createSourceFile('script.ts', scriptBody, ts.ScriptTarget.Latest, true)
@@ -572,7 +596,17 @@ function analyzeScript(
             continue
         }
         for (const declaration of reactive) {
-            scope.push(scopeLineFor(declaration, propsShapes, verbatim, span, bindings, classify))
+            scope.push(
+                scopeLineFor(
+                    declaration,
+                    propsShapes,
+                    verbatim,
+                    span,
+                    bindings,
+                    classify,
+                    pendingCellNames,
+                ),
+            )
         }
     }
     return {
@@ -584,6 +618,7 @@ function analyzeScript(
         importedReactives,
         propsLocalName,
         watchLocalName,
+        pendingCellNames,
     }
 }
 
@@ -710,6 +745,9 @@ function scopeLineFor(
     span: (node: ts.Node, prefixLength: number) => ShadowMapping,
     bindings: ReactiveImportBindings,
     classify?: InterpolationClassifier,
+    /* Collects the names that project through `$$cellValuePending` (STREAMING cells) so the
+       `{#await}` emit can strip their pending `undefined`. Absent for nested scripts. */
+    pendingCellNames?: Set<string>,
 ): ScopeLine {
     const name = ts.isIdentifier(declaration.name) ? declaration.name.text : '_'
     const call = declaration.initializer as ts.CallExpression
@@ -807,12 +845,21 @@ function scopeLineFor(
     const fnIsThunk = ts.isArrowFunction(fn) || ts.isFunctionExpression(fn)
     const wrapPrefix = fnIsThunk ? '' : seedIsAsync(fn) ? 'async () => (' : '() => ('
     const wrapSuffix = fnIsThunk ? '' : ')'
-    /* ADR-0042: a STREAMING promise cell (async seed, no top-level `await`) reads
-       `undefined`-while-pending → `$$cellValuePending` (resolved `T | undefined`). A BLOCKING
-       (`await`) cell suspends its region so it is always resolved, and a sync cell is never pending
-       → `$$cellValue` (resolved `T`). (A bare stream seed keeps `$$cellValue`'s frame type — the
-       pre-existing type-directed case, unchanged here.) */
-    const helper = seedIsAsync(fn) && !seedIsBlocking(fn) ? '$$cellValuePending' : '$$cellValue'
+    /* ADR-0042/0043: a STREAMING cell reads `undefined`-while-pending → `$$cellValuePending`
+       (resolved `T | undefined`). Two seed shapes stream: a no-`await` async thunk (`async () =>
+       x`), and a bare call/identifier whose type resolves to a promise/stream — the latter is what
+       desugarSignals routes to `trackedComputed(…, streaming)` (`isPromiseComputed` /
+       `isEagerStreamComputed`), so the shadow must agree or a `state.computed(getFoo())` reads as
+       non-optional `T` while the runtime peeks `undefined`. A BLOCKING (`await`) cell suspends its
+       region so it is always resolved, and a genuinely sync seed is never pending → `$$cellValue`
+       (resolved `T`). The bare-seed arm needs the warm classifier; fail-open keeps `$$cellValue`. */
+    const streamingSeed =
+        (seedIsAsync(fn) && !seedIsBlocking(fn)) || bareSeedStreams(fn, span, verbatim, classify)
+    const helper = streamingSeed ? '$$cellValuePending' : '$$cellValue'
+    /* Record the pending cell so `{#await <name>}` strips its pending `undefined` (ADR-0047). */
+    if (streamingSeed && ts.isIdentifier(declaration.name)) {
+        pendingCellNames?.add(name)
+    }
     const prefix = `${keyword} ${name}${annotation} = ${helper}(${wrapPrefix}`
     /* Peek-wrap any buried async sub-expression in the seed (ADR-0032, script side) so a bare
        `getSession()?.x ?? []` types as its resolved value — matching the `desugarSignals` lift.
@@ -870,6 +917,31 @@ function seedIsBlocking(seed: ts.Expression): boolean {
     return hasTopLevelAwait(seed)
 }
 
