solid-objects 0.13.3 → 0.14.0

package/docs/parity.md

@@ -8,13 +8,24 @@ Reference: Ruby `solid_objects` 0.13.3. The JavaScript package began at the
 Ruby design's `0.12` capability generation; that version number did not imply
 earlier JavaScript releases.
 
-The Node `0.13.3` implementation has capability parity with that reference. Its
+The Node `0.14.0` implementation has capability parity with that reference. Its
 relational runtime, correctness boundaries, administration, diagnostics,
 operator dashboard, realtime projections, browser behavior, and supported
-adapters have native equivalents. Rails-specific rendering surfaces are
-replaced by transport- and framework-neutral JavaScript APIs. The partial guard
-row and the shared planned result-lookup row below are explicit scope
-boundaries, not missing Ruby capabilities.
+adapters have native equivalents. Transport- and framework-neutral JavaScript
+APIs replace the Rails-specific render surfaces. Three rows below are explicit
+scope boundaries that the Ruby reference shares: the partial guard row, the
+backpressure row, and the shared planned result-lookup row. They are not missing
+Ruby capabilities.
+
+`0.14.0` also adds `runtime.enqueueInternalMessage()`,
+`runtime.enqueueInternalMessageInTransaction()`, and
+`runtime.snapshotWithIncarnation()`. These are Node-only integration points
+for a host package (such as a future commercial scaling layer), not ported
+Ruby capabilities. Ruby's equivalent primitives
+(`SolidObjects::Mailbox#enqueue`, `ActorSnapshot`) are already reachable
+in-process, and they need no dedicated public API. Node's `exports` map enforces
+a package-privacy boundary between a package and its dependents. Ruby has no
+such boundary between a gem and its dependents.
 
 ## Status vocabulary
 
@@ -29,53 +40,60 @@ boundaries, not missing Ruby capabilities.
 
 ## Runtime and correctness
 
-| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                 |
-| ------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                      |
-| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                    |
-| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, and adapter-appropriate sequence locking.                                                 |
-| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                |
-| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                               |
-| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                 |
-| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                               |
-| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation.                  |
-| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                        |
-| One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                      |
-| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                |
-| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                     |
-| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.       |
-| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                |
-| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                          |
-| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers. |
-| Result lookup by request ID                                                                                   | Planned | This is also an open Ruby roadmap item and will be implemented in both runtimes when its authorization shape is settled.                                                                                           |
+| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                     |
+| ------------------------------------------------------------------------------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                                                                                                                                          |
+| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                                                                                                                                        |
+| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, and adapter-appropriate sequence locking.                                                                                                                                                                     |
+| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                                                                                                                                    |
+| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                                                                                                                                                   |
+| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                                                                                                                                     |
+| Backpressure and payload caps                                                                                 | Partial | Serialization enforces a shared maximum JSON nesting depth, raising `InvalidPayload`, and an optional caller-supplied `maxBytes` limit, raising `PayloadTooLarge`; reminder names are bounded to 255 characters. Distributed per-actor rate limits and global admission control do not exist yet, matching the open Ruby roadmap item. |
+| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                                                                                                                                                   |
+| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation.                                                                                                                                      |
+| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                                                                                                                                            |
+| One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                                                                                                                                          |
+| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                                                                                                                                    |
+| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                                                                                                                                         |
+| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.                                                                                                                           |
+| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                                                                                                                                    |
+| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                                                                                                                                              |
+| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers.                                                                                                                     |
+| Result lookup by request ID                                                                                   | Planned | This is also an open Ruby roadmap item and will be implemented in both runtimes when its authorization shape is settled.                                                                                                                                                                                                               |
 
