@tinvar/react 0.0.0-stage → 0.4.0

package/src/router.js

@@ -0,0 +1,3555 @@
+// The client router: navigation, history, scroll, and the wire protocol.
+//
+// tinvar-spec.md, "Client router and components": the visit API mirrors
+// Inertia's "so the same mental model applies; only the payload differs".
+// The payload is an RSC stream, and turning one into React elements needs the
+// application's own client bundle -- the module instance that hydrated the
+// page, or client components resolve to a different React and nothing works.
+// So, as with deferred boundaries, mounting is a callback the app supplies
+// and this module never imports React.
+//
+// What lives here is everything that is the same for every application:
+// which requests to send and with which headers, what each control response
+// means, when history is pushed or replaced, where the scroll goes, and
+// which pages are fetched before they are asked for.
+
+import { csrfToken } from './csrf.js';
+import { markDocumentLoad, reloadUnlessLoading } from './document-load.js';
+import { hasFiles, toFormData } from './form-data.js';
+import { createOnceStore } from './once-store.js';
+import { PrefetchCache, cacheWindow } from './prefetch-cache.js';
+import { createRememberStore, importHistoryKey, keepNewest, tabStorage } from './remember-store.js';
+import { purgeResumeStore } from './resume-store.js';
+
+export const RSC_CONTENT_TYPE = 'text/x-component';
+export const ROUTE_TOKEN_HEADER = 'x-route-token';
+
+/** "Prefetch requests skip side effects like previous-URL tracking." */
+export const PREFETCH_PURPOSE = 'prefetch';
+
+/**
+ * Marks a background request -- a poll -- so the server records no visit
+ * for it. A poll re-asks for the page already up; one asking for the whole
+ * page is neither a prefetch nor a partial reload, and without this it would
+ * read to the server as the person coming back to that page.
+ */
+export const BACKGROUND_HEADER = 'x-background';
+
+/** Where an action's response lists the cache tags it invalidated. */
+export const INVALIDATED_TAGS_HEADER = 'x-invalidated-tags';
+
+/**
+ * Where a page's payload carries the session's history key, when the page's
+ * history is encrypted; a document carries it in its page metadata (ADR 0019).
+ */
+export const HISTORY_KEY_HEADER = 'x-history-key';
+
+/** How many X-Redirects one visit will follow before loading the document. */
+export const MAX_REDIRECTS = 10;
+
+/**
+ * How long restoring a scroll position keeps trying, in milliseconds, while
+ * the page is still too short to reach it.
+ */
+export const SCROLL_RESTORE_MS = 2000;
+
+/** Input that means the user is moving the page, and a restore should stop. */
+const USER_SCROLL_EVENTS = ['wheel', 'touchstart', 'keydown', 'pointerdown'];
+
+/**
+ * The attribute that marks an inner scroller -- a sidebar, a pane, a table
+ * that scrolls inside the page -- whose position the router keeps with the
+ * window's: "`scroll-region` attribute for inner scrollers".
+ */
+export const SCROLL_REGION_ATTRIBUTE = 'scroll-region';
+
+/**
+ * The events the forms layer emits through the router (announce()): an
+ * action call starting, its files uploading, and its answer applied.
+ */
+const ANNOUNCED = new Set(['actionStart', 'progress', 'actionSettle']);
+
+function noop() {}
+
+/**
+ * Events the router emits. `cancelable` ones can be stopped by a listener.
+ *
+ * Cancelling is a UI hook -- show a toast instead of reloading, confirm
+ * before leaving a dirty form -- and never a security control. Any script on
+ * the page can listen on the document and cancel, and the server must hold
+ * every line regardless: a version the client declines to reload for is
+ * still refused on its next request, and a page the client is stopped from
+ * leaving was authorised when it was rendered. A 401 is the one outcome a
+ * listener cannot cancel.
+ */
+const CANCELABLE = new Set(['before', 'location', 'httpException', 'networkError', 'error']);
+
+/** The app's mount threw: the payload arrived but could not be rendered. */
+class MountFailed extends Error {
+  constructor(cause) {
+    super('The page could not be mounted.', { cause });
+    this.name = 'MountFailed';
+  }
+}
+
+/**
+ * What a visit's `onError` is handed when the server answered with a status
+ * that is not a page: 404, 403, 500. The router's `httpException` event
+ * says the same, and is the one that decides -- cancelled, the router loads
+ * nothing; not, it loads the URL as a document to show the server's page.
+ */
+export class VisitHttpError extends Error {
+  /** @param {string} url @param {number} status */
+  constructor(url, status) {
+    super(`The server answered ${status}.`);
+    this.name = 'VisitHttpError';
+    this.url = url;
+    this.status = status;
+  }
+}
+
+/**
+ * What a visit's `onError` is handed when no answer came: the connection
+ * dropped, the server could not be reached. `networkError` decides what the
+ * router does, as `httpException` does for a status.
+ */
+export class VisitNetworkError extends Error {
+  /** @param {string} url @param {unknown} cause */
+  constructor(url, cause) {
+    super('The server could not be reached.', { cause });
+    this.name = 'VisitNetworkError';
+    this.url = url;
+  }
+}
+
+export class VisitCancelled extends Error {
+  constructor() {
+    super('The visit was cancelled.');
+    this.name = 'VisitCancelled';
+  }
+}
+
+/**
+ * @typedef {{
+ *   method?: 'get',
+ *   data?: Record<string, unknown>,
+ *   replace?: boolean,
+ *   preserveScroll?: boolean | ((page: { url: string, view: string | null, partial: boolean }) => boolean),
+ *   headers?: Record<string, string>,
+ *   background?: boolean,
+ *   only?: readonly string[],
+ *   except?: readonly string[],
+ *   reset?: readonly string[],
+ *   preserveUrl?: boolean,
+ *   signal?: AbortSignal,
+ *   showProgress?: boolean,
+ *   viewTransition?: boolean | ((transition: ViewTransition) => void),
+ *   fresh?: boolean,
+ *   refreshOnce?: boolean,
+ *   preserveState?: boolean | ((page: { url: string, view: string | null, partial: boolean }) => boolean),
+ *   onSuccess?: (page: { url: string, view: string | null, partial: boolean }) => unknown,
+ *   onError?: (error: unknown) => unknown,
+ *   instant?: boolean | string,
+ * }} VisitOptions
+ *
+ * `instant` shows, while the page is fetched, the layouts on screen with a
+ * layout's loading boundary below them (ADR 0092): the boundary of the
+ * layout directly above the page given true, of the layout by that key
+ * given a string. Only for a visit that is not answered from the prefetch
+ * cache, and never for a partial reload, a background request, or back and
+ * forward. A layout on screen with no such boundary makes it an ordinary
+ * visit.
+ *
+ * `data` is the query: merged into the URL's query string, each key
+ * replacing whatever the URL said under it (see withData()). Pages are GET
+ * only, so it is never a body.
+ *
+ * `preserveScroll` keeps the window and the scroll regions where they are
+ * rather than at the top. A function decides once the response is in, told
+ * what `preserveState`'s is.
+ *
+ * `onSuccess` is this visit's own `success`: the page was mounted.
+ * `onError` hears each way the visit failed, as the router's three channels
+ * do: the payload arrived and could not be rendered (`error`, handed what
+ * the mount threw), the server answered a status that is not a page
+ * (`httpException`, handed a VisitHttpError with the status), or no answer
+ * came (`networkError`, a VisitNetworkError with what the fetch threw).
+ * Either may return a promise, and the visit's `finish` -- and the promise
+ * visit() returns -- waits for it, as Inertia's does. It is told, never
+ * asked: what the router does next -- a document load to show the server's
+ * page -- is the event's to cancel. A GET carries no validation errors, so
+ * Inertia's `onError(errors)` has nothing to hear; a failed action's stay on
+ * its form.
+ *
+ * `signal` is the caller's own cancel token: aborting it cancels this visit,
+ * or this background request, and nothing else.
+ *
+ * `fresh` asks the server even when a prefetched copy of the page is kept:
+ * for the visit after an action, which may have changed whose session this
+ * is in a way no script can see.
+ *
+ * `refreshOnce` claims none of the #[Once] content this client keeps, so
+ * the server renders those fields again: for a live refresh, which says
+ * something the page read has changed -- and a once field is something it
+ * read, whose own tags may not name what changed.
+ *
+ * `only` and `except` ask for a partial reload: dot paths, `<segment>` or
+ * `<segment>.<field>`, where a segment is a layout's key or `page`. The
+ * server recomputes the segments they name, and the payload carries only
+ * those (ADR 0015).
+ *
+ * `reset` names merged fields -- #[Merge] lists and Scroll pages, by dot
+ * path -- that this response replaces rather than adds to: what a filter
+ * that changes the list asks for (X-Reset, ADR 0020).
+ *
+ * `preserveUrl` fetches the URL without moving the address bar to it: no
+ * entry pushed or replaced, and the page on screen stays the one the bar
+ * names. For a background request it lets a partial payload of the page on
+ * screen, fetched at another of its URLs -- the next page of a list -- be
+ * merged into it.
+ *
+ * @typedef {{
+ *   cacheFor?: number | string | readonly [number | string, number | string],
+ *   cacheTags?: string | readonly string[],
+ *   method?: string,
+ * }} PrefetchOptions
+ *
+ * `preserveState` keeps the page's client components' state where React
+ * matches them (true), or mounts the page fresh (false): the page segment,
+ * or the segments a partial reload carries, while layouts keep theirs, as
+ * Inertia's persistent layouts do. A function decides once the response is
+ * in. False by default for a visit that shows a whole page, as Inertia's;
+ * true for reload(), a partial reload, a background request and an
+ * action's re-render (ADR 0045).
+ *
+ * @typedef {{
+ *   url: string,
+ *   routeToken: string | null,
+ *   signal: AbortSignal,
+ *   partial?: boolean,
+ *   preserveState?: boolean,
+ * }} Page
+ *
+ * `signal` aborts once a later navigation supersedes this one. A mount that
+ * is still decoding can stop early; whatever it does, the router commits
+ * nothing for a superseded page after the mount returns. `partial` says the
+ * payload is the segments a partial reload recomputed, to merge into the
+ * page on screen, not a page. `preserveState` false asks for it to be
+ * committed fresh.
+ *
+ * `prepare` is the mount in two steps, as createPageRoot() hands it:
+ * decode the payload, then commit it. Used in place of `mount` where given,
+ * so a view transition holds the page for the commit alone.
+ *
+ * @typedef {{
+ *   mount?: (stream: ReadableStream<Uint8Array>, page: Page) => void | Promise<void>,
+ *   prepare?: (stream: ReadableStream<Uint8Array>, page: Page) => Promise<{ commit: () => Promise<void> } | null | undefined>,
+ *   version?: string,
+ *   fetch?: typeof fetch,
+ *   window?: Window,
+ *   initialRouteToken?: string | null,
+ *   initialView?: string | null,
+ *   hardNavigate?: (url: string) => void,
+ *   storage?: Storage | null,
+ *   resumeStore?: import('./resume-store.js').ResumeStore,
+ *   initialHistoryKey?: string | null,
+ *   endpoints?: { matches(url: URL | string): boolean },
+ *   instant?: (under: true | string) => (() => void) | null,
+ * }} RouterOptions
+ *
+ * `instant` shows an instant visit's loading boundary and hands back what
+ * takes it away, as createPageRoot()'s does; without it, an instant visit
+ * is an ordinary one.
+ *
+ * `storage` is where useRemember() keeps its values: the tab's
+ * sessionStorage unless given, and memory alone given null.
+ *
+ * `initialHistoryKey` is the first page's history key, read from the page
+ * metadata if not given: what the router seals the first page's remembered
+ * state with (ADR 0019).
+ *
+ * `endpoints` is the application's #[Get], #[Post] and #[Endpoint] routes --
+ * codegen's `endpoint` -- whose URLs are no page's (ADR 0074). A link to one
+ * is left to the browser, a visit to one is a full load, and none is ever
+ * fetched with `RSC: 1` or prefetched: what answers is a download or JSON,
+ * not a payload.
+ *
+ * @typedef {{
+ *   page: number,
+ *   key: string | null,
+ *   index: number,
+ *   top: number,
+ *   first: number,
+ *   last: number,
+ *   window: boolean,
+ * }} ScrollAnchor
+ *
+ * Where a merged list was read to: the item at the top of what the reader
+ * saw -- its page, its key where the list could tell, and its place on its
+ * page -- how far down the screen or the list's scroll container its top
+ * was, the pages that were loaded, and whether the list scrolls with the
+ * window.
+ */
+
+/** The page's view, on a payload; sent back as X-Page with a partial reload. */
+export const PAGE_HEADER = 'x-page';
+
+/** As many once keys as the server reads from X-Have-Once, and as many bytes. */
+const MAX_HELD_KEYS = 64;
+const MAX_HELD_BYTES = 4000;
+
+/** Where once-shared values' holds go back to the server (ADR 0065), and how many it reads. */
+const SHARED_HOLDS_HEADER = 'X-Have-Shared';
+const MAX_SHARED_HOLDS = 16;
+const MAX_SHARED_BYTES = 8000;
+
+/** Marks a payload holding only what a partial reload recomputed. */
+export const PARTIAL_HEADER = 'x-partial';
+
+/**
+ * The token a page's live subscription is scoped to, on a payload: what the
+ * render read (Tinvar\Live). Handed on in the `success` event's
+ * `liveToken`, for the live module.
+ */
+export const LIVE_TOKEN_HEADER = 'x-live-token';
+
+/** The id of the element the renderer writes the page metadata into. */
+export const PAGE_METADATA_ID = 'tinvar-page';
+
+/**
+ * The initial page metadata the renderer wrote into the document: the
+ * page's URL, the build it was rendered for, and its route token. A
+ * document load cannot read response headers, so this is the only way the
+ * first page's route token and the client's own build reach the router.
+ *
+ * Null when the element is missing or is not what the renderer writes --
+ * the document is the app's, and nothing in it is assumed well-formed.
+ *
+ * @param {Document} [doc]
+ * @returns {{ url: string, version: string, routeToken: string | null, view: string | null, historyKey: string | null, route: string | null } | null}
+ */
+export function readPageMetadata(doc = globalThis.document) {
+  // The first JSON data block with the id, in document order. The renderer
+  // writes its block at the very start of the document, so nothing the page
+  // renders can precede it -- and an element that merely shares the id, or
+  // a later block planted in page content, is passed over rather than read.
+  if (typeof doc?.querySelector !== 'function') return null;
+  const element = doc.querySelector(`script[type="application/json"]#${PAGE_METADATA_ID}`);
+  if (!element) return null;
+
+  let data;
+  try {
+    data = JSON.parse(element.textContent ?? '');
+  } catch {
+    return null;
+  }
+
+  if (typeof data?.url !== 'string' || typeof data.version !== 'string') return null;
+
+  return {
+    url: data.url,
+    version: data.version,
+    routeToken: typeof data.routeToken === 'string' ? data.routeToken : null,
+    view: typeof data.view === 'string' ? data.view : null,
+    historyKey: typeof data.historyKey === 'string' ? data.historyKey : null,
+    // What the page's own reports are filed under: its route's name, or its
+    // view where it has none (ADR 0129).
+    route: typeof data.route === 'string' ? data.route : null,
+  };
+}
+
+/**
+ * Takes the history key out of the page metadata block, leaving the rest:
+ * once the router has imported it as a key it cannot export, the block
+ * would otherwise go on holding the raw bytes for as long as the document
+ * lasts. The block is the renderer's, written before the document; React
+ * renders nothing of it, so nothing hydrates against what it held.
+ *
+ * @param {Document | undefined} doc
+ */
+function forgetMetadataKey(doc) {
+  if (typeof doc?.querySelector !== 'function') return;
+  const element = doc.querySelector(`script[type="application/json"]#${PAGE_METADATA_ID}`);
+  if (!element) return;
+  try {
+    const data = JSON.parse(element.textContent ?? '');
+    if (data === null || typeof data !== 'object' || !('historyKey' in data)) return;
+    delete data.historyKey;
+    element.textContent = JSON.stringify(data);
+  } catch {
+    // Not what the renderer writes; nothing of ours to take out.
+  }
+}
+
+/**
+ * Which session a route token was minted for: the session hash, the user
+ * hash, the tenant and the panel a route token carries (TokenClaims), as one
+ * string to compare. Null without a token, or for one this does not
+ * understand.
+ *
+ * Read without verifying -- the payload is plain base64url JSON, and nothing
+ * here trusts it. It only answers whether something this client is holding
+ * belongs to the session it is talking to now. "Client-held data ... is
+ * bound to (user, tenant) ... Any mismatch between stored and current user
+ * or tenant also purges it." The user hash names who is signed in and the
+ * auth epoch the application keeps for them: a role changed, impersonation
+ * started or stopped, with the session id kept, is a change of binding too.
