@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.186

package/src/client/navigation-root.tsx

@@ -9,14 +9,18 @@
  * NavigationRoot holds the current element in React state. Navigation
  * updates call startTransition(() => setState(newElement)), which IS
  * a transition update. React keeps the old committed tree visible while
- * any new Suspense boundaries in the transition resolve.
+ * the new tree resolves, instead of hiding it behind a Suspense fallback.
  *
- * Also manages `pendingUrl` as React state with an urgent/transition split:
- * - Navigation START: `setPendingUrl(url)` is an urgent update — React
- *   commits it before the next paint, showing the spinner immediately.
- * - Navigation END: `setPendingUrl(null)` is inside `startTransition`
- *   alongside `setElement(newTree)` — both commit atomically, so the
- *   spinner disappears in the same frame as the new content appears.
+ * The navigation's async work runs OUTSIDE the transition scope and every
+ * state update it schedules gets its own synchronous `startTransition` — a
+ * transition scope does not survive an `await`, and an async callback that
+ * returns a thenable defers the commit past the promise callers await. See
+ * the long comment on `_navigateTransition` (TIM-1306).
+ *
+ * This component holds no pending state. The `TopLoader` it renders and the
+ * public `usePendingNavigation()` both subscribe to the router's external
+ * pending store; NavigationRoot's own `pendingUrl` was a second, unread
+ * representation of the same fact and is gone (TIM-1307).
  *
  * Hard navigation guard: When a hard navigation is triggered (500 error,
  * version skew), the component throws an unresolved thenable AFTER all
@@ -31,10 +35,56 @@
  * See design/19-client-navigation.md §"NavigationContext"
  */
 
-import { createElement, Fragment, startTransition, useState, type ReactNode } from 'react';
-import { PendingNavigationProvider } from './navigation-context.js';
+import {
+  createElement,
+  Fragment,
+  startTransition,
+  useLayoutEffect,
+  useRef,
+  useState,
+  type ReactNode,
+} from 'react';
 import { TopLoader, type TopLoaderConfig } from './top-loader.js';
 
+// ─── Transition Result ──────────────────────────────────────────
+
+/**
+ * What a navigation's `perform()` hands back to the transition.
+ *
+ * Declared once and shared by every layer that passes it along — the router's
+ * `RouterDeps.navigateTransition` imports it too — so a field cannot be added
+ * to the producer and dropped by the adapter in between. `E` is the element
+ * type: `ReactNode` here, `unknown` in the router, which never touches it.
+ */
+export interface TransitionResult<E = ReactNode> {
+  /** The wrapped tree to render. */
+  element: E;
+  /** Resolves when the Flight stream finishes decoding, or null. */
+  decodePromise: Promise<void> | null;
+  /**
+   * Publishes the navigation's state — segment cache, pathname, address bar,
+   * history stack, and the client's record of the mounted tree — and
+   * announces it to listeners outside React.
+   *
+   * Run when React commits this tree, not when the tree is handed over: a
+   * tree React is still waiting on, or one a later navigation replaces first,
+   * has been given to React without being on screen. A superseded navigation
+   * never runs it and leaves every one of those consumers describing the
+   * route still on screen (TIM-1301).
+   */
+  commit: () => void;
+}
+
+/**
+ * The tree NavigationRoot holds in state, and the state publish that belongs
+ * to it. They travel as one object so React's commit of the tree is the event
+ * that publishes — see the effect in NavigationRoot.
+ */
+interface RenderedTree {
+  element: ReactNode;
+  publish: (() => void) | null;
+}
+
 // ─── Navigation Transition Counter ──────────────────────────────
 // Monotonically increasing counter that increments each time
 // navigateTransition() is called. Used to detect stale transitions:
@@ -50,12 +100,37 @@ import { TopLoader, type TopLoaderConfig } from './top-loader.js';
 
 const NAV_TRANSITION_KEY = Symbol.for('__timber_nav_transition_counter');
 
