@ultimat3/render 20.2.0 → 21.0.0

package/CLAUDE.md

@@ -62,9 +62,10 @@ for the mirror-image reason, keeping `render → pwa` refused. Never `cli` (upwa
 | The hydration runtime's CSP | `HYDRATE_RUNTIME_BODIES` — every body `hydrateRuntime` can emit, one per non-empty subset of the three strategies, seven in all. It is emitted INLINE in every document carrying an island, and `@ultimat3/http`'s `script-src` is `'self' 'wasm-unsafe-eval'`, so under the enforced policy a container serves (`dev: false`) **no island ever booted** — invisible in `x dev`, where the policy is report-only. `@ultimat3/cli`'s `script-csp.ts` hashes this list at boot, the mirror of `style-csp.ts`. Hashes and not a nonce, for `cspHashSource`'s own reason: a `render: 'static'` page is a file on disk. Never restate the concatenation — `runtimeBody` is the one place the served text and the hashed text are the same string. **Still uncovered**: `render-stream.ts`'s per-hole `<script>$X("id")</script>`, whose body is per-response and cannot be hashed. Unreachable today (`dev-render.ts` passes `holes: []`), and the first real hole needs a nonce, not a hash. |
 | Island markup | the props `<script>` is emitted INSIDE the wrapper by `render-html.ts`, so a document assembler has exactly one thing left to remember: `hydrateRuntime(directives)`. |
 | Island boot | `el.__x` holds the boot PROMISE, never a boolean. As a flag, a second interaction while the chunk was still loading got a resolved promise back and the replay queue flushed into an island that had not mounted — the events went nowhere and the listeners were already removed. |
-| Island mount markers | `data-x-mounted=""` when `mount()` RESOLVED, `data-x-failed="<message>"` when it rejected — set by the runtime, never by `emitIslandAttributes`, because the server does not know the answer. `el.__x` alone cannot carry this: it is assigned when `import()` is CALLED, so a chunk still downloading and one whose `mount()` threw were the same observable, and telling those apart is what `x shot` gates on. Two attributes rather than two values of one, so `[data-x-mounted]` never counts a failure as a success. The rejection handler RETHROWS — swallowing it resolves `el.__x` and the interaction runtime flushes its replay queue into an island that never mounted, which is the row above reintroduced one layer out. Costs 129 B of shared prelude: `idle` 774, `visible` 846, `interaction` 1,251 (`As of 2026-08-25`, the numbers `DEFAULT_ISLAND_JS_BYTES` is derived from — `interaction` moved 1,067 -> 1,251 for the replay-target row below, and neither of the other two changed). |
+| Island mount markers | `data-x-mounted=""` when `mount()` RESOLVED, `data-x-failed="<message>"` when it rejected — set by the runtime, never by `emitIslandAttributes`, because the server does not know the answer. `el.__x` alone cannot carry this: it is assigned when `import()` is CALLED, so a chunk still downloading and one whose `mount()` threw were the same observable, and telling those apart is what `x shot` gates on. Two attributes rather than two values of one, so `[data-x-mounted]` never counts a failure as a success. The rejection handler RETHROWS — swallowing it resolves `el.__x` and the interaction runtime flushes its replay queue into an island that never mounted, which is the row above reintroduced one layer out. Costs 129 B of shared prelude: `idle` 1,744, `visible` 846, `interaction` 1,629 (`As of 2026-09-22`, the numbers `DEFAULT_ISLAND_JS_BYTES` is derived from — `idle` moved 774 -> 1,744 and `interaction` 1,251 -> 1,629 when both began sharing `catchUp` and aiming by path, the rows below). |
 | A runtime that calls `boot` | TERMINATES the chain, because `boot` rethrows. `idle` and `visible` end in `.catch(hush)`; `interaction` passes `off` as the rejection arm of its `then`. A bare `boot(el)` produced a fresh rejected promise per call — one unhandled rejection per user event on an island whose `mount()` threw — and, on `interaction`, left `done` false, the listeners attached and the queue growing by one retained `Event` (each with a live `target`) per click, for an island that will never mount. Nothing is lost by swallowing here: the DOM already carries the failure as `data-x-failed`, which is the row above and the documented observable. `hydrate-runtime.test.ts` runs all three against a real module; Bun's runner fails a test on an unhandled rejection, so the omission reds the suite by itself. |