 ## Operations
 
-| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                   |
-| ----------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                       |
-| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                |
-| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                    |
-| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                            |
-| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                           |
-| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit.                                                       |
-| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                          |
-| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                     |
-| Operator dashboard                                                            | Native | The opt-in `solid-objects/web` export provides Fetch and Node/Connect mounting, authorized runtime views and actions, session-backed CSRF, filtering, paging, charts, and immutable extension hooks. |
-| Structured instrumentation                                                    | Native | An isolated transport-neutral sink emits immutable lifecycle metadata and structurally excludes application payloads.                                                                                |
-| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                    |
+| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                              |
+| ----------------------------------------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                                                                                                                                                                                                                  |
+| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                                                                                                                                                                                                           |
+| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                                                                                                                                                                                                               |
+| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                                                                                                                                                                                                                       |
+| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                                                                                                                                                                                                                      |
+| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit.                                                                                                                                                                                                                                                  |
+| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                                                                                                                                                                                                                     |
+| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                                                                                                                                                                                                                |
+| Operator dashboard                                                            | Native | The opt-in `solid-objects/web` export provides Fetch and Node/Connect mounting, authorized runtime views and actions, session-backed CSRF, filtering, paging, charts, and immutable extension hooks. Matches the Ruby dashboard's own documented limits: no audit trail of admin actions, dead-letter retry is one at a time, and pause sets a flag rather than interrupting an in-flight turn. |
+| Structured instrumentation                                                    | Native | An isolated transport-neutral sink emits immutable lifecycle metadata and structurally excludes application payloads.                                                                                                                                                                                                                                                                           |
+| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                                                                                                                                                                                                               |
 
 ## Databases and wake-up
 
-| Capability               | Status | TypeScript shape or remaining work                                                                                                                                                      |
-| ------------------------ | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQLite                   | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits. |
-| PostgreSQL               | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                     |
-| MySQL                    | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits.                             |
-| Durable polling fallback | Native | Every role progresses without a notification service.                                                                                                                                   |
-| In-process wake-up       | Native | A generation-based default adapter prevents claim-to-wait signal loss; commits wake role-specific waiters and polling remains the fallback.                                             |
-| PostgreSQL wake-up       | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                   |
-| Redis wake-up            | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                        |
+| Capability               | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                    |
+| ------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| SQLite                   | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits.                                                                                               |
+| PostgreSQL               | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                                                                                                                   |
+| MySQL                    | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits. Ruby also tests a second client, `trilogy`; Node has no comparable second MySQL client, so only `mysql2` is tracked here. |
+| Durable polling fallback | Native | Every role progresses without a notification service.                                                                                                                                                                                                                                 |
+| In-process wake-up       | Native | A generation-based default adapter prevents claim-to-wait signal loss; commits wake role-specific waiters and polling remains the fallback.                                                                                                                                           |
+| PostgreSQL wake-up       | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                                                                                                                 |
+| Redis wake-up            | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                                                                                                                      |
+
+Every wake-up adapter above is opt-in. Neither runtime selects one
+automatically. An application that configures nothing keeps polling. Each
+runtime warns once when live processes share a database without a configured
+cross-process adapter. This limit is intentional in both runtimes. It is not a
+gap between them.
 
 ## Realtime and browser behavior
 
@@ -89,6 +107,67 @@ boundaries, not missing Ruby capabilities.
 | Personalized payload broadcasts                              | Native         | Static typed projections run against committed state under each fresh subscriber context, reauthorize as queries, isolate failures, and carry independent revision fences.                                                                                                                                         |
 | Real-browser compatibility suite                             | Native         | Playwright exercises subscription replay over native WebSocket, incarnation/revision fences, payload delivery, component batching, and cancellation in Chromium.                                                                                                                                                   |
 
