@timber-js/app 0.2.0-alpha.197 → 0.2.0-alpha.199

package/src/client/navigation-commit.ts

@@ -15,6 +15,58 @@ import type { HistoryStack } from './history.ts';
 import type { SegmentInfo, StateTree } from '../shared/segment-info.ts';
 import type { ParamsSource } from '../shared/payload-root.ts';
 import { setNavigationState, type NavigationState } from './navigation-context.ts';
+import {
+  statusPageRendered,
+  _setStatusPageRendered,
+  onStatusPageRendered,
+  _setOnStatusPageRendered,
+} from './state.ts';
+
+// ─── What a status page teaches the cache ─────────────────────────────────
+//
+// A status page replaces a subtree: a deny page lands at the segment owning
+// the matched file and nothing below it mounts; an `error.tsx` fallback
+// discards everything under the boundary that rendered it. `X-Timber-Segments`
+// nonetheless describes the whole chain the payload was built against — it
+// must, because a partial navigation picks its merge point out of it — so the
+// cache has to be told not to learn from such a tree.
+//
+// The HTTP status used to say so, and could not be trusted to: an RSC payload
+// response commits one macrotask after its first chunk, and a nested
+// component that denies after I/O puts its row in the stream after the
+// status line has gone out (TIM-1489). The only thing that reliably knows a
+// status page rendered is the status page itself, and the only moment that
+// matters is the commit that puts it on screen — so every status page the
+// framework produces is wrapped in `StatusPageMarker`, whose layout effect
+// reports on each commit that renders it. Layout effects run child-before-
+// parent, so the report lands before `NavigationRoot`'s publish of that
+// same commit, and never for a render React discards. Without Suspense
+// around the row, the transition cannot commit until the row has arrived, so
+// this covers the delayed nested case too, which no status ever could.
+//
+// The report also clears the cache on the spot, because not every commit
+// has a navigation to consume it: a deny row arriving inside a Suspense
+// boundary after its navigation published, or a status document being
+// hydrated, would otherwise leave a tree in the cache that is no longer on
+// screen. Consuming the flag at commit is what keeps the same navigation from
+// re-seeding it a moment later. Both are over-approximations — a page-level
+// deny leaves every layout standing — at the cost of one full render on the
+// next navigation.
+//
+// Slot boundaries do not report: a slot degrading is the page staying, and
+// the chain it mounted is the chain the header describes. See TIM-1356,
+// TIM-1495, design/04-authorization.md §"Where a Deny Page Renders".
+
+/**
+ * Record that a status page for the main route is on screen. Called from
+ * `StatusPageMarker`'s layout effect; consumed by the commit of the
+ * navigation whose tree it belongs to, and acted on immediately for the
+ * commits that have none.
+ */
+export function reportStatusPageRendered(): void {
+  _setStatusPageRendered(true);
+  onStatusPageRendered?.();
+}
 
 /** Everything a commit needs to describe the page it makes current. */
 export interface NavigationCommitInput {
@@ -38,22 +90,6 @@ export interface NavigationCommitInput {
   /** When true, clear the segment cache if segmentInfo is absent
    *  (popstate replay for entries without layout metadata). */
   clearSegmentCacheOnEmpty?: boolean;
-  /**
-   * HTTP status of the response this navigation rendered, when it came from a
-   * fetch. Omitted by replays, which re-publish a tree already judged.
-   *
-   * An error response rendered a status page, and a status page replaces a
-   * subtree: the deny page lands at the segment owning the matched file and
-   * nothing below it mounts. `segmentInfo` nonetheless describes the whole
-   * chain the payload was built against — it must, because the merge point is
-   * chosen out of it — so the cache has to be told not to learn from this one.
-   *
-   * Enforced here rather than at the call sites because there are three of
-   * them (`performNavigationFetch`, `refresh()`, and uncached traversal, the
-   * last two through `fetchCommitAndRender`) and only one had the check.
-   * See TIM-1356.
-   */
-  status?: number;
   /**
    * Layouts the server skipped on this response (`X-Timber-Skipped-Segments`),
    * when it came from a fetch. Omitted by replays and revalidation.
@@ -65,9 +101,11 @@ export interface NavigationCommitInput {
    * replayed later, shows whatever the client holds *then*, not what was on
    * screen when the entry committed. Such entries store a null payload and
    * traversals to them fetch instead. Decided here, not at the fetch call
-   * sites, for the same reason as `status`: `performNavigationFetch` had the
-   * check and `fetchCommitAndRender` did not, so a back/forward fetch that
-   * was answered with skips stored the holes (TIM-1432).
+   * sites, because there are three of those (`performNavigationFetch`,
+   * `refresh()`, and uncached traversal) and a rule applied at one of them
+   * holds by accident: `performNavigationFetch` had the check and
+   * `fetchCommitAndRender` did not, so a back/forward fetch that was
+   * answered with skips stored the holes (TIM-1432).
    */
   skippedSegments?: string[] | null;
 }
@@ -93,7 +131,7 @@ function hasSkippedSlot(segmentInfo: SegmentInfo[] | null | undefined): boolean
  * The metadata a history entry keeps. `skipped` describes the *response*
  * — "this slot's content was omitted" — and the entry stores no such
  * payload (it stores null). Left on the entry, the flag outlives the
- * response: `applyRevalidation()` reuses the entry's metadata beside a full
+ * response: `applyActionResult()` reuses the entry's metadata beside a full
  * re-render and would have that judged non-replayable too.
  */
 function storedSegmentInfo(segmentInfo: SegmentInfo[] | null | undefined) {
@@ -145,6 +183,10 @@ export function createNavigationCommitter(deps: {
 }): NavigationCommitter {
   const { segmentCache, historyStack } = deps;
 