-| Where `interaction` replays | `aim(el, ev)` in `hydrate.ts`, never `ev.target`. Every island's `mount` opens with `el.textContent = ''` — the documented idiom, and what `settings`, `feed` and `like` all do — so the node the visitor pressed is DETACHED by the time the replay runs and `ev.target.dispatchEvent(c)` reached nothing: the first press did nothing and the second worked, which reads as a slow network and is never filed as a bug. `examples/dummy/apps/web/app/posts/[id]/page.tsx` declares `hydrate: 'idle'` in writing to avoid it. The runtime CAN tell the two mounts apart — `el.contains(ev.target)` AFTER the mount is the exact question — so this is a repair and not a refusal: refusing the pairing would delete a strategy that works today for a takeover-style island (`contact-sales.island.tsx` attaches to the server's own form and replaces nothing). Kept → the original target. Replaced → `document.elementFromPoint(ev.clientX, ev.clientY)`, which is where the event would land had the visitor pressed a moment later. The island ROOT is the last resort and never the repair: Solid's delegated listener sits on `document` and walks UP from the target (`solid-js/web`'s `eventHandler`), so a handler on a CHILD of the root is never visited and dispatching at the root fixes nothing for the canonical island. A hit landing outside this island falls back to the root too — synthesizing a click on an element the visitor never pressed is worse than losing the replay. `typeof ev.clientX === 'number'`, never `ev.clientX || ev.clientY`: (0, 0) is a coordinate. `hydrate-replay.test.ts` holds it, and it is a separate file because `hydrate-runtime.test.ts`'s element is BOTH the island root and every event's target — the two answers are the same node there, which is how this survived. |
+| `idle` replays too | An `idle` island is pressable for the idle wait plus its chunk's download, and a press in that window reached a node with no handler: every app's first click could vanish. `idle` and `interaction` share ONE `catchUp(el)` in `hydrate.ts` — capture listeners for `data-x-events` (default `click`), a queue, `aim`, one flush — which answers `go`: a caught event calls it (so a press wakes an `idle` island early), and `idle` calls it again from `requestIdleCallback`. Every `go` chains on the same `el.__x` and the first flush sets `done`, so each event replays once and an untouched island still drops its listeners at mount. Emitted once when either strategy is on the page; a `visible`-only page pays nothing. `hydrate-replay.test.ts`'s idle block holds it. |
+| Where `interaction` replays | `aim(el, ev)` in `hydrate.ts`, never `ev.target`. Every island's `mount` opens with `el.textContent = ''` — the documented idiom, and what `settings`, `feed` and `like` all do — so the node the visitor pressed is DETACHED by the time the replay runs and `ev.target.dispatchEvent(c)` reached nothing: the first press did nothing and the second worked, which reads as a slow network and is never filed as a bug. `examples/dummy/apps/web/app/posts/[id]/page.tsx` declares `hydrate: 'idle'` in writing to avoid it. The runtime CAN tell the two mounts apart — `el.contains(ev.target)` AFTER the mount is the exact question — so this is a repair and not a refusal: refusing the pairing would delete a strategy that works today for a takeover-style island (`contact-sales.island.tsx` attaches to the server's own form and replaces nothing). Kept → the original target. Replaced → `document.elementFromPoint(ev.clientX, ev.clientY)`, which is where the event would land had the visitor pressed a moment later. The island ROOT is the last resort and never the repair: Solid's delegated listener sits on `document` and walks UP from the target (`solid-js/web`'s `eventHandler`), so a handler on a CHILD of the root is never visited and dispatching at the root fixes nothing for the canonical island. A hit landing outside this island falls back to the root too — synthesizing a click on an element the visitor never pressed is worse than losing the replay. `typeof ev.clientX === 'number'`, never `ev.clientX || ev.clientY`: (0, 0) is a coordinate — unless `ev.detail === 0`, a keyboard-activated or scripted `click()`, which fires at (0, 0) and names no point. Between the hit test and the root sits the STRUCTURAL answer: `path(el, target)` records the child-element indices and tag when the event is caught, and the replay walks them in the mounted tree — same tag at the same place is the island's render of the pressed control; a different tag falls to the root. `hydrate-replay.test.ts` holds it, and it is a separate file because `hydrate-runtime.test.ts`'s element is BOTH the island root and every event's target — the two answers are the same node there, which is how this survived. |
 | `idle`'s deadline | `IDLE_HYDRATE_TIMEOUT_MS`, interpolated INTO the runtime string. Exported because a second reader has to agree — `x shot` waits before it photographs, and a settle shorter than this deadline reports an unhydrated page for one that hydrates perfectly. A constant the emitted string restates instead of reading is worse than no constant. |