-function getTransitionCounter(): { id: number } {
+/**
+ * `waiters` are woken on every bump so an in-flight navigation can stop
+ * waiting on its own payload the moment it is superseded — see
+ * `settleOnDecodeOrSupersession`.
+ */
+interface TransitionCounter {
+  id: number;
+  waiters: Set<() => void>;
+}
+
+function getTransitionCounter(): TransitionCounter {
   const g = globalThis as Record<symbol, unknown>;
-  if (!g[NAV_TRANSITION_KEY]) {
-    g[NAV_TRANSITION_KEY] = { id: 0 };
+  const existing = g[NAV_TRANSITION_KEY] as Partial<TransitionCounter> | undefined;
+  if (!existing) {
+    const created: TransitionCounter = { id: 0, waiters: new Set() };
+    g[NAV_TRANSITION_KEY] = created;
+    return created;
   }
-  return g[NAV_TRANSITION_KEY] as { id: number };
+  // A duplicated copy of this module may have created the singleton before
+  // `waiters` existed. The object is shared across chunks, so fill it in
+  // rather than replacing it — replacing would strand the other copy's id.
+  existing.waiters ??= new Set();
+  return existing as TransitionCounter;
+}
+
+/** Bump the counter and wake everything waiting on an older transition. */
+function bumpTransitionCounter(): number {
+  const counter = getTransitionCounter();
+  counter.id += 1;
+  for (const wake of [...counter.waiters]) wake();
+  return counter.id;
 }
 
 /**
@@ -71,7 +146,54 @@ function getTransitionCounter(): { id: number } {
  * replayed back page (TIM-1022).
  */
 export function supersedeNavigationTransitions(): void {
-  getTransitionCounter().id += 1;
+  bumpTransitionCounter();
+}
+
+/**
+ * Wait for the payload to finish decoding, OR for this transition to be
+ * superseded — whichever happens first.
+ *
+ * A superseded navigation must stop waiting on its own stream. The stream is
+ * deliberately NOT aborted once its tree has been handed to React (the tree
+ * may be on screen with boundaries still feeding from it — see
+ * `handedOffNavAbort` in `client/router.ts`), so there is nothing left to make
+ * `decodePromise` settle promptly. Awaiting it bare would keep the loser's
+ * `router.navigate()` promise pending for the rest of the stream — and
+ * forever if it stalls — which is what `<Link>`'s `isPending` is timed
+ * against, so the losing link would sit spinning while the winner loaded
+ * (codex on #1004).
+ *
+ * A decode *failure* still propagates: it is a real error for this
+ * navigation, and the caller's recovery is timed against it.
+ */
+function settleOnDecodeOrSupersession(
+  decodePromise: Promise<void>,
+  counter: TransitionCounter,
+  transId: number
+): Promise<void> {
+  if (counter.id !== transId) return Promise.resolve();
+  return new Promise<void>((resolve, reject) => {
+    const stopWaiting = (): void => {
+      counter.waiters.delete(wake);
+    };
+    const wake = (): void => {
+      if (counter.id !== transId) {
+        stopWaiting();
+        resolve();
+      }
+    };
+    counter.waiters.add(wake);
+    decodePromise.then(
+      () => {
+        stopWaiting();
+        resolve();
+      },
+      (error: unknown) => {
+        stopWaiting();
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
 }
 
 // ─── Hard Navigation Guard ──────────────────────────────────────
@@ -143,14 +265,13 @@ let _transitionRender: ((element: ReactNode) => void) | null = null;
 
 /**
  * Module-level reference to the navigation transition function.
- * Wraps a full navigation (fetch + render) in a single startTransition
- * with the pending URL.
+ *
+ * Runs the fetch OUTSIDE any transition scope and wraps only the state update
+ * that hands the resulting tree to React — describing this as "a full
+ * navigation in a single startTransition" is the shape TIM-1306 removed.
  */
 let _navigateTransition:
-  | ((
-      pendingUrl: string,
-      perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>
-    ) => Promise<void>)
+  | ((url: string, perform: () => Promise<TransitionResult>) => Promise<void>)
   | null = null;
 
