@evinvest/kitstart 0.8.0 → 0.9.0

package/dist/server/lead-webhook.js

@@ -1,5 +1,6 @@
 import "server-only";
 import { randomUUID } from "node:crypto";
+import { suspectOf } from "../core/lead.js";
 import { openWebhookOutbox } from "./webhook-outbox.js";
 /**
  * What the Service-Arb panel's `lead.created` calls a callback request. Its
@@ -19,7 +20,7 @@ export function panelChannel(channel) {
  * so a broken setting fails startup rather than a lead.
  */
 export function leadWebhook(site, env, options) {
-    const { buildBody, signing, ...outboxOptions } = options;
+    const { buildBody, signing, panelSuspect = false, ...outboxOptions } = options;
     if (!env.leadWebhook || !buildBody)
         return null;
     if (env.leadsDb.kind !== "sqlite")
@@ -28,8 +29,10 @@ export function leadWebhook(site, env, options) {
     const now = options.now ?? Date.now;
     return {
         outbox,
+        panelSuspect,
         enqueue(lead, id, meta) {
-            const ctx = { leadId: id, brandId: site.brand.id, ...meta, at: new Date(now()), idempotencyKey: randomUUID() };
+            const suspect = panelSuspect ? suspectOf(lead) : undefined;
+            const ctx = { leadId: id, brandId: site.brand.id, ...meta, at: new Date(now()), idempotencyKey: randomUUID(), ...(suspect ? { suspect } : {}) };
             const body = JSON.stringify(buildBody(lead, ctx));
             if (typeof body !== "string")
                 throw new Error("buildWebhookBody returned nothing JSON can carry");
@@ -39,5 +42,6 @@ export function leadWebhook(site, env, options) {
         start: intervalMs => outbox.start(intervalMs),
         stop: () => outbox.stop(),
         close: () => outbox.close(),
+        requeueDead: () => outbox.requeueDead(),
     };
 }

package/dist/server/webhook-outbox.d.ts

@@ -18,12 +18,28 @@ export interface WebhookTarget {
     secret: string;
     signing: WebhookSigning;
 }
+/** What `onDead` is told of a row given up on: its error as tagged (`HTTP 503`), never the receiver's words. */
+export interface DeadRow {
+    id: number;
+    ref: string | null;
+    attempts: number;
+    error: string;
+}
 export interface WebhookOutboxOptions {
-    /** Tries per row, the first included; past it the row is `dead`. */
+    /**
+     * How long a row is retried, from when it was queued (or requeued); past it
+     * a failure makes it `dead`. 48 hours by default: a receiver down over a
+     * night and a day still gets its leads.
+     */
+    horizonMs?: number;
+    /** A cap on tries per row besides the horizon, the first included; none by default. */
     maxAttempts?: number;
     /** The wait after the first failure; doubled after each next one. */
     baseDelayMs?: number;
+    /** The longest wait between two tries: an hour by default. */
     maxDelayMs?: number;
+    /** Told of every row given up on, after the error log — the alert hook. */
+    onDead?: (row: DeadRow) => void;
     /** Per request, so a hung receiver does not hold the tick. */
     timeoutMs?: number;
     /** Rows sent per tick. */
@@ -57,9 +73,19 @@ export interface WebhookOutbox {
     start(intervalMs?: number): void;
     stop(): void;
     rows(): OutboxRow[];
+    /**
+     * Puts this target's `dead` rows back in the queue, due now, with their
+     * tries and horizon fresh — after a key rotation or an outage longer than
+     * the horizon. Answers how many. `kitstart-outbox requeue` does the same
+     * from a shell.
+     */
+    requeueDead(): number;
     close(): void;
 }
+/** The old default cap on tries; kept for a brand that passes it as `maxAttempts`. The horizon decides now. */
 export declare const WEBHOOK_MAX_ATTEMPTS = 12;
+export declare const WEBHOOK_HORIZON_MS: number;
+export declare const WEBHOOK_MAX_DELAY_MS: number;
 export declare const WEBHOOK_TICK_MS = 10000;
 /**
  * `https:` anywhere; `http:` only where nothing but the cluster sees the