+  // See `reportStatusPageRendered`: a status page that commits with no
+  // navigation to consume the report still empties the cache.
+  _setOnStatusPageRendered(() => segmentCache.clear());
+
   /**
    * Update the segment cache from server-provided segment metadata.
    *
@@ -211,18 +253,28 @@ export function createNavigationCommitter(deps: {
      */
     prepareNavigation(url: string, opts: NavigationCommitInput): PreparedNavigation {
       const navState = deriveNavigationState(url);
-
-      // A tree rendered by an error response is not one to cache — see
-      // `status` on NavigationCommitInput. Normalized here, once, so no fetch
-      // caller can forget it; the history entry records the same thing, or a
-      // traversal back to this URL would replay the metadata this drops.
-      const cacheable = opts.status === undefined || opts.status < 400;
-      const segmentInfo = cacheable ? opts.segmentInfo : [];
       const payload = isReplayable(opts) ? opts.payload : null;
 
+      // The tree this navigation renders has not rendered yet. Whatever a
+      // boundary reported before now belongs to a commit that had no
+      // navigation to consume it — a hydration, a row that arrived inside a
+      // Suspense boundary after its navigation had published — and must not
+      // be charged to this one.
+      _setStatusPageRendered(false);
+
       return {
         navState,
         commit() {
+          // A tree in which a boundary rendered a status page is not one to
+          // cache — see the module note. Read at commit rather than at
+          // prepare because that is when the boundary has spoken: the row it
+          // renders may not have existed when the response headers were read.
+          // The history entry records the same thing, or a traversal back to
+          // this URL would replay the metadata this drops.
+          const cacheable = !statusPageRendered;
+          _setStatusPageRendered(false);
+          const segmentInfo = cacheable ? opts.segmentInfo : [];
+
           if (segmentInfo && segmentInfo.length > 0) {
             updateSegmentCache(segmentInfo);
           } else if (segmentInfo?.length === 0 || opts.clearSegmentCacheOnEmpty) {

package/src/client/navigation-transition.ts

@@ -94,114 +94,95 @@ export interface TransitionResult<E = ReactNode> {
   commit: () => void;
 }
 
-// ─── Navigation Transition Counter ──────────────────────────────
-// Monotonically increasing counter that increments each time
-// navigateTransition() is called. Used to detect stale transitions:
-// if a newer transition started while the current one's perform()
-// was in flight, the current transition is stale and should reject.
-//
-// Separate from the link-pending navId (which only increments on
-// link clicks). This counter covers all navigation types: link clicks,
-// programmatic navigate(), refresh(), and handlePopState().
-//
-// Uses globalThis for singleton guarantee across chunks — same pattern
-// as NavigationContext and the link pending store.
+/** What happened to this navigation's tree. */
+export type CommitOutcome = 'committed' | 'superseded' | 'failed';
 
-const NAV_TRANSITION_KEY = Symbol.for('__timber_nav_transition_counter');
+// ─── RenderOwner ────────────────────────────────────────────────
 