+## JavaScript-only: the browser runtime
+
+`0.14.0` ships an in-browser runtime with SQLite WASM storage
+([#17](https://github.com/cardmagic/solid-objects-js/issues/17)). The
+runtime itself is a JavaScript-only capability: the Ruby gem has no browser
+target, so no Ruby parity row exists for milestones M1 through M3. The
+transmit family (milestone M4) started here but is not JavaScript-only; the
+next section tracks it as a shared capability. All four milestones are
+complete:
+
+- M1: the shared modules no longer import Node built-in modules, a
+  registered platform factory supplies async context propagation, and
+  `pnpm run check` enforces a Node-free import graph for the browser-safe
+  modules.
+- M2: `solid-objects/database/sqlite-wasm` implements the `Database`
+  contract on SQLite WASM. The full runtime passes a round-trip test
+  against it, and Playwright proves OPFS persistence across a page reload.
+- M3: `solid-objects/browser/host` hosts the full runtime in a browser
+  module worker on OPFS storage, with durable actor state across page
+  reloads proven in Chromium. `solid-objects/browser/tab-host` elects one
+  leader per origin with the Web Locks API and serves every tab over a
+  `BroadcastChannel`; Playwright proves shared state across two tabs and
+  failover with durable continuation after the leader tab closes.
+  `solid-objects/database/shared-sqlite-wasm` goes further: it moves the
+  election behind the `Database` seam, so every tab runs the ordinary
+  `configure -> install -> ref` flow and the runtime's own leases and
+  fencing arbitrate the tabs' workers. The plan
+  named a `SharedWorker` as the host; Web Locks election between dedicated
+  workers replaced it, because OPFS sync access handles exist only in
+  dedicated workers.
+- M4: `solid-objects/transmit` drains the local effects outbox to a
+  server runtime with at-least-once delivery, per-actor order, and an
+  idempotent server ingest. Vitest proves order under transmit failures,
+  replay deduplication, and recovery after an offline period, on SQLite,
+  PostgreSQL, and MySQL.
+
+## Shared capability: the transmit family
+
+The transmit family is the one part of the browser work that both runtimes
+share. The Ruby gem adopts it in
+[solid-objects-ruby#49](https://github.com/cardmagic/solid-objects-ruby/pull/49)
+(proposals [#47](https://github.com/cardmagic/solid-objects-ruby/issues/47)
+and [#48](https://github.com/cardmagic/solid-objects-ruby/issues/48)):
+`SolidObjects::Transmission.receive` is the ingest, and `Actor#transmit`
+with `register_transmit` is the staging side. Identifiers differ by
+runtime idiom; the wire contract is what both sides guarantee:
+
+- envelope keys are camelCase (`effectId`, `actorType`, `actorId`,
+  `operation`, and an optional `arguments` that defaults to an empty
+  object);
+- the ingest idempotency key is `transmit:<effectId>`, byte for byte;
+- a replay with changed arguments raises the idempotency conflict on both
+  sides and leaves the first application intact.
+
+`compatibility/transmit-envelopes.json` is committed to both repositories
+with a consuming test on each side, so the contract is enforced from both
+sides of the repository boundary. Manual cross-runtime QA (Node to Rails
+and Rails to Node) ran in solid-objects-ruby#49; the one disagreement it
+found (the optional `arguments` default) is fixed and pinned by the shared
+fixture.
+
 ## Rails-specific surfaces
 
 Rails generators, Active Record models/controllers, Turbo rendering, and

package/docs/releasing.md

@@ -26,8 +26,8 @@ npm trust github solid-objects \
 
 ## Release procedure
 
-1. Update the version in `package.json` and `src/version.ts`, refresh the
-   lockfile when needed, and move the release notes out of the Unreleased
+1. Update the version in `package.json` and `src/version.ts`. Refresh the
+   lockfile when necessary. Move the release notes out of the Unreleased
    section in `CHANGELOG.md` into a dated section for the new version. The
    publish job reads that section, so a version without one fails the release.
 2. Run `pnpm run format:check`, `pnpm run check`, `pnpm run test:coverage`,
@@ -48,7 +48,7 @@ quality, database, Redis, and browser job succeeds. It rejects tags that do not
 match `package.json`, safely skips versions already present in npm, and
 publishes new versions with npm provenance.
 