package/dist/server/webhook-outbox.js

@@ -2,7 +2,10 @@ import "server-only";
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { signatureHeaders } from "./webhook-signature.js";
+/** The old default cap on tries; kept for a brand that passes it as `maxAttempts`. The horizon decides now. */
 export const WEBHOOK_MAX_ATTEMPTS = 12;
+export const WEBHOOK_HORIZON_MS = 48 * 60 * 60_000;
+export const WEBHOOK_MAX_DELAY_MS = 60 * 60_000;
 export const WEBHOOK_TICK_MS = 10_000;
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS webhook_outbox (
@@ -113,6 +116,12 @@ async function judge(response, rowId, log) {
     const why = said ? `${tag}: ${said}` : tag;
     if (status === 408 || status === 429 || status >= 500)
         return { kind: "retry", tag, why, afterMs: retryAfter(response) };
+    // A rotated key (401, 403) or a receiver moved or not yet deployed (404):
+    // fixed by a person, after which the lead must still arrive.
+    if (status === 401 || status === 403)
+        return { kind: "retry", tag, why, afterMs: null, alarm: "check LEAD_WEBHOOK_KEY_ID / LEAD_WEBHOOK_SECRET against the receiver's key" };
+    if (status === 404)
+        return { kind: "retry", tag, why, afterMs: null, alarm: "check LEAD_WEBHOOK_URL" };
     // 3xx included: redirects are not followed, since the target was vetted and its Location was not.
     return { kind: "dead", tag, why };
 }
@@ -124,9 +133,10 @@ async function judge(response, rowId, log) {
  * agreed to take them.
  */
 export function openWebhookOutbox(path, target, options = {}) {
-    const maxAttempts = options.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
+    const horizon = options.horizonMs ?? WEBHOOK_HORIZON_MS;
+    const maxAttempts = options.maxAttempts ?? Number.POSITIVE_INFINITY;
     const baseDelay = options.baseDelayMs ?? 5_000;
-    const maxDelay = options.maxDelayMs ?? 60 * 60_000;
+    const maxDelay = options.maxDelayMs ?? WEBHOOK_MAX_DELAY_MS;
     const timeoutMs = options.timeoutMs ?? 10_000;
     const batch = options.batch ?? 20;
     const send = options.fetch ?? fetch;
@@ -146,13 +156,15 @@ export function openWebhookOutbox(path, target, options = {}) {
         throw error;
     }
     const insert = db.prepare("INSERT INTO webhook_outbox (target, ref, body, created_at, next_attempt_at) VALUES (?, ?, ?, ?, ?) RETURNING id");
-    const due = db.prepare("SELECT id, body, attempts FROM webhook_outbox WHERE state = 'pending' AND target = ? AND next_attempt_at <= ? ORDER BY next_attempt_at, id LIMIT ?");
+    const due = db.prepare("SELECT id, ref, body, attempts, created_at FROM webhook_outbox WHERE state = 'pending' AND target = ? AND next_attempt_at <= ? ORDER BY next_attempt_at, id LIMIT ?");
     // A lease: another process ticking the same file skips a row while it is in flight.
     const claim = db.prepare("UPDATE webhook_outbox SET next_attempt_at = ? WHERE id = ? AND state = 'pending' AND next_attempt_at <= ?");
     const finish = db.prepare("UPDATE webhook_outbox SET state = ?, attempts = ?, last_error = ?, done_at = ? WHERE id = ?");
     const reschedule = db.prepare("UPDATE webhook_outbox SET attempts = ?, next_attempt_at = ?, last_error = ? WHERE id = ?");
     const list = db.prepare("SELECT id, ref, state, attempts, next_attempt_at, last_error FROM webhook_outbox ORDER BY id");
     const stranded = db.prepare("SELECT COUNT(*) AS n FROM webhook_outbox WHERE state = 'pending' AND target <> ?");
+    // `created_at` restarts the horizon: a requeued row is queued anew.
+    const requeue = db.prepare("UPDATE webhook_outbox SET state = 'pending', attempts = 0, created_at = ?, next_attempt_at = ?, done_at = NULL WHERE state = 'dead' AND target = ?");
     const left = int(stranded.get(target.url), "n");
     if (left > 0)
         log.warn(`webhook: ${left} pending row(s) queued for another target; left in place, not sent`);
@@ -187,6 +199,7 @@ export function openWebhookOutbox(path, target, options = {}) {
             const id = int(row, "id");
             const body = text(row, "body") ?? "";
             const attempts = int(row, "attempts") + 1;
+            const queuedAt = int(row, "created_at");
             if (Number(claim.run(t + timeoutMs + 5_000, id, t).changes) === 0)
                 continue;
             const verdict = await deliver(id, body);
@@ -194,15 +207,25 @@ export function openWebhookOutbox(path, target, options = {}) {
                 finish.run("delivered", attempts, verdict.note?.slice(0, ERROR_CAP) ?? null, now(), id);
                 report.delivered += 1;
             }
-            else if (verdict.kind === "dead" || attempts >= maxAttempts) {
+            else if (verdict.kind === "dead" || attempts >= maxAttempts || now() - queuedAt >= horizon) {
                 finish.run("dead", attempts, verdict.why, now(), id);
-                log.error(`webhook: outbox #${id} dead after ${attempts} attempt(s): ${verdict.tag}`);
+                log.error(`webhook: outbox #${id} dead after ${attempts} attempt(s): ${verdict.tag}; requeue with requeueDead() or \`kitstart-outbox requeue\``);
                 report.dead += 1;
+                try {
+                    options.onDead?.({ id, ref: text(row, "ref"), attempts, error: verdict.tag });
+                }
+                catch (error) {
+                    log.error("webhook: the onDead hook failed", error);
+                }
             }
             else {
                 const wait = backoff(attempts, verdict.afterMs);
                 reschedule.run(attempts, now() + wait, verdict.why, id);
-                log.warn(`webhook: outbox #${id} attempt ${attempts} failed (${verdict.tag}); next in ${Math.round(wait / 1000)} s`);
+                const line = `webhook: outbox #${id} attempt ${attempts} failed (${verdict.tag}); next in ${Math.round(wait / 1000)} s`;
+                if (verdict.alarm)
+                    log.error(`${line} — ${verdict.alarm}`);
+                else
+                    log.warn(line);
                 report.retried += 1;
             }
         }
@@ -249,6 +272,10 @@ export function openWebhookOutbox(path, target, options = {}) {
                 lastError: text(row, "last_error"),
             }));
         },
+        requeueDead() {
+            const t = now();
+            return Number(requeue.run(t, t, target.url).changes);
+        },
         close() {
             stop();
             db.close();