+ *
+ * @param {string | null | undefined} token
+ * @returns {string | null}
+ */
+export function bindingOf(token) {
+  if (typeof token !== 'string') return null;
+  const body = token.split('.')[1];
+  if (!body) return null;
+
+  try {
+    const claims = JSON.parse(atob(body.replace(/-/g, '+').replace(/_/g, '/')));
+    if (typeof claims?.s !== 'string' || claims.s === '') return null;
+    return JSON.stringify([claims.s, String(claims.u ?? ''), String(claims.y ?? ''), String(claims.n ?? '')]);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The cache tags an action's response says it invalidated, from its
+ * `X-Invalidated-Tags` header. Accepts the response, its headers, or the
+ * header's value.
+ *
+ * @param {Response | Headers | { headers?: Headers } | string | null | undefined} source
+ * @returns {string[]}
+ */
+export function invalidatedTags(source) {
+  const headers = typeof source?.get === 'function' ? source : source?.headers;
+  const value = typeof source === 'string' ? source : headers?.get?.(INVALIDATED_TAGS_HEADER);
+  return typeof value === 'string' ? tagsOf(value.split(',')) : [];
+}
+
+/**
+ * `cacheTags` as given -- one tag or several -- as a list of distinct,
+ * non-empty tags.
+ *
+ * @param {string | readonly string[] | null | undefined} tags
+ * @returns {string[]}
+ */
+function tagsOf(tags) {
+  const listed = typeof tags === 'string' ? [tags] : Array.isArray(tags) ? tags : [];
+  return [...new Set(listed.map((tag) => String(tag).trim()).filter((tag) => tag !== ''))];
+}
+
+/**
+ * Whether a visit asks for a partial reload.
+ *
+ * @param {{ only?: readonly string[], except?: readonly string[] }} opts
+ */
+function isPartial(opts) {
+  return opts.only !== undefined || opts.except !== undefined;
+}
+
+/**
+ * Partial-reload paths as sent: trimmed, non-empty, each once. A comma
+ * would split one path into two on the server, so a path holding one is
+ * refused here rather than read as two.
+ *
+ * @param {readonly string[]} paths
+ * @returns {string[]}
+ */
+function pathsOf(paths) {
+  const out = [];
+  for (const raw of paths) {
+    const path = String(raw).trim();
+    if (path.includes(','))
+      throw new TypeError(`[tinvar:client] '${path}' is not one path: it holds a comma.`);
+    if (path !== '' && !out.includes(path)) out.push(path);
+  }
+  return out;
+}
+
+/**
+ * What the store kept for an entry under a session, as a page's record
+ * holds it: each value with that session.
+ *
+ * @param {Record<string, unknown>} stored
+ * @param {string | null} session
+ * @returns {Map<string, { session: string, value: unknown }>}
+ */
+function valuesOf(stored, session) {
+  const values = new Map();
+  if (session === null) return values;
+  for (const [key, value] of Object.entries(stored)) values.set(key, { session, value });
+  return values;
+}
+
+/** Every router that is up, for flushInvalidated() and revokeSession(). */
+const live = new Set();
+
+/**
+ * Ends the session on this client, for whatever heard the server's 401:
+ * "Client-held data ... is cleared, with a full page load, on ... session
+ * revocation, which the server signals with a 401" (tinvar-spec.md). The
+ * router given -- or, without one, every router that is up -- revokes what
+ * it holds; and what useRemember() kept in the tab's storage is wiped
+ * either way, so a page with no router on it, or one whose router kept its
+ * values elsewhere, leaves nothing behind for the next document to read.
+ *
+ * Only the clearing: the caller makes the page load that must follow.
+ *
+ * @param {{ revoke: () => void } | null | undefined} [router]
+ */
+export function revokeSession(router) {
+  if (router) router.revoke();
+  else for (const each of live) each.revoke();
+  createRememberStore(tabStorage(globalThis.window)).wipe();
+  // And every resumable upload remembered: each was the session's.
+  purgeResumeStore(null);
+}
+
+/**
+ * Clears the history of every router that is up -- or of the router given
+ * -- and wipes what useRemember() kept in the tab's storage either way: what
+ * logging out calls before the page it loads next. See Router.clearHistory().
+ *
+ * @param {{ clearHistory: () => void } | null | undefined} [router]
+ */
+export function clearHistory(router) {
+  if (router) router.clearHistory();
+  else for (const each of live) each.clearHistory();
+  createRememberStore(tabStorage(globalThis.window)).wipe();
+  purgeResumeStore(null);
+}
+
+/**
+ * Flushes what an action invalidated from every router on the page: each
+ * prefetched page carrying a tag the response's `X-Invalidated-Tags` names.
+ *
+ * tinvar-spec.md, "Caching and invalidation": "an action's response lists
+ * the server-side query tags it invalidated (`X-Invalidated-Tags`), and the
+ * client flushes matching prefetch entries automatically. Inertia makes
+ * developers repeat `invalidateCacheTags` on each form." Whatever sends
+ * actions -- a form helper, an app's own fetch -- hands each response here,
+ * once, and no form names a tag.
+ *
+ * @param {Response | Headers | { headers?: Headers } | string | null | undefined} source
+ * @returns {string[]} the tags it named
+ */
+export function flushInvalidated(source) {
+  const tags = invalidatedTags(source);
+  if (tags.length > 0) {
+    for (const router of live) router.flushByCacheTags(tags);
+  }
+  return tags;
+}
+
+/**
+ * Whether a page keeps its client components' state, or its scroll
+ * position: what the visit said -- a function deciding once the response is
+ * in -- or else `fallback`. A function that throws is reported and decides
+ * nothing: the page it was asked about is still mounted, as a view
+ * transition's that throws is.
+ *
+ * @param {VisitOptions['preserveState'] | VisitOptions['preserveScroll']} option
+ * @param {{ url: string, view: string | null, partial: boolean }} page
+ * @param {boolean} fallback
+ * @returns {boolean}
+ */
+function preserves(option, page, fallback) {
+  if (typeof option === 'function') {
+    try {
+      return option(page) === true;
+    } catch (error) {
+      if (typeof globalThis.reportError === 'function') globalThis.reportError(error);
+      else console.error(error);
+      return fallback;
+    }
+  }
+  return typeof option === 'boolean' ? option : fallback;
+}
+
+/**
+ * Runs a visit's `onSuccess` or `onError`, waiting for the promise it may
+ * return. What it throws or rejects with is its own bug, reported as a
+ * listener's is; the visit has already come out the way it did.
+ *
+ * @param {((...args: any[]) => unknown) | undefined} callback
+ * @param {...unknown} args
+ */
+async function runCallback(callback, ...args) {
+  if (typeof callback !== 'function') return;
+  try {
+    await callback(...args);
+  } catch (error) {
+    if (typeof globalThis.reportError === 'function') globalThis.reportError(error);
+    else console.error(error);
+  }
+}
+
+/**
+ * A GET visit's URL with its `data` merged into the query string, as
+ * Inertia deep-merges a GET's: a plain object merges into what the URL
+ * holds under its name, field by field and as deep as it goes, so
+ * `{ filter: { status } }` replaces `filter[status]` and keeps
+ * `filter[sort]`; anything else -- a value, a list, null -- replaces the
+ * name and everything under it (`status` and `status[...]` alike), as
+ * deepmerge overwrites an array. The rest of the query stays, the fragment
+ * too. A key whose value is undefined takes the field out; an empty object
+ * changes nothing.
+ *
+ * Written as toFormData() writes a body -- `tags[]` for a list,
+ * `filter[status]` for a field, booleans as 1 and 0, null as an empty
+ * string -- so PHP reads the same nesting from a query as from a form. A
+ * file has no place in a URL: data holding one is the caller's mistake,
+ * said to the caller, rather than sent as "[object File]".
+ *
+ * @param {URL} url
+ * @param {unknown} data
+ * @returns {URL}
+ */
+function withData(url, data) {
+  if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+    throw new TypeError("[tinvar:client] A visit's data is an object of query fields.");
+  }
+  if (hasFiles(data)) {
+    throw new TypeError('[tinvar:client] A visit is a GET, which cannot carry a file; send it to an action.');
+  }
+
+  const query = url.searchParams;
+  for (const replaced of replacedNames(data, null)) {
+    for (const name of [...query.keys()]) {
+      if (name === replaced || name.startsWith(`${replaced}[`)) query.delete(name);
+    }
+  }
+  for (const [name, value] of toFormData(/** @type {Record<string, unknown>} */ (data))) {
+    query.append(name, String(value));
+  }
+  return url;
+}
+
+/**
+ * The query names a visit's data replaces: each leaf's, where a leaf is
+ * anything but a plain object -- a plain object is merged into, by its own
+ * leaves. Named as toFormData() writes them, `filter[status]`.
+ *
+ * @param {Record<string, unknown>} data
+ * @param {string | null} prefix
+ * @returns {string[]}
+ */
+function replacedNames(data, prefix) {
+  const out = [];
+  for (const [key, value] of Object.entries(data)) {
+    const name = prefix === null ? key : `${prefix}[${key}]`;
+    if (isPlainObject(value))
+      out.push(...replacedNames(/** @type {Record<string, unknown>} */ (value), name));
+    else out.push(name);
+  }
+  return out;
+}
+
+/** @param {unknown} value */
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+/**
+ * Scroll region positions as history state holds them: one `[left, top]`
+ * for each region, by its place in the document, or null for a place with
+ * nothing usable. History state is the page's to write as much as the
+ * router's, so nothing read back from it is taken on trust.
+ *
+ * @param {unknown} stored
+ * @returns {(readonly [number, number] | null)[] | null}
+ */
+function regionsOf(stored) {
+  if (!Array.isArray(stored)) return null;
+  return stored.map((position) =>
+    Array.isArray(position) && Number.isFinite(position[0]) && Number.isFinite(position[1])
+      ? /** @type {const} */ ([Number(position[0]), Number(position[1])])
+      : null,
+  );
+}
+
+export function createRouter(/** @type {RouterOptions} */ options) {
+  const win = options.window ?? globalThis.window;
+  // Read only for what was not passed: a router given all of it needs
+  // nothing from the document, and may be running against one that has no
+  // DOM.
+  const metadata =
+    options.version !== undefined &&
+    options.initialRouteToken !== undefined &&
+    options.initialView !== undefined &&
+    options.initialHistoryKey !== undefined
+      ? null
+      : readPageMetadata(win.document);
+
+  // Passed explicitly, or read from the page. Without one every client
+  // navigation would be refused as a build mismatch, so its absence is an
+  // error now rather than a reload loop later.
+  const version = options.version ?? metadata?.version;
+  if (typeof version !== 'string') {
+    throw new Error('[tinvar:client] No build version: pass `version` or render the page metadata.');
+  }
+  const doFetch = options.fetch ?? win.fetch.bind(win);
+  const listeners = new Map();
+
+  /** Set by destroy(); after it the router does nothing at all. */
+  let destroyed = false;
+
+  /**
+   * Set by a 401; after it the router sends nothing more. A full load is on
+   * its way, and anything sent meanwhile would only ask again with the
+   * session the server has already refused.
+   */
+  let revoked = false;
+
+  /** Forgets the load of the page on screen a 401 waits to make; see revoke(). */
+  let stopReload = () => {};
+
+  /** @type {AbortController | null} */
+  let inFlight = null;
+  /**
+   * The visit whose page is up, whose payload may still be streaming after
+   * the visit is over: aborted once a page supersedes it, so the page left
+   * is read no further (Page.signal).
+   *
+   * @type {AbortController | null}
+   */
+  let showing = null;
+
+  /** Each visit's URL, for its `finish` event. */
+  const visitUrls = new WeakMap();
+  /** Visits whose `finish` has been emitted. */
+  const finished = new WeakSet();
+
+  /** Background requests in flight -- polls, deferred refreshes. */
+  const background = new Set();
+
+  /** Every background request, in flight or not, so its `finish` can say so. */
+  const backgrounds = new WeakSet();
+
+  /**
+   * How many background requests have been made, and the number of the
+   * newest that has been mounted. Polls can overlap, and their answers can
+   * arrive out of order; one older than what is on screen is never mounted.
+   */
+  let requested = 0;
+  let newestMounted = 0;
+  /** @type {WeakMap<AbortController, number>} */
+  const requestedAs = new WeakMap();
+  /** The background mounts that are an action's re-render; see applyPayload(). */
+  const applying = new WeakSet();
+
+  /** The route token for the page currently mounted; see routeTokens(). */
+  let routeToken =
+    options.initialRouteToken !== undefined ? options.initialRouteToken : (metadata?.routeToken ?? null);
+
+  /**
+   * The session the client is holding data for, from the last route token
+   * a page came with; see bindingOf(). Null until a page carries one, and
+   * kept across pages that do not: a page with no token says nothing about
+   * whose session this is, so it neither confirms nor changes it.
+   */
+  let binding = bindingOf(routeToken);
+
+  /**
+   * The view of the page on screen, sent as X-Page so a partial reload
+   * "applies only to the same page". Null where the server does not say,
+   * and then no partial reload is asked for: the server would render the
+   * page whole without it anyway.
+   */
+  let view = options.initialView !== undefined ? options.initialView : (metadata?.view ?? null);
+
+  /** Pages fetched ahead of a click; see prefetch(). */
+  const cache = new PrefetchCache();
+
+  /**
+   * The history key each copy of a prefetched page came with, imported: the
+   * cache keeps no raw key in its headers (see withoutKey()).
+   *
+   * @type {WeakMap<Response, import('./remember-store.js').HistoryKey>}
+   */
+  const importedKeys = new WeakMap();
+
+  /**
+   * What pages rendered from #[Once] fields, kept so a later request can
+   * list them in X-Have-Once and be sent without them; see once-store.js.
+   */
+  const once = createOnceStore();
+
+  /**
+   * Background requests loading another page of a merged list into the page
+   * on screen -- `preserveUrl`. Not refreshes of what is shown, so a newer
+   * poll does not make one stale; see handle().
+   */
+  const merging = new WeakSet();
+
+  /**
+   * The URL of the page that is mounted, without its fragment. Two history
+   * entries that differ only in fragment are the same document.
+   */
+  let mounted = stripHash(win.location.href);
+
+  // The browser's own restoration fights ours: it restores to where the
+  // OLD document was, before our mount has replaced the content.
+  if ('scrollRestoration' in win.history) {
+    win.history.scrollRestoration = 'manual';
+  }
+
+  /**
+   * Scroll positions, by history entry.
+   *
+   * Recorded as the user scrolls rather than when a visit leaves the page,
+   * because back and forward leave a page too and the router hears of them
+   * only AFTER the browser has moved to the new entry -- too late to save
+   * anything onto the old one. Saving at that point is what broke forward:
+   * the entry left by a back press was never saved, and a visit made while
+   * a back was pending wrote the old page's position onto the new entry.
+   *
+   * Each entry carries a key in its state. `entry` is the key of the entry
+   * whose page is on screen, and null while a back or forward is pending,
+   * when the page on screen belongs to no entry at all. Positions are also
+   * persisted into history.state, debounced (browsers throttle
+   * replaceState), so they survive a reload of the document.
+   *
+   * This map, and the two below, hold only the newest entries, as many as
+   * remembered state keeps (keepNewest()): a long session's every visit
+   * stayed in memory. An entry dropped here falls back to what its
+   * history.state holds.
+   */
+  const positions = new Map();
+
+  /**
+   * The scroll regions' positions, by history entry: one `[left, top]` for
+   * each element carrying a `scroll-region` attribute, in document order.
+   * Recorded with the window's, as the user scrolls one, for the same reason,
+   * and persisted beside it. Matched to the regions of the page shown again
+   * by place, as Inertia matches them: nothing else names a region, and the
+   * page an entry shows renders its regions in the same order each time.
+   *
+   * @type {Map<string, (readonly [number, number] | null)[]>}
+   */
+  const regionPositions = new Map();
+
+  /**
+   * Where each merged list on an entry's page was read to, by history entry
+   * and then by the list's dot path: the item in view, how far down the
+   * screen it was, and the pages that were loaded (see infinite-scroll.js).
+   * Recorded with the scroll position, for the same reason, and persisted
+   * with it -- as places alone, the item's key kept only here (placesOf()).
+   * Forgotten with the session. A raw position cannot bring the reader back
+   * to a list loaded a page at a time: the page arrived at holds only the
+   * page its URL names, so the same offset lands a page or more away.
