solid-objects 0.13.2 → 0.14.0

package/docs/parity.md

@@ -4,17 +4,28 @@ This ledger tracks capability parity with the Ruby `solid_objects` gem.
 Parity means preserving a capability and its correctness or security boundary,
 not copying a Rails API into Node.
 
-Reference: Ruby `solid_objects` 0.13.2. The JavaScript package began at the
+Reference: Ruby `solid_objects` 0.13.3. The JavaScript package began at the
 Ruby design's `0.12` capability generation; that version number did not imply
 earlier JavaScript releases.
 
-The Node `0.13.2` implementation has capability parity with that reference. Its
+The Node `0.14.0` implementation has capability parity with that reference. Its
 relational runtime, correctness boundaries, administration, diagnostics,
 operator dashboard, realtime projections, browser behavior, and supported
-adapters have native equivalents. Rails-specific rendering surfaces are
-replaced by transport- and framework-neutral JavaScript APIs. The partial guard
-row and the shared planned result-lookup row below are explicit scope
-boundaries, not missing Ruby capabilities.
+adapters have native equivalents. Transport- and framework-neutral JavaScript
+APIs replace the Rails-specific render surfaces. Three rows below are explicit
+scope boundaries that the Ruby reference shares: the partial guard row, the
+backpressure row, and the shared planned result-lookup row. They are not missing
+Ruby capabilities.
+
+`0.14.0` also adds `runtime.enqueueInternalMessage()`,
+`runtime.enqueueInternalMessageInTransaction()`, and
+`runtime.snapshotWithIncarnation()`. These are Node-only integration points
+for a host package (such as a future commercial scaling layer), not ported
+Ruby capabilities. Ruby's equivalent primitives
+(`SolidObjects::Mailbox#enqueue`, `ActorSnapshot`) are already reachable
+in-process, and they need no dedicated public API. Node's `exports` map enforces
+a package-privacy boundary between a package and its dependents. Ruby has no
+such boundary between a gem and its dependents.
 
 ## Status vocabulary
 
@@ -29,53 +40,60 @@ boundaries, not missing Ruby capabilities.
 
 ## Runtime and correctness
 
-| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                 |
-| ------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                      |
-| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                    |
-| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, and adapter-appropriate sequence locking.                                                 |
-| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                |
-| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                               |
-| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                 |
-| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                               |
-| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation.                  |
-| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                        |
-| One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                      |
-| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                |
-| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                     |
-| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.       |
-| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                |
-| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                          |
-| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers. |
-| Result lookup by request ID                                                                                   | Planned | This is also an open Ruby roadmap item and will be implemented in both runtimes when its authorization shape is settled.                                                                                           |
+| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                     |
+| ------------------------------------------------------------------------------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                                                                                                                                          |
+| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                                                                                                                                        |
+| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, and adapter-appropriate sequence locking.                                                                                                                                                                     |
+| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                                                                                                                                    |
+| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                                                                                                                                                   |
+| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                                                                                                                                     |
+| Backpressure and payload caps                                                                                 | Partial | Serialization enforces a shared maximum JSON nesting depth, raising `InvalidPayload`, and an optional caller-supplied `maxBytes` limit, raising `PayloadTooLarge`; reminder names are bounded to 255 characters. Distributed per-actor rate limits and global admission control do not exist yet, matching the open Ruby roadmap item. |
+| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                                                                                                                                                   |
+| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation.                                                                                                                                      |
+| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                                                                                                                                            |
+| One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                                                                                                                                          |
+| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                                                                                                                                    |
+| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                                                                                                                                         |
+| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.                                                                                                                           |
+| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                                                                                                                                    |
+| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                                                                                                                                              |
+| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers.                                                                                                                     |
+| Result lookup by request ID                                                                                   | Planned | This is also an open Ruby roadmap item and will be implemented in both runtimes when its authorization shape is settled.                                                                                                                                                                                                               |
 
