solid-objects 0.16.0 → 0.17.0

package/docs/parity.md

@@ -4,18 +4,15 @@ This ledger tracks capability parity with the Ruby `solid_objects` gem.
 Parity preserves a capability and its correctness or security boundary. It does
 not copy a Rails API into Node.
 
-Reference: Ruby `solid_objects` 0.14.0. The JavaScript package began at the
-Ruby design's `0.12` capability generation; that version number did not imply
-earlier JavaScript releases.
-
-The Node `0.14.0` implementation has capability parity with that reference. Its
-relational runtime, correctness boundaries, administration, diagnostics,
-operator dashboard, realtime projections, browser behavior, and supported
-adapters have native equivalents. Transport- and framework-neutral JavaScript
-APIs replace the Rails-specific render surfaces. Three rows below are explicit
-scope boundaries that the Ruby reference shares: the partial guard row, the
-backpressure row, and the shared planned result-lookup row. They are not missing
-Ruby capabilities.
+Reference: Ruby `solid_objects` 0.17.0. The JavaScript package began at the Ruby
+design's `0.12` capability generation; that version number did not imply earlier
+JavaScript releases.
+
+The SQL runtimes share durable identity, ordered mailboxes, fenced commits,
+effects, reminders, authorization, administration, and realtime guarantees.
+Transport- and framework-neutral JavaScript APIs replace Rails-specific surfaces.
+The partial write-guard and backpressure rows below record their actual limits.
+Browser and Cloudflare hosting have separate scope boundaries later in this file.
 
 `0.14.0` also adds `runtime.enqueueInternalMessage()`,
 `runtime.enqueueInternalMessageInTransaction()`, and
@@ -32,7 +29,7 @@ such boundary between a gem and its dependents.
 Operation-reference typing is runtime-specific: TypeScript infers scheduled and
 transmitted operations from the concrete receiver, and checks literal effect
 callback names. Ruby offers opt-in RBS generation from declared application types
-in [solid-objects-ruby#66](https://github.com/cardmagic/solid-objects-ruby/pull/66).
+since Ruby 0.14.7.
 Both preserve runtime operation validation and global effect/commit-action names;
 this does not imply automatic TypeScript-style inference in Ruby.
 
@@ -51,60 +48,63 @@ SQL waiters read results and status from one statement. Ruby already checks
 completion and returns the result from the same loaded message; no Ruby change
 is needed for the JavaScript stale-result race fix.
 
-| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, adapter-appropriate sequence locking, and PostgreSQL/MySQL row locks held from fence validation through commit.                                                                                                                                                                                                                                                                                                                      |
-| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                                                                                                                                                                                                                                                                                                                                                           |
-| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Backpressure and payload caps                                                                                 | Partial | Serialization enforces a shared maximum JSON nesting depth, raising `InvalidPayload`, and an optional caller-supplied `maxBytes` limit, raising `PayloadTooLarge`; reminder names are bounded to 255 characters. Distributed per-actor rate limits, global admission control, and cache-capacity eviction are not planned in either runtime. They are hot, request-path, and loss-tolerant, so one durable ordered message per check is the wrong shape. Solid Objects Pro answers them with grouped and ephemeral operations, which [fit](fit.md) describes. |
-| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                                                                                                                                                                                                                                                                                                                                                                          |
-| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation. Typed callback envelopes are exported.                                                                                                                                                                                                                                                                                                                      |
-| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                                                                                                                                                                                                                                                                                                                                                                |
-| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.                                                                                                                                                                                                                                                                                                                                                  |
-| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                                                                                                                                                                                                                                                                                                                                                           |
-| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                                                                                                                                                                                                                                                                                                                                                                     |
-| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers.                                                                                                                                                                                                                                                                                                                                            |
-| Result lookup by request ID and idempotency key                                                               | Native  | `runtime.findBy({ requestId })` and `reference.findBy({ idempotencyKey })` rebuild a `MessageReference`, authorized with the hook the original call ran. An actor remembers the keys of its own finished turns, so a key lookup separates a pruned message from one that never existed.                                                                                                                                                                                                                                                                       |
+| Capability                                                                                                    | Status  | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Actor registry, durable identity, JSON state, and adjacent state migrations                                   | Native  | Ordinary classes, static actor types, inferred state, explicit migrations, and isolated runtime context across every actor-instance callback.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Query and projection purity                                                                                   | Native  | Both runtimes reject state mutation and staged effects, recovery checks, commit actions, reminders, or outbound messages in queries, observable projections, and personalized payloads. Projection guards compare the complete staged work, including same-count replacements. Query and observable violations fail terminally with `QueryMutatedState`; payload violations fail only that payload. Snapshot projection reads enforce the same rule.                                                                                                                                                                                                                                                                  |
+| JSON property preservation                                                                                    | Native  | Reserved property names such as `__proto__`, `constructor`, and `prototype` remain ordinary data, including through size checks and immutable copies. Both suites consume `compatibility/json-values.json`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Fluent committed calls and background delivery                                                                | Native  | `await reference.operation()` and `reference.send.operation()`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Ordered mailbox, sequence allocation, idempotency, retries, dead letters, leases, renewal, and fenced commits | Native  | Relational ready/claimed membership tables, distinct generated request IDs and caller idempotency keys, durable history, adapter-appropriate sequence locking, and PostgreSQL/MySQL row locks held from fence validation through commit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Domain rejection and strict poison ordering                                                                   | Native  | Rejections accept JavaScript identifier-style codes and roll back without retry; invalid codes fail terminally, while retryable failures block later operations until completion or dead-lettering.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Bounded activation passes and hot-actor fairness                                                              | Native  | Configurable turn-count and elapsed-time budgets bound each pass, then move only that actor's already-due memberships behind actors already waiting.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Bounded claim candidate scan                                                                                  | Native  | A configurable ordered scan continues to another ready actor when a worker loses the first candidate's lease race.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Backpressure and payload caps                                                                                 | Partial | Serialization enforces a shared maximum JSON nesting depth, raising `InvalidPayload`, and an optional caller-supplied `maxBytes` limit, raising `PayloadTooLarge`; keyed reminder names are bounded to 255 characters in JS and 191 in Ruby. These existing database limits remain runtime-specific; use at most 191 ASCII characters for a name shared across runtimes. Distributed per-actor rate limits, global admission control, and cache-capacity eviction are not planned in either runtime. They are hot, request-path, and loss-tolerant, so one durable ordered message per check is the wrong shape. Solid Objects Pro answers them with grouped and ephemeral operations, which [fit](fit.md) describes. |
+| Idle activation cache                                                                                         | Native  | Long-running workers retain hydrated actors under renewable fenced leases, restore public state after failed turns, and release on timeout, fairness yield, lease loss, or shutdown.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Transactional effects and outcome operations                                                                  | Native  | At-least-once handlers receive immutable stable effect, attempt, source-message, and actor identity; success and failure operations also receive the originally staged arguments for correlation. Typed callback envelopes are exported.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Actor-to-actor delivery                                                                                       | Native  | `sendTo(reference).operation()` stages delivery in the source actor commit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| One-shot and recurring reminders                                                                              | Native  | Scheduling, cancellation by name/key/handle, read-your-writes inspection, catch-up policy, stale-claim recovery, pausing, and authorized resume. Cancellation cannot recall an already-enqueued occurrence.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, outcome, and wait reauthorize the original stored operation and arguments. All delivery modes retain immutable JSON results under the result-size cap. Result reads raise terminal rejection/failure errors; outcome returns them as data. Whole-call deadlines distinguish enqueue, wait, database, activation, and mailbox blockers.                                                                                                                                                                                                                                                                                                                                                                |
+| Result lookup by request ID and idempotency key                                                               | Native  | `runtime.findBy({ requestId })` and `reference.findBy({ idempotencyKey })` rebuild a `MessageReference`, authorized with the hook the original call ran. An actor remembers the keys of its own finished turns, so a key lookup separates a pruned message from one that never existed.                                                                                                                                                                                                                                                                                                                                                                                                                               |
 