 // ─── Component ───────────────────────────────────────────────────
@@ -158,9 +279,8 @@ let _navigateTransition:
 /**
  * Root wrapper component that enables transition-based rendering.
  *
- * Renders PendingNavigationProvider around children for the pending URL
- * context. The DOM tree matches the server-rendered HTML during hydration
- * (the provider renders no extra DOM elements).
+ * Renders the TopLoader alongside the tree it holds in state. Neither adds a
+ * DOM element on the hydration path, so the tree matches the server HTML.
  *
  * Usage in browser-entry.ts:
  *   const rootEl = createElement(NavigationRoot, { initial: wrapped });
@@ -179,8 +299,39 @@ export function NavigationRoot({
   initial: ReactNode;
   topLoaderConfig?: TopLoaderConfig;
 }): ReactNode {
-  const [element, setElement] = useState<ReactNode>(initial);
-  const [pendingUrl, setPendingUrl] = useState<string | null>(null);
+  const [rendered, setRendered] = useState<RenderedTree>({ element: initial, publish: null });
+
+  // Publish the navigation's state when React commits its tree — not when the
+  // tree is handed over. A tree React is still waiting on, or one a later
+  // navigation replaces before React renders it, has been *given* to React
+  // without being on screen; publishing then describes a route the user never
+  // saw, which is the defect this ordering exists to prevent (TIM-1301).
+  //
+  // A **layout** effect, so the publish lands before the browser paints and,
+  // more importantly, before every descendant's passive effect. A destination
+  // component that navigates from a mount effect — a redirect guard, a
+  // `refresh()` on mount — would otherwise start its navigation while the
+  // segment cache, address bar and pathname still described the departing
+  // route, and send an X-Timber-State-Tree for a tree that is no longer
+  // mounted (codex on #998).
+  //
+  // Descendant *layout* effects still run first: React runs layout effects
+  // child-before-parent, and the only way to precede them would be a fiber
+  // rendered as an earlier sibling of the payload. That is not free here —
+  // `server/ssr-wrappers.tsx` mirrors this component's fiber shape so `useId`
+  // agrees across hydration, and an extra sibling shifts every id in the
+  // payload subtree. A layout effect that navigates on mount is the price.
+  //
+  // Keyed on the tree object rather than on the effect run. A publish moves
+  // the address bar, which is not idempotent, so any second invocation for the
+  // same tree — an effect re-run React is entitled to perform — must be a
+  // no-op rather than a second history entry.
+  const publishedRef = useRef<RenderedTree | null>(null);
+  useLayoutEffect(() => {
+    if (publishedRef.current === rendered) return;
+    publishedRef.current = rendered;
+    rendered.publish?.();
+  }, [rendered]);
 
   // NOTE: We use standalone `startTransition` (imported from 'react'),
   // NOT `useTransition`. The `useTransition` hook's `startTransition`
@@ -192,67 +343,118 @@ export function NavigationRoot({
   //
   // Standalone `startTransition` creates independent transition lanes
   // for each call, so concurrent navigations don't interfere. We don't
-  // need useTransition's `isPending` — we track pending state via our
-  // own `pendingUrl` useState.
+  // need useTransition's `isPending` — pending state lives in the router's
+  // external store, which TopLoader and usePendingNavigation() subscribe to.
   //
   // This matches the Next.js pattern (TIM-625): "No useTransition in
   // the router at all — only standalone startTransition."
 