package/dist/testing/index.d.ts

@@ -9,4 +9,5 @@
 export { describeLandingContract, type LandingContractOptions } from "./landing-contract.js";
 export { servedPaths } from "./served-files.js";
 export { describeLeadStoreContract, type LeadStoreHarness } from "./lead-store-contract.js";
+export { leadRuleDisagreements, PHONE_MATRIX } from "./lead-rules.js";
 export { serviceAreaPlace, storefrontPlace, testLead } from "./fixtures.js";

package/dist/testing/index.js

@@ -9,4 +9,5 @@
 export { describeLandingContract } from "./landing-contract.js";
 export { servedPaths } from "./served-files.js";
 export { describeLeadStoreContract } from "./lead-store-contract.js";
+export { leadRuleDisagreements, PHONE_MATRIX } from "./lead-rules.js";
 export { serviceAreaPlace, storefrontPlace, testLead } from "./fixtures.js";

package/dist/testing/landing-contract.js

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import { isPublished, publicationGaps } from "../core/place/publication.js";
 import { createRouting, NON_PAGE_ROUTES, pointSuffixes, THANKS } from "../core/routing.js";
 import { openLaunchBlockers } from "../core/site.js";
+import { leadRuleDisagreements } from "./lead-rules.js";
 import { servedPaths } from "./served-files.js";
 const SOURCE_LINE = /@source\s+["'][^"']*node_modules\/@evinvest\/kitstart\/dist["']/;
 const MATCHER = "/((?!_next/).*)";
@@ -42,6 +43,11 @@ export function describeLandingContract(site, options = {}) {
                 expect(moves && suffixes.includes(redirect.from), redirect.from).toBe(false);
             }
         });
+        // A number the form lets through and the server refuses sends the visitor
+        // back for nothing they can see; `validateLead` is the shared rule.
+        it("refuses exactly the phone numbers the form blocks", () => {
+            expect(leadRuleDisagreements(site.lead)).toEqual([]);
+        });
         it("publishes nothing without a domain", () => {
             if (site.brand.domain !== null)
                 return;