+/* True for a bare (non-thunk, no-`await`) call/identifier seed whose checker type resolves to a
+   promise or async iterable — the STREAMING cell desugarSignals routes to `trackedComputed(…,
+   streaming)` (`isPromiseComputed` / `isEagerStreamComputed`). Such a cell peeks `undefined` while
+   pending, so its shadow type must be `$$cellValuePending` (resolved `T | undefined`), matching the
+   `async () => x` streaming form. Restricted to a bare CALL/IDENTIFIER seed — the whole-seed shape,
+   mirroring desugarSignals' bare-seed routing; a compound seed's buried async sub-expression is
+   peek-wrapped separately. Needs the warm classifier — absent (or on a resolution throw) it returns
+   false, keeping today's `$$cellValue`. */
+function bareSeedStreams(
+    seed: ts.Expression,
+    span: (node: ts.Node, prefixLength: number) => ShadowMapping,
+    verbatim: (node: ts.Node) => string,
+    classify: InterpolationClassifier | undefined,
+): boolean {
+    if (classify === undefined || (!ts.isCallExpression(seed) && !ts.isIdentifier(seed))) {
+        return false
+    }
+    try {
+        const kind = classify(span(seed, 0).sourceStart, verbatim(seed))
+        return kind === 'promise' || kind === 'asyncIterable'
+    } catch {
+        return false
+    }
+}
+
 /* Whether any ELEMENT in the tree carries an `attach` — gates emitting the DOM-typed
    attachment aliases. All nested content (block bodies, await/switch branches, snippet
    bodies) routes through `children`, so a recursive `children` walk is complete. */
@@ -1123,9 +1195,17 @@ function emitNode(node: TemplateNode, builder: Builder): void {
                they're the pending content, checked without the resolved value. */
             const resolved = builder.unique('awaited')
             builder.raw('{\n')
-            builder.raw(`const ${resolved} = await `)
+            /* A bare `{#await <pendingCell>}` awaits the CELL (ADR-0047 `$$awaitSubject`): it shows
+               pending then binds the RESOLVED value, never the pending `undefined` the
+               `$$cellValuePending` peek carries. So strip that `undefined` with `$$awaitCell` — the
+               resolved/`:then` bindings all derive from `resolved`, so one strip covers every one.
+               Only a whole-subject bare pending-cell reference qualifies (mirrors the runtime
+               `awaitSubjectExpr` classification); any other subject (a plain promise, a blocking
+               cell, a compound expression) stays a plain `await`. */
+            const subjectIsPendingCell = builder.pendingCellNames.has(node.promise.trim())
+            builder.raw(`const ${resolved} = ${subjectIsPendingCell ? '$$awaitCell(' : 'await '}`)
             builder.expr(node.promise, node.loc)
-            builder.raw(`;\nvoid ${resolved};\n`)
+            builder.raw(`${subjectIsPendingCell ? ')' : ''};\nvoid ${resolved};\n`)
             const pending = node.children.filter((child) => child.kind !== 'branch')
             const branches = node.children.filter((child) => child.kind === 'branch')
             if (node.blocking && node.as !== undefined) {

package/src/lib/ui/createScope.ts

@@ -85,7 +85,14 @@ export function createScope(
        declaration order — the local half of a cell's serialization-stable warm-seed key
        (`${scope.id}:${index}`, see `createAsyncCell`). Per-scope (not global) so a client-only
        sibling component can't shift another component's cell keys: divergence stays local. Both
-       SSR and client construct a component's cells in the same order, so the indices agree. */
+       SSR and client construct a component's cells in the same order, so the indices agree — but
+       ONLY because every cell that CAN become async draws exactly one index per construction,
+       independent of whether it materializes as async on a given render. `computed` gets this from
+       its static `isAsyncFunction` routing; `linked` decides at runtime (it draws in
+       `createAsyncCell` when its seed suspends, else RESERVES the index in its plain-`state`
+       fall-through), so a `linked` whose blocking dep is in flight on the server but warm on the
+       client still occupies its one slot on both sides. Break that "exactly one per construction"
+       rule and every downstream cell keys off-by-one across the handoff. */
     let cellIndex = 0
 
     /* `cell` and `nextCellIndex` are not on the public `Scope` type — `cell` is the compiler-only

package/src/lib/ui/dom/each.ts

@@ -62,6 +62,12 @@ export function each<T>(
     /* Each row's scope, registered with the owner so every live row disposes on owner
        teardown (the effect's own disposer only unsubscribes it from `items()`). */
     const group = scopeGroup()
+    /* Persistent reconcile scratch, reused across passes so a steady-state reconcile
+       allocates nothing: `keys` holds each desired key (one `keyOf` call per item), `resolved`
+       its surviving row (or undefined → build). Both are sized to the current list each pass
+       and their stale tail is cleared, so a shrinking list retains no disposed-row refs. */
+    const keys: string[] = []
+    const resolved: (EachRow | undefined)[] = []
 