   // Non-navigation render (revalidation, popstate cached replay).
+  // Non-navigation render (revalidation, popstate cached replay). Both publish
+  // synchronously in the router before calling this — neither has an in-flight
+  // window in which it could be superseded — so there is nothing to publish
+  // on commit.
   _transitionRender = (newElement: ReactNode) => {
     startTransition(() => {
-      setElement(newElement);
+      setRendered({ element: newElement, publish: null });
     });
   };
 
   // Full navigation transition.
-  // setPendingUrl(url) is an URGENT update — React commits it before the next
-  // paint, so the pending spinner appears immediately when navigation starts.
-  // Inside startTransition: the async fetch + setElement + setPendingUrl(null)
-  // are deferred. When the transition commits, the new tree and pendingUrl=null
-  // both apply in the same React commit — making the pending→active transition
-  // atomic (no frame where pending is false but the old tree is still visible).
-  _navigateTransition = (
-    url: string,
-    perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>
-  ) => {
-    // Increment the transition counter SYNCHRONOUSLY (before startTransition
-    // schedules the async work). Each call gets a unique transId; the counter
-    // is the same globalThis singleton, so a newer call always has a higher id.
+  //
+  // The async work runs OUTSIDE any transition scope, and each state update is
+  // its own synchronous `startTransition`. Two React behaviours force that
+  // shape; both were measured on React 19.2.7 (tests/navigation-transition-
+  // suspense.test.ts pins the observable half).
+  //
+  // 1. A transition scope does not survive an `await`. `startTransition`
+  //    restores the previous scope in its `finally`, which for an async
+  //    callback runs when that callback RETURNS — i.e. at its first `await`.
+  //    So an update scheduled past an await inside `startTransition(async …)`
+  //    is an ordinary urgent update:
+  //
+  //      startTransition(() => setEl(x))                     -> 'HOME' held
+  //      startTransition(async () => { await p; setEl(x) })  -> fallback shown
+  //
+  //    Left uncorrected, every navigation whose new tree suspends replaces the
+  //    visible page with a Suspense fallback — the exact thing this component
+  //    exists to prevent (TIM-1306). React documents the caveat under
+  //    `startTransition`: updates after an await need their own transition.
+  //
+  // 2. Re-wrapping *inside* the async callback is not enough. Returning a
+  //    thenable from `startTransition` hands it to `ReactSharedInternals.S`,
+  //    which calls react-dom's `entangleAsyncAction`. That opens an action
+  //    scope: `currentEntangledLane` collects EVERY transition update
+  //    scheduled while the scope is open — including one from a nested,
+  //    fully synchronous `startTransition` — and rendering that lane throws
+  //    `currentEntangledActionThenable`, suspending until the action settles.
+  //    Which is after the promise `navigateTransition` hands back, so a caller
+  //    that awaits a navigation and then reads the DOM sees the departing
+  //    page, and the TIM-1301 publish (a layout effect on the commit) is just
+  //    as late. (Not `ReactSharedInternals.asyncTransitions` — that counter is
+  //    write-only in 19.2.7.)
+  //
+  // No async action is created here, so every navigation commits as soon as
+  // React can render its destination — where TIM-1301 put it. That
+  // now holds for ALL of them. It used not to hold for `<Link>`, which wrapped
+  // `router.navigate()` in its own `useTransition`: that action scope
+  // entangled this component's updates just the same, so a Link navigation
+  // committed only once the payload had finished decoding, and with it
+  // `pushState`, the segment cache and `timber:navigation-end`. Link now calls
+  // `router.navigate()` outside any transition and tracks its own `isPending`