+   *
+   * @type {Map<string, Record<string, ScrollAnchor>>}
+   */
+  const anchors = new Map();
+
+  /**
+   * The anchors of the entry a back, a forward or a reload arrived at, for
+   * the lists of the page being mounted for it to take, once each. A list
+   * that takes one in the window puts the reader back itself, so the raw
+   * position is not restored over it; nor is a scroll region's over the
+   * one a list takes in its own container (`containers`).
+   *
+   * @type {{ anchors: Record<string, ScrollAnchor>, taken: Set<string>, window: boolean, containers: Set<Element> } | null}
+   */
+  let restored = null;
+
+  /** @type {string | null} */
+  let entry = null;
+  /** @type {ReturnType<typeof setTimeout> | undefined} */
+  let persistTimer;
+  /** Foreground mounts in progress; scroll is not recorded during any. */
+  let mounting = 0;
+  /**
+   * Instant visits showing a loading boundary: the page under it is not the
+   * one being left, and a boundary shorter than how far it was scrolled
+   * clamps the scroll -- so where it was is kept before the boundary goes
+   * up, and nothing is read for it while the boundary shows.
+   */
+  let boundaries = 0;
+  /**
+   * The scroll restore in progress, if any: the window position it is still
+   * reaching for -- null once a list has taken the window over -- and how
+   * to stop it. See restoreScroll().
+   *
+   * @type {{ position: readonly number[] | null, stop: () => void } | null}
+   */
+  let restoring = null;
+
+  // Where this entry was left, if this document is a reload of it or was
+  // reached by back or forward from another document. Read before the entry
+  // is claimed, which records the position the page has now.
+  const left = isReturn(win) ? objectState().tinvar?.scroll : undefined;
+  const leftRegions = isReturn(win) ? regionsOf(objectState().tinvar?.regions) : null;
+  if (isReturn(win)) restored = arrivedAt(objectState().tinvar?.anchors);
+
+  // The first entry has no state of ours, so a later popstate back to it
+  // would have nothing to restore from.
+  entry = claimEntry();
+  keepNewest(positions, entry, [win.scrollX, win.scrollY]);
+  if (leftRegions !== null) keepNewest(regionPositions, entry, leftRegions);
+  if (restored !== null) keepNewest(anchors, entry, restored.anchors);
+
+  /**
+   * The URL of the first page, for its `navigate`, and whether that is
+   * still to be emitted: once `ready` has settled, so a listener the app adds
+   * straight after creating the router hears it -- or before any other
+   * event, should one come first, so it is always the first a listener
+   * hears. See announceInitial().
+   */
+  const initialUrl = win.location.href;
+  let initialPending = true;
+
+  /** What seals and opens remembered state, for a page whose history is encrypted. */
+  const crypto = win.crypto ?? globalThis.crypto;
+
+  /**
+   * Where useRemember() values are kept, by history entry, for one session;
+   * see remember-store.js for why not in history.state.
+   */
+  const store = createRememberStore(
+    options.storage !== undefined ? options.storage : tabStorage(win),
+    crypto,
+  );
+
+  /**
+   * Where resumable uploads are remembered (ADR 0143): each record is the
+   * session's that began it, so every record of another session -- its file
+   * handle with it -- goes wherever what useRemember() kept is wiped, and
+   * when the router starts, for a session that changed or ended while no
+   * page of this tab was open.
+   */
+  const resumeStore = options.resumeStore;
+  // A page with no token is no session, as adoptBinding() reads it: a load
+  // after a sign-out keeps nothing the user before left.
+  purgeResumeStore(binding, resumeStore);
+
+  /**
+   * What useRemember() keeps, for the page on screen: by key, each value
+   * with the session it was set under. Written to the store under its
+   * history entry's key, debounced with the scroll position, so back and
+   * forward -- and a reload of the document -- bring it back.
+   *
+   * One record per page shown. A page being mounted gets its own
+   * (`incoming`) before its entry exists, so what its components remember
+   * as they mount goes to the entry about to be made, and what the page
+   * being left remembers meanwhile goes to the entry it belongs to.
+   *
+   * `session` is the binding of the page the record belongs to -- for a page
+   * being mounted, the one its response came with -- and null where there
+   * is none, when nothing is remembered.
+   *
+   * `key` is the history key the page came with, imported, and null for a
+   * page whose history is not encrypted (ADR 0019). What a page with one
+   * remembers is sealed with it in storage, and never written in the clear.
+   * `restoring` is set while what the page's entry kept is still being
+   * opened, which nothing may overwrite until it has been. `sealed` is what
+   * was last sent to be sealed, so the same values are not sealed again.
+   *
+   * @typedef {{
+   *   entry: string | null,
+   *   session: string | null,
+   *   values: Map<string, { session: string, value: unknown }>,
+   *   key: import('./remember-store.js').HistoryKey | null,
+   *   restoring: boolean,
+   *   sealed?: string,
+   * }} Remembered
+   */
+  /** @type {Remembered} */
+  let remembered = {
+    entry,
+    session: binding,
+    values: valuesOf(store.read(entry, binding), binding),
+    key: historyKeyOf(
+      options.initialHistoryKey !== undefined ? options.initialHistoryKey : (metadata?.historyKey ?? null),
+    ),
+    restoring: false,
+  };
+  /** @type {Remembered | null} */
+  let incoming = null;
+
+  // Imported, the raw key has no more use here, and is not left where
+  // anything on the page could go on reading it for the document's life:
+  // not in the metadata block, nor in what this router read from it
+  // (ADR 0019).
+  if (metadata !== null) metadata.historyKey = null;
+  forgetMetadataKey(win.document);
+
+  /**
+   * Settles once what the first page's entry kept has been read back. A
+   * reload of an encrypted entry finds it sealed, and opening it takes a
+   * moment: an application awaits this before hydrating, so its components
+   * mount with what was remembered, as they would from an entry kept in
+   * the clear -- for which it has already settled.
+   */
+  const ready = store.isSealed(entry, binding) ? restore(remembered) : Promise.resolve();
+
+  // "`navigate` with `type: 'initial' | 'visit' | 'history'`": the first
+  // page's, once what its entry remembered is back -- see `initialPending`.
+  void ready.then(announceInitial, announceInitial);
+
+  /**
+   * Emits the first page's `navigate`, once. The page is already on screen,
+   * hydrating, when the router is made: what this says is that it is the
+   * page shown, for whatever counts pages -- analytics -- to count the first
+   * as it counts the rest.
+   */
+  function announceInitial() {
+    if (!initialPending) return;
+    initialPending = false;
+    // A router made against a window with no DOM -- given everything it
+    // needs, so it reads nothing from the document -- has nothing to emit
+    // an event on, and this one comes unasked.
+    if (typeof win.CustomEvent !== 'function' || typeof win.document?.dispatchEvent !== 'function') return;
+    emit('navigate', { url: initialUrl, type: 'initial' });
+  }
+
+  /**
+   * @param {string} name
+   * @param {Record<string, unknown>} [detail]
+   * @returns {boolean} false if a listener cancelled it
+   */
+  function emit(name, detail = {}) {
+    // A visit unwinding after destroy() must not reach the page: no events,
+    // and -- since a cancelled event is what stops a full load -- report
+    // every one as cancelled.
+    if (destroyed) return false;
+
+    // The first page is shown before anything happens on it: a visit made
+    // straight after the router, before `ready` settled, is still the second
+    // page to a listener.
+    if (initialPending) announceInitial();
+
+    const event = new win.CustomEvent(`tinvar:${name}`, {
+      detail,
+      cancelable: CANCELABLE.has(name),
+    });
+
+    // A listener's exception is the listener's bug, not the visit's. One
+    // thrown on `success` became a networkError -- and a full reload -- after
+    // history had been pushed; one thrown on `start` left the visit's slot
+    // held for good. Reported the way dispatchEvent reports its own
+    // listeners', and the visit carries on.
+    for (const fn of listeners.get(name) ?? []) {
+      try {
+        fn(event);
+      } catch (error) {
+        if (typeof win.reportError === 'function') win.reportError(error);
+        else console.error(error);
+      }
+    }
+
+    // Each event is also a native CustomEvent, so code outside the app's
+    // module graph -- analytics, a progress bar -- can listen without
+    // importing the router.
+    return win.document.dispatchEvent(event) && !event.defaultPrevented;
+  }
+
+  /**
+   * A full page load: the remedy for a build mismatch and the fallback for
+   * anything this router cannot handle in place.
+   */
+  function hardNavigate(url) {
+    if (destroyed) return;
+
+    // http and https only, checked HERE -- the one place every full load
+    // goes through -- rather than at each caller. A javascript: URL has
+    // origin "null", so it failed the same-origin check in visit() and was
+    // handed straight to location.assign, which runs it. The same was true
+    // of an X-Location from a response and of any future caller. data: and
+    // blob: are refused for the same reason: they are documents the page
+    // chose the content of, not places.
+    let target;
+    try {
+      target = new URL(url, win.location.href);
+    } catch {
+      return;
+    }
+
+    if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+      console.error(`[tinvar:client] Refusing to navigate to a ${target.protocol} URL.`);
+      return;
+    }
+
+    // Marked first, so what ends the session on this client while it
+    // loads leaves it to arrive (document-load.js).
+    markDocumentLoad(target.href);
+    (options.hardNavigate ?? ((u) => win.location.assign(u)))(target.href);
+  }
+
+  /**
+   * The session is gone. "Session revocation, which the server signals with
+   * a 401", is cleared "with a full page load" (tinvar-spec.md, "Client-held
+   * data"), and the load is what reaches the server's login redirect.
+   *
+   * Not the app's to cancel: an error rendered in place left the protected
+   * page on screen and its route token in hand. And not skipped for a
+   * background request, the one exception to "a background request never
+   * navigates": a poll that heard the session was gone and did nothing left
+   * the page up, still polling, until the user next clicked.
+   *
+   * What the session held goes at once, either way. The page on screen --
+   * loaded again for a background request (a poll, a prefetch, a list's
+   * next page) or for a visit to the page itself (reload(), a link to it)
+   * -- leaves a document load already begun to arrive: an action that
+   * ended the session sent the browser on, and the request went out
+   * meanwhile. Loaded over it, the page on screen is the page being left,
+   * and the browser landed back on it (document-load.js). A visit to
+   * another page, back and forward among them, loads the page it asked for
+   * at once: it is where the user went, the latest navigation, which
+   * replaces a load begun before it as a later navigation does in the
+   * browser.
+   *
+   * @param {string | null} href the page a visit asked for; null for the
+   *   page on screen
+   * @param {AbortSignal} signal the request that got the 401
+   */
+  function revoke(href, signal) {
+    forgetSession(signal);
+
+    if (href === null) {
+      stopReload();
+      stopReload = reloadUnlessLoading(hardNavigate, win);
+      return;
+    }
+
+    // Without the fragment when it is this document. Assigning the URL the
+    // document already has, fragment and all, is a fragment navigation: the
+    // browser scrolls to it and loads nothing.
+    const page = stripHash(href);
+    hardNavigate(page === stripHash(win.location.href) ? page : href);
+  }
+
+  /**
+   * Drops everything held for the session, and sends nothing more: what a
+   * 401 calls for, short of the page load that follows it.
+   *
+   * @param {AbortSignal | null} signal the request that got the 401, left to
+   *   unwind on its own; null when the 401 came to something else
+   */
+  function forgetSession(signal) {
+    revoked = true;
+
+    // Dropped now rather than when the document unloads: an action sent in
+    // between would carry it, and a click in between would be shown a page
+    // prefetched under the session that has just ended.
+    routeToken = null;
+    cache.clear();
+    once.clear();
+
+    // And everything useRemember() kept, for every entry of this tab: the
+    // session it was kept for is the one that ended. Wiped, not merely left
+    // unread.
+    binding = null;
+    remembered.values.clear();
+    remembered.session = null;
+    remembered.key = null;
+    incoming = null;
+    clearTimeout(persistTimer);
+    store.wipe();
+    purgeResumeStore(null, resumeStore);
+    // And where its lists were read to, which names the items read.
+    forgetAnchors();
+
+    // Nothing else in flight may mount over the page or take its token.
+    if (inFlight && inFlight.signal !== signal) interrupt();
+    for (const c of [...background]) {
+      if (c.signal === signal) continue;
+      background.delete(c);
+      c.abort();
+      finish(c, true);
+    }
+
+    // For what holds client-held data the router does not: the live
+    // module's tokens and its stream.
+    emit('revoke');
+  }
+
+  /**
+   * Aborts the visit in flight and finishes it NOW, flagged as interrupted.
+   *
+   * Its own `finish` used to arrive once its fetch had unwound -- after the
+   * next visit's `start` -- so a progress bar that hides on `finish` hid in
+   * the middle of the visit that replaced it.
+   */
+  function interrupt() {
+    const c = inFlight;
+    if (!c) return;
+    inFlight = null;
+    c.abort();
+    finish(c, true);
+  }
+
+  /** Emits a visit's `finish`, once. */
+  function finish(controller, interrupted) {
+    if (finished.has(controller)) return;
+    finished.add(controller);
+    emit('finish', {
+      url: visitUrls.get(controller),
+      ...(interrupted ? { interrupted: true } : {}),
+      ...(backgrounds.has(controller) ? { background: true } : {}),
+    });
+  }
+
+  /** $controller's page is up: the page it replaced is read no further. */
+  function supersede(controller) {
+    const left = showing;
+    showing = controller;
+    if (left !== null && left !== controller) left.abort();
+  }
+
+  /** Aborts every background request and, as interrupt() does, finishes each now. */
+  function abortBackground() {
+    const cancelled = [...background];
+    background.clear();
+    for (const c of cancelled) {
+      c.abort();
+      finish(c, true);
+    }
+  }
+
+  /**
+   * Runs a page's commit inside a view transition, when a visit asked for
+   * one and the browser has them; otherwise just runs it.
+   *
+   * The browser snapshots the old page, holds rendering while the update
+   * runs, and animates to the new page once its promise settles -- which is
+   * when the page has committed. Started only once the payload is decoded,
+   * where the app gave the router `prepare`, so the page is held for the
+   * commit alone: not for the network, and not for the decode. An app that
+   * gave only `mount` has the page held for both. Whatever the update
+   * throws comes back out as it would without a transition: the transition
+   * is skipped, and the visit reports it.
+   *
+   * `viewTransition` may be a function, handed the ViewTransition to add
+   * classes or wait on.
+   *
+   * @param {VisitOptions['viewTransition']} option
+   * @param {() => Promise<void>} update
+   * @returns {Promise<void>}
+   */
+  async function withViewTransition(option, update) {
+    const doc =
+      /** @type {Document & { startViewTransition?: (update: () => Promise<void>) => ViewTransition }} */ (
+        win.document
+      );
+    if (!option || typeof doc.startViewTransition !== 'function') return update();
+
+    const transition = doc.startViewTransition(update);
+
+    // Both reject when the update throws or the transition is skipped. That
+    // is reported once, through updateCallbackDone; left unhandled here, each
+    // would also surface as an unhandled rejection.
+    transition.ready.catch(noop);
+    transition.finished.catch(noop);
+
+    if (typeof option === 'function') {
+      try {
+        option(transition);
+      } catch (error) {
+        if (typeof win.reportError === 'function') win.reportError(error);
+        else console.error(error);
+      }
+    }
+
+    await transition.updateCallbackDone;
+  }
+
+  /**
+   * A visit's payload as the mount reads it, reported as it is read: the
+   * RSC events. `streamStart` as the router hands it over, `streamChunk` as
+   * each chunk arrives, and `streamEnd` once all of it has -- or, with
+   * `interrupted`, once it never will: the visit was superseded or
+   * cancelled, the connection dropped, the mount stopped reading, or the page
+   * could not be mounted (stop()).
+   *
+   * A streamed page commits at its shell, and that is where its `finish`
+   * comes ("with streaming, finish at the first meaningful flush"); its
+   * Suspense content goes on arriving after. `streamEnd` is when the last of
+   * it has.
+   *
+   * Sizes only, never the bytes: a payload is what the page was rendered
+   * from, and every script on the page can listen for a native event.
+   *
+   * @param {ReadableStream<Uint8Array>} body
+   * @param {{ url: string, background?: true }} detail what each event says of the request
+   * @param {AbortSignal} signal the visit's, aborted once it is superseded
+   * @returns {{ stream: ReadableStream<Uint8Array>, stop: () => void }}
+   */
+  function observe(body, detail, signal) {
+    const reader = body.getReader();
+    let received = 0;
+    let ended = false;
+
+    /** @param {boolean} interrupted */
+    const end = (interrupted) => {
+      if (ended) return;
+      ended = true;
+      signal.removeEventListener('abort', stop);
+      emit('streamEnd', { ...detail, bytes: received, ...(interrupted ? { interrupted: true } : {}) });
+    };
+    function stop() {
+      if (ended) return;
+      end(true);
+      reader.cancel().catch(noop);
+    }
+
+    emit('streamStart', detail);
+    if (signal.aborted) stop();
+    else signal.addEventListener('abort', stop, { once: true });
+
+    // The controller refuses a close or an enqueue once the mount has
+    // cancelled its side; what is left then is only to stop reading.