package/dist/testing/lead-rules.d.ts

@@ -0,0 +1,18 @@
+import { type LeadSchema } from "../core/lead.js";
+/**
+ * Numbers people type, and whether each is a way to reach them — the
+ * review's matrix (LEAD-FORMS-REVIEW-2026-10-03) and the spellings that must
+ * keep working.
+ */
+export declare const PHONE_MATRIX: readonly {
+    mobile: string;
+    valid: boolean;
+}[];
+/**
+ * Where a brand's form rule disagrees with the form's own phone check: a
+ * number the form lets through that the server refuses (the visitor is sent
+ * back for nothing they can see), or one the form blocks that the rule would
+ * take. Every other field is filled as the form fills it — the first subject,
+ * a postcode — so only the phone is judged. Empty is agreement.
+ */
+export declare function leadRuleDisagreements(schema: LeadSchema<string>): string[];

package/dist/testing/lead-rules.js

@@ -0,0 +1,50 @@
+import { readCandidate, validateCandidate } from "../core/lead.js";
+import { phoneProblem } from "../core/phone.js";
+/**
+ * Numbers people type, and whether each is a way to reach them — the
+ * review's matrix (LEAD-FORMS-REVIEW-2026-10-03) and the spellings that must
+ * keep working.
+ */
+export const PHONE_MATRIX = [
+    { mobile: "06 12 34 56 78", valid: true },
+    { mobile: "0612345678", valid: true },
+    { mobile: "6 12 34 56 78", valid: true },
+    { mobile: "+33 (0)6 12 34 56 78", valid: true },
+    { mobile: "0033 6 12 34 56 78", valid: true },
+    { mobile: "06.12.34.56.78", valid: true },
+    { mobile: "06-12-34-56-78", valid: true },
+    { mobile: "01 23 45 67 89", valid: true },
+    { mobile: "+1 415 555 0123", valid: true },
+    { mobile: "+44 7911 123456", valid: true },
+    { mobile: "+12345678", valid: true },
+    { mobile: "０６１２３４５６７８", valid: true },
+    { mobile: "(415) 555-0123", valid: false },
+    { mobile: "+3361234567", valid: false },
+    { mobile: "0000000000", valid: false },
+    { mobile: "06 66 66 66 66", valid: false },
+    { mobile: "06 12 34 56 7", valid: false },
+    { mobile: "12 34 56 7", valid: false },
+    { mobile: "+1234567", valid: false },
+    { mobile: "06 12", valid: false },
+];
+/**
+ * Where a brand's form rule disagrees with the form's own phone check: a
+ * number the form lets through that the server refuses (the visitor is sent
+ * back for nothing they can see), or one the form blocks that the rule would
+ * take. Every other field is filled as the form fills it — the first subject,
+ * a postcode — so only the phone is judged. Empty is agreement.
+ */
+export function leadRuleDisagreements(schema) {
+    const out = [];
+    for (const { mobile } of PHONE_MATRIX) {
+        const form = new FormData();
+        form.set(schema.wire.subject, schema.subjects[0] ?? "");
+        form.set(schema.wire.locality, "75011");
+        form.set(schema.wire.mobile, mobile);
+        const blocked = phoneProblem(mobile) !== null;
+        const refused = validateCandidate(schema, readCandidate(schema, form, null)) !== null;
+        if (blocked !== refused)
+            out.push(`${mobile}: the form ${blocked ? "blocks" : "takes"} it, the server ${refused ? "refuses" : "takes"} it`);
+    }
+    return out;
+}

package/dist/testing/lead-store-contract.js

@@ -41,6 +41,26 @@ export function describeLeadStoreContract(name, harness) {
             await expect(store.health()).resolves.toBeUndefined();
             await store.close();
         });
+        // LEAD-FORMS-REVIEW-2026-10-03 #3: a resend after a lost answer is the same lead.
+        it("keeps one row per submission id, and finds it back", async () => {
+            const store = await harness().open();
+            if (!store.findSubmission)
+                return void (await store.close());
+            const sid = "3f2b8c1e-5d4a-4f6b-9c7e-1a2b3c4d5e6f";
+            const first = await store.insert(lead({ submissionId: sid, channel: "callback", consent: { text: "Oui.", at: "2026-10-03T10:00:00.000Z" }, extras: { name: "Ana" } }));
+            await expect(store.insert(lead({ submissionId: sid }))).rejects.toThrow();
+            expect(await store.count()).toBe(1);
+            expect(await store.findSubmission(sid)).toEqual({
+                id: first,
+                lead: lead({ submissionId: sid, channel: "callback", consent: { text: "Oui.", at: "2026-10-03T10:00:00.000Z" }, extras: { name: "Ana" } }),
+            });
+            expect(await store.findSubmission("00000000-0000-4000-8000-000000000000")).toBeNull();
+            // Leads without one (the no-JS post) never collide.
+            await store.insert(lead());
+            await store.insert(lead());
+            expect(await store.count()).toBe(3);
+            await store.close();
+        });
         it("keeps what it acknowledged across a close and a reopen", async () => {
             const h = harness();
             if (!h.reopen)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evinvest/kitstart",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Landing-site machinery for local-service brands: a site composition root, the Place/Presence/ServiceArea model with a publication gate, host/locale routing, schema.org and SEO builders, the lead funnel with its antispam, and analytics events. Pure core at '.', more subpaths per runtime.",
   "license": "BlueOak-1.0.0",
   "publishConfig": {
@@ -57,7 +57,8 @@
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",
   "bin": {
-    "kitstart-size": "./dist/cli/kitstart-size.js"
+    "kitstart-size": "./dist/cli/kitstart-size.js",
+    "kitstart-outbox": "./dist/cli/kitstart-outbox.js"
   },
   "files": [
     "dist",