 Effect callback envelopes are typed with `EffectFailurePayload`,
 `EffectSuccessPayload`, and `SerializedError` in both SQL and Cloudflare.
-Ruby RBS contracts are tracked in cardmagic/solid-objects-ruby#64 and preserve
-Ruby field names; this does not change runtime delivery semantics.
+Ruby publishes RBS contracts with native Ruby field names; this does not change runtime delivery semantics.
 
 ## Operations
 
-| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| ----------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                                                                                                                                                                                                                                                                                                                                                                               |
-| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit. SQL instance pruning uses an index on actor type and update time.                                                                                                                                                                                                                                                                                                                                             |
-| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                                                                                                                                                                                                                                                                                                                                                                                  |
-| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                                                                                                                                                                                                                                                                                                                                                                             |
-| Operator dashboard                                                            | Native | The opt-in `solid-objects/web` export provides Fetch and Node/Connect mounting, authorized runtime views and actions, session-backed CSRF, filtering, paging, charts, and immutable extension hooks. Matches the Ruby dashboard's own documented limits: no audit trail of admin actions, dead-letter retry is one at a time, and pause sets a flag rather than interrupting an in-flight turn.                                                                                                                                                              |
-| Structured instrumentation                                                    | Native | An isolated transport-neutral sink emits immutable lifecycle metadata and structurally excludes application payloads.                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| Large committed state warning                                                 | Native | `warnStateBytes` reports one `solid_objects.state.large` event, holding the actor type, actor ID, byte count, and threshold, when a committed image passes a 128 KB soft threshold. The event holds no application state, and it reports after the commit. The Ruby gem carries the same event and the same 5 MB hard default from `0.14.3`, as `warn_state_bytes`. Its threshold defaults to 64 KB rather than 128 KB, because its measured curve falls sooner: it keeps 55% of its empty-state throughput at 13 KB, where this package keeps 98% at 16 KB. |
-| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                                                                                                                                                                                                                                                                                                                                                                            |
+| Capability                                                                    | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ----------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Process registration, heartbeats, stale claim recovery, and graceful shutdown | Native | Runtime roles persist host, PID, runtime versions, draining and stopped transitions, cooperative cancellation, and a bounded shutdown deadline; cleanup recovers stale claims.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Failed-role replacement                                                       | Native | Built-in and registered roles are rebuilt through their factories with capped backoff; shutdown is the terminal replacement boundary.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Additional supervised components                                              | Native | `registerComponent()` builds, validates, runs, and stops application components with the runtime.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Dead-letter inspection and retry                                              | Native | `runtime.deadLetters` provides deny-by-default immutable inspection and idempotent durable retry linkage.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Reconciliation reads                                                          | Native | Authorized cursor pages cover active, quiet, and orphaned instances; bounded state batches are migrated and deeply frozen.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| Message, process, and opt-in instance retention                               | Native | Supervised scheduling bounds message and process growth; authorized manual APIs add preview and keep destructive instance expiration explicit. SQL instance pruning uses an index on actor type and update time.                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Doctor and schema verification                                                | Native | Structured checks cover configuration, schema/version shape, adapter server versions, neutral-context policy probes, live roles, and a targeted round trip.                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| CLI                                                                           | Native | The packaged executable loads an application runtime and exposes start, diagnostics, processes, dead letters, reminders, and explicit retention pruning as JSON.                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Operator dashboard                                                            | Native | Fetch and Node/Connect mounting, authorized views and actions, CSRF, filtering, paging, charts, and extensions match the Rack dashboard. Both dashboards expose individual retries and pause/resume; bulk redrive is available through the administration APIs. Pause does not interrupt an in-flight turn.                                                                                                                                                                                                                                                                                                                    |
+| Bulk redrive and administration audit                                         | Native | Message, effect, and broadcast scopes support idempotent retry and durable, bounded, cancellable redrive. Retry and task transitions persist administration identity in audit rows.                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Structured instrumentation                                                    | Native | Versioned events, metric samples, isolated observers, and bounded authorized diagnostics match Ruby. Both test suites check SQL event attributes against `compatibility/telemetry-events.json`; only JS activation events add their turn's message fields. Both runtimes log exporter and observer failures, require observer callbacks, and cap local observers at 1,000. Timeout events share wait reasons, activation owner IDs, and string generations; see [observability](observability.md). Durable Objects uses host instrumentation and remote diagnostics, sends fewer attributes, and does not send `sync.timeout`. |
+| Large committed state warning                                                 | Native | `warnStateBytes` reports one `solid_objects.state.large` event, holding the actor type, actor ID, byte count, and threshold, when a committed image passes a 128 KB soft threshold. The event holds no application state, and it reports after the commit. The Ruby gem carries the same event and the same 5 MB hard default from `0.14.3`, as `warn_state_bytes`. Its threshold defaults to 64 KB rather than 128 KB, because its measured curve falls sooner: it keeps 55% of its empty-state throughput at 13 KB, where this package keeps 98% at 16 KB.                                                                   |
+| Public test helper                                                            | Native | `runtime.testing` provides role-selective deterministic draining, explicit-time due-reminder execution, and dependency-ordered reset without relying on cascades.                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 ## Databases and wake-up
 