 ## Operations
 
-| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                   |
-| ----------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                       |
-| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                |
-| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                    |
-| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                            |
-| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                           |
-| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit.                                                       |
-| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                          |
-| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                     |
-| Operator dashboard                                                            | Native | The opt-in `solid-objects/web` export provides Fetch and Node/Connect mounting, authorized runtime views and actions, session-backed CSRF, filtering, paging, charts, and immutable extension hooks. |
-| Structured instrumentation                                                    | Native | An isolated transport-neutral sink emits immutable lifecycle metadata and structurally excludes application payloads.                                                                                |
-| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                    |
+| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                              |
+| ----------------------------------------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                                                                                                                                                                                                                  |
+| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                                                                                                                                                                                                           |
+| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                                                                                                                                                                                                               |
+| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                                                                                                                                                                                                                       |
+| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                                                                                                                                                                                                                      |
+| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit.                                                                                                                                                                                                                                                  |
+| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                                                                                                                                                                                                                     |
+| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                                                                                                                                                                                                                |
+| Operator dashboard                                                            | Native | The opt-in `solid-objects/web` export provides Fetch and Node/Connect mounting, authorized runtime views and actions, session-backed CSRF, filtering, paging, charts, and immutable extension hooks. Matches the Ruby dashboard's own documented limits: no audit trail of admin actions, dead-letter retry is one at a time, and pause sets a flag rather than interrupting an in-flight turn. |
+| Structured instrumentation                                                    | Native | An isolated transport-neutral sink emits immutable lifecycle metadata and structurally excludes application payloads.                                                                                                                                                                                                                                                                           |
+| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                                                                                                                                                                                                               |
 
 ## Databases and wake-up
 
-| Capability               | Status | TypeScript shape or remaining work                                                                                                                                                      |
-| ------------------------ | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQLite                   | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits. |
-| PostgreSQL               | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                     |
-| MySQL                    | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits.                             |
-| Durable polling fallback | Native | Every role progresses without a notification service.                                                                                                                                   |
-| In-process wake-up       | Native | A generation-based default adapter prevents claim-to-wait signal loss; commits wake role-specific waiters and polling remains the fallback.                                             |
-| PostgreSQL wake-up       | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                   |
-| Redis wake-up            | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                        |
+| Capability               | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                    |
+| ------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| SQLite                   | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits.                                                                                               |
+| PostgreSQL               | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                                                                                                                   |
+| MySQL                    | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits. Ruby also tests a second client, `trilogy`; Node has no comparable second MySQL client, so only `mysql2` is tracked here. |
+| Durable polling fallback | Native | Every role progresses without a notification service.                                                                                                                                                                                                                                 |
+| In-process wake-up       | Native | A generation-based default adapter prevents claim-to-wait signal loss; commits wake role-specific waiters and polling remains the fallback.                                                                                                                                           |
+| PostgreSQL wake-up       | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                                                                                                                 |
+| Redis wake-up            | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                                                                                                                      |
+
+Every wake-up adapter above is opt-in. Neither runtime selects one
+automatically. An application that configures nothing keeps polling. Each
+runtime warns once when live processes share a database without a configured
+cross-process adapter. This limit is intentional in both runtimes. It is not a
+gap between them.
 
 ## Realtime and browser behavior
 
@@ -89,6 +107,67 @@ boundaries, not missing Ruby capabilities.
 | Personalized payload broadcasts                              | Native         | Static typed projections run against committed state under each fresh subscriber context, reauthorize as queries, isolate failures, and carry independent revision fences.                                                                                                                                         |
 | Real-browser compatibility suite                             | Native         | Playwright exercises subscription replay over native WebSocket, incarnation/revision fences, payload delivery, component batching, and cancellation in Chromium.                                                                                                                                                   |
 