package/template/flake.nix

@@ -3,7 +3,7 @@
     v_flakes.url = "github:valeratrades/v_flakes?ref=v1.6";
     # The lib flake at the tag of the @evinvest/kitstart version in
     # package-lock.json — mkLanding refuses a mismatch.
-    ev.url = "github:EV-invest/lib?ref=@evinvest/kitstart-v0.8.0";
+    ev.url = "github:EV-invest/lib?ref=@evinvest/kitstart-v0.9.0";
     ev.inputs.v_flakes.follows = "v_flakes";
   };
 

package/template/package.json

@@ -20,7 +20,7 @@
   "dependencies": {
     "@evinvest/analytics": "^0.3.0",
     "@evinvest/i18n": "^0.9.0",
-    "@evinvest/kitstart": "^0.8.0",
+    "@evinvest/kitstart": "^0.9.0",
     "@evinvest/marketing": "^0.3.0",
     "@evinvest/uikit": "^0.25.0",
     "next": "16.3.6",

package/template/src/shared/config/lead.ts

@@ -1,11 +1,14 @@
-import type { LeadSchema } from "@evinvest/kitstart";
+import { validateLead, type LeadSchema } from "@evinvest/kitstart";
 
 export const SUBJECTS = ["standard", "deep", "other"] as const;
 export type Subject = (typeof SUBJECTS)[number];
 
 /**
  * What the quote form asks, and the one rule worth enforcing: a lead with no
- * way to reach the customer is not a lead. The reason is for the log only.
+ * way to reach the customer is not a lead. `validateLead` is the number rule
+ * the form itself blocks on; a brand rule of its own composes with it —
+ * `lead => validateLead(lead) ?? mine(lead)` — and names the field it refuses,
+ * which the form shows the error at.
  */
 export const LEAD: LeadSchema<Subject> = {
   subjects: SUBJECTS,
@@ -13,5 +16,5 @@ export const LEAD: LeadSchema<Subject> = {
   extras: [{ name: "surface_m2", max: 6 }],
   // One shape for the mail, the webhook and a dialler: `+33612345678`.
   mobileFormat: "e164",
-  validate: lead => (lead.mobile.replace(/\D/g, "").length < 10 ? "a mobile number" : null),
+  validate: validateLead,
 };

package/template/tests/e2e/quote-form.spec.ts

@@ -131,7 +131,7 @@ for (const javaScriptEnabled of [false, true]) {
       expect(body.get("location")).toBe("paris");
       // The sentence shown is what is posted, and what the lead keeps.
       expect(body.get("consent")).toBe("J’accepte d’être rappelé·e à ce numéro au sujet de ma demande.");
-      await expect(page).toHaveURL(/\/fr\/thanks$/);
+      await expect(page).toHaveURL(/\/fr\/thanks\?channel=callback$/);
     });
 