 /**
- * `waiters` are woken on every bump so an in-flight navigation can stop
- * waiting on its own payload the moment it is superseded — see
- * `settleOnDecodeOrSupersession`.
- */
-interface TransitionCounter {
-  id: number;
-  waiters: Set<() => void>;
-}
-
-function getTransitionCounter(): TransitionCounter {
-  const g = globalThis as Record<symbol, unknown>;
-  const existing = g[NAV_TRANSITION_KEY] as Partial<TransitionCounter> | undefined;
-  if (!existing) {
-    const created: TransitionCounter = { id: 0, waiters: new Set() };
-    g[NAV_TRANSITION_KEY] = created;
-    return created;
-  }
-  // A duplicated copy of this module may have created the singleton before
-  // `waiters` existed. The object is shared across chunks, so fill it in
-  // rather than replacing it — replacing would strand the other copy's id.
-  existing.waiters ??= new Set();
-  return existing as TransitionCounter;
-}
-
-/** Bump the counter and wake everything waiting on an older transition. */
-function bumpTransitionCounter(): number {
-  const counter = getTransitionCounter();
-  counter.id += 1;
-  for (const wake of [...counter.waiters]) wake();
-  return counter.id;
-}
-
-/**
- * Invalidate all in-flight navigation transitions. Any navigateTransition()
- * call whose perform() has not yet committed will reject with AbortError
- * instead of committing its element.
+ * A per-render identity that replaces the transition counter, the
+ * `handedOffNavAborts` set, and the `AbortController`-as-owner pattern.
+ *
+ * The navigation lifecycle holds one slot (`current: RenderOwner | null`).
+ * All supersession is "take the slot":
+ *
+ *   - Navigation takes unconditionally (previous owner gets settled + aborted
+ *     if !handedOff).
+ *   - Revalidation takes only if empty (epoch check).
+ *   - Handover gate before root.render checks `current === owner`.
+ *   - `settle()` is called from NavigationRoot publish (committed), slot
+ *     takeover (superseded), or rejection (failed).
  *
- * Called by the router when a render supersedes in-flight navigations
- * WITHOUT going through navigateTransition() — the cached popstate replay
- * renders directly, which doesn't bump the counter, so a stale forward
- * navigation's render would otherwise pass the `counter.id !== transId`
- * guard and commit the forward page over the replayed back page (TIM-1022).
+ * `settle()` records the outcome and resolves `displaced` for non-committed
+ * outcomes. The `outcome` field is first-wins with one exception:
+ * `settle('superseded')` overrides a prior `'committed'`, because a
+ * committed-but-still-decoding navigation can be displaced by a successor
+ * and the post-decode check must throw rather than letting the old
+ * navigation continue.
+ *
+ * TIM-1481: replaces counter + waiters + bumpTransitionCounter +
+ * supersedeNavigationTransitions + handedOffNavAborts + globalThis singleton.
  */
-export function supersedeNavigationTransitions(): void {
-  bumpTransitionCounter();
+export interface RenderOwner {
+  readonly kind: 'navigation' | 'revalidation';
+  readonly fetchAbort: AbortController;
+  handedOff: boolean;
+  /** Sync read for the post-perform() check. null until settled. */
+  outcome: CommitOutcome | null;
+  /**
+   * Resolves when this owner is displaced — a successor supersedes it or it
+   * fails. Does NOT resolve on commit: a committed navigation still waits
+   * for its decode to finish. Used to stop waiting on a decode that is no
+   * longer this navigation's business.
+   */
+  readonly displaced: Promise<void>;
+  /**
+   * Record this owner's outcome and, for non-committed outcomes, resolve
+   * `displaced`. First-wins with one exception: `settle('superseded')`
+   * overrides a prior `'committed'`.
+   */
+  settle: (outcome: CommitOutcome) => void;
 }
 