-The job then builds the release notes with `scripts/release-notes.mjs`, which
-prints the `CHANGELOG.md` section for the tagged version, and creates the GitHub
-release for the tag. Re-running the job on a tag that npm already holds still
-creates a missing release.
+The job then builds the release notes with `scripts/release-notes.mjs`. That
+script prints the `CHANGELOG.md` section for the tagged version. The job then
+creates the GitHub release for the tag. If you run the job again on a tag that
+npm already holds, it still creates a missing release.

package/docs/state-and-lifecycle.md

@@ -17,8 +17,8 @@ fields, then walks its prototype chain to discover methods and getters.
 - Operation, field, and getter names must not collide with the reference API.
 
 The constructor must establish every persisted field and must not depend on
-external state. Solid Objects invokes it while validating the class, creating
-defaults, hydrating state, and projecting a snapshot.
+external state. Solid Objects invokes it at four points: class validation,
+default creation, state hydration, and snapshot projection.
 
 ## Observable broadcast modes
 
@@ -79,12 +79,16 @@ asynchronous work or write through a database wrapped by
 a failing migration, or state newer than the running code raises
 `StateMigrationError`.
 
-For a destructive shape change, use expand/contract deployment: first deploy
-readers that understand both shapes, then deploy the migration, wait for
-operational evidence that actors have advanced, and only then remove old-shape
-support. If old code cannot understand the new shape, drain it before new code
-can persist the migration. Keep old migration steps so actors idle for several
-releases can still advance one version at a time.
+For a destructive shape change, use an expand/contract deployment:
+
+1. deploy readers that understand both shapes;
+2. deploy the migration;
+3. wait for operational evidence that the actors advanced;
+4. remove the old-shape support.
+
+If old code cannot understand the new shape, drain it before new code persists
+the migration. Keep the old migration steps. An actor that stays idle for
+several releases can then still advance one version at a time.
 
 Actor state migration is separate from `runtime.install()`. The latter applies
 the package's relational schema migrations; it does not eagerly rewrite actor

package/docs/support.md

@@ -2,18 +2,32 @@
 
 ## Runtime support
 
-| Component      | Supported or tested range                                   |
-| -------------- | ----------------------------------------------------------- |
-| Node.js        | 24.4.0 or newer; CI runs 24.4.0 and 24.15.0                 |
-| TypeScript     | 5.9 or newer for TypeScript applications                    |
-| SQLite         | Node's built-in `node:sqlite` on the supported Node runtime |
-| PostgreSQL     | 14 or newer; CI runs 14 and 18                              |
-| MySQL          | 8.0 or newer with InnoDB; CI runs 8.0 and 8.4               |
-| Redis wake-up  | Optional; CI runs Redis 7                                   |
-| Browser client | Chromium through Playwright                                 |
-
-The package is ESM-only. PostgreSQL, MySQL, and Redis require their optional
-peer dependency. SQLite has no driver dependency beyond Node.js.
+| Component       | Supported or tested range                                   |
+| --------------- | ----------------------------------------------------------- |
+| Node.js         | 24.4.0 or newer; CI runs 24.4.0 and 24.15.0                 |
+| TypeScript      | 5.9 or newer for TypeScript applications                    |
+| SQLite          | Node's built-in `node:sqlite` on the supported Node runtime |
+| PostgreSQL      | 14 or newer; CI runs 14 and 18                              |
+| MySQL           | 8.0 or newer with InnoDB; CI runs 8.0 and 8.4               |
+| Redis wake-up   | Optional; CI runs Redis 7                                   |
+| Browser client  | Chromium through Playwright                                 |
+| SQLite WASM     | `@sqlite.org/sqlite-wasm` 3.50 or newer; optional           |
+| Browser runtime | Chromium through Playwright; OPFS for persistent storage    |
+
+The package is ESM-only. PostgreSQL, MySQL, Redis, and SQLite WASM require
+their optional peer dependency. The Node SQLite adapter has no driver
+dependency beyond Node.js.
+
+The browser runtime needs two platform capabilities:
+
+- Persistent storage uses the OPFS SAH pool VFS, which needs a secure context
+  and a dedicated worker. `sqliteWasm({ storage: "persistent" })` fails fast
+  where OPFS is unavailable; temporary storage works everywhere the WASM
+  module loads.
+- The tab host election uses the Web Locks API. Every current browser
+  provides it. Node.js provides `navigator.locks` from 24.5, so Node-side use
+  of `solid-objects/browser/tab-host` needs a newer Node than the package
+  floor; the tab host test suite skips on older Node.
 