+    const settle = (/** @type {() => void} */ fn) => {
+      try {
+        fn();
+      } catch {
+        // The reader has gone.
+      }
+    };
+
+    const stream = new ReadableStream({
+      async pull(controller) {
+        /** @type {ReadableStreamReadResult<Uint8Array>} */
+        let chunk;
+        try {
+          chunk = await reader.read();
+        } catch (error) {
+          end(true);
+          settle(() => controller.error(error));
+          return;
+        }
+        if (chunk.done) {
+          end(false);
+          settle(() => controller.close());
+          return;
+        }
+        received += chunk.value.byteLength;
+        emit('streamChunk', { ...detail, bytes: chunk.value.byteLength, received });
+        settle(() => controller.enqueue(chunk.value));
+      },
+      cancel(reason) {
+        end(true);
+        return reader.cancel(reason);
+      },
+    });
+
+    return { stream, stop };
+  }
+
+  /**
+   * Mounts a page: through the app's `prepare` -- decode, then commit, the
+   * commit alone inside the view transition the visit asked for -- or its
+   * one-step `mount`, inside the transition whole.
+   *
+   * @param {ReadableStream<Uint8Array>} body
+   * @param {Page} page
+   * @param {VisitOptions['viewTransition']} [transition]
+   */
+  async function mountPage(body, page, transition) {
+    // Raced against the signal: a superseded visit is over the moment it is
+    // superseded, whatever the app's mount does. A mount that never settled
+    // -- a commit callback React dropped when two transitions merged --
+    // otherwise held the visit open forever, and with it the mount count
+    // that suspends scroll recording, so no position was saved again.
+    let onAbort;
+    const aborted = new Promise((_, reject) => {
+      onAbort = () => reject(new VisitCancelled());
+      if (page.signal.aborted) onAbort();
+      else page.signal.addEventListener('abort', onAbort, { once: true });
+    });
+
+    try {
+      if (typeof options.prepare === 'function') {
+        const prepared = await Promise.race([options.prepare(body, page), aborted]);
+        if (page.signal.aborted) throw new VisitCancelled();
+        await withViewTransition(transition, () => Promise.race([prepared?.commit(), aborted]));
+      } else {
+        await withViewTransition(transition, () => Promise.race([options.mount(body, page), aborted]));
+      }
+    } catch (error) {
+      if (error instanceof VisitCancelled) throw error;
+      if (page.signal.aborted) throw new VisitCancelled();
+      throw new MountFailed(error);
+    } finally {
+      page.signal.removeEventListener('abort', onAbort);
+    }
+  }
+
+  /**
+   * Whether a URL may be fetched as a page. Every URL the router fetches --
+   * a visit's and every redirect it follows -- passes through here, so the
+   * two rules cannot be applied to one and forgotten on the other (as they
+   * were, briefly, for X-Redirect).
+   *
+   * @param {URL} url
+   */
+  function fetchable(url) {
+    // Only http(s). A blob: URL carries the app's own origin, so the origin
+    // check admits it -- and the router would fetch and mount content the
+    // page built itself, not the server. hardNavigate() refuses the same
+    // schemes, so a refused URL ends there.
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+
+    // Only this origin. Anything else is an ordinary link to somewhere
+    // else, and sending RSC headers -- or the CSRF token -- to another
+    // origin would be the wrong thing to do even if it answered.
+    if (url.origin !== win.location.origin) return false;
+
+    // Not an endpoint's URL, which answers with a file or JSON rather than
+    // a page: the browser loads it (ADR 0074).
+    return !isEndpoint(url);
+  }
+
+  /**
+   * Whether a URL is one of the application's endpoints, by the table
+   * codegen wrote: on this origin, at a path one of them answers.
+   *
+   * @param {URL | string} href
+   */
+  function isEndpoint(href) {
+    if (options.endpoints === undefined) return false;
+    let url;
+    try {
+      url = new URL(String(href), win.location.href);
+    } catch {
+      return false;
+    }
+    return url.origin === win.location.origin && options.endpoints.matches(url);
+  }
+
+  /**
+   * Scrolls to the element a fragment names.
+   *
+   * @param {string} hash
+   * @returns {boolean} whether there was one
+   */
+  function scrollToFragment(hash) {
+    if (!hash) return false;
+
+    // A malformed escape (`#%E0`) makes decodeURIComponent throw, and the
+    // throw -- after the page had mounted -- was reported as a network
+    // failure and reloaded the page. Such a fragment names nothing.
+    let id;
+    try {
+      id = decodeURIComponent(hash.slice(1));
+    } catch {
+      return false;
+    }
+
+    const anchor = win.document.getElementById(id);
+    anchor?.scrollIntoView();
+    return anchor !== null;
+  }
+
+  /**
+   * The current entry's state, as something this router can add a field to.
+   * An app may have stored a string or a number there, and spreading one
+   * turned 'app-state' into {0: 'a', 1: 'p', ...}. A non-object is kept
+   * whole under `value` instead.
+   */
+  function objectState() {
+    const state = win.history.state;
+    if (state === null || state === undefined) return {};
+    if (typeof state === 'object' && !Array.isArray(state)) return state;
+    return { value: state };
+  }
+
+  /**
+   * Whether the page on screen is the current history entry's. Not after a
+   * back or forward that ended without mounting -- handled in place,
+   * cancelled -- which leaves the browser on an entry whose page never
+   * arrived. Scroll is not recorded in that state either: `entry` stays null
+   * until a page is mounted again.
+   */
+  function showingCurrentEntry() {
+    return stripHash(win.location.href) === mounted;
+  }
+
+  /**
+   * Gives the current history entry a key if it has none -- the first
+   * entry, or one made by an in-page anchor or by code other than this
+   * router -- and returns it.
+   *
+   * @returns {string}
+   */
+  function claimEntry() {
+    const state = objectState();
+    const key = state.tinvar?.key;
+    if (typeof key === 'string') return key;
+
+    const fresh = newKey();
+    win.history.replaceState(
+      { ...state, tinvar: { ...(state.tinvar ?? {}), key: fresh, scroll: [win.scrollX, win.scrollY] } },
+      '',
+    );
+    return fresh;
+  }
+
+  function onScroll() {
+    if (entry === null || mounting > 0 || boundaries > 0) return;
+    keepNewest(positions, entry, [win.scrollX, win.scrollY]);
+    schedulePersist();
+  }
+
+  /**
+   * A scroll inside the page: one of its scroll regions moved. Heard on the
+   * document in the capture phase, since an element's scroll does not
+   * bubble; every region is read, for its place among the others.
+   *
+   * @param {Event} event
+   */
+  function onRegionScroll(event) {
+    if (entry === null || mounting > 0 || boundaries > 0) return;
+    const target = /** @type {Element | null} */ (event.target);
+    if (typeof target?.hasAttribute !== 'function' || !target.hasAttribute(SCROLL_REGION_ATTRIBUTE)) return;
+    keepNewest(regionPositions, entry, readRegions());
+    schedulePersist();
+  }
+
+  /** The page's scroll regions, in document order; none without a DOM. */
+  function regionsOnPage() {
+    const doc = win.document;
+    if (typeof doc?.querySelectorAll !== 'function') return [];
+    return [...doc.querySelectorAll(`[${SCROLL_REGION_ATTRIBUTE}]`)];
+  }
+
+  /** @returns {(readonly [number, number])[]} where each scroll region is scrolled to */
+  function readRegions() {
+    return regionsOnPage().map((region) => /** @type {const} */ ([region.scrollLeft, region.scrollTop]));
+  }
+
+  /** @param {Element} region @param {number} left @param {number} top */
+  function scrollRegion(region, left, top) {
+    if (typeof region.scrollTo === 'function') {
+      region.scrollTo(left, top);
+    } else {
+      region.scrollLeft = left;
+      region.scrollTop = top;
+    }
+  }
+
+  /**
+   * Scrolls each region on the page to the position saved for its place,
+   * and says whether every one is there. A place the page has no region for
+   * yet -- its content still streaming in -- is not there; one a list puts
+   * back by its own anchor is left to the list.
+   *
+   * @param {readonly (readonly [number, number] | null)[]} saved
+   * @param {ReadonlySet<Element>} skip
+   */
+  function scrollRegionsTo(saved, skip) {
+    const regions = regionsOnPage();
+    let there = true;
+    saved.forEach((position, i) => {
+      if (position === null) return;
+      const region = regions[i];
+      if (region === undefined) {
+        there = false;
+        return;
+      }
+      if (skip.has(region)) return;
+      scrollRegion(region, position[0], position[1]);
+      if (Math.abs(region.scrollLeft - position[0]) >= 1 || Math.abs(region.scrollTop - position[1]) >= 1) {
+        there = false;
+      }
+    });
+    return there;
+  }
+
+  /** "Scroll: reset on navigation", the scroll regions with the window. */
+  function resetRegions() {
+    for (const region of regionsOnPage()) scrollRegion(region, 0, 0);
+  }
+
+  /**
+   * One replaceState for whatever has changed since the last: browsers
+   * rate-limit replaceState, and scrolling and typing both change state many
+   * times a second.
+   */
+  function schedulePersist() {
+    clearTimeout(persistTimer);
+    persistTimer = setTimeout(persist, 100);
+  }
+
+  /**
+   * Writes the scroll position into the current entry's state -- only onto
+   * the entry it belongs to: after a back or forward, history.state is
+   * already the one arrived at -- and what useRemember() kept into the
+   * store, under its page's entry.
+   */
+  function persist() {
+    clearTimeout(persistTimer);
+    storeRemembered(remembered);
+
+    const state = win.history.state;
+    if (entry === null || state?.tinvar?.key !== entry) return;
+    const tinvar = { ...state.tinvar, scroll: positions.get(entry) };
+    const regions = regionPositions.get(entry);
+    if (regions !== undefined) tinvar.regions = regions;
+    const lists = anchors.get(entry);
+    if (lists !== undefined) tinvar.anchors = placesOf(lists);
+    win.history.replaceState({ ...state, tinvar }, '');
+  }
+
+  /**
+   * Anchors as history state may hold them: where the item was -- its page,
+   * its place on it, how far down -- never which item it was. A key is
+   * what the page rendered it under, an order number or a customer's id,
+   * and history state is kept in the clear, written to disk with the tab,
+   * read by whatever reads the tab after the session -- what ADR 0019 keeps
+   * remembered state sealed against. The key stays in memory, for a back or
+   * forward within the document; a reload finds the item by its place.
+   *
+   * @param {Record<string, ScrollAnchor>} lists
+   * @returns {Record<string, ScrollAnchor>}
+   */
+  function placesOf(lists) {
+    /** @type {Record<string, ScrollAnchor>} */
+    const places = {};
+    for (const [id, anchor] of Object.entries(lists)) places[id] = { ...anchor, key: null };
+    return places;
+  }
+
+  /**
+   * Forgets where every list was read to, for every entry, and takes the
+   * current entry's out of its state: the session they were recorded under
+   * has ended, or is no longer this one. Other entries' states hold places
+   * alone (placesOf()), and the router can write only the entry it is on.
+   */
+  function forgetAnchors() {
+    anchors.clear();
+    restored = null;
+    const state = win.history.state;
+    if (state?.tinvar?.anchors === undefined) return;
+    const { anchors: _, ...tinvar } = state.tinvar;
+    win.history.replaceState({ ...state, tinvar }, '');
+  }
+
+  /**
+   * The anchors an entry's state holds, as the lists of its page may take
+   * them -- only what has the shape of one, since history state is
+   * anyone's to write.
+   *
+   * @param {unknown} stored
+   * @returns {{ anchors: Record<string, ScrollAnchor>, taken: Set<string>, window: boolean, containers: Set<Element> } | null}
+   */
+  function arrivedAt(stored) {
+    if (stored === null || typeof stored !== 'object') return null;
+    /** @type {Record<string, ScrollAnchor>} */
+    const found = {};
+    for (const [id, anchor] of Object.entries(stored)) {
+      if (isAnchor(anchor)) found[id] = anchor;
+    }
+    return Object.keys(found).length === 0
+      ? null
+      : { anchors: found, taken: new Set(), window: false, containers: new Set() };
+  }
+
+  /**
+   * Writes a page's remembered values to the store, under its entry and its
+   * session.
+   *
+   * A value goes with the session it was set under, and one set under
+   * another session than its page's is dropped rather than written: the
+   * binding is the one taken when the value was set, never the one in force
+   * when the debounce happens to fire, so a sign-out and a sign-in as
+   * someone else in between cannot carry it across. A page bound to no
+   * session, or to one that is no longer this router's, keeps nothing.
+   *
+   * @param {Remembered} record
+   */
+  function storeRemembered(record) {
+    if (record.entry === null || record.session === null || record.session !== binding) return;
+    // Its entry's values are still being opened; writing now would replace
+    // them with whatever little has been set since. See restore().
+    if (record.restoring) return;
+
+    /** @type {Record<string, unknown>} */
+    const values = {};
+    for (const [key, kept] of record.values) {
+      if (!belongs(kept, record)) {
+        record.values.delete(key);
+        continue;
+      }
+      values[key] = kept.value;
+    }
+
+    // Sealed values already on their way are not sent again. A second seal
+    // of the same values -- the debounce, pagehide -- would supersede the
+    // first, and one that pagehide starts never lands: what the first was
+    // about to write would be lost with it.
+    if (record.key !== null) {
+      const sending = sealedAs(record.entry, values);
+      if (sending !== null && sending === record.sealed) return;
+      record.sealed = sending ?? undefined;
+    }
+    void store.write(record.entry, record.session, values, record.key);
+  }
+
+  /**
+   * What a write of an entry's values amounts to, to tell one from the
+   * next; null for values JSON cannot hold, which are never taken as
+   * already sent.
+   *
+   * @param {string} entry
+   * @param {Record<string, unknown>} values
+   */
+  function sealedAs(entry, values) {
+    try {
+      return JSON.stringify([entry, values]);
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Whether a remembered value may be shown or written for a page: it was
+   * set under that page's session, and that session is one.
+   *
+   * @param {{ session: string }} kept
+   * @param {Remembered} record
+   */
+  function belongs(kept, record) {
+    return record.session !== null && kept.session === record.session;
+  }
+
+  /**
+   * A page's history key, imported, from the header or metadata it came
+   * in; null for a page that came with none. Imported for each page rather
+   * than kept by its text: the router holds the key only as a CryptoKey it
+   * cannot export.
+   *
+   * @param {string | null | undefined} encoded
+   * @returns {import('./remember-store.js').HistoryKey | null}
+   */
+  function historyKeyOf(encoded) {
+    return typeof encoded === 'string' && encoded !== '' ? importHistoryKey(encoded, crypto) : null;
+  }
+
+  /**
+   * Opens what a page's entry kept sealed, into its record.
+   *
+   * Anything the page remembered while this ran is newer than what the
+   * entry kept, and stays; it could not be written meanwhile, so it is
+   * written now. A record forgotten meanwhile -- a 401, clearHistory() --
+   * takes nothing back.
+   *
+   * @param {Remembered} record
+   * @returns {Promise<void>}
+   */
+  async function restore(record) {
+    record.restoring = true;
+    /** @type {Record<string, unknown>} */
+    let kept = {};
+    try {
+      kept = await store.open(String(record.entry), record.session, record.key);
+    } catch {
+      // Storage that throws keeps nothing to read back; `ready` still settles.
+    } finally {
+      record.restoring = false;
+    }
+    if (destroyed || record.session === null) return;
+
+    const setMeanwhile = record.values.size > 0;
+    for (const [key, value] of Object.entries(kept)) {
+      if (!record.values.has(key)) record.values.set(key, { session: record.session, value });
+    }
+    if (setMeanwhile) storeRemembered(record);
+  }
+
+  /** The record a component mounting now remembers into; see `remembered`. */
+  function rememberScope() {
+    return incoming ?? remembered;
+  }
+
+  /**
+   * What was remembered under a key, for the page a component belongs to --
+   * undefined when nothing was, or when it was under another session, which
+   * forgets it.
+   *
+   * @param {string} key
+   * @param {Remembered} [scope]
+   */
+  function rememberedValue(key, scope = rememberScope()) {
+    const kept = scope.values.get(key);
+    if (kept === undefined) return undefined;
+    if (!belongs(kept, scope)) {
+      scope.values.delete(key);
+      return undefined;
+    }
+    return kept.value;
+  }
+
+  /**
+   * Remembers a value under a key, for the page a component belongs to,
+   * bound to the session in force now.