+  // with a plain `useState` (TIM-1307).
+  //
+  // Nothing here may reopen an action scope: no `startTransition` callback in
+  // this path may return a thenable, and no caller may invoke this from inside
+  // a React action scope. That is a rule about `startTransition`, not about
+  // `perform` — `perform` is async by contract and is awaited OUTSIDE any
+  // transition scope, which is exactly why it is safe.
+  //
+  // Standalone `startTransition` rather than `useTransition`'s is still
+  // deliberate — see the TIM-625 note above; each navigation needs an
+  // independent lane.
+  //
+  // `url` is unused: it named the pending state this component used to hold,
+  // and the router already publishes the same URL to its own pending store
+  // before calling here. It stays in the signature because the router's
+  // `RouterDeps.navigateTransition` adapter passes it and the argument reads
+  // at the call site.
+  _navigateTransition = (_url: string, perform: () => Promise<TransitionResult>) => {
+    // Increment the transition counter SYNCHRONOUSLY (before any await). Each
+    // call gets a unique transId; the counter is the same globalThis
+    // singleton, so a newer call always has a higher id.
     const counter = getTransitionCounter();
-    const transId = ++counter.id;
-
-    // NO urgent setPendingUrl here. Per-link pending state is driven by
-    // Link's own useTransition — only the clicked Link re-renders for
-    // isPending. setPendingUrl is set INSIDE startTransition so the
-    // TopLoader activates as a transition update (no full-tree re-render).
-
-    return new Promise<void>((resolve, reject) => {
-      startTransition(async () => {
-        setPendingUrl(url);
-        try {
-          const { element, decodePromise } = await perform();
-          if (counter.id !== transId) {
-            decodePromise?.catch(() => {});
-            reject(new DOMException('Navigation superseded', 'AbortError'));
-            return;
-          }
-          setElement(element);
-          if (decodePromise) await decodePromise;
-          if (counter.id === transId) {
-            setPendingUrl(null);
-            resolve();
-          } else {
-            reject(new DOMException('Navigation superseded', 'AbortError'));
-          }
-        } catch (err) {
-          if (counter.id === transId) {
-            setPendingUrl(null);
-          }
-          reject(err);
-        }
+    const transId = bumpTransitionCounter();
+
+    const superseded = () => new DOMException('Navigation superseded', 'AbortError');
+
+    return (async () => {
+      const { element, decodePromise, commit } = await perform();
+      if (counter.id !== transId) {
+        decodePromise?.catch(() => {});
+        throw superseded();
+      }
+      // Hand the tree over with its commit attached. The effect above runs
+      // it if and when React commits this tree, so a navigation that is
+      // superseded while its payload streams publishes nothing (TIM-1301).
+      //
+      // This is THE update that must not hide the departing page (TIM-1306).
+      startTransition(() => {
+        setRendered({ element, publish: commit });
       });
-    });
+      // React may commit the tree before this settles — that is the point:
+      // the destination reveals as React is able to render it
+      // rather than waiting for the whole Flight stream. The await is here so
+      // the promise this function hands back still means "the payload is
+      // decoded", which is what the router's scroll restoration, the
+      // Navigation API deferred and `<Link>`'s `isPending` are timed against.
+      //
+      // ...unless this navigation loses first, in which case it stops waiting
+      // on a stream that is no longer its business. See
+      // `settleOnDecodeOrSupersession`.
+      if (decodePromise) await settleOnDecodeOrSupersession(decodePromise, counter, transId);
+      if (counter.id !== transId) throw superseded();
+    })();
   };
 