 /**
- * Wait for the payload to finish decoding, OR for this transition to be
- * superseded — whichever happens first.
- *
- * A superseded navigation must stop waiting on its own stream. The stream is
- * deliberately NOT aborted once its tree has been handed to React (the tree
- * may be on screen with boundaries still feeding from it — see
- * `handedOffNavAbort` in `client/router-lifecycle.ts`), so there is nothing
- * left to make `decodePromise` settle promptly. Awaiting it bare would keep
- * the loser's `router.navigate()` promise pending for the rest of the stream
- * — and forever if it stalls — which is what `<Link>`'s `isPending` is timed
- * against, so the losing link would sit spinning while the winner loaded
- * (codex on #1004).
- *
- * A decode *failure* still propagates: it is a real error for this
- * navigation, and the caller's recovery is timed against it.
+ * Create a fresh RenderOwner. Exported so tests that call
+ * `navigateTransition` directly can construct one without a router.
  */
-function settleOnDecodeOrSupersession(
-  decodePromise: Promise<void>,
-  counter: TransitionCounter,
-  transId: number
-): Promise<void> {
-  if (counter.id !== transId) return Promise.resolve();
-  return new Promise<void>((resolve, reject) => {
-    const stopWaiting = (): void => {
-      counter.waiters.delete(wake);
-    };
-    const wake = (): void => {
-      if (counter.id !== transId) {
-        stopWaiting();
-        resolve();
+export function createRenderOwner(kind: 'navigation' | 'revalidation'): RenderOwner {
+  let resolveDisplaced!: () => void;
+  const displaced = new Promise<void>((r) => {
+    resolveDisplaced = r;
+  });
+
+  const owner: RenderOwner = {
+    kind,
+    fetchAbort: new AbortController(),
+    handedOff: false,
+    outcome: null,
+    displaced,
+    settle(outcome: CommitOutcome): void {
+      if (owner.outcome === null) {
+        owner.outcome = outcome;
+      } else if (outcome === 'superseded' && owner.outcome === 'committed') {
+        // A committed-but-still-decoding navigation can be displaced by a
+        // successor. Override so the post-decode check throws AbortError
+        // rather than letting the old navigation continue with scroll
+        // restoration while a newer navigation is active.
+        owner.outcome = 'superseded';
       }
-    };
-    counter.waiters.add(wake);
-    decodePromise.then(
-      () => {
-        stopWaiting();
-        resolve();
-      },
-      (error: unknown) => {
-        stopWaiting();
-        reject(error instanceof Error ? error : new Error(String(error)));
+      // Resolve `displaced` for any non-committed outcome, even if the
+      // outcome field was already set. A committed-but-still-decoding
+      // navigation must be woken when a successor supersedes it — the old
+      // counter-based waiter did this because the counter bumped regardless
+      // of commit state. A commit does NOT resolve displaced: that would
+      // end the decode wait early, clearing pending state before the Flight
+      // stream finishes.
+      if (outcome !== 'committed') {
+        resolveDisplaced();
       }
-    );
-  });
+    },
+  };
+  return owner;
 }
 
 // ─── navigateTransition ─────────────────────────────────────────
@@ -235,44 +216,112 @@ function settleOnDecodeOrSupersession(
  * one's `perform()` was in flight — the stale tree is never handed to React
  * and its `commit` never runs (TIM-629, TIM-1301).
  *
+ * `onCommit` is the caller's hook on the *commit*, which the returned promise
+ * deliberately does not wait for. It runs exactly once: when React commits
+ * this navigation's tree, or — so nothing waits on a commit that will never
+ * come — when the navigation is abandoned instead: superseded by a newer
+ * transition (before or after its tree was handed to React) or failed. It is
+ * how `<Link>` keeps `isPending` up until the destination is on screen
+ * without scheduling anything against React's lanes (TIM-1418).
+ *
+ * `owner` is the `RenderOwner` for this render (TIM-1481). Supersession is
+ * detected via `owner.outcome` (sync) and `owner.displaced` (async).
+ * No module-level state; no globalThis singleton.
+ *
  * Used for: navigate(), refresh(), popstate with fetch.
  */
 export function navigateTransition(
+  owner: RenderOwner,
   perform: () => Promise<TransitionResult>,
-  render: NavigationRender
+  render: NavigationRender,
+  onCommit?: (outcome: CommitOutcome) => void
 ): Promise<void> {
-  // Increment the transition counter SYNCHRONOUSLY (before any await). Each
-  // call gets a unique transId; the counter is the same globalThis
-  // singleton, so a newer call always has a higher id.
-  const counter = getTransitionCounter();
-  const transId = bumpTransitionCounter();
-
   const superseded = () => new DOMException('Navigation superseded', 'AbortError');
 