+   *
+   * Without a session -- no page has carried a route token -- nothing is
+   * remembered at all: a value bound to no one would be readable by whoever
+   * signs in next.
+   *
+   * @param {string} key
+   * @param {unknown} value
+   * @param {Remembered} [scope]
+   */
+  function rememberValue(key, value, scope = rememberScope()) {
+    if (destroyed || revoked || scope.session === null) return;
+    // The session taken now, with the value, and never looked up again: a
+    // value is only ever bound to the session it was set under.
+    scope.values.set(key, { session: scope.session, value });
+    // A page still mounting has no entry yet; its values are written when
+    // its entry is made.
+    if (scope !== remembered) return;
+    // Sealed values are written at once rather than on the debounce:
+    // sealing is asynchronous, and a write that pagehide is the first to
+    // start never finishes before the document goes.
+    if (scope.key !== null) storeRemembered(scope);
+    schedulePersist();
+  }
+
+  /**
+   * Remembers where this entry was scrolled to, before leaving it -- and
+   * writes what useRemember() kept for it, which a debounce due after the
+   * new entry exists would no longer reach.
+   */
+  function saveScroll() {
+    if (entry === null) return;
+    if (boundaries === 0) {
+      keepNewest(positions, entry, [win.scrollX, win.scrollY]);
+      keepNewest(regionPositions, entry, readRegions());
+    }
+    persist();
+  }
+
+  /** Where an entry was left, by key, falling back to what its state says. */
+  function savedScroll(key, fallback) {
+    return (key !== undefined && positions.get(key)) || fallback;
+  }
+
+  /** Where an entry's scroll regions were left, by key, falling back to its state. */
+  function savedRegions(key, fallback) {
+    return (key !== undefined && regionPositions.get(key)) || regionsOf(fallback);
+  }
+
+  /** Stops the scroll restore in progress, if any. */
+  function stopRestoring() {
+    restoring?.stop();
+  }
+
+  /**
+   * Puts the scroll back where an entry was left -- the window, and each
+   * scroll region by its place on the page -- and keeps at it while the page
+   * grows into that position.
+   *
+   * A page mounted from a stream is often shorter at commit than it will
+   * be: its Suspense content arrives after. A single scrollTo at commit was
+   * clamped to the short page and never revisited, so back to a long page
+   * landed near its top. The target is kept and tried again each frame
+   * until it is reached, the user takes over the scroll, or
+   * SCROLL_RESTORE_MS has passed. A scroll region inside streamed content
+   * may not be there at all at commit, and is waited for the same way.
+   *
+   * @param {readonly number[] | null} position the window's, or null to leave it
+   * @param {readonly (readonly [number, number] | null)[] | null} [regions] the scroll regions', or null to leave them
+   * @param {ReadonlySet<Element>} [skip] regions a list puts back by its own anchor
+   */
+  function restoreScroll(position, regions = null, skip = new Set()) {
+    stopRestoring();
+    /** @type {{ position: readonly number[] | null, stop: () => void }} */
+    const target = { position, stop: noop };
+
+    // Read from `target` each time: a list that takes the window over
+    // meanwhile (takeScrollAnchor()) leaves the regions still to restore.
+    const reach = () => {
+      const at = target.position;
+      if (at !== null) win.scrollTo(at[0], at[1]);
+      const regionsThere = regions === null || scrollRegionsTo(regions, skip);
+      return (at === null || scrolledTo(at[0], at[1])) && regionsThere;
+    };
+    if (reach()) return;
+
+    const started = Date.now();
+    let frame;
+
+    const stop = () => {
+      cancelFrame(frame);
+      for (const type of USER_SCROLL_EVENTS) win.removeEventListener(type, stop, true);
+      if (restoring === target) restoring = null;
+    };
+    target.stop = stop;
+
+    const retry = () => {
+      if (Date.now() - started > SCROLL_RESTORE_MS) return stop();
+      if (reach()) return stop();
+      frame = nextFrame(retry);
+    };
+
+    // Whatever the user does with the page is theirs. A restore that went
+    // on pulling the page back while they scrolled it would fight them.
+    for (const type of USER_SCROLL_EVENTS) win.addEventListener(type, stop, { capture: true, passive: true });
+    restoring = target;
+    frame = nextFrame(retry);
+  }
+
+  /** Whether the window is at a position, give or take a fractional pixel. */
+  function scrolledTo(x, y) {
+    return Math.abs(win.scrollX - x) < 1 && Math.abs(win.scrollY - y) < 1;
+  }
+
+  /** @param {() => void} fn */
+  function nextFrame(fn) {
+    return typeof win.requestAnimationFrame === 'function'
+      ? { raf: win.requestAnimationFrame(fn) }
+      : { timer: setTimeout(fn, 16) };
+  }
+
+  function cancelFrame(frame) {
+    if (frame?.raf !== undefined) win.cancelAnimationFrame(frame.raf);
+    if (frame?.timer !== undefined) clearTimeout(frame.timer);
+  }
+
+  /**
+   * @param {string} href
+   * @param {VisitOptions} [opts]
+   * @returns {Promise<boolean>} whether a page was mounted
+   */
+  function visit(href, opts = {}) {
+    // Malformed paths are the caller's mistake, said to the caller -- not a
+    // failed request, which would end in a full load.
+    if (opts.only !== undefined) pathsOf(opts.only);
+    if (opts.except !== undefined) pathsOf(opts.except);
+    if (opts.reset !== undefined) pathsOf(opts.reset);
+
+    // A GET's data is its query. Merged here, before `before`, so every
+    // listener and the request itself see the URL the visit goes to.
+    const target =
+      opts.data === undefined ? href : withData(new URL(href, win.location.href), opts.data).href;
+
+    return go(target, opts, { redirects: 0, history: null });
+  }
+
+  /**
+   * Every navigation -- a visit, a redirect it follows, back and forward --
+   * goes through here and handle(), so they cannot drift apart. Back and
+   * forward ran a copy of this that had: it skipped the content-type check,
+   * ignored X-Location and X-Redirect, and reported nothing on failure.
+   *
+   * The context lives here rather than on VisitOptions, so callers cannot
+   * set it and it does not leak into the `before` event's detail.
+   *
+   * @typedef {{
+   *   redirects: number,
+   *   history: { scroll: unknown, regions?: unknown } | null,
+   *   sequence?: number,
+   * }} Context
+   *
+   * `redirects` counts the X-Redirects that led here. `history` is set for
+   * back and forward: the browser has already moved to the entry, so there
+   * is nothing to push and nothing to cancel, and the scroll is restored
+   * rather than reset. `sequence` numbers a background request.
+   *
+   * Resolves with whether a page was mounted -- for a background request,
+   * whether it refreshed the page on screen -- so a caller can tell a poll
+   * that landed from one that failed, was dropped, or was never sent.
+   *
+   * @param {string} href
+   * @param {VisitOptions} opts
+   * @param {Context} ctx
+   * @returns {Promise<boolean>}
+   */
+  async function go(href, opts, ctx) {
+    if (destroyed || revoked) return false;
+    const url = new URL(href, win.location.href);
+
+    if (!fetchable(url)) {
+      // Elsewhere is a full load -- which a background request never does.
+      if (!opts.background) hardNavigate(url.href);
+      return false;
+    }
+
+    // Back and forward have already happened; there is nothing to cancel.
+    if (!ctx.history && !emit('before', { url: url.href, options: opts })) {
+      return false;
+    }
+
+    // A new visit supersedes one in flight. Two navigations racing to mount
+    // would leave the page showing whichever finished last, not whichever
+    // the user asked for last.
+    //
+    // A BACKGROUND request is not a navigation and never takes this slot:
+    // a poll must not cancel the page the user just asked for. It goes the
+    // other way. A refresh of the page being left is worthless, and one
+    // that mounted while the user's visit was pending could finish after
+    // it and put the old page back -- so a navigation cancels background
+    // requests, and none starts while a navigation is pending.
+    if (opts.background && inFlight) return false;
+
+    // The caller's own cancel token: one visit, or one poll, stopped
+    // without touching anything else in flight.
+    if (opts.signal?.aborted) return false;
+
+    const controller = new AbortController();
+    visitUrls.set(controller, url.href);
+    if (opts.background) {
+      background.add(controller);
+      backgrounds.add(controller);
+      if (opts.preserveUrl) merging.add(controller);
+      // Numbered, so an older one answering late cannot mount over a newer
+      // one; see handle().
+      ctx = { ...ctx, sequence: ++requested };
+      requestedAs.set(controller, requested);
+    } else {
+      interrupt();
+      inFlight = controller;
+      abortBackground();
+    }
+
+    const cancel = () => {
+      if (inFlight === controller) interrupt();
+      else if (background.delete(controller)) {
+        controller.abort();
+        finish(controller, true);
+      }
+    };
+    opts.signal?.addEventListener('abort', cancel, { once: true });
+
+    // Whether a progress bar should show for it: never for a background
+    // request, and not for a visit that said `showProgress: false`.
+    emit('start', {
+      url: url.href,
+      ...(opts.background ? { background: true } : {}),
+      showProgress: !opts.background && opts.showProgress !== false,
+    });
+
+    /** Takes an instant visit's loading boundary away, if one is showing. */
+    let settle = null;
+
+    try {
+      // Nothing is awaited unless something is kept: up to the request the
+      // visit runs synchronously, so one cancelled straight after it was
+      // made has already sent its one request, and aborts it.
+      const kept = usesCache(opts, ctx) ? cached(url, controller.signal) : null;
+
+      // A kept copy is about as quick as the boundary would be, and is the
+      // page itself; only a visit that waits on the server shows one.
+      if (kept === null && opts.instant && !opts.background && !ctx.history && !isPartial(opts)) {
+        saveScroll();
+        boundaries++;
+        const shown = options.instant?.(opts.instant === true ? true : String(opts.instant)) ?? null;
+        if (shown === null) {
+          // No boundary went up: the page under the visit is still the one
+          // being left, and is read as ever.
+          boundaries--;
+        } else {
+          settle = () => {
+            boundaries--;
+            shown();
+          };
+        }
+      }
+
+      const response = (kept === null ? null : await kept) ?? (await request(url, opts, controller.signal));
+      const shown = await handle(response, url, opts, ctx, controller.signal);
+      // Merged into the page up -- a partial reload, a list's next page --
+      // the page's own payload is still the one being read.
+      if (shown && !isPartial(opts) && opts.preserveUrl !== true) supersede(controller);
+      return shown;
+    } catch (error) {
+      // A superseded visit reports nothing, whatever its mount threw on the
+      // way out -- the visit that replaced it owns the page now.
+      if (controller.signal.aborted || error instanceof VisitCancelled || error?.name === 'AbortError') {
+        return false;
+      }
+
+      // The response arrived; rendering it failed. Not connectivity, so not
+      // networkError -- an app retrying on network errors would retry a
+      // render that fails the same way every time. Its own cancelable
+      // channel; if nobody handles it, a document load renders the page on
+      // the server instead.
+      if (error instanceof MountFailed) {
+        const unhandled = emit('error', { url: url.href, error: error.cause });
+        // The visit's own `onError` first, waited for: whatever it does --
+        // reports the failure somewhere -- happens before the document goes.
+        // A visit made meanwhile owns the page, and is not loaded over.
+        await runCallback(opts.onError, error.cause);
+        if (unhandled && !opts.background && !controller.signal.aborted) hardNavigate(url.href);
+        return false;
+      }
+
+      // Connectivity, not an HTTP status. "Keep three error channels: 422
+      // -> errors, other statuses -> onHttpException, connectivity ->
+      // onNetworkError." The visit's `onError` hears it too, waited for
+      // before the document load, as it is for a render that failed.
+      const unhandled = emit('networkError', { url: url.href, error });
+      await runCallback(opts.onError, new VisitNetworkError(url.href, error));
+      if (unhandled && !opts.background && !controller.signal.aborted) hardNavigate(url.href);
+      return false;
+    } finally {
+      // The page that arrived has replaced it already; a visit that failed,
+      // was cancelled or was superseded puts back the page it came from.
+      settle?.();
+      opts.signal?.removeEventListener('abort', cancel);
+      if (inFlight === controller) inFlight = null;
+      background.delete(controller);
+      finish(controller, false);
+    }
+  }
+
+  /**
+   * @param {URL} url
+   * @param {VisitOptions} opts
+   * @param {AbortSignal} signal
+   * @returns {Promise<Response>}
+   */
+  async function request(url, opts, signal) {
+    // Cancelled while waiting on a prefetch that came to nothing.
+    if (signal.aborted) throw new VisitCancelled();
+
+    const response = await doFetch(url.href, {
+      method: 'GET',
+      headers: {
+        ...pageHeaders(),
+        ...partialHeaders(opts),
+        ...(opts.background ? { [BACKGROUND_HEADER]: '1' } : {}),
+        ...mergeHeaders(opts),
+        ...(opts.refreshOnce ? {} : onceHeaders()),
+        ...opts.headers,
+      },
+      credentials: 'same-origin',
+      // A navigation never follows a cross-origin redirect silently; the
+      // server answers 409 with a location when it wants a full load.
+      redirect: 'manual',
+      signal,
+    });
+
+    if (signal.aborted) throw new VisitCancelled();
+    return response;
+  }
+
+  /** What every request for a page's payload says, a prefetch's included. */
+  function pageHeaders() {
+    return { RSC: '1', accept: RSC_CONTENT_TYPE, 'X-Version': version };
+  }
+
+  /**
+   * What asks for a partial reload: the paths, and the page they are part
+   * of. Nothing when the page on screen never said which it is -- the
+   * server would render the page whole without X-Page regardless.
+   *
+   * @param {VisitOptions} opts
+   * @returns {Record<string, string>}
+   */
+  function partialHeaders(opts) {
+    if (!isPartial(opts) || view === null) return {};
+
+    /** @type {Record<string, string>} */
+    const headers = { 'X-Page': view };
+    if (opts.only !== undefined) headers['X-Only'] = pathsOf(opts.only).join(',');
+    if (opts.except !== undefined) headers['X-Except'] = pathsOf(opts.except).join(',');
+    return headers;
+  }
+
+  /**
+   * The merged fields this response is to replace rather than add to.
+   *
+   * @param {VisitOptions} opts
+   * @returns {Record<string, string>}
+   */
+  function mergeHeaders(opts) {
+    const paths = opts.reset === undefined ? [] : pathsOf(opts.reset);
+    return paths.length === 0 ? {} : { 'X-Reset': paths.join(',') };
+  }
+
+  /**
+   * The #[Once] keys whose rendered content this client keeps, so the
+   * response can leave those fields out -- with the route token of the page
+   * on screen, which the server checks names its own session before it
+   * believes the list (ADR 0020). Only keys kept under that token's
+   * session: what was kept for another is never claimed, and is dropped
+   * when a page for this one arrives.
+   *
+   * Within the server's limits, so the list is never refused whole for
+   * being long: the most recently used keys, which the page on screen's
+   * are, go first.
+   *
+   * @returns {Record<string, string>}
+   */
+  function onceHeaders() {
+    if (routeToken === null) return {};
+
+    const keys = [];
+    let bytes = 0;
+    for (const key of once.claimable(bindingOf(routeToken))) {
+      if (keys.length === MAX_HELD_KEYS || bytes + key.length + 1 > MAX_HELD_BYTES) break;
+      keys.push(key);
+      bytes += key.length + 1;
+    }
+    /** @type {Record<string, string>} */
+    const headers = keys.length === 0 ? {} : { 'X-Have-Once': keys.join(','), 'X-Once-Binding': routeToken };
+
+    // Once-shared values by their holds (ADR 0065), which the server checks
+    // against the session, user, tenant, panel and build asking now. Kept
+    // under the same binding as the keys above, so none sent for another
+    // session is ever handed back.
+    const holds = [];
+    bytes = 0;
+    for (const { hold } of once.holds(bindingOf(routeToken))) {
+      if (holds.length === MAX_SHARED_HOLDS || bytes + hold.length + 1 > MAX_SHARED_BYTES) break;
+      holds.push(hold);
+      bytes += hold.length + 1;
+    }
+    if (holds.length > 0) headers[SHARED_HOLDS_HEADER] = holds.join(',');
+
+    return headers;
+  }
+
+  /**
+   * The once keys a set of claim headers claimed: X-Have-Once's, and each
+   * once-shared value whose hold went in X-Have-Shared.