+## JavaScript-only: the browser runtime
+
+`0.14.0` ships an in-browser runtime with SQLite WASM storage
+([#17](https://github.com/cardmagic/solid-objects-js/issues/17)). The
+runtime itself is a JavaScript-only capability: the Ruby gem has no browser
+target, so no Ruby parity row exists for milestones M1 through M3. The
+transmit family (milestone M4) started here but is not JavaScript-only; the
+next section tracks it as a shared capability. All four milestones are
+complete:
+
+- M1: the shared modules no longer import Node built-in modules, a
+  registered platform factory supplies async context propagation, and
+  `pnpm run check` enforces a Node-free import graph for the browser-safe
+  modules.
+- M2: `solid-objects/database/sqlite-wasm` implements the `Database`
+  contract on SQLite WASM. The full runtime passes a round-trip test
+  against it, and Playwright proves OPFS persistence across a page reload.
+- M3: `solid-objects/browser/host` hosts the full runtime in a browser
+  module worker on OPFS storage, with durable actor state across page
+  reloads proven in Chromium. `solid-objects/browser/tab-host` elects one
+  leader per origin with the Web Locks API and serves every tab over a
+  `BroadcastChannel`; Playwright proves shared state across two tabs and
+  failover with durable continuation after the leader tab closes.
+  `solid-objects/database/shared-sqlite-wasm` goes further: it moves the
+  election behind the `Database` seam, so every tab runs the ordinary
+  `configure -> install -> ref` flow and the runtime's own leases and
+  fencing arbitrate the tabs' workers. The plan
+  named a `SharedWorker` as the host; Web Locks election between dedicated
+  workers replaced it, because OPFS sync access handles exist only in
+  dedicated workers.
+- M4: `solid-objects/transmit` drains the local effects outbox to a
+  server runtime with at-least-once delivery, per-actor order, and an
+  idempotent server ingest. Vitest proves order under transmit failures,
+  replay deduplication, and recovery after an offline period, on SQLite,
+  PostgreSQL, and MySQL.
+
+## Shared capability: the transmit family
+
+The transmit family is the one part of the browser work that both runtimes
+share. The Ruby gem adopts it in
+[solid-objects-ruby#49](https://github.com/cardmagic/solid-objects-ruby/pull/49)
+(proposals [#47](https://github.com/cardmagic/solid-objects-ruby/issues/47)
+and [#48](https://github.com/cardmagic/solid-objects-ruby/issues/48)):
+`SolidObjects::Transmission.receive` is the ingest, and `Actor#transmit`
+with `register_transmit` is the staging side. Identifiers differ by
+runtime idiom; the wire contract is what both sides guarantee:
+
+- envelope keys are camelCase (`effectId`, `actorType`, `actorId`,
+  `operation`, and an optional `arguments` that defaults to an empty
+  object);
+- the ingest idempotency key is `transmit:<effectId>`, byte for byte;
+- a replay with changed arguments raises the idempotency conflict on both
+  sides and leaves the first application intact.
+
+`compatibility/transmit-envelopes.json` is committed to both repositories
+with a consuming test on each side, so the contract is enforced from both
+sides of the repository boundary. Manual cross-runtime QA (Node to Rails
+and Rails to Node) ran in solid-objects-ruby#49; the one disagreement it
+found (the optional `arguments` default) is fixed and pinned by the shared
+fixture.
+
 ## Rails-specific surfaces
 
 Rails generators, Active Record models/controllers, Turbo rendering, and

package/docs/releasing.md

@@ -26,9 +26,10 @@ npm trust github solid-objects \
 
 ## Release procedure
 
-1. Update the version in `package.json` and `src/version.ts`, refresh the
-   lockfile when needed, and move the release notes out of the Unreleased
-   section in `CHANGELOG.md`.
+1. Update the version in `package.json` and `src/version.ts`. Refresh the
+   lockfile when necessary. Move the release notes out of the Unreleased
+   section in `CHANGELOG.md` into a dated section for the new version. The
+   publish job reads that section, so a version without one fails the release.
 2. Run `pnpm run format:check`, `pnpm run check`, `pnpm run test:coverage`,
    `pnpm run build`, `pnpm run pack:check`, `pnpm run test:package`,
    `pnpm run test:recovery`, `pnpm run test:browser`, and
@@ -38,11 +39,16 @@ npm trust github solid-objects \
 4. Create and push an annotated tag matching the package version:
 