 | Route truth | `registry.ts`. Never keep a second route list anywhere, and never a second *matcher*: this package's `matchRoute` was deleted in 2026-08 with zero consumers, because `@ultimat3/http`'s trie (`stages.ts`) is the one that serves requests and two matchers with different precedence rules is two answers to "which route is this?". `routeFor` is an exact-path `Map` lookup, not a pattern matcher. |
 | Route filename | `page.tsx` under `site/`/`app/`, `route.ts` under `api/` — `ROUTE_FILENAME`, one per surface. The URL is the directory path. Anything else is `X_ROUTE_FILE_INVALID`; never widen the table to accept a second spelling. |
@@ -95,6 +96,8 @@ for the mirror-image reason, keeping `render → pwa` refused. Never `cli` (upwa
 | Solid | no `solid-js` import anywhere in this package — `type-pins.tsx` satisfies its `JSX.Element` structurally, through `jsxImportSource`, and never names it. The JSX factory in `jsx.ts` builds inert nodes — it is not a Solid renderer and must never become one. The client half runs in an island chunk, which `@ultimat3/cli`'s `solid-loader.ts` compiles with `babel-preset-solid`: Solid's reactivity is a COMPILE-time contract, so nothing this package could inject would substitute for it. `router-client.ts` was the one file built on that premise ("inject primitives") and it never had a caller. |
 | Root element | `ROOT_ELEMENT_ID` (`render-html.ts`), the id every document's body wraps its component in. It was `SPA_ROOT_ID` in `render-spa.ts`, naming a mode that never used it and that no longer exists. |
 | The loaders | `module-loader.ts` installs them at **`server.ts`** module scope, once — `index.ts` until the barrel split, and it cannot be there again: the client barrel would carry `sass` and `node:url`. A plugin only affects modules loaded after it, so a second install point is a page that renders in one entry point and not another. Anything that loads an app's `.tsx` reaches `@ultimat3/render/server` first, which is why `packages/cli/src/app-load.ts` imports it for the side effect and nothing else. |
+| Client sync tags | `client-sync-tags.ts` — `ultimate-sync` (the socket URL: `/_x/sync` or a declared `wss://…`), `ultimate-build` (the build id a script cannot read off `x-ultimate-build`) and `ultimate-sync-worker` (absent when no worker was built). Principal-free, so every document carries them. The three names are literals here until core or realtime owns constants a reader imports. `As of 2026-09-22`. |
+| Client scope tag | `client-scope-tag.ts` — `<meta name="ultimate-scope" content="<opaque>">`, read once by core's `pageClient()` (plan 101). `documentCarriesScope(headers)` is the ONE rule for which documents may carry it: `cache-control` says `private` — a gated `ssr` page and every `stream`. A `static`/`isr`/ungated-`ssr` document is shareable and carries NO tag; absent means "not rendered for anyone", never `''` (anonymous). The literal `ultimate-scope` is duplicated in core's reader because core cannot import this package — the pin is owed once core exports its constant. `As of 2026-09-22`. |
 | `<head>` baseline | `documentBaseline()` in `head.ts` — charset, viewport, `color-scheme` — merged FIRST so a route can still override any of them. Absent until `As of 2026-08`, and the missing `viewport` is why every deployed app rendered zoomed-out on a phone whatever its CSS said. |
 | Escaping | `html.ts` only, and that now includes `render-stream.ts` (`holeMarker`'s attribute, and `revealChunk`'s `$X(...)` argument via `JSON.stringify` — an id containing `")` closed the call and ran the rest) and `head.ts`'s `themeScript` (`storageKey`/`attribute` as JS string LITERALS). All author-controlled today — the identical status `emitIslandAttributes` had before the last sweep. `render-spa.ts` was the third entry here and went with the mode. A second escaper is how one of them ends up missing a character, and a missing character in an attribute is an injection. `escapeAttribute` itself is `@ultimat3/seo`'s (tier 1), re-exported by `html.ts` rather than reimplemented — the copy that lived here was the second escaper this row forbids, and `pwa/CLAUDE.md` already named seo's as the one. `head.ts` and `hydrate.ts` each had a private copy; both now import — `escapeAttribute` for every attribute value (`emitIslandAttributes` interpolated all five of its own raw until 2026-08, while this row already claimed otherwise) and `escapeJsonContent` for a JSON script body. |
 | Script and style CONTENT | never emitted raw. Three rules, one choice: HTML text (`escapeText`), raw text for code (`escapeRawTextContent`: `</` → `<\/`, `<!--` → `<\!--`), and the total JSON rule for a `type` ending in `json` (`escapeJsonContent`: `<`, `>`, `&`, U+2028/9 → `\uXXXX`, still valid JSON). `meta.ld` is built from route data, and it was emitted VERBATIM until `As of 2026-08` — a title could close the element. Never HTML-escape a script body: a character reference is not decoded there, so `&lt;` corrupts the code AND leaves the hole. |