 The Node.js floor is 24.4.0 because the SQLite adapter reads integer columns as
 `BigInt`. Node.js 24.4.0 is the first release that accepts `readBigInts` on the
@@ -28,19 +42,30 @@ can change. Prefer 24.15.0 or newer where the choice is free.
 
 ## What the matrix covers
 
-The default suite exercises actor definitions, mailbox ordering, state
-migrations, leases, fencing, retries, dead letters, effects, reminders,
-realtime outboxes, administration, authorization, retention, lifecycle,
-timeouts, and SQLite behavior.
+The default suite exercises:
+
+- actor definitions, mailbox order, and state migrations;
+- leases, fencing, retries, and dead letters;
+- effects, reminders, and realtime outboxes;
+- administration, authorization, and retention;
+- lifecycle, timeouts, and SQLite behavior.
 
 Database jobs run the real adapter suites against PostgreSQL and MySQL servers.
 The Redis job runs wake-up behavior against a real Redis server. The browser
 job uses native WebSocket connections and Chromium for replay, payload,
-component, dashboard, and revision-fence behavior.
+component, dashboard, and revision-fence behavior. It also runs the browser
+runtime suites in Chromium module workers: SQLite WASM transactions and OPFS
+persistence across page reloads, the full runtime with durable actor state,
+deadline rollback under the turn-scoped context store, two tabs on one
+runtime with leader failover, and the sync bridge drain into a Node runtime.
+
+The quality job also:
 
-The quality job also builds the ESM package, inspects `npm pack`, installs the
-generated tarball in a clean temporary project, runs its packaged SQLite
-quickstart, and executes the multi-process recovery demonstration.
+1. builds the ESM package;
+2. inspects `npm pack`;
+3. installs the tarball in a clean temporary project;
+4. runs the packaged SQLite quickstart;
+5. executes the multi-process recovery demonstration.
 