    ```shell
-   git tag -a v0.13.2 -m "Version 0.13.2"
-   git push origin v0.13.2
+   git tag -a v0.13.3 -m "Version 0.13.3"
+   git push origin v0.13.3
    ```
 
 The tag runs the complete CI matrix. The publish job starts only after every
 quality, database, Redis, and browser job succeeds. It rejects tags that do not
 match `package.json`, safely skips versions already present in npm, and
 publishes new versions with npm provenance.
+
+The job then builds the release notes with `scripts/release-notes.mjs`. That
+script prints the `CHANGELOG.md` section for the tagged version. The job then
+creates the GitHub release for the tag. If you run the job again on a tag that
+npm already holds, it still creates a missing release.

package/docs/state-and-lifecycle.md

@@ -17,8 +17,8 @@ fields, then walks its prototype chain to discover methods and getters.
 - Operation, field, and getter names must not collide with the reference API.
 
 The constructor must establish every persisted field and must not depend on
-external state. Solid Objects invokes it while validating the class, creating
-defaults, hydrating state, and projecting a snapshot.
+external state. Solid Objects invokes it at four points: class validation,
+default creation, state hydration, and snapshot projection.
 
 ## Observable broadcast modes
 
@@ -79,12 +79,16 @@ asynchronous work or write through a database wrapped by
 a failing migration, or state newer than the running code raises
 `StateMigrationError`.
 
-For a destructive shape change, use expand/contract deployment: first deploy
-readers that understand both shapes, then deploy the migration, wait for
-operational evidence that actors have advanced, and only then remove old-shape
-support. If old code cannot understand the new shape, drain it before new code
-can persist the migration. Keep old migration steps so actors idle for several
-releases can still advance one version at a time.
+For a destructive shape change, use an expand/contract deployment:
+
+1. deploy readers that understand both shapes;
+2. deploy the migration;
+3. wait for operational evidence that the actors advanced;
+4. remove the old-shape support.
+
+If old code cannot understand the new shape, drain it before new code persists
+the migration. Keep the old migration steps. An actor that stays idle for
+several releases can then still advance one version at a time.
 
 Actor state migration is separate from `runtime.install()`. The latter applies
 the package's relational schema migrations; it does not eagerly rewrite actor