package/README.md

@@ -210,17 +210,17 @@ production Solid, `As of 2026-08`:
 | `render(() => <p>hello</p>, el)` — the floor, before an author writes a line | 12,588 |
 | a signal, a button and reactive text | 13,663 |
 | `settings.island.tsx`, the heaviest island this repo ships | 17,797 |
-| one directive's hydration runtime at `hydrate: 'idle'` | 774 |
-| the same at `'interaction'`, which is what an island route declaring no `hydrate` gets | 1,251 |
+| one directive's hydration runtime at `hydrate: 'idle'`, what an `app/` island gets from `defaultHydrate` | 1,744 |
+| the same at `'interaction'`, which is what an island route declaring no `hydrate` gets | 1,629 |
 
-17,797 + 1,251 = **19,048** — the heaviest island this repo ships, plus the runtime an app pays
-without writing a number down. `DEFAULT_ISLAND_HYDRATE` is `'interaction'`
-([`route.ts:33`](src/route.ts)), applied at `:253` to any island route that states no `hydrate`, so
-`idle`'s 774 is the cheaper case and not the one a budget has to clear.
+17,797 + 1,744 = **19,541** — the heaviest island this repo ships, plus the costlier of the two
+runtimes an app pays without writing a number down. `idle` became the costlier on 2026-09-22, when
+it learned to catch a press made before it mounted and replay it through the same `catchUp` as
+`interaction`, and both learned to aim a keyboard press by the pressed node's path (774 -> 1,744);
+`DEFAULT_ISLAND_HYDRATE` is `'interaction'` ([`route.ts:34`](src/route.ts)) at 1,629.
 