+  // `onCommit`, exactly once, on whichever comes first: the commit, a
+  // supersession, or a failure.
+  let commitSettled = onCommit === undefined;
+  const settleCommit = (outcome: CommitOutcome): void => {
+    if (commitSettled) return;
+    commitSettled = true;
+    onCommit?.(outcome);
+  };
+
+  // Watch for displacement from outside (a successor taking the slot).
+  if (!commitSettled) {
+    void owner.displaced.then(() => {
+      if (owner.outcome === 'superseded') settleCommit('superseded');
+    });
+  }
+
   return (async () => {
-    const { element, decodePromise, commit } = await perform();
-    if (counter.id !== transId) {
-      decodePromise?.catch(() => {});
-      throw superseded();
+    try {
+      const { element, decodePromise, commit } = await perform();
+      if (owner.outcome !== null) {
+        decodePromise?.catch(() => {});
+        throw superseded();
+      }
+      // Hand the tree over with its commit attached. NavigationRoot runs it if
+      // and when React commits this tree, so a navigation that is superseded
+      // while its payload streams publishes nothing (TIM-1301).
+      //
+      // This is THE update that must not hide the departing page (TIM-1306);
+      // `render` is the synchronous transition around `root.render`.
+      render(element, () => {
+        try {
+          commit();
+        } finally {
+          settleCommit('committed');
+        }
+      });
+      // React may commit the tree before this settles — that is the point:
+      // the destination reveals as React is able to render it
+      // rather than waiting for the whole Flight stream. The await is here so
+      // the promise this function hands back still means "the payload is
+      // decoded", which is what the router's scroll restoration, the
+      // Navigation API deferred and `<Link>`'s `isPending` are timed against.
+      //
+      // ...unless this navigation loses first, in which case it stops waiting
+      // on a stream that is no longer its business.
+      if (decodePromise) {
+        await settleOnDecodeOrDisplacement(decodePromise, owner);
+      }
+      if (owner.outcome !== null && owner.outcome !== 'committed') {
+        throw superseded();
+      }
+    } catch (error) {
+      settleCommit('failed');
+      throw error;
     }
-    // Hand the tree over with its commit attached. NavigationRoot runs it if
-    // and when React commits this tree, so a navigation that is superseded
-    // while its payload streams publishes nothing (TIM-1301).
-    //
-    // This is THE update that must not hide the departing page (TIM-1306);
-    // `render` is the synchronous transition around `root.render`.
-    render(element, commit);
-    // React may commit the tree before this settles — that is the point:
-    // the destination reveals as React is able to render it
-    // rather than waiting for the whole Flight stream. The await is here so
-    // the promise this function hands back still means "the payload is
-    // decoded", which is what the router's scroll restoration, the
-    // Navigation API deferred and `<Link>`'s `isPending` are timed against.
-    //
-    // ...unless this navigation loses first, in which case it stops waiting
-    // on a stream that is no longer its business. See
-    // `settleOnDecodeOrSupersession`.
-    if (decodePromise) await settleOnDecodeOrSupersession(decodePromise, counter, transId);
-    if (counter.id !== transId) throw superseded();
   })();
 }
+
+/**
+ * Wait for the payload to finish decoding, OR for this owner to be
+ * displaced — whichever happens first.
+ *
+ * A superseded navigation must stop waiting on its own stream. The stream is
+ * deliberately NOT aborted once its tree has been handed to React (the tree
+ * may be on screen with boundaries still feeding from it — see
+ * `RenderOwner.handedOff`), so there is nothing left to make `decodePromise`
+ * settle promptly. Awaiting it bare would keep the loser's
+ * `router.navigate()` promise pending for the rest of the stream — and
+ * forever if it stalls — which is what `<Link>`'s `isPending` is timed
+ * against, so the losing link would sit spinning while the winner loaded
+ * (codex on #1004).
+ *
+ * A decode *failure* still propagates: it is a real error for this
+ * navigation, and the caller's recovery is timed against it.
+ */
+function settleOnDecodeOrDisplacement(
+  decodePromise: Promise<void>,
+  owner: RenderOwner
+): Promise<void> {
+  // Only bail early for displacement (superseded/failed), not for commit.
+  // A committed tree still needs to wait for its decode to finish — pending
+  // state and the Link indicator are timed against it.
+  if (owner.outcome !== null && owner.outcome !== 'committed') {
+    return Promise.resolve();
+  }
+  return Promise.race([decodePromise, owner.displaced]);
+}

package/src/client/router-effects.ts

@@ -10,6 +10,7 @@
  */
 
 import { setHardNavigating } from './navigation-root.tsx';
+import type { RenderOwner } from './navigation-transition.ts';
 import { RedirectError, ServerErrorResponse, NonRscResponse } from './rsc-fetch.ts';
 import { recordSkew } from './router-skew.ts';
 