+   *
+   * @param {Record<string, string>} claims
+   * @returns {string[]}
+   */
+  function claimedBy(claims) {
+    const keys = claims['X-Have-Once']?.split(',') ?? [];
+    const sent = claims[SHARED_HOLDS_HEADER]?.split(',') ?? [];
+    if (sent.length === 0 || routeToken === null) return keys;
+    for (const { key, hold } of once.holds(bindingOf(routeToken))) {
+      if (sent.includes(hold)) keys.push(key);
+    }
+    return keys;
+  }
+
+  /**
+   * Whether a navigation may be answered from the prefetch cache: a plain
+   * GET visit the user made. Not back and forward, which ask for the entry
+   * they arrive at as it is now; not a redirect being followed; not a
+   * background request; not a visit sending headers of its own, which
+   * may be asking for something a prefetch did not; and not one asked to be
+   * `fresh`.
+   *
+   * @param {VisitOptions} opts
+   * @param {Context} ctx
+   */
+  function usesCache(opts, ctx) {
+    return (
+      !opts.background &&
+      !opts.fresh &&
+      !isPartial(opts) &&
+      opts.reset === undefined &&
+      !opts.preserveUrl &&
+      ctx.history === null &&
+      ctx.redirects === 0 &&
+      (opts.method ?? 'get') === 'get' &&
+      Object.keys(opts.headers ?? {}).length === 0
+    );
+  }
+
+  /**
+   * A prefetched copy of a page, or null to ask the server.
+   *
+   * One still in flight is waited for rather than sent again: the click
+   * that follows a hover usually lands while its prefetch is on the way.
+   * A stale one -- past the first of a `cacheFor` pair -- is used, and a
+   * fresh copy fetched behind it for the next visit.
+   *
+   * @param {URL} url
+   * @param {AbortSignal} signal
+   * @returns {Promise<Response | null> | null} null at once when nothing is kept
+   */
+  function cached(url, signal) {
+    const key = stripHash(url.href);
+
+    // A visit to the page on screen is a reload, and asks the server.
+    if (key === mounted) return null;
+
+    const kept = cache.lookup(key);
+    return kept === null ? null : take(kept, signal);
+  }
+
+  /**
+   * @param {{ entry: import('./prefetch-cache.js').Entry, stale: boolean }} kept
+   * @param {AbortSignal} signal
+   * @returns {Promise<Response | null>}
+   */
+  async function take(kept, signal) {
+    const key = kept.entry.url;
+    const response = await kept.entry.response;
+    // A 401 on the prefetch ended the session while this waited.
+    if (signal.aborted || revoked) throw new VisitCancelled();
+    if (response === null) return null;
+
+    // Rendered for another session than the one now on screen, or asked for
+    // under one that has since ended. Nothing it holds may be shown -- nor
+    // anything else kept under that session.
+    if (foreign(kept.entry.binding) || !underThisSession(kept.entry)) {
+      cache.clear();
+      return null;
+    }
+
+    if (kept.stale) void fetchAhead(key, kept.entry.window, kept.entry.tags);
+
+    // A copy: the kept response is never read, so every visit within its
+    // lifetime -- and a back to the page that linked here -- can take one.
+    // With the key it came with, imported; the copy has no header for it.
+    const copy = response.clone();
+    if (kept.entry.historyKey) importedKeys.set(copy, kept.entry.historyKey);
+    return copy;
+  }
+
+  /**
+   * Whether a binding names a session other than the one the client holds
+   * data for. Unknown on either side is not a mismatch: a page without a
+   * route token says nothing about whose session it is.
+   *
+   * @param {string | null} other
+   */
+  function foreign(other) {
+    return other !== null && binding !== null && other !== binding;
+  }
+
+  /**
+   * Whether a kept page was asked for under the session the tab holds now,
+   * by the CSRF cookie: script can read it, the server rotates it with the
+   * session, and every tab shares it. A route token only says whose page it
+   * is once a page carrying one is mounted -- after a sign-in, the redirect
+   * was answered before any had been -- and a sign-out in another tab sends
+   * this one nothing at all. The cookie has changed in both.
+   *
+   * @param {import('./prefetch-cache.js').Entry} entry
+   */
+  function underThisSession(entry) {
+    return entry.csrf === csrfToken(win.document);
+  }
+
+  /**
+   * Takes the binding a mounted page came with. A different session than
+   * the one the cache was filled under purges it -- a sign-in, a sign-out
+   * or a tenant switch all rotate what the token says. So does a page with
+   * none after one with one: the server mints no token for a visitor with
+   * no session, so that is the session ending, not a page keeping quiet.
+   *
+   * @param {string | null} next
+   */
+  function adoptBinding(next) {
+    // What was rendered from once fields for any other session goes; what
+    // the page just mounted kept, it kept under this one.
+    once.keepOnly(next);
+    if (next !== binding) {
+      if (binding !== null) cache.clear();
+      // Whatever was remembered under the session before is gone with it,
+      // for every entry of the tab -- wiped, not merely left unread -- and
+      // where its lists were read to.
+      store.wipe();
+      purgeResumeStore(next, resumeStore);
+      forgetAnchors();
+    }
+    binding = next;
+  }
+
+  /**
+   * Fetches a page ahead of a visit and keeps it for `cacheFor`.
+   *
+   * Sent with `Purpose: prefetch`, so the server can tell it from a visit
+   * and skip what a visit records; the page runs its whole GET pipeline
+   * either way, authorization included. Only GET: "Loaders and queries run
+   * in a read-only transaction ... because hovering a link runs them. Only
+   * GET links prefetch."
+   *
+   * Background work, never a navigation: no `before`, `start` or `finish`,
+   * and nothing here moves the page -- except a 401, which ends the session
+   * for everything this client holds, as it does for a poll.
+   *
+   * @param {string} href
+   * @param {PrefetchOptions} [opts]
+   * @returns {Promise<void>} settles once the page is kept, or is not
+   */
+  function prefetch(href, opts = {}) {
+    if (destroyed || revoked) return Promise.resolve();
+    if (opts.method !== undefined && String(opts.method).toLowerCase() !== 'get') return Promise.resolve();
+
+    const url = new URL(href, win.location.href);
+    if (!fetchable(url)) return Promise.resolve();
+
+    // The page on screen is not worth a second copy: a visit to it is a
+    // reload, and reloads ask the server.
+    const key = stripHash(url.href);
+    if (key === mounted) return Promise.resolve();
+
+    // Read before anything is sent, so a malformed duration throws at the
+    // caller rather than after a request nobody can use.
+    const window = cacheWindow(opts.cacheFor);
+    const tags = tagsOf(opts.cacheTags);
+
+    let kept = cache.lookup(key);
+    if (kept && !underThisSession(kept.entry)) {
+      // Kept under a session that has since ended: nothing kept under it is
+      // worth keeping, and this page is asked for again under this one.
+      cache.clear();
+      kept = null;
+    }
+    if (kept && !kept.stale) {
+      // Two links to one page may name different tags; a change to either
+      // makes the one copy out of date.
+      kept.entry.tags = [...new Set([...kept.entry.tags, ...tags])];
+      return kept.entry.response.then(noop);
+    }
+
+    return fetchAhead(key, window, tags);
+  }
+
+  /**
+   * @param {string} key the page's URL, without its fragment
+   * @param {{ fresh: number, stale: number }} window
+   * @param {readonly string[]} tags
+   * @returns {Promise<void>}
+   */
+  function fetchAhead(key, window, tags) {
+    /** @type {import('./prefetch-cache.js').Entry} */
+    const entry = {
+      url: key,
+      tags,
+      window,
+      controller: new AbortController(),
+      binding: null,
+      csrf: csrfToken(win.document),
+      arrivedAt: null,
+      response: Promise.resolve(null),
+    };
+
+    // Kept before the request starts, so a click from here on waits for
+    // this request instead of sending its own.
+    cache.add(entry);
+    entry.response = fetchEntry(entry);
+
+    return entry.response.then(noop);
+  }
+
+  /**
+   * @param {import('./prefetch-cache.js').Entry} entry
+   * @returns {Promise<Response | null>}
+   */
+  async function fetchEntry(entry) {
+    const { signal } = entry.controller;
+    emit('prefetching', { url: entry.url });
+
+    // Once keys too: what is kept stays until a fresh copy replaces it, it
+    // is dropped to make room -- which drops this entry with it -- or the
+    // session goes, and the session going clears this cache.
+    const claims = onceHeaders();
+    entry.claimed = claimedBy(claims);
+
+    let response;
+    try {
+      response = await doFetch(entry.url, {
+        method: 'GET',
+        headers: { ...pageHeaders(), ...claims, Purpose: PREFETCH_PURPOSE },
+        credentials: 'same-origin',
+        redirect: 'manual',
+        signal,
+      });
+    } catch {
+      // Offline, or stopped. Nothing is kept, and a click asks again.
+      cache.forget(entry);
+      return null;
+    }
+
+    if (signal.aborted || destroyed) {
+      cache.forget(entry);
+      return null;
+    }
+
+    if (response.status === 401) {
+      revoke(null, signal);
+      return null;
+    }
+
+    // Only a page: a redirect, a version mismatch or an error is the
+    // visit's to handle when it happens, not something to replay.
+    const type = response.headers.get('content-type') ?? '';
+    if (response.status !== 200 || !type.startsWith(RSC_CONTENT_TYPE) || !response.body) {
+      cache.forget(entry);
+      return null;
+    }
+
+    // Rendered for another session, by its token. Or the session cookie
+    // changed while it was on its way, and whose page it is cannot be told.
+    // Either way, nothing kept under the session before is kept now.
+    const theirs = bindingOf(response.headers.get(ROUTE_TOKEN_HEADER));
+    if (foreign(theirs) || !underThisSession(entry)) {
+      cache.clear();
+      return null;
+    }
+
+    // Flushed while it was in flight -- by a cancel or a purge -- in which
+    // case the answer is no longer wanted.
+    if (!cache.arrived(entry, theirs)) return null;
+
+    emit('prefetched', { url: entry.url });
+    return withoutKey(response, entry);
+  }
+
+  /**
+   * A prefetched response as the cache keeps it: its history key imported
+   * onto the entry, as a key that cannot be exported, and the header taken
+   * off. Kept with it, the raw key sat in memory for the entry's lifetime,
+   * in headers anything holding the response could read (ADR 0019).
+   *
+   * @param {Response} response
+   * @param {import('./prefetch-cache.js').Entry} entry
+   * @returns {Response}
+   */
+  function withoutKey(response, entry) {
+    const raw = response.headers.get(HISTORY_KEY_HEADER);
+    if (raw === null) return response;
+    entry.historyKey = historyKeyOf(raw);
+    const headers = new Headers(response.headers);
+    headers.delete(HISTORY_KEY_HEADER);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  }
+
+  /**
+   * What each response means.
+   *
+   * @param {Response} response
+   * @param {URL} url
+   * @param {VisitOptions} opts
+   * @param {Context} ctx
+   * @param {AbortSignal} signal aborted once a later navigation supersedes this one
+   * @returns {Promise<boolean>} whether a page was mounted
+   */
+  async function handle(response, url, opts, ctx, signal) {
+    // A background request -- a poll, a prefetch -- is something the user
+    // did not ask for, so it may never take the page away from them. The
+    // spec says this of a version mismatch ("does not force a reload"); it
+    // holds for every other reason a foreground visit would fall back to a
+    // full load as well, or a poll could yank the user to another URL.
+    const fullLoad = (href) => {
+      if (!opts.background) hardNavigate(href);
+    };
+
+    // Whatever a response says it invalidated is out of date in the
+    // prefetch cache, whatever else the response is -- a redirect after an
+    // action carries the tags as much as the action's own answer does. And
+    // so is any once field kept under one of those tags: no longer claimed.
+    const invalidated = invalidatedTags(response);
+    cache.deleteTagged(invalidated);
+    once.flushTags(invalidated);
+
+    // 409 + X-Location: "Full page load: version mismatch on GET, or
+    // external redirect." For a BACKGROUND request the spec says a mismatch
+    // "does not force a reload but fires a cancelable location event so the
+    // app can show a 'new version' toast" -- interrupting a user who did not
+    // navigate would be its own bug.
+    if (response.status === 409) {
+      const location = response.headers.get('x-location');
+      if (location) {
+        // Against the URL that was requested, as a Location is (RFC 9110),
+        // not the address bar -- a relative target from a page at another
+        // path resolved somewhere else entirely.
+        const target = new URL(location, url);
+
+        // A version reload sends the client back to the page it asked for;
+        // the fragment never reaches the server, so the location cannot
+        // carry it. Put back, as Inertia does, when the location is the
+        // same page -- not for an external redirect somewhere else.
+        if (!target.hash && target.origin === url.origin && target.pathname === url.pathname) {
+          target.hash = url.hash;
+        }
+        if (opts.background) {
+          emit('location', { url: target.href, background: true });
+          return false;
+        }
+        if (emit('location', { url: target.href, background: false })) {
+          hardNavigate(target.href);
+        }
+        return false;
+      }
+
+      // 409 + X-Redirect: "Redirect with a preserved fragment."
+      const redirect = response.headers.get('x-redirect');
+      if (redirect) {
+        // Following one is a navigation, which a background request never
+        // makes.
+        if (opts.background) return false;
+
+        // A redirect that leads back to itself -- or round a cycle -- would
+        // otherwise be followed until something ran out. Past the limit the
+        // document is loaded instead, where the browser's own redirect
+        // handling applies.
+        if (ctx.redirects >= MAX_REDIRECTS) {
+          fullLoad(url.href);
+          return false;
+        }
+
+        // Followed INSIDE this visit, not as a new one. A nested visit with
+        // replace: true ran before this one had pushed anything, so it
+        // overwrote the page being LEFT, and it emitted a second, cancelable
+        // `before` that could strand the visit half done. The visit's own
+        // replace setting stands; back and forward replace the entry they
+        // arrived at rather than pushing a new one after it.
+        const next = new URL(withFragment(redirect, url.hash), url);
+        if (!fetchable(next)) {
+          fullLoad(next.href);
+          return false;
+        }
+
+        const followed = await request(next, opts, signal);
+        return handle(
+          followed,
+          next,
+          ctx.history ? { ...opts, replace: true } : opts,
+          { redirects: ctx.redirects + 1, history: null },
+          signal,
+        );
+      }
+    }
+
+    // A redirect the fetch did not follow (redirect: 'manual' yields an
+    // opaque response). The server is meant to answer 409 instead; a raw
+    // redirect is a full load rather than a guess at where it pointed.
+    if (response.type === 'opaqueredirect') {
+      fullLoad(url.href);
+      return false;
+    }
+
+    if (!response.ok) {
+      // Cancelable, so an app can render its own error page in place. If
+      // nobody does, a full load of the same URL shows the server's.
+      const handled = !emit('httpException', { url: url.href, status: response.status });
+      const failure = new VisitHttpError(url.href, response.status);
+
+      // The session has ended: what is held for it goes first, whatever
+      // the callback does or however long it takes -- a callback that
+      // never settled must not keep one session's pages on screen.
+      if (response.status === 401) {
+        // The page on screen, for a background request and for a visit to
+        // the page itself: reload(), a link to it.
+        const onScreen = opts.background || stripHash(url.href) === mounted;
+        revoke(onScreen ? null : url.href, signal);
+        await runCallback(opts.onError, failure);
+        return false;
+      }
+
+      // Told before anything is loaded in the page's place, and waited for.
+      await runCallback(opts.onError, failure);
+      // A visit made while the callback ran owns the page now.
+      if (!handled && !signal.aborted) fullLoad(url.href);
+      return false;
+    }
+
+    const type = response.headers.get('content-type') ?? '';
+    if (!type.startsWith(RSC_CONTENT_TYPE) || !response.body) {
+      // A 200 that is not a payload is not something to hand the RSC
+      // reader. Load it as a document instead.
+      fullLoad(url.href);
+      return false;
+    }
+
+    // Any page rendered for another session -- signed out in another tab,
+    // say -- means what was prefetched under this one must go, whether or
+    // not this response is mounted.
+    const theirs = bindingOf(response.headers.get(ROUTE_TOKEN_HEADER));
+    if (foreign(theirs)) cache.clear();
+
+    // Only part of a page: the segments a partial reload recomputed, to go
+    // into the page on screen. A partial request the server answered with
+    // the whole page -- it is another page now, or partial reloads are off --
+    // is mounted as the page it is.
+    const partial = response.headers.has(PARTIAL_HEADER);
+    const shows = partial ? view : response.headers.get(PAGE_HEADER);
+
+    if (opts.background) {
+      // Rendered for another session than the page on screen: another tab
+      // signed in as someone else, or out, while this one went on polling or
+      // loading the list. Mounted under this page's token, the other
+      // session's orders went into this one's list. The session has changed
+      // under the page, and is treated as it would be at a 401: nothing more
+      // is mounted, everything held for it goes, and the page is loaded
+      // again under whoever the session is now.