-The default is **20,480** (20kb), which is not that number rounded: the next whole kilobyte above
-it is 19,456, and clearing today's worst island by 408 bytes is a ceiling the next line anyone
-writes breaks. 20kb leaves 1,432 B, and stays under 2× 19,048 — so a route that bundles the same
+The default is **20,480** (20kb), the next whole kilobyte above that number: 939 B of headroom,
+and under 2× 19,541 — so a route that bundles the same
 island twice is still refused. All three clauses are assertions in
 [`island-budget.test.ts`](src/island-budget.test.ts)'s `DEFAULT_ISLAND_JS_BYTES` block, against the
 measured table above; a default that stopped clearing the floor, or stopped being a ceiling, is red.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/render",
-  "version": "20.2.0",
+  "version": "21.0.0",
   "description": "The route primitive and the five render modes: static, isr, ssr, stream, spa.",
   "license": "MIT",
   "type": "module",
@@ -36,10 +36,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/cache": "20.2.0",
-    "@ultimat3/core": "20.2.0",
-    "@ultimat3/i18n": "20.2.0",
-    "@ultimat3/seo": "20.2.0",
-    "sass": "1.102.0"
+    "@ultimat3/cache": "21.0.0",
+    "@ultimat3/core": "21.0.0",
+    "@ultimat3/i18n": "21.0.0",
+    "@ultimat3/seo": "21.0.0",
+    "sass": "1.104.0"
   }
 }

package/src/client-scope-tag.ts

@@ -0,0 +1,49 @@
+/**
+ * The page's client scope, as a `<head>` tag: `<meta name="ultimate-scope" content="…">`, read
+ * once by `@ultimat3/core`'s `pageClient()` when the page's client handle is created. Only a
+ * PRIVATE document carries one (`documentCarriesScope`): anything a shared cache may hold would
+ * serve one visitor's scope to the next, and a store fenced as the wrong principal is the leak the
+ * fence exists to stop.
+ */
+
+import { CLIENT_PERSIST_META, CLIENT_SCOPE_META } from '@ultimat3/core';
+import type { HeadTag } from './head';
+
+/** The `name` core's reader matches — core's constant, so the writer and the reader are one literal. */
+export { CLIENT_PERSIST_META, CLIENT_SCOPE_META };
+
+/** `scope` is opaque (`@ultimat3/auth`'s `clientScopeOf`), and `''` is the anonymous page. */
+export function clientScopeTag(scope: string): HeadTag {
+  return {
+    kind: 'meta',
+    key: `meta:${CLIENT_SCOPE_META}`,
+    attrs: { name: CLIENT_SCOPE_META, content: scope },
+  };
+}
+
+/**
+ * The record types this app keeps on disk (`entity(name, { persist: true })`), for the page's
+ * persister. Beside the scope and ONLY beside it: persistence is per principal, so a document with
+ * no scope has nothing to persist under. None persisted is no tag — absent already means "none".
+ */
+export function clientPersistTags(types: readonly string[]): readonly HeadTag[] {
+  if (types.length === 0) return [];
+  return [
+    {
+      kind: 'meta',
+      key: `meta:${CLIENT_PERSIST_META}`,
+      attrs: { name: CLIENT_PERSIST_META, content: [...types].sort().join(',') },
+    },
+  ];
+}
+
+/**
+ * Whether a document with these response headers may carry a scope: its `cache-control` says
+ * `private`. Read off the headers the mode ALREADY decided — `ssrHeaders` makes a gated page
+ * private and an ungated one `public, s-maxage`, a stream is always private, `static`/`isr` never —
+ * so this is not a second opinion on what is shareable.
+ */
+export function documentCarriesScope(headers: Readonly<Record<string, string>>): boolean {
+  const cacheControl = headers['cache-control'] ?? '';
+  return cacheControl.split(',').some((directive) => directive.trim().toLowerCase() === 'private');
+}