@@ -84,15 +85,15 @@ export function leaveSpa(url: string, fromUrl: string): Promise<never> {
 }
 
 export interface SpaExitDeps {
-  /** The controller that owns the router right now, or null when idle. */
-  currentNavAbort: () => AbortController | null;
+  /** The owner that holds the router right now, or null when idle. */
+  currentOwner: () => RenderOwner | null;
   /** Supersede whatever is in flight and take ownership. */
   supersede: () => void;
 }
 
 export interface SpaExits {
   /**
-   * Leave the SPA — but only if `navAbort` still owns the router. Every
+   * Leave the SPA — but only if `owner` still owns the router. Every
    * failure a navigation can end on (a server error, a non-RSC response, a
    * version skew) can surface long after the user has clicked something else:
    * a fetch that was never cancellable, a Flight thenable that rejects late.
@@ -104,7 +105,7 @@ export interface SpaExits {
    * `finally` clears the current controller, so an ownership check downstream
    * of it compares against `null` and never leaves at all.
    */
-  leaveSpaIfOwned: (navAbort: AbortController, url: string, fromUrl: string) => Promise<void>;
+  leaveSpaIfOwned: (owner: RenderOwner, url: string, fromUrl: string) => Promise<void>;
 
   /**
    * Leave the SPA from a path that never entered `runNavigation()` — the
@@ -127,13 +128,9 @@ export interface SpaExits {
  * together because every caller of `leaveSpa()` needs one or the other, and
  * an unguarded call is the bug (TIM-1275, TIM-1276).
  */
-export function createSpaExits({ currentNavAbort, supersede }: SpaExitDeps): SpaExits {
-  async function leaveSpaIfOwned(
-    navAbort: AbortController,
-    url: string,
-    fromUrl: string
-  ): Promise<void> {
-    if (currentNavAbort() !== navAbort) return;
+export function createSpaExits({ currentOwner, supersede }: SpaExitDeps): SpaExits {
+  async function leaveSpaIfOwned(owner: RenderOwner, url: string, fromUrl: string): Promise<void> {
+    if (currentOwner() !== owner) return;
     await leaveSpa(url, fromUrl);
   }
 
@@ -146,8 +143,8 @@ export function createSpaExits({ currentNavAbort, supersede }: SpaExitDeps): Spa
 }
 
 export interface NavigationRecoveryDeps {
-  /** The controller that owns the router right now, or null when idle. */
-  currentNavAbort: () => AbortController | null;
+  /** The owner that holds the router right now, or null when idle. */
+  currentOwner: () => RenderOwner | null;
   leaveSpaIfOwned: SpaExits['leaveSpaIfOwned'];
   /** Replace the current entry with `url` — the router's own `navigate()`. */
   navigate: (url: string) => Promise<void>;
@@ -176,20 +173,20 @@ export interface NavigationRecoveryDeps {
  * {@link SpaExits.leaveSpaIfOwned}.
  */
 export function createNavigationRecovery({
-  currentNavAbort,
+  currentOwner,
   leaveSpaIfOwned,
   navigate,
 }: NavigationRecoveryDeps) {
   return async function recoverFromNavigationError(
     error: unknown,
-    navAbort: AbortController,
+    owner: RenderOwner,
     url: string,
     fromUrl: string
   ): Promise<boolean> {
     if (error instanceof RedirectError) {
       // Same ownership rule as leaving the SPA: a superseded navigation must
       // not steer the document to the destination it was abandoned for.
-      if (currentNavAbort() !== navAbort) return true;
+      if (currentOwner() !== owner) return true;
       await navigate(error.redirectUrl);
       return true;
     }
@@ -202,7 +199,7 @@ export function createNavigationRecovery({
       error instanceof NonRscResponse ||
       recordSkew(error)
     ) {
-      await leaveSpaIfOwned(navAbort, url, fromUrl);
+      await leaveSpaIfOwned(owner, url, fromUrl);
       return true;
     }
     return false;