-| Capability               | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                    |
-| ------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQLite                   | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits.                                                                                                                                                                                               |
-| PostgreSQL               | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                                                                                                                                                                                                                   |
-| MySQL                    | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits. Ruby also tests a second client, `trilogy`; Node has no comparable second MySQL client, so only `mysql2` is tracked here.                                                                                                 |
-| Durable polling fallback | Native | Every role progresses without a notification service. Effects, reminders, and broadcasts use canonical ordered polling indexes; PostgreSQL and MySQL lock only the selected row with `FOR UPDATE SKIP LOCKED`. Broadcasts and reminders compare separate available and stale-recovery probes, preserve the oldest-first choice, and retry past candidates locked by another claimant. |
-| In-process wake-up       | Native | A generation-based default adapter prevents claim-to-wait signal loss; commits wake role-specific waiters and polling remains the fallback.                                                                                                                                                                                                                                           |
-| PostgreSQL wake-up       | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                                                                                                                                                                                                                 |
-| Redis wake-up            | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                                                                                                                                                                                                                      |
+| Capability                  | Status | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                                                    |
+| --------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| SQLite                      | Native | Uses built-in `node:sqlite`, serialized process-local access, bounded transient writer retries, foreign keys, strict tables, database time, and deadline-bounded access and lock waits. Ruby uses a yielding busy handler for background writes so a waiting thread lets the lock holder commit, including on Rails 7.1/7.2; both preserve synchronous deadlines.                     |
+| PostgreSQL                  | Native | Optional `pg` 8.23 peer, bounded pooling, 64-bit schema, row-locked sequences, server checks, and deadline-bounded pool, statement, and lock waits.                                                                                                                                                                                                                                   |
+| MySQL                       | Native | Optional `mysql2` 3.23 peer, bounded pooling, InnoDB schema, row-locked sequences, scoped deadlock retry, and deadline-bounded pool, query, and lock waits. Ruby also tests a second client, `trilogy`; Node has no comparable second MySQL client, so only `mysql2` is tracked here.                                                                                                 |
+| Durable polling fallback    | Native | Every role progresses without a notification service. Effects, reminders, and broadcasts use canonical ordered polling indexes; PostgreSQL and MySQL lock only the selected row with `FOR UPDATE SKIP LOCKED`. Broadcasts and reminders compare separate available and stale-recovery probes, preserve the oldest-first choice, and retry past candidates locked by another claimant. |
+| In-process wake-up          | Native | A generation-based adapter prevents claim-to-wait signal loss. It is the polling fallback or an explicit opt-out from automatic cross-process selection.                                                                                                                                                                                                                              |
+| Automatic wake-up selection | Native | Prefer configured Redis, then proven PostgreSQL notifications, then polling. Probe failures warn and report the resolved capability; MySQL needs Redis for cross-process wake-up.                                                                                                                                                                                                     |
+| PostgreSQL wake-up          | Native | `database.wakeUp()` uses one dedicated event-driven client, role-specific `LISTEN/NOTIFY`, generation fencing, reconnectable listeners, and durable polling fallback.                                                                                                                                                                                                                 |
+| Redis wake-up               | Native | An optional `redis` peer provides role-specific Pub/Sub over separate lazy publisher/subscriber connections, with bounded failures and durable polling fallback.                                                                                                                                                                                                                      |
 