package/src/client-sync-tags.ts

@@ -0,0 +1,44 @@
+/**
+ * The page's sync target as `<head>` tags, read by `@ultimat3/realtime`'s tab-side socket host:
+ * where the one socket dials, which build the page was rendered by, and which worker script hosts
+ * the socket. Principal-free, so a shareable document may carry them — unlike the scope tag.
+ */
+
+import { CLIENT_BUILD_META, CLIENT_SYNC_META, CLIENT_SYNC_WORKER_META } from '@ultimat3/core';
+import type { HeadTag } from './head';
+
+/** Core's names (`page-meta.ts`), so the writer here and every reader share one literal each. */
+export { CLIENT_BUILD_META, CLIENT_SYNC_META, CLIENT_SYNC_WORKER_META };
+
+export interface ClientSyncHead {
+  readonly syncUrl: string;
+  readonly buildId: string;
+  readonly workerUrl?: string | undefined;
+  /** `/_x/page-boot/<hash>.js` — realtime's page boot, when the app has realtime. */
+  readonly bootUrl?: string | undefined;
+}
+
+export function clientSyncTags(head: ClientSyncHead): readonly HeadTag[] {
+  return [
+    meta(CLIENT_SYNC_META, head.syncUrl),
+    meta(CLIENT_BUILD_META, head.buildId),
+    ...(head.workerUrl === undefined ? [] : [meta(CLIENT_SYNC_WORKER_META, head.workerUrl)]),
+  ];
+}
+
+const meta = (name: string, content: string): HeadTag => ({
+  kind: 'meta',
+  key: `meta:${name}`,
+  attrs: { name, content },
+});
+
+/**
+ * The page boot as one deferred classic script: it runs before every island module that follows it
+ * in the document, and ONCE per page — the disk restore and the outbox are the page's job, never
+ * each island's. Rendered only where there is a principal to restore for (`dev-render.ts`).
+ */
+export function clientBootTags(head: ClientSyncHead): readonly HeadTag[] {
+  return head.bootUrl === undefined
+    ? []
+    : [{ kind: 'script', key: 'script:ultimate-boot', attrs: { src: head.bootUrl, defer: true } }];
+}

package/src/hydrate.ts

@@ -135,9 +135,14 @@ function hush(){}
 // `hush` above: `boot` rethrows, so every runtime below has to terminate the chain it starts or
 // the page reports an unhandled rejection for a failure it already recorded on the element.
 
+// `idle` hydrates on the browser's schedule, not the visitor's, so its server-rendered controls
+// are pressable for the idle wait plus the chunk's download — up to IDLE_HYDRATE_TIMEOUT_MS and
+// more. A press in that window reached a node with no handler and was lost, which is every app's
+// first click. It catches up exactly as `interaction` does, through the one `catchUp` below; the
+// only difference left between the two is that `idle` also boots when the browser goes idle.
 const RUNTIME_IDLE = `
 each('[data-x-hydrate="idle"]',function(el){
-var go=function(){boot(el).catch(hush)};
+var go=catchUp(el);
 if('requestIdleCallback'in window)requestIdleCallback(go,{timeout:${IDLE_HYDRATE_TIMEOUT_MS}});else setTimeout(go,1)})
 `.trim();
 