   // ─── Hard navigation guard ─────────────────────────────────
@@ -261,10 +463,10 @@ export function NavigationRoot({
   // page teardown. This avoids "Rendered more hooks" crashes in
   // CHILD components whose hook counts may shift during teardown.
   //
-  // CRITICAL: This throw MUST come AFTER all hooks (the two
-  // useState calls above). React requires the same hooks to run on
-  // every render. If we threw before hooks, React would see 0 hooks
-  // on the re-render vs 2 hooks on the initial render — triggering
+  // CRITICAL: This throw MUST come AFTER all hooks (the useState,
+  // useRef and useLayoutEffect above). React requires the same hooks
+  // to run on every render. If we threw before hooks, React would see
+  // 0 hooks on the re-render vs 3 on the initial render — triggering
   // the exact "Rendered more hooks" error we're trying to prevent.
   //
   // By placing it after hooks but before the return, all hooks
@@ -275,14 +477,23 @@ export function NavigationRoot({
     throw unresolvedThenable;
   }
 
-  // Inject TopLoader alongside the element tree inside PendingNavigationProvider.
-  // The TopLoader reads pendingUrl from context to show/hide the progress bar.
-  // It is rendered only when not explicitly disabled via config.
+  // Inject TopLoader alongside the element tree. It subscribes to the router's
+  // pending store itself, so it takes no props from here beyond its config,
+  // and only it re-renders when a navigation starts or ends. Rendered only
+  // when not explicitly disabled via config.
+  //
+  // This Fragment is a FORK — two children — so it advances React's tree
+  // context and shifts every `useId` below it. `server/ssr-wrappers.tsx`
+  // mirrors it for exactly that reason; a single-child wrapper would not need
+  // a mirror. See tests/ssr-wrapper-parity.test.ts.
   const showTopLoader = topLoaderConfig?.enabled !== false;
-  const children = showTopLoader
-    ? createElement(Fragment, null, createElement(TopLoader, { config: topLoaderConfig }), element)
-    : element;
-  return createElement(PendingNavigationProvider, { value: pendingUrl }, children);
+  if (!showTopLoader) return rendered.element;
+  return createElement(
+    Fragment,
+    null,
+    createElement(TopLoader, { config: topLoaderConfig }),
+    rendered.element
+  );
 }
 
 // ─── Public API ──────────────────────────────────────────────────
@@ -301,27 +512,43 @@ export function transitionRender(element: ReactNode): void {
 }
 
 /**
- * Run a full navigation inside a React transition with optimistic pending URL.
+ * Run a full navigation, handing its tree to React in a transition.
+ *
+ * The `perform` callback fetches the RSC payload, updates router state, and
+ * returns the wrapped React element. `perform` is async by contract and runs
+ * OUTSIDE any transition scope — only the `setRendered` that hands its result
+ * over is wrapped, in a synchronous `startTransition`.
+ *
+ * Do not call this from inside a React action scope, and never let a
+ * `startTransition` callback in this path return a thenable: either opens an
+ * action scope that entangles the update and defers the commit until the
+ * action settles (TIM-1306, TIM-1307).
  *
- * The `perform` callback runs inside `startTransition` — it should fetch the
- * RSC payload, update router state, and return the wrapped React element.
- * The pending URL shows immediately (urgent update) and reverts
- * to null when the transition commits (atomic with the new tree).
+ * Returns a Promise that resolves when the async work completes — the payload
+ * is fetched, decoded, and handed to React. It does **not** wait for React to
+ * commit the tree, so the state that publishes on that commit (address bar,
+ * segment cache, history entry, pathname) may still be a beat behind when it
+ * resolves. Anything that needs the destination to be current should listen
+ * for `timber:navigation-end`, which is dispatched by the publish itself.
  *
- * Returns a Promise that resolves when the async work completes (note: the
- * React transition may not have committed yet, but all state updates are done).
+ * Awaiting the publish here was tried and rejected: it makes the promise
+ * depend on a React commit, which never arrives if the root unmounts
+ * mid-navigation, and deadlocks any caller that awaits a navigation inside
+ * `act()`.
  *
  * Used for: navigate(), refresh(), popstate with fetch.
  */
 export function navigateTransition(
-  pendingUrl: string,
-  perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>
+  url: string,
+  perform: () => Promise<TransitionResult>
 ): Promise<void> {
   if (_navigateTransition) {
-    return _navigateTransition(pendingUrl, perform);
+    return _navigateTransition(url, perform);
   }
-  // Fallback: no NavigationRoot mounted (shouldn't happen in production)
-  return perform().then(() => {});
+  // Fallback: no NavigationRoot mounted (shouldn't happen in production).
+  // Nothing can supersede a transition that does not exist, so the commit
+  // runs unconditionally.
+  return perform().then((result) => result.commit());
 }
 
 /**
@@ -345,11 +572,9 @@ export function installDeferredNavigation(createAndMount: (initial: ReactNode) =
   _transitionRender = (element: ReactNode) => {
     mountOnce(element);
   };
-  _navigateTransition = async (
-    _pendingUrl: string,
-    perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>
-  ) => {
-    const { element } = await perform();
+  _navigateTransition = async (_url: string, perform: () => Promise<TransitionResult>) => {
+    const { element, commit } = await perform();
+    commit();
     mountOnce(element);
   };
 }