package/docs/support.md

@@ -2,34 +2,70 @@
 
 ## Runtime support
 
-| Component      | Supported or tested range                                   |
-| -------------- | ----------------------------------------------------------- |
-| Node.js        | 24.15 or newer; CI uses 24.15                               |
-| TypeScript     | 5.9 or newer for TypeScript applications                    |
-| SQLite         | Node's built-in `node:sqlite` on the supported Node runtime |
-| PostgreSQL     | 14 or newer; CI runs 14 and 18                              |
-| MySQL          | 8.0 or newer with InnoDB; CI runs 8.0 and 8.4               |
-| Redis wake-up  | Optional; CI runs Redis 7                                   |
-| Browser client | Chromium through Playwright                                 |
-
-The package is ESM-only. PostgreSQL, MySQL, and Redis require their optional
-peer dependency. SQLite has no driver dependency beyond Node.js.
+| Component       | Supported or tested range                                   |
+| --------------- | ----------------------------------------------------------- |
+| Node.js         | 24.4.0 or newer; CI runs 24.4.0 and 24.15.0                 |
+| TypeScript      | 5.9 or newer for TypeScript applications                    |
+| SQLite          | Node's built-in `node:sqlite` on the supported Node runtime |
+| PostgreSQL      | 14 or newer; CI runs 14 and 18                              |
+| MySQL           | 8.0 or newer with InnoDB; CI runs 8.0 and 8.4               |
+| Redis wake-up   | Optional; CI runs Redis 7                                   |
+| Browser client  | Chromium through Playwright                                 |
+| SQLite WASM     | `@sqlite.org/sqlite-wasm` 3.50 or newer; optional           |
+| Browser runtime | Chromium through Playwright; OPFS for persistent storage    |
+
+The package is ESM-only. PostgreSQL, MySQL, Redis, and SQLite WASM require
+their optional peer dependency. The Node SQLite adapter has no driver
+dependency beyond Node.js.
+
+The browser runtime needs two platform capabilities:
+
+- Persistent storage uses the OPFS SAH pool VFS, which needs a secure context
+  and a dedicated worker. `sqliteWasm({ storage: "persistent" })` fails fast
+  where OPFS is unavailable; temporary storage works everywhere the WASM
+  module loads.
+- The tab host election uses the Web Locks API. Every current browser
+  provides it. Node.js provides `navigator.locks` from 24.5, so Node-side use
+  of `solid-objects/browser/tab-host` needs a newer Node than the package
+  floor; the tab host test suite skips on older Node.
+
+The Node.js floor is 24.4.0 because the SQLite adapter reads integer columns as
+`BigInt`. Node.js 24.4.0 is the first release that accepts `readBigInts` on the
+`DatabaseSync` constructor. Node.js 24.0.0 through 24.3.x ignore the option and
+return `Number`, which loses precision on 64-bit values and fails the effect
+recovery and transaction retry tests.
+
+Node.js 24.15.0 is the first release where `node:sqlite` is no longer
+experimental. Between 24.4.0 and 24.14.x the module works but prints
+`ExperimentalWarning: SQLite is an experimental feature` on stderr, and its API
+can change. Prefer 24.15.0 or newer where the choice is free.
 
 ## What the matrix covers
 
-The default suite exercises actor definitions, mailbox ordering, state
-migrations, leases, fencing, retries, dead letters, effects, reminders,
-realtime outboxes, administration, authorization, retention, lifecycle,
-timeouts, and SQLite behavior.
+The default suite exercises:
+
+- actor definitions, mailbox order, and state migrations;
+- leases, fencing, retries, and dead letters;
+- effects, reminders, and realtime outboxes;
+- administration, authorization, and retention;
+- lifecycle, timeouts, and SQLite behavior.
 
 Database jobs run the real adapter suites against PostgreSQL and MySQL servers.
 The Redis job runs wake-up behavior against a real Redis server. The browser
 job uses native WebSocket connections and Chromium for replay, payload,
-component, dashboard, and revision-fence behavior.
+component, dashboard, and revision-fence behavior. It also runs the browser
+runtime suites in Chromium module workers: SQLite WASM transactions and OPFS
+persistence across page reloads, the full runtime with durable actor state,
+deadline rollback under the turn-scoped context store, two tabs on one
+runtime with leader failover, and the sync bridge drain into a Node runtime.
+
+The quality job also:
 
-The quality job also builds the ESM package, inspects `npm pack`, installs the
-generated tarball in a clean temporary project, runs its packaged SQLite
-quickstart, and executes the multi-process recovery demonstration.
+1. builds the ESM package;
+2. inspects `npm pack`;
+3. installs the tarball in a clean temporary project;
+4. runs the packaged SQLite quickstart;
+5. executes the multi-process recovery demonstration.
 