@@ -171,7 +176,16 @@ io.observe(el)})
 // root is never visited. The root is the last resort, not the repair: it is where an event with no
 // coordinates goes (a `keydown` has no `clientX`), and where a hit landing outside this island goes
 // — synthesizing a click on an element the visitor never pressed is worse than losing the replay.
-// `typeof` and not `ev.clientX||ev.clientY`, because (0, 0) is a coordinate.
+// `typeof` and not `ev.clientX||ev.clientY`, because (0, 0) is a coordinate — but not when
+// `ev.detail` is 0: a keyboard-activated or scripted `click()` fires at (0, 0) and names no point,
+// so hit-testing the page's corner found nothing of the island and the press went to the root.
+//
+// Between the hit test and the root sits the STRUCTURAL answer: `path` records, when the event is
+// caught, the child-element indices from the root to the target plus the target's tag, and `aim`
+// walks the same indices in the mounted tree. Same tag at the same place is the island's own render
+// of the control that was pressed — which is what a keyboard press, a `keydown`, and a hit landing
+// on a sticky header all lack otherwise. A different tag there is a different control and falls
+// through to the root, for the stranger rule above.
 //
 // `off` is BOTH arms of the `then`, and the rejection arm is the reason it is a named function.
 // `boot` rethrows on purpose (see the prelude), so `el.__x` holds a rejected promise from the
@@ -181,18 +195,32 @@ io.observe(el)})
 // grew by one retained `Event` — each holding a live `target` — per click, for an island that
 // will never mount. Swallowing here loses no signal: the DOM already carries the failure as
 // `data-x-failed`, which is the documented observable.
-const RUNTIME_INTERACTION = `
-function aim(el,ev){var t=ev.target;if(t&&el.contains(t))return t;
-var x=ev.clientX,h=typeof x==='number'?document.elementFromPoint(x,ev.clientY):null;
-return h&&el.contains(h)?h:el}
-each('[data-x-hydrate="interaction"]',function(el){
-var evs=(el.getAttribute('data-x-events')||'click').split(' ');
+//
+// `catchUp(el)` attaches the capture listeners and answers `go`, the one boot-then-flush both
+// strategies call: a caught event calls it, and `idle` calls it again from its idle callback. Every
+// `go` chains on the same `el.__x`, and the first flush empties `q` and sets `done`, so however many
+// ran, each caught event is replayed exactly once and an untouched island still lets go of its
+// listeners at mount — a listener left behind would replay every later click a second time.
+const RUNTIME_CATCH_UP = `
+function path(el,t){var p=[t&&t.tagName];
+for(;t&&t!==el&&t.parentNode;t=t.parentNode)p.unshift(Array.prototype.indexOf.call(t.parentNode.children,t));
+return t===el?p:null}
+function aim(el,ev,p){var t=ev.target;if(t&&el.contains(t))return t;
+var x=ev.clientX,h=typeof x==='number'&&ev.detail!==0?document.elementFromPoint(x,ev.clientY):null;
+if(h&&el.contains(h))return h;
+for(var n=el,i=0;p&&n&&i<p.length-1;i++)n=n.children[p[i]];
+return p&&n&&n.tagName===p[p.length-1]?n:el}
+function catchUp(el){var evs=(el.getAttribute('data-x-events')||'click').split(' ');
 var q=[],done=false;
 var off=function(){done=true;evs.forEach(function(n){el.removeEventListener(n,on,true)});q=[]};
-var on=function(ev){if(done)return;q.push(ev);
-boot(el).then(function(){var r=q;off();
-r.forEach(function(ev){var c=new ev.constructor(ev.type,ev);aim(el,ev).dispatchEvent(c)})},off)};
-evs.forEach(function(n){el.addEventListener(n,on,true)})})
+var go=function(){boot(el).then(function(){var r=q;off();
+r.forEach(function(e){var ev=e[0],c=new ev.constructor(ev.type,ev);aim(el,ev,e[1]).dispatchEvent(c)})},off)};
+var on=function(ev){if(done)return;q.push([ev,path(el,ev.target)]);go()};
+evs.forEach(function(n){el.addEventListener(n,on,true)});return go}
+`.trim();
+
+const RUNTIME_INTERACTION = `
+each('[data-x-hydrate="interaction"]',catchUp)
 `.trim();
 
 const RUNTIME_PARTS: Readonly<Record<Exclude<HydrateStrategy, 'never'>, string>> = {
@@ -220,6 +248,9 @@ const RUNTIME_ORDER: readonly Exclude<HydrateStrategy, 'never'>[] = HYDRATE_STRA
 const runtimeBody = (needed: ReadonlySet<Exclude<HydrateStrategy, 'never'>>): string =>
   [
     RUNTIME_PRELUDE,
+    // Emitted once for whichever of the two catch-up strategies the page uses; a `visible`-only
+    // page never pays for it.
+    ...(needed.has('idle') || needed.has('interaction') ? [RUNTIME_CATCH_UP] : []),
     ...RUNTIME_ORDER.filter((strategy) => needed.has(strategy)).map(
       (strategy) => RUNTIME_PARTS[strategy],
     ),