     /* Build a row's range. Hydrate mode (only while the claim cursor is active —
        read fresh, since a row built by a post-hydration reconcile must create, not
@@ -177,22 +183,30 @@ export function each<T>(
         withoutHydration(() => {
             /* Undefined source → empty list (see the hydration loop, ADR-0032 D3). */
             const list = source == null ? [] : Array.isArray(source) ? source : [...source]
-            const keys = list.map(keyOf)
+            const count = list.length
             generation += 1
             const pass = generation
-            /* Resolve each desired key to its surviving row once, here, stamping it with
-               this pass — so prune below is an int compare (no `Set`) and the placement
-               walk reuses the resolved row instead of a second `rows.get`. Halving the map
-               lookups per reconcile is a real win once the harness's O(n) `nextSibling` no
-               longer swamps it. `undefined` marks a key with no surviving row — a build. */
-            const resolved: (EachRow | undefined)[] = new Array(keys.length)
-            for (let index = 0; index < keys.length; index += 1) {
-                const row = rows.get(keys[index] as string)
+            /* Fill the reused scratch and resolve each desired key to its surviving row once,
+               here, stamping it with this pass — so prune below is an int compare (no `Set`)
+               and the placement walk reuses the resolved row instead of a second `rows.get`.
+               Halving the map lookups per reconcile is a real win once the harness's O(n)
+               `nextSibling` no longer swamps it. `undefined` marks a key with no surviving row
+               — a build. One `keyOf` call per item, cached in `keys` for the placement walk. */
+            for (let index = 0; index < count; index += 1) {
+                const key = keyOf(list[index] as T)
+                keys[index] = key
+                const row = rows.get(key)
                 if (row !== undefined) {
                     row.gen = pass
                 }
                 resolved[index] = row
             }
+            /* Drop the previous pass's longer tail so a shrunk list retains no disposed-row
+               refs and the scratch stays sized to the live list. */
+            if (keys.length > count) {
+                keys.length = count
+                resolved.length = count
+            }
             /* Prune departed rows first (those the resolve loop didn't reach this pass) so
                their ranges don't sit between survivors and throw off the in-place sibling
                checks below. */

package/src/lib/ui/dom/spreadAttrs.ts

@@ -70,7 +70,22 @@ function bindKeys(
         if (skip.has(key)) {
             continue
         }
-        const value = object[key]
+        /* Reading the value can itself throw a `SuspenseSignal`: when `source()` is a
+           restProps proxy (the `<Button {...rest}>` case), its `get` invokes the underlying
+           prop thunk, so a key whose expression reads a still-pending blocking `await` suspends
+           HERE — after the `source()` enumeration guard already passed. Classify it as an
+           attribute; `attr`'s own effect swallows the suspend and fills the value in on settle.
+           An event handler never suspends — its thunk returns a function without reading a cell. */
+        let value: unknown
+        try {
+            value = object[key]
+        } catch (signal) {
+            if (!(signal instanceof SuspenseSignal)) {
+                throw signal
+            }
+            attr(element, key, () => source()[key])
+            continue
+        }
         if (key.startsWith('on') && typeof value === 'function') {
             on(element, key.slice(2), value as EventListener)
         } else if (typeof value !== 'function') {

package/src/lib/ui/linked.ts

@@ -1,6 +1,7 @@
 import { isAsyncIterable } from '../shared/isAsyncIterable.ts'
 import type { AsyncState } from '../shared/types/AsyncState.ts'
 import type { NamedAsyncIterable } from '../shared/types/NamedAsyncIterable.ts'
+import { CURRENT_SCOPE } from './runtime/CURRENT_SCOPE.ts'
 import { createAsyncCell } from './runtime/createAsyncCell.ts'
 import { createEffectNode } from './runtime/createEffectNode.ts'
 import { isAsyncFunction } from './runtime/isAsyncFunction.ts'
@@ -8,6 +9,7 @@ import { routeBareSeed } from './runtime/routeBareSeed.ts'
 import { SuspenseSignal } from './runtime/SuspenseSignal.ts'
 import type { State } from './runtime/types/State.ts'
 import { state } from './state.ts'
+import type { Scope } from './types/Scope.ts'
 