+      if (foreign(theirs)) {
+        revoke(null, signal);
+        return false;
+      }
+
+      // Only the page already showing may be refreshed in the background --
+      // that is a poll. Mounting any other page would replace what the user
+      // is looking at with something they did not ask for, so a background
+      // response for another URL is never mounted. Either way: no history,
+      // no scroll, and the route token stays the one the user's own
+      // navigation produced.
+      //
+      // Compared with the MOUNTED page, not the address bar: after a back
+      // that failed in place, the bar names a page that is not on screen,
+      // and refreshing "it" put that page up under the old one's token.
+      //
+      // One exception: `preserveUrl`, another page of a merged list for the
+      // page on screen. Only a partial payload of it is mounted -- the server
+      // sends one only for the page the request named in X-Page -- and merged
+      // into what is shown (ADR 0020). A whole page means the URL is some
+      // other page now, and is never mounted in the background.
+      const loading = opts.preserveUrl === true && partial;
+      if ((loading || stripHash(url.href) === mounted) && showingCurrentEntry()) {
+        // Overlapping polls answer in any order. One older than what is on
+        // screen is dropped; the older ones still out are stopped, so none
+        // can commit after this one and put an earlier page back.
+        //
+        // Not an action's re-render still mounting, though older by number.
+        // A poll knows nothing of the action: a partial one re-renders a
+        // segment, and stopping the whole page the action sent back left its
+        // layout as it was before the action, its submission settled with
+        // nothing re-rendered. Both commit, in the order they arrive.
+        //
+        // Nor a list's next page: it is not an older copy of what a poll
+        // brought but more of the list, and dropping it left the reader at
+        // the end of the list with nothing loading.
+        const sequence = ctx.sequence ?? 0;
+        if (!loading && sequence < newestMounted) return false;
+        for (const c of [...background]) {
+          if (
+            c.signal === signal ||
+            applying.has(c) ||
+            merging.has(c) ||
+            (requestedAs.get(c) ?? 0) > sequence
+          ) {
+            continue;
+          }
+          background.delete(c);
+          c.abort();
+          finish(c, true);
+        }
+
+        const payload = observe(response.body, { url: url.href, background: true }, signal);
+        try {
+          await mountPage(payload.stream, {
+            url: url.href,
+            routeToken,
+            signal,
+            partial,
+            // A poll, a live refresh, a list's next page: the page the reader
+            // is on, which keeps its state unless asked otherwise.
+            preserveState: preserves(opts.preserveState, { url: url.href, view: shows, partial }, true),
+          });
+        } catch (error) {
+          payload.stop();
+          throw error;
+        }
+        if (signal.aborted) throw new VisitCancelled();
+        newestMounted = Math.max(newestMounted, sequence);
+        view = shows;
+        emit('success', {
+          url: url.href,
+          background: true,
+          partial,
+          liveToken: response.headers.get(LIVE_TOKEN_HEADER),
+        });
+        await runCallback(opts.onSuccess, { url: url.href, view: shows, partial });
+        return true;
+      }
+      return false;
+    }
+
+    // A restore still reaching for a position on the page being left has
+    // nothing more to do there, and must not move the page that replaces it.
+    stopRestoring();
+
+    // Back and forward have already left their entry; its position was
+    // recorded as the user scrolled.
+    if (!ctx.history) saveScroll();
+
+    // Decided before the mount, while the address bar still names the entry
+    // being replaced: only an entry whose own page is on screen keeps its
+    // state. After a back that failed in place, the bar's entry belongs to
+    // a page that never mounted, and keeping its state carried one page's
+    // app state onto another.
+    // A visit that keeps the address bar where it is stays on its entry, so
+    // whatever URL it fetched, it is the same page's for all of this.
+    const samePage = (opts.preserveUrl === true || stripHash(url.href) === mounted) && showingCurrentEntry();
+
+    const page = {
+      url: url.href,
+      routeToken: response.headers.get(ROUTE_TOKEN_HEADER),
+      signal,
+      partial,
+      // Inertia's default: a visit shows a fresh page, its components
+      // mounted again; reload() and a partial reload keep theirs -- the
+      // segments a partial reload re-renders are put back where they were,
+      // state and all (ADR 0015) -- and so does a visit that keeps the
+      // address bar where it is.
+      preserveState: preserves(
+        opts.preserveState,
+        { url: url.href, view: shows, partial },
+        partial || opts.preserveUrl === true,
+      ),
+    };
+
+    // Whether the window and the scroll regions stay where they are, decided
+    // once, now the response is in, as `preserveState` is and told the same.
+    const keepScroll = preserves(opts.preserveScroll, { url: url.href, view: shows, partial }, false);
+
+    // What the page being mounted remembers (useRemember). An entry arrived
+    // at by back or forward brings back its own values; the same page again
+    // under the same session -- a reload, a partial reload -- keeps the
+    // page's; any other page starts with nothing. Bound to the session the
+    // page came with, so a page rendered after a sign-in never reads what
+    // was remembered before it -- and to no session at all when it came
+    // with no route token. A page that does not say whose it is must not
+    // be taken for the last session's: unbound, it reads and keeps nothing.
+    //
+    // Sealed with the history key the page came with, if any (ADR 0019). An
+    // entry kept sealed is opened with it before the page mounts, so the
+    // page's components mount with what it kept; one sealed under another
+    // session's key does not open.
+    const session = theirs;
+    const historyKey = importedKeys.get(response) ?? historyKeyOf(response.headers.get(HISTORY_KEY_HEADER));
+    const reuse = samePage && !ctx.history && session === remembered.session;
+    const arrived = ctx.history ? String(objectState().tinvar?.key) : null;
+    const kept = arrived === null ? {} : await store.open(arrived, session, historyKey);
+    if (signal.aborted) throw new VisitCancelled();
+
+    /** @type {Remembered} */
+    const record = reuse
+      ? remembered
+      : { entry: null, session, values: valuesOf(kept, session), key: historyKey, restoring: false };
+    // A page kept through a reload seals with the key it comes with now;
+    // one that comes with none keeps sealing with the key it had, rather
+    // than writing in the clear what was typed under encryption.
+    if (reuse && historyKey !== null) record.key = historyKey;
+
+    // While a page mounts, what is on screen is neither page: a shorter
+    // page makes the browser clamp the scroll and fire `scroll`, and that
+    // clamped position was recorded against the page being left. Its
+    // position was saved just above; nothing is recorded while any mount is
+    // in progress.
+    //
+    // A count rather than clearing `entry`: clearing it meant a visit that
+    // never committed had to put the old key back, and a superseded visit
+    // whose mount settled late put it back while a NEWER visit was mounting.
+    mounting++;
+    incoming = record;
+
+    // Where the lists on the entry arrived at were read to, for them to
+    // take as they mount; nothing for any other visit, which starts its
+    // lists at the top -- nor for a page of another session than the one
+    // they were read under, which forgets them as it is adopted.
+    restored =
+      ctx.history && theirs === binding
+        ? arrivedAt(anchors.get(arrived ?? '') ?? objectState().tinvar?.anchors)
+        : null;
+
+    const payload = observe(response.body, { url: url.href }, signal);
+    try {
+      await mountPage(payload.stream, page, opts.viewTransition);
+
+      // A mount takes time, and another navigation -- a click, a back press
+      // -- can start meanwhile. Checking only after the fetch let a
+      // superseded visit go on to push its URL over the newer one, and left
+      // the router holding the newer page's route token while showing this
+      // one, so an action revalidated a page that was not on screen. Nothing
+      // below runs for a visit that has been superseded, and the token is
+      // only taken once this page is the one that stays.
+      if (signal.aborted) throw new VisitCancelled();
+    } catch (error) {
+      if (incoming === record) incoming = null;
+      payload.stop();
+      throw error;
+    } finally {
+      mounting--;
+    }
+    routeToken = page.routeToken;
+    adoptBinding(theirs);
+    if (!opts.preserveUrl) mounted = stripHash(url.href);
+    view = shows;
+
+    // The page's own record from now on; see `remembered`.
+    if (incoming === record) incoming = null;
+    remembered = record;
+
+    if (ctx.history) {
+      // "Restore on back/forward."
+      entry = claimEntry();
+      record.entry = entry;
+      storeRemembered(record);
+      const saved = savedScroll(entry, ctx.history.scroll);
+      const regions = savedRegions(entry, ctx.history.regions);
+      if (restored?.window) {
+        // A list on the page took its anchor and puts the reader back by
+        // it, reloading the pages it had; the raw position would land on
+        // whatever the page holds at that offset now. The scroll regions
+        // are still put back.
+        if (regions !== null) restoreScroll(null, regions, restored.containers);
+      } else if (Array.isArray(saved)) {
+        restoreScroll(saved, regions, restored?.containers);
+      } else {
+        // An entry this router never recorded -- pushed by other code. The
+        // previous page's position means nothing on it.
+        resetRegions();
+        if (!scrollToFragment(url.hash)) win.scrollTo(0, 0);
+      }
+    } else if (opts.preserveUrl) {
+      // The address bar and its entry stay as they were: nothing pushed,
+      // nothing replaced. The page took over the entry's record above, or
+      // starts its own on the entry now.
+      if (record.entry === null && entry !== null) {
+        record.entry = entry;
+        storeRemembered(record);
+      }
+      if (!keepScroll) {
+        resetRegions();
+        if (!scrollToFragment(url.hash)) win.scrollTo(0, 0);
+      }
+      if (entry !== null) keepNewest(regionPositions, entry, readRegions());
+    } else {
+      const key = newKey();
+      const scroll = keepScroll ? [win.scrollX, win.scrollY] : [0, 0];
+      const ours = { key, scroll };
+
+      // A visit to the URL already in the address bar -- a link to the page
+      // it is on -- replaces the entry, as a browser's own navigation does.
+      // Pushed, each click added another copy of the page for back to step
+      // through.
+      if (opts.replace || url.href === win.location.href) {
+        // Replacing the entry for the SAME page -- reload(), a filter that
+        // stays on the page -- keeps whatever else the entry holds. It was
+        // overwritten wholesale, so anything an app had stored on the entry
+        // was gone after a reload. A different page starts clean.
+        const kept = samePage ? objectState() : {};
+        win.history.replaceState({ ...kept, tinvar: ours }, '', url.href);
+        // The replaced entry is gone from history; so is any use for its
+        // position. Without this every reload() and poll-driven replace
+        // left one behind.
+        if (entry !== null) {
+          positions.delete(entry);
+          regionPositions.delete(entry);
+          anchors.delete(entry);
+        }
+      } else {
+        win.history.pushState({ tinvar: ours }, '', url.href);
+      }
+      entry = key;
+      // What the page remembered as it mounted goes under its entry now
+      // that there is one; a replaced entry's values go with the entry.
+      if (record.entry !== null && record.entry !== key) store.write(record.entry, record.session, {});
+      record.entry = key;
+      storeRemembered(record);
+      keepNewest(positions, key, scroll);
+
+      // "Scroll: reset on navigation", unless asked to keep it -- the scroll
+      // regions with the window, as Inertia resets them. A fragment in the
+      // URL is a request to go somewhere specific on the new page.
+      if (!keepScroll) {
+        resetRegions();
+        if (!scrollToFragment(url.hash)) win.scrollTo(0, 0);
+      }
+      keepNewest(regionPositions, key, readRegions());
+    }
+
+    emit('success', { url: url.href, partial, liveToken: response.headers.get(LIVE_TOKEN_HEADER) });
+    emit('navigate', { url: url.href, type: ctx.history ? 'history' : 'visit' });
+    // The visit's own `onSuccess`, waited for before its `finish`.
+    await runCallback(opts.onSuccess, { url: url.href, view: shows, partial });
+    return true;
+  }
+
+  /**
+   * Back and forward. The URL has already changed by the time this runs,
+   * so the page is fetched for it and the saved scroll position put back.
+   */
+  function onPopState(/** @type {PopStateEvent} */ event) {
+    const saved = savedScroll(event.state?.tinvar?.key, event.state?.tinvar?.scroll);
+
+    // An in-page anchor makes its own history entry, and the browser fires
+    // popstate moving between it and its neighbours. The document has not
+    // changed, so this is a scroll, not a navigation: refetching remounted
+    // the whole page and threw away its state for a jump to a heading.
+    if (stripHash(win.location.href) === mounted) {
+      interrupt();
+      const regions = savedRegions(event.state?.tinvar?.key, event.state?.tinvar?.regions);
+      entry = claimEntry();
+      // Still the same page: what it remembers goes with it to this entry.
+      remembered.entry = entry;
+      persist();
+      if (Array.isArray(saved)) {
+        restoreScroll(saved, regions);
+      } else {
+        stopRestoring();
+        scrollToFragment(win.location.hash);
+      }
+      emit('navigate', { url: win.location.href, type: 'history' });
+      return;
+    }
+
+    // What the page being left remembered, written now: the debounce could
+    // fire after the next page mounts, when `remembered` is already that
+    // page's, and whatever was typed in its last moments was lost. Only the
+    // store -- the scroll in history.state belongs to the entry arrived at.
+    clearTimeout(persistTimer);
+    storeRemembered(remembered);
+
+    // Until the entry's page is mounted, what is on screen belongs to the
+    // entry that was left, and scrolling it must not be recorded against
+    // the one arrived at.
+    entry = null;
+
+    void go(
+      win.location.href,
+      {},
+      {
+        redirects: 0,
+        history: { scroll: saved, regions: event.state?.tinvar?.regions },
+      },
+    );
+  }
+
+  win.addEventListener('popstate', onPopState);
+  win.addEventListener('scroll', onScroll, { passive: true });
+  // A window with no DOM has no regions to hear.
+  if (typeof win.document?.addEventListener === 'function') {
+    win.document.addEventListener('scroll', onRegionScroll, { capture: true, passive: true });
+  }
+  // A reload or a closed tab ends the page before the debounce can fire.
+  win.addEventListener('pagehide', persist);
+
+  // scrollRestoration is manual, so the browser does not put a reloaded
+  // document back where it was, nor one reached by back from another
+  // document -- and nothing here did either, so both landed at the top.
+  // The page may still be streaming in and is about to be hydrated;
+  // restoreScroll keeps reaching for the position until the page has grown
+  // into it, which covers the first commit. The scroll regions with it.
+  const leftAt = Array.isArray(left) && Number.isFinite(left[0]) && Number.isFinite(left[1]) ? left : null;
+  if (leftAt !== null || leftRegions !== null) restoreScroll(leftAt, leftRegions, restored?.containers);
+
+  /**
+   * Mounts a re-rendered payload of the page on screen -- what an action's
+   * revalidation sends back -- without asking the server again.
+   *
+   * "The response carries a fresh RSC payload for affected mounted routes."
+   * It is mounted as a background refresh is: onto the page on screen only,
+   * with no history and no scroll, and the route token kept. Never while a
+   * visit is in flight -- that payload is of the page being left, and
+   * mounting it could put that page back over the one the user asked for --
+   * and a visit started meanwhile stops it, as it stops a poll. Resolves
+   * once the page has committed, so a caller settling a revalidation after
+   * it (beginRevalidation()) settles it with the new page up.
+   *
+   * Of the visit options a form was given, `viewTransition`,
+   * `preserveState`, `onSuccess` and `onError` apply: the page stays where
+   * it is, and nothing is pushed or replaced.
+   *
+   * `liveToken`, given, is the re-render's live token, handed on in the
+   * `success` event as a reload's X-Live-Token is (ADR 0048); not given,
+   * the event carries none, and the live module keeps what it holds.
+   *
+   * `routeToken` is the token the action was sent with: the payload is the
+   * re-render of the page that token names. Once another page has been
+   * mounted -- the user followed a link while the action ran -- it is no
+   * longer the page on screen, and mounting it would put the page they left
+   * back up under the new page's URL and token. So it is refused.
+   *
+   * @param {string | Uint8Array | ReadableStream<Uint8Array>} payload
+   * @param {VisitOptions & { routeToken?: string | null, liveToken?: string | null }} [opts]
+   * @returns {Promise<boolean>} whether the payload was mounted
+   */
+  async function applyPayload(payload, opts = {}) {
+    if (destroyed || revoked || inFlight) return false;
+    if (opts.routeToken !== undefined && opts.routeToken !== routeToken) return false;
+
+    const controller = new AbortController();
+    const sequence = ++requested;
+    visitUrls.set(controller, mounted);
+    requestedAs.set(controller, sequence);
+    applying.add(controller);
+    background.add(controller);
+    backgrounds.add(controller);
+    emit('start', { url: mounted, background: true, showProgress: false });
+
+    try {
+      // An older background refresh still on its way must not commit over
+      // this one.