package/src/index.ts

@@ -16,6 +16,23 @@ export type { HydrateStrategy, OfflineStrategy, RenderMode } from '@ultimat3/cor
 // never had); still named here because `@ultimat3/cli`'s budget reporter reads it beside the route
 // table it prints against.
 export { formatBytes, HYDRATE_STRATEGIES, OFFLINE_STRATEGIES, RENDER_MODES } from '@ultimat3/core';
+/** The `<meta name="ultimate-scope">` core's `pageClient()` reads, on private documents only. */
+export {
+  CLIENT_PERSIST_META,
+  CLIENT_SCOPE_META,
+  clientPersistTags,
+  clientScopeTag,
+  documentCarriesScope,
+} from './client-scope-tag';
+/** Where the page's one socket dials, and the worker that hosts it (plan 101, slice 11). */
+export type { ClientSyncHead } from './client-sync-tags';
+export {
+  CLIENT_BUILD_META,
+  CLIENT_SYNC_META,
+  CLIENT_SYNC_WORKER_META,
+  clientBootTags,
+  clientSyncTags,
+} from './client-sync-tags';
 export { parseTtlMs } from './duration';
 export type { RenderErrorCode } from './errors';
 export {

package/src/modes.ts

@@ -225,14 +225,13 @@ export function defaultHydrate(surface: Surface): HydrateStrategy {
  * (`settings.island.tsx`) is 17,797 B. No `budget.js` under 4096 was reachable by any of them, on
  * any surface, because the allowance is measured above the baseline and not against it.
  *
- * The number: 17,797 (the heaviest island this repo actually ships) + 1,251 (`hydrateRuntimeBytes`
- * for one directive at `DEFAULT_ISLAND_HYDRATE`, which is `'interaction'` — `route.ts:33`, applied
- * at `:253` to any island route declaring no `hydrate`) = **19,048**. That is the worst case an
- * app reaches without writing a number down. 20,480 is NOT that rounded up — the next whole
- * kilobyte above it is 19,456 — it is one whole kB further, leaving 1,432 B of headroom and still
- * under 2x 19,048, so a route bundling the same island twice is refused. `island-budget.test.ts`
- * asserts all three. `idle` costs 774 and `visible` 846, so an island route that declares its
- * strategy pays less; the default is what the budget has to clear.
+ * The number: 17,797 (the heaviest island this repo actually ships) + 1,744 (`hydrateRuntimeBytes`
+ * for one `idle` directive — `defaultHydrate('app')`, and since 2026-09-22 the costlier of the two
+ * runtimes an island gets unasked; `DEFAULT_ISLAND_HYDRATE`'s `'interaction'` is 1,629) =
+ * **19,541**. That is the worst case an app reaches without writing a number down. 20,480 is the
+ * next whole kilobyte above it, leaving 939 B of headroom and still under 2x 19,541, so a route
+ * bundling the same island twice is refused. `island-budget.test.ts` asserts all three. `visible` costs 846, so an island route
+ * that declares it pays less; the default is what the budget has to clear.
  *
  * All three grew by 129 B on 2026-08-21 (from 881 / 615 / 687), when the prelude learned to mark a
  * mount's OUTCOME so `x shot` can tell an island that RAN from one that only started loading, and
@@ -240,8 +239,10 @@ export function defaultHydrate(surface: Surface): HydrateStrategy {
  * `interaction` — when each runtime learned to TERMINATE the promise chain `boot` starts rather
  * than emit one unhandled rejection per user event. `interaction` alone grew a third time on
  * 2026-08-25 (+184 B, `aim`), when the replay learned that the node it was dispatching at had been
- * detached by the mount it was waiting for. The headroom absorbed all three and the conclusion is
- * unchanged, which is the point of stating the
+ * detached by the mount it was waiting for. On 2026-09-22 `idle` learned the same replay through a
+ * shared `catchUp`, and both learned to aim a keyboard press by the pressed node's path (774 -> 1,744;
+ * `interaction` 1,251 -> 1,629), and `idle` became the worst case. The
+ * headroom absorbed all four and the conclusion is unchanged, which is the point of stating the
  * arithmetic here rather than the answer alone. It is not
  * derived from Solid's own size on purpose — this package may not import or name `solid-js`
  * (`CLAUDE.md`), so a constant tracking the runtime's version would be a dependency in a comment.