 ## Boundaries
 

package/examples/quickstart-report.ts

@@ -0,0 +1,151 @@
+export interface QuickstartSummary {
+  sameIdentityCalls: number
+  sameIdentityFinalState: number
+  independentIdentitiesOverlapped: boolean
+  temporaryStateRemoved: boolean
+}
+
+interface QuickstartCheck {
+  passed: boolean
+  title: string
+  detail: readonly string[]
+}
+
+const INSTALL_COMMAND = "npm install solid-objects"
+const AGENT_PROMPT = "where would the solid-objects library be best used in this app?"
+const DOCUMENTATION_URL = "https://solidobjects.dev/node"
+
+export function formatQuickstartPlan(plan: {
+  sameIdentityCalls: number
+  actorSource: string
+}): string {
+  return [
+    "Solid Objects quickstart",
+    "",
+    "This command will:",
+    "",
+    "  1. create a temporary SQLite database;",
+    `  2. send ${plan.sameIdentityCalls} concurrent calls to one identity;`,
+    "  3. run two other identities at the same time;",
+    "  4. close the runtime and delete the temporary database.",
+    "",
+    "No server, container, or configuration is needed.",
+    "",
+    "The actor it runs:",
+    "",
+    ...plan.actorSource.split("\n").map((line) => `  ${line}`.trimEnd()),
+    "",
+    "",
+  ].join("\n")
+}
+
+export function formatQuickstartPrompt(): string {
+  return "Run it now? [Y/n] "
+}
+
+export function answerAllowsRun(answer: string): boolean {
+  const value = answer.trim().toLowerCase()
+  if (value === "") return true
+  return value === "y" || value === "yes"
+}
+
+export function formatQuickstartStop(): string {
+  return ["", "Nothing ran. No database and no files were created.", ""].join("\n")
+}
+
+export function formatQuickstartReport(summary: QuickstartSummary): string {
+  const results = checks(summary)
+  return [
+    "Results",
+    "",
+    ...results.flatMap(checkLines),
+    "",
+    "Each line above is an assertion, not a print. The command exits with a",
+    "non-zero code when one of them fails.",
+    "",
+    ...meaning(results),
+    "Add it to your app",
+    "",
+    `  ${INSTALL_COMMAND}`,
+    "",
+    "Or tell your agent",
+    "",
+    `  ${AGENT_PROMPT}`,
+    "",
+    `Docs: ${DOCUMENTATION_URL}`,
+    "",
+  ].join("\n")
+}
+
+function meaning(results: readonly QuickstartCheck[]): string[] {
+  if (results.some((check) => !check.passed)) return []
+  return [
+    "What each PASS means",
+    "",
+    "  Two requests on the same cart cannot overwrite each other.",
+    "  That identity has one durable mailbox, so its calls commit one at a",
+    "  time and no update is lost.",
+    "",
+    "  Unrelated identities do not wait for that mailbox.",
+    "  The order is per identity, not global.",
+    "",
+    "  The state lives in an ordinary SQL database, so it survives a restart.",
+    "",
+  ]
+}
+
+function checkLines(check: QuickstartCheck): string[] {
+  const result = check.passed ? "PASS" : "FAIL"
+  return [`${result}  ${check.title}`, ...check.detail.map((line) => `      ${line}`)]
+}
+
+function checks(summary: QuickstartSummary): QuickstartCheck[] {
+  return [
+    {
+      passed: summary.sameIdentityFinalState === summary.sameIdentityCalls,
+      title: `${summary.sameIdentityCalls} concurrent calls to one identity`,
+      detail: sameIdentityDetail(summary),
+    },
+    {
+      passed: summary.independentIdentitiesOverlapped,
+      title: "Two different identities ran at the same time",
+      detail: overlapDetail(summary),
+    },
+    {
+      passed: summary.temporaryStateRemoved,
+      title: "Temporary state removed",
+      detail: cleanupDetail(summary),
+    },
+  ]
+}
+
+function sameIdentityDetail(summary: QuickstartSummary): string[] {
+  if (summary.sameIdentityFinalState !== summary.sameIdentityCalls) {
+    return [
+      `The committed state is ${summary.sameIdentityFinalState} after ${summary.sameIdentityCalls} calls.`,
+      "The runtime lost an update.",
+    ]
+  }
+  return [
+    "They ran in order on one mailbox.",
+    `The committed state is ${summary.sameIdentityFinalState}.`,
+    `The return values were the complete sequence 1 through ${summary.sameIdentityCalls}.`,
+  ]
+}
+
+function overlapDetail(summary: QuickstartSummary): string[] {
+  if (!summary.independentIdentitiesOverlapped) {
+    return ["Their execution windows did not overlap."]
+  }
+  return [
+    "Their execution windows overlapped, so an unrelated identity",
+    "never waits behind this one.",
+  ]
+}
+
+function cleanupDetail(summary: QuickstartSummary): string[] {
+  if (!summary.temporaryStateRemoved) {
+    return ["The temporary SQLite database is still on disk."]
+  }
+  return ["The scoped temporary SQLite database was deleted at exit."]
+}