+      for (const c of [...background]) {
+        if (c === controller || (requestedAs.get(c) ?? 0) > sequence) continue;
+        background.delete(c);
+        c.abort();
+        finish(c, true);
+      }
+
+      const body =
+        typeof ReadableStream !== 'undefined' && payload instanceof ReadableStream
+          ? payload
+          : /** @type {ReadableStream<Uint8Array>} */ (new Response(/** @type {BodyInit} */ (payload)).body);
+      // The page re-rendered in place, the form that sent the action on
+      // it: its state stays unless the form's options say otherwise.
+      await mountPage(
+        body,
+        {
+          url: mounted,
+          routeToken,
+          signal: controller.signal,
+          partial: false,
+          preserveState: preserves(opts.preserveState, { url: mounted, view, partial: false }, true),
+        },
+        opts.viewTransition,
+      );
+      if (controller.signal.aborted) return false;
+      supersede(controller);
+
+      newestMounted = Math.max(newestMounted, sequence);
+      emit('success', {
+        url: mounted,
+        background: true,
+        ...('liveToken' in opts ? { liveToken: opts.liveToken ?? null } : {}),
+      });
+      // The visit after the action, as a redirect's or a reload's would be.
+      await runCallback(opts.onSuccess, { url: mounted, view, partial: false });
+      return true;
+    } catch (error) {
+      if (controller.signal.aborted || error instanceof VisitCancelled) return false;
+      // A payload that cannot be rendered leaves the page as it was, and
+      // says so on the router's own channel; a background refresh never
+      // loads a document in its place.
+      if (error instanceof MountFailed) {
+        emit('error', { url: mounted, error: error.cause, background: true });
+        await runCallback(opts.onError, error.cause);
+        return false;
+      }
+      throw error;
+    } finally {
+      background.delete(controller);
+      finish(controller, false);
+    }
+  }
+
+  const router = {
+    visit,
+    isEndpoint,
+    get: (href, opts = {}) => visit(href, { ...opts, method: 'get' }),
+    /**
+     * The page on screen, fetched again. Given the `routeToken` an action
+     * was sent with, refused as applyPayload() refuses: once another page
+     * has been mounted since, or while a visit is in flight -- reloading
+     * would cut off the visit the user started while the action ran.
+     */
+    reload: ({ routeToken: sentFrom, ...opts } = {}) => {
+      if (sentFrom !== undefined && (inFlight || sentFrom !== routeToken)) return Promise.resolve(false);
+      return visit(win.location.href, { preserveState: true, ...opts, replace: true, preserveScroll: true });
+    },
+    prefetch,
+    applyPayload,
+
+    /**
+     * Tells the page an action flashed something: the router's `flash`
+     * event, to its listeners and as a native `tinvar:flash` CustomEvent on
+     * the document, as every router event is.
+     *
+     * @param {Record<string, unknown>} flash
+     * @param {Record<string, unknown>} [detail] more to say, as the action's name
+     */
+    flash(flash, detail = {}) {
+      emit('flash', { ...detail, flash });
+    },
+
+    /**
+     * Tells the page about an action call, for the forms layer -- <Form>,
+     * useForm and useHttp: `actionStart` as it is sent, `progress` as its
+     * files upload, and `actionSettle` once its answer has been applied to
+     * the page. To the router's listeners, and as native `tinvar:<name>`
+     * CustomEvents on the document, as every router event is. None is
+     * cancelable: the call is under way, and what stops one is its form's
+     * `cancel()`.
+     *
+     * Only those three: the rest of the router's events say what the router
+     * did, and are not anyone else's to emit.
+     *
+     * @param {'actionStart' | 'progress' | 'actionSettle'} name
+     * @param {Record<string, unknown>} [detail]
+     */
+    announce(name, detail = {}) {
+      if (!ANNOUNCED.has(name)) {
+        throw new TypeError(`[tinvar:client] '${name}' is not an event the forms layer announces.`);
+      }
+      emit(name, detail);
+    },
+
+    /**
+     * Forgets the prefetched copy of a page, so its next visit asks the
+     * server.
+     *
+     * @param {string} href
+     */
+    flush(href) {
+      cache.delete(stripHash(new URL(href, win.location.href).href));
+    },
+
+    /** Forgets every prefetched page. */
+    flushAll() {
+      cache.clear();
+    },
+
+    /**
+     * Ends the session on this client, for a 401 heard by something other
+     * than the router -- an action, a useHttp call, a fragment: the route
+     * token, every prefetched page and everything useRemember() kept, for
+     * every entry of the tab, are dropped, whatever is in flight is
+     * stopped, and nothing more is sent. The caller loads the page, as the
+     * router does on a 401 of its own: "cleared, with a full page load".
+     */
+    revoke() {
+      if (destroyed) return;
+      forgetSession(null);
+    },
+
+    /**
+     * "Logout calls `clearHistory()` to rotate the key" (tinvar-spec.md):
+     * everything remembered, for every entry of the tab, is wiped -- seals
+     * still under way included -- and the history key the router holds is
+     * dropped, so nothing it sealed can be opened by this document again.
+     * Nothing more is remembered on the page it is called on; the next page
+     * remembers under the key it comes with.
+     *
+     * The key itself is the session's (ADR 0019): it rotates when the
+     * server gives the session a new id, which signing out does. This only
+     * makes sure nothing sealed under the old one is left behind meanwhile.
+     */
+    clearHistory() {
+      if (destroyed) return;
+      for (const record of [remembered, incoming]) {
+        if (record === null) continue;
+        record.values.clear();
+        record.session = null;
+        record.key = null;
+      }
+      store.wipe();
+      purgeResumeStore(null, resumeStore);
+      // And what once fields rendered: client-held data of the same session.
+      // Kept in memory alone, never in storage, so there is nothing sealed
+      // to rotate a key for -- but nothing of it outlives the sign-out
+      // either, on this document or a later one (ADR 0020).
+      once.clear();
+      // And where the lists were read to, whose keys name what was read.
+      forgetAnchors();
+      // And what else holds the session's data: the live module.
+      emit('clearHistory');
+    },
+
+    /**
+     * Settles once what the first page's entry remembered has been read
+     * back -- at once unless its history is encrypted. Await it before
+     * hydrating, so what was remembered is there when components mount.
+     */
+    ready,
+
+    /**
+     * Forgets every prefetched page carrying one of these tags -- given by
+     * the `cacheTags` it was prefetched with.
+     *
+     * @param {string | readonly string[]} tags
+     * @returns {number} how many pages were forgotten
+     */
+    flushByCacheTags(tags) {
+      const listed = tagsOf(tags);
+      once.flushTags(listed);
+      return cache.deleteTagged(listed);
+    },
+
+    /**
+     * Forgets what an action's response says it invalidated; see the
+     * module's flushInvalidated(), which does this for every router.
+     *
+     * @param {Response | Headers | { headers?: Headers } | string | null | undefined} source
+     * @returns {string[]} the tags it named
+     */
+    flushInvalidated(source) {
+      const tags = invalidatedTags(source);
+      cache.deleteTagged(tags);
+      once.flushTags(tags);
+      return tags;
+    },
+
+    /**
+     * What a page kept of a #[Once] field, for <OnceSlot> to put back where
+     * the server left the field out -- only for a page of the session it
+     * was kept under. `scope` is the page the slot belongs to, from
+     * rememberScope().
+     *
+     * @param {string} key
+     * @param {Remembered} [scope]
+     * @returns {{ content: unknown } | undefined}
+     */
+    heldOnce(key, scope = rememberScope()) {
+      return once.read(key, scope.session);
+    },
+
+    /**
+     * The once-shared values' holds, as a fragment request claims them
+     * (ADR 0074): X-Have-Shared with the holds kept under the page on
+     * screen's session, which the server checks against the session, user,
+     * tenant, panel and build asking now. No X-Have-Once: a fragment claims
+     * no loader field.
+     *
+     * @returns {Record<string, string>}
+     */
+    sharedClaims() {
+      if (destroyed || revoked) return {};
+      const headers = onceHeaders();
+      const holds = headers[SHARED_HOLDS_HEADER];
+      return holds === undefined ? {} : { [SHARED_HOLDS_HEADER]: holds };
+    },
+
+    /**
+     * Keeps what a page rendered from a #[Once] field, under the session the
+     * page came with, so the next request can list the key in X-Have-Once --
+     * or, for a once-shared value, hand its hold back in X-Have-Shared.
+     *
+     * @param {string} key
+     * @param {unknown} content
+     * @param {number | null} ttl seconds it may be listed for
+     * @param {readonly string[]} tags
+     * @param {Remembered} [scope]
+     * @param {string | null} [hold] a once-shared value's signed hold (ADR 0065)
+     */
+    holdOnce(key, content, ttl, tags, scope = rememberScope(), hold = null) {
+      if (destroyed || revoked) return;
+      // A prefetched page sent without a field kept under a key dropped to
+      // make room could not be filled; it is asked for again instead.
+      cache.deleteClaiming(once.record(key, scope.session, content, ttl, tags, hold));
+    },
+
+    /**
+     * Stops listing once keys -- the given ones, or all -- so the next
+     * response sends those fields fresh. What was kept stays shown until
+     * then.
+     *
+     * @param {string | readonly string[]} [keys]
+     */
+    flushOnce(keys) {
+      once.flush(keys === undefined ? undefined : tagsOf(keys));
+    },
+
+    /**
+     * Moves the address bar to another URL of the page on screen, without a
+     * request: what <InfiniteScroll> does as the reader scrolls from one
+     * page of a list into the next. The entry is replaced, not pushed, and
+     * keeps its state -- its scroll position and what was remembered on it
+     * -- since it is still the same page.
+     *
+     * Refused for another origin, and while the page on screen is not the
+     * entry's (a back or forward is pending).
+     *
+     * @param {string} href
+     * @returns {boolean} whether the address bar moved
+     */
+    replaceUrl(href) {
+      if (destroyed) return false;
+      const target = new URL(href, win.location.href);
+      if (!fetchable(target) || !showingCurrentEntry()) return false;
+      win.history.replaceState(win.history.state, '', target.href);
+      mounted = stripHash(target.href);
+      return true;
+    },
+
+    /**
+     * Records where a merged list on the page on screen is read to, on the
+     * page's history entry: what <InfiniteScroll> calls as the reader
+     * scrolls. Persisted with the scroll position. Not while a page is
+     * being mounted or a back or forward is pending, when the list on
+     * screen belongs to no entry.
+     *
+     * @param {string} id the list's dot path
+     * @param {ScrollAnchor} anchor
+     */
+    saveScrollAnchor(id, anchor) {
+      if (destroyed || entry === null || mounting > 0 || !showingCurrentEntry() || !isAnchor(anchor)) return;
+      // Nothing after the session has ended on this page -- a 401, or
+      // clearHistory(), after which the page remembers nothing more.
+      if (revoked || (remembered.session === null && binding !== null)) return;
+      keepNewest(anchors, entry, { ...anchors.get(entry), [id]: anchor });
+      schedulePersist();
+    },
+
+    /**
+     * Where a merged list was read to on the entry a back, a forward or a
+     * reload arrived at, for the list to put the reader back by -- once;
+     * undefined after any other visit. One in the window stops the raw
+     * position being restored, which the list does instead; one in a
+     * scroll container -- given as `container` -- stops that container's,
+     * when it is a scroll region.
+     *
+     * @param {string} id the list's dot path
+     * @param {Element | null} [container] the element the list scrolls in, null for the window
+     * @returns {ScrollAnchor | undefined}
+     */
+    takeScrollAnchor(id, container = null) {
+      if (destroyed || restored === null || restored.taken.has(id)) return undefined;
+      const anchor = restored.anchors[id];
+      if (anchor === undefined) return undefined;
+      restored.taken.add(id);
+      if (anchor.window) {
+        restored.window = true;
+        // The window's part of the restore alone: the scroll regions are
+        // still put back.
+        if (restoring !== null) restoring.position = null;
+      } else if (container !== null && typeof container === 'object') {
+        restored.containers.add(container);
+      }
+      return anchor;
+    },
+
+    /**
+     * The page a component mounting now belongs to, for what it remembers:
+     * the page being mounted while a visit mounts one, otherwise the page on
+     * screen. useRemember() takes it once, as it mounts.
+     */
+    rememberScope,
+
+    /**
+     * The value remembered under a key for a page, or undefined -- also when
+     * it was set under another session, which forgets it.
+     */
+    remembered: rememberedValue,
+
+    /**
+     * Remembers a value under a key for a page, on its history entry,
+     * bound to the session in force as it is set. Without a session nothing
+     * is remembered.
+     */
+    remember: rememberValue,
+
+    /**
+     * Cancels what is in flight: the visit (`sync`), background requests
+     * such as polls (`async`) and prefetches (`prefetch`). All three unless
+     * told otherwise. Prefetched pages that have arrived are kept.
+     *
+     * @param {{ sync?: boolean, async?: boolean, prefetch?: boolean }} [which]
+     */
+    cancelAll({ sync = true, async = true, prefetch: prefetches = true } = {}) {
+      if (sync) interrupt();
+      if (async) abortBackground();
+      if (prefetches) cache.abortInFlight();
+    },
+
+    /**
+     * Subscribes to a router event. Returns an unsubscribe function.
+     *
+     * @param {string} name
+     * @param {(event: CustomEvent) => void} fn
+     */
+    on(name, fn) {
+      if (!listeners.has(name)) listeners.set(name, new Set());
+      listeners.get(name).add(fn);
+      return () => listeners.get(name)?.delete(fn);
+    },
+
+    /**
+     * The route tokens to send with an action, so it can re-render the page
+     * that is mounted. The server only re-renders routes the action itself
+     * invalidated, so sending the token is not asking for anything.
+     *
+     * @returns {string[]}
+     */
+    routeTokens() {
+      return routeToken === null ? [] : [routeToken];
+    },
+
+    /**
+     * The view of the page on screen, as the server named it -- in the page
+     * metadata, or a payload's X-Page -- or null where it did not: what a
+     * page with no route name files its reports under (ADR 0129).
+     *
+     * @returns {string | null}
+     */
+    currentView() {
+      return view;
+    },
+
+    /** Removes the router's listeners. */
+    destroy() {
+      destroyed = true;
+      live.delete(router);
+      stopReload();
+      inFlight?.abort();
+      showing?.abort();
+      abortBackground();
+      cache.clear();
+      once.clear();
+      win.removeEventListener('popstate', onPopState);
+      win.removeEventListener('pagehide', persist);
+      win.removeEventListener('scroll', onScroll);
+      win.document?.removeEventListener?.('scroll', onRegionScroll, { capture: true });
+      clearTimeout(persistTimer);
+      stopRestoring();
+      listeners.clear();
+    },
+  };
+
+  live.add(router);
+  return router;
+}
+
+/** Keeps the fragment of the page being left, as "X-Redirect" preserves it. */
+function withFragment(target, hash) {
+  if (!hash) return target;
+
+  const url = new URL(target, 'http://placeholder');
+  if (url.hash) return target;
+
+  return target + hash;
+}
+
+let keys = 0;
+
+/** A key for a history entry, unique within this tab's history. */
+function newKey() {
+  return `${Date.now().toString(36)}.${(keys++).toString(36)}`;
+}
+
+function stripHash(href) {
+  const url = new URL(href);
+  url.hash = '';
+  return url.href;
+}
+
+/**
+ * Whether a value has a scroll anchor's shape. History state is the page's
+ * to write as much as the router's, so nothing read back from it is taken
+ * on trust.
+ *
+ * @param {unknown} value
+ * @returns {value is ScrollAnchor}
+ */
+function isAnchor(value) {
+  if (value === null || typeof value !== 'object') return false;
+  const anchor = /** @type {Record<string, unknown>} */ (value);
+  const whole = (/** @type {unknown} */ n) => Number.isInteger(n);
+  return (
+    whole(anchor.page) &&
+    (anchor.key === null || typeof anchor.key === 'string') &&
+    whole(anchor.index) &&
+    Number(anchor.index) >= 0 &&
+    Number.isFinite(anchor.top) &&
+    whole(anchor.first) &&
+    whole(anchor.last) &&
+    typeof anchor.window === 'boolean'
+  );
+}
+
+/**
+ * Whether this document was loaded by a reload or by back or forward: a
+ * return to an entry the user has seen, rather than a fresh navigation.
+ *
+ * @param {Window} win
+ */
+function isReturn(win) {
+  const performance = win.performance;
+  const [timing] =
+    typeof performance?.getEntriesByType === 'function' ? performance.getEntriesByType('navigation') : [];
+  if (timing && 'type' in timing) return timing.type === 'reload' || timing.type === 'back_forward';
+
+  // The older interface, where Navigation Timing 2 is missing: 1 is a
+  // reload, 2 is back or forward.
+  const legacy = /** @type {{ navigation?: { type?: number } } | undefined} */ (performance)?.navigation
+    ?.type;
+  return legacy === 1 || legacy === 2;
+}