 /*
 A writable cell seeded reactively from upstream — the abide form of Angular's
@@ -95,6 +97,19 @@ export function linked<T>(
             transform: coerce,
         }) as AsyncState<T>
     }
+    /* Reserve this cell's async-cell ordinal even though the seed resolved synchronously to a
+       plain `state`. Whether a `linked` seed suspends (→ `createAsyncCell`, which draws a
+       `nextCellIndex()` for its warm-seed key) or resolves synchronously (→ this plain `state`,
+       drawing none) is DATA-dependent, and that data can differ across the SSR→client handoff: a
+       blocking dependency still in flight on the server (→ suspend → async cell → index drawn) is
+       already warm-adopted on the warm client (→ sync resolve → plain state → no index). Without
+       this reserve, every async cell declared AFTER a `linked` in the same scope would key
+       off-by-one between sides and adopt the wrong warm seed. Drawing the index here makes a
+       `linked` ALWAYS occupy exactly one ordinal — the invariant `computed` gets for free from its
+       static `isAsyncFunction` routing — so downstream keys align regardless of which path ran. A
+       detached cell (no scope) never warm-seeds, so it draws nothing, mirroring `createAsyncCell`. */
+    const scope = CURRENT_SCOPE.current as (Scope & { nextCellIndex: () => number }) | undefined
+    scope?.nextCellIndex()
     /* The cell is a plain `state` — same store, same write path, so `transform` gates
        reseeds and explicit writes identically. */
     const cell = state<T>(undefined as T, transform)

package/src/lib/ui/startClient.ts

@@ -7,6 +7,7 @@ import { cacheStoreSlot } from '../shared/cacheStoreSlot.ts'
 import { createCacheStore } from '../shared/createCacheStore.ts'
 import { pageSlot } from '../shared/pageSlot.ts'
 import { SOCKET_SEED } from '../shared/SOCKET_SEED.ts'
+import { SSR_SCRIPT_ID } from '../shared/SSR_SCRIPT_ID.ts'
 import { sharedCacheStoreSlot } from '../shared/sharedCacheStoreSlot.ts'
 import type { SsrPayload } from '../shared/types/SsrPayload.ts'
 import type { StreamedResolution } from '../shared/types/StreamedResolution.ts'
@@ -32,6 +33,39 @@ navigation — importing each further page's chunk on first visit and probing th
 destination through the server's app.handle so auth/redirect gating still applies.
 Returns a disposer. `target` defaults to `#app`; pass one explicitly in tests.
 */
+/*
+Reads the server's SSR payload. Production ships it as an inert `<script
+type="application/json">` (ADR-0051) parsed once here in the deferred bundle — off the
+critical path, and through the fast JSON grammar rather than a compiled multi-MB JS object
+literal. A pre-set `globalThis.__SSR__` wins first: the uiStartClient tests stamp it
+directly, and it preserves any pre-bundle inline stamp. The parsed payload is republished
+onto `globalThis.__SSR__` for devtools / inspector visibility.
+*/
+function readSsrPayload(): Partial<SsrPayload> {
+    const globalScope = globalThis as { __SSR__?: Partial<SsrPayload> }
+    const preset = globalScope.__SSR__
+    if (preset !== undefined) {
+        return preset
+    }
+    const element = typeof document !== 'undefined' ? document.getElementById(SSR_SCRIPT_ID) : null
+    const text = element?.textContent
+    if (!text) {
+        return {}
+    }
+    /* Degrade a mangled payload to a cold boot rather than throwing out of startClient (a
+       proxy/extension could corrupt the script text). The old inline `window.__SSR__ = {…}`
+       statement failed the same way — its throw left the global undefined and the `?? {}`
+       fallback booted cold — so keep that resilience instead of failing the whole mount. */
+    let parsed: Partial<SsrPayload>
+    try {
+        parsed = JSON.parse(text) as Partial<SsrPayload>
+    } catch {
+        return {}
+    }
+    globalScope.__SSR__ = parsed
+    return parsed
+}
+
 // @documentation plumbing
 export function startClient(
     routes: Record<string, RouteLoader>,
@@ -43,7 +77,7 @@ export function startClient(
     if (target === null) {
         throw new Error('[abide] startClient: missing #app target')
     }
-    const ssr = (globalThis as { __SSR__?: Partial<SsrPayload> }).__SSR__ ?? {}
+    const ssr = readSsrPayload()
     /* Seed the per-page __SSR__ stamps into their shared slots before mount: the mount
        base, app name (default log channel), health payload (so health()'s first probe is
        warm), and the env-configured RPC timeout (ABIDE_CLIENT_TIMEOUT, shipped per