 ## Boundaries
 

package/examples/failure-recovery/actor.ts

@@ -25,16 +25,14 @@ export class RecoveryCounter extends Actor {
   async serialize({ controlDirectory }: { controlDirectory: string }): Promise<number> {
     const message = this.currentMessage
     if (!message) throw new Error("serialize requires a durable message")
-    await appendFile(
-      join(controlDirectory, "serialization.jsonl"),
-      `${JSON.stringify({ event: "start", messageId: message.id, at: Date.now() })}\n`,
-    )
+    // The attempt and the process identify the execution, so a start pairs with
+    // its own finish even when a superseded attempt outlives its replacement.
+    const execution = { messageId: message.id, attempt: message.attempt, processId: process.pid }
+    const path = join(controlDirectory, "serialization.jsonl")
+    await appendFile(path, `${JSON.stringify({ event: "start", ...execution, at: Date.now() })}\n`)
     await new Promise((resolve) => setTimeout(resolve, 100))
     this.count += 1
-    await appendFile(
-      join(controlDirectory, "serialization.jsonl"),
-      `${JSON.stringify({ event: "finish", messageId: message.id, at: Date.now() })}\n`,
-    )
+    await appendFile(path, `${JSON.stringify({ event: "finish", ...execution, at: Date.now() })}\n`)
     return this.count
   }
 }

package/examples/failure-recovery/demo.ts

@@ -8,6 +8,11 @@ import { fork, type ChildProcess } from "node:child_process"
 import { createRuntime, type ActorReference, type MessageReference } from "solid-objects"
 import { sqlite } from "solid-objects/database/sqlite"
 import { RecoveryCounter } from "./actor.ts"
+import {
+  assertSerializedExecution,
+  parseSerializationEvent,
+  type SerializationProof,
+} from "./serialization.ts"
 
 interface WorkerMessage {
   event: string
@@ -15,12 +20,6 @@ interface WorkerMessage {
   processed?: number
 }
 
-interface SerializationEvent {
-  event: "start" | "finish"
-  messageId: string
-  at: number
-}
-
 interface ExternalEffectEvent {
   messageId: string
   attempt: number
@@ -59,7 +58,7 @@ try {
 
 assert.equal(existsSync(directory), false)
 
-async function proveSerialization(): Promise<{ finalState: number; overlap: false }> {
+async function proveSerialization(): Promise<SerializationProof & { finalState: number }> {
   const controlDirectory = join(directory, "serialization")
   await mkdir(controlDirectory)
   const reference = runtime.ref(RecoveryCounter, "serialized")
@@ -74,15 +73,10 @@ async function proveSerialization(): Promise<{ finalState: number; overlap: fals
     join(controlDirectory, "serialization.jsonl"),
     parseSerializationEvent,
   )
-  assert.equal(events.length, 4)
-  const starts = events.filter((event) => event.event === "start")
-  const finishes = events.filter((event) => event.event === "finish")
-  assert.equal(starts.length, 2)
-  assert.equal(finishes.length, 2)
-  assert(Number(starts[1]?.at) >= Number(finishes[0]?.at))
+  const proof = assertSerializedExecution(events, { messageCount: 2 })
   const snapshot = await reference.snapshot()
   assert.equal(snapshot.count, 2)
-  return { finalState: snapshot.count, overlap: false }
+  return { ...proof, finalState: snapshot.count }
 }
 
 async function proveCrashRecovery(): Promise<{
@@ -200,18 +194,6 @@ async function readJsonLines<Value>(
   return (await readFile(path, "utf8")).trim().split("\n").filter(Boolean).map(parse)
 }
 
-function parseSerializationEvent(line: string): SerializationEvent {
-  const event = JSON.parse(line) as Partial<SerializationEvent>
-  if (
-    (event.event !== "start" && event.event !== "finish") ||
-    typeof event.messageId !== "string" ||
-    typeof event.at !== "number"
-  ) {
-    throw new TypeError("invalid serialization event")
-  }
-  return { event: event.event, messageId: event.messageId, at: event.at }
-}
-
 function parseExternalEffectEvent(line: string): ExternalEffectEvent {
   const event = JSON.parse(line) as Partial<ExternalEffectEvent>
   if (