     test("is refused without the consent", async ({ page }) => {
@@ -208,3 +208,88 @@ test("a scripted post of the form lands on the thanks page", async ({ page }) =>
   });
   expect(answer).toEqual({ ok: true, redirected: true, path: "/fr/thanks" });
 });
+
+// A number the server refuses: never silent, never lost (LEAD-FORMS-REVIEW-2026-10-03 #1).
+const INVALID = "Ce numéro n’est pas valide. Exemple : 06 12 34 56 78 ou +33 6 12 34 56 78.";
+
+test.describe("a refused number, without JavaScript", () => {
+  test.use({ javaScriptEnabled: false, reducedMotion: "reduce" });
+
+  test("goes back to the card, naming the field and keeping the need", async ({ page }) => {
+    await page.goto("/fr#quote");
+    const form = page.locator("#quote-form");
+    await form.getByLabel("Code postal").fill("75011");
+    await form.getByLabel("Téléphone").fill("06 12 34 56 7");
+    await form.getByRole("button", { name: "Recevoir le prix" }).click();
+    await expect(page).toHaveURL(/\/fr\?lead_error=phone&need=standard#quote$/);
+  });
+});
+
+test.describe("a refused number, with JavaScript", () => {
+  const hydrated = (page: Page) => expect(page.locator("#quote select")).toHaveCount(0);
+
+  test("is blocked before it is sent, in the page's words", async ({ page }) => {
+    await page.goto("/fr");
+    await hydrated(page);
+    let sent = 0;
+    page.on("request", r => void (r.method() === "POST" && sent++));
+    const form = page.locator("#quote-form");
+    await form.getByLabel("Code postal").fill("75011");
+    const phone = form.getByLabel("Téléphone");
+    await phone.fill("+3361234567");
+    await form.getByRole("button", { name: "Recevoir le prix" }).click();
+    await expect(phone).toHaveAttribute("aria-invalid", "true");
+    await expect(form.getByRole("alert")).toHaveText(INVALID);
+    expect(await phone.evaluate(el => (el instanceof HTMLInputElement ? el.validationMessage : ""))).toBe(INVALID);
+    expect(sent).toBe(0);
+  });
+
+  test("refused by the server, shows why at the field and keeps what was typed", async ({ page }) => {
+    await page.goto("/fr");
+    await hydrated(page);
+    const form = page.locator("#quote-form");
+    // Past the form's own check, as a stale page's would be.
+    await form.evaluate(el => el instanceof HTMLFormElement && (el.noValidate = true));
+    await form.getByLabel("Code postal").fill("75011");
+    const phone = form.getByLabel("Téléphone");
+    await phone.fill("0000000000");
+    const answered = page.waitForResponse(r => new URL(r.url()).pathname === "/quote");
+    await form.getByRole("button", { name: "Recevoir le prix" }).click();
+    expect((await answered).status()).toBe(422);
+    await expect(form.getByRole("alert")).toHaveText(INVALID);
+    await expect(phone).toBeFocused();
+    await expect(phone).toHaveValue("0000000000");
+    await expect(form.getByLabel("Code postal")).toHaveValue("75011");
+    await expect(page).toHaveURL(/\/fr$/);
+  });
+
+  test("brought back by the no-JS refusal, shows it at the field", async ({ page }) => {
+    await page.goto("/fr?lead_error=phone&need=deep#quote");
+    const form = page.locator("#quote-form");
+    await expect(form.getByRole("alert")).toHaveText(INVALID);
+    await expect(form.getByLabel("Téléphone")).toBeFocused();
+    // The need came back with it: chosen, not asked again.
+    await expect(form.locator("input[name=subject]")).toHaveValue("deep");
+    await expect(form.getByText("Grand ménage")).toBeVisible();
+    await expect(page).toHaveURL(/\/fr\?need=deep#quote$/);
+  });
+});
+
+// No network at the press of submit: the form stays, says so, and sends the
+// same lead once the network is back (LEAD-FORMS-REVIEW-2026-10-03 #4).
+test("offline, the form says so, keeps what was typed and sends it on retry", async ({ page, context }) => {
+  await page.goto("/fr");
+  await expect(page.locator("#quote select")).toHaveCount(0);
+  const form = page.locator("#quote-form");
+  await form.getByLabel("Code postal").fill("75011");
+  await form.getByLabel("Téléphone").fill("0612345678");
+  await context.setOffline(true);
+  await form.getByRole("button", { name: "Recevoir le prix" }).click();
+  const alert = form.getByRole("alert");
+  await expect(alert).toContainText("Pas de connexion");
+  await expect(page).toHaveURL(/\/fr$/);
+  await expect(form.getByLabel("Téléphone")).toHaveValue("0612345678");
+  await context.setOffline(false);
+  await alert.getByRole("button", { name: "Réessayer" }).click();
+  await expect(page).toHaveURL(/\/fr\/thanks$/);
+});