 Both runtimes select a wake-up adapter automatically. `wakeUp` takes a name or
 an adapter and defaults to `"automatic"`, which prefers a configured Redis URL,
@@ -152,11 +152,14 @@ with the hook the original call ran, and report absence, an unregistered actor,
 and a refusal the same way. `outcome` reports the status, result, error,
 rejection, and attempt count in both.
 
-Three details differ, and all come from the runtimes rather than the feature.
-This runtime stores a result for every completed message, so a lookup answers
-one for asynchronous work; Ruby stores a result only for `sync` delivery, so a
-lookup there answers the status and the error but not the result. This runtime
-needed a new unique index on `request_id`, added as schema version 12, because
+Both runtimes retain JSON results for synchronous, background, and internal
+messages under the configured result-size cap. Every status, result, and outcome
+read rechecks authorization against the original operation and arguments.
+`result` raises terminal failures; `outcome` exposes them as data. Results discarded
+by older Ruby workers cannot be recovered retroactively.
+
+Two storage details differ. This runtime needed a new unique index on
+`request_id`, added as schema version 12, because
 its table constrained the pair `(actor_type, actor_id, request_id)`; the Ruby
 schema has carried a global unique index since its first migration. The error
 record also differs: Ruby's `ErrorRecord` carries `class_name`, `message`, and
@@ -189,15 +192,15 @@ because a Durable Object indexes only its own messages, so that form raises
 
 ## Realtime and browser behavior
 
-| Capability                                                   | Status         | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                 |
-| ------------------------------------------------------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Explicit observable projection and durable invalidations     | Native         | `observables()` is opt-in and invalidation-only by default. `broadcastValue()` sends changed values; `broadcastInvalidation()` explicitly sends only changed names while comparing the real value. Private or subscriber-specific values belong behind invalidation-only component endpoints or in typed payloads. |
-| Action Cable channels and signed stream names                | Not applicable | `runtime.realtime` provides authenticated transport-neutral sessions; the host owns its HTTP/WebSocket server and authentication.                                                                                                                                                                                  |
-| Authorized subscriptions                                     | Native         | Each request is denied by default and authorized before actor lookup; sessions replay committed observables and fence ordered durable revisions. Multi-process hosts explicitly bridge their shared transport.                                                                                                     |
-| Turbo scalar replacement                                     | Not applicable | The browser client exposes invalidations to application rendering code. Framework adapters can be separate packages.                                                                                                                                                                                               |
-| Keyed component refresh, morph/replace, and batch coalescing | Native         | A typed framework-neutral registry selects explicit dependencies, coalesces batch requests, aborts superseded work, fences each target, and delegates synchronous application strategy to the host.                                                                                                                |
-| Personalized payload broadcasts                              | Native         | Static typed projections run against committed state under each fresh subscriber context, reauthorize as queries, isolate failures, and carry independent revision fences.                                                                                                                                         |
-| Real-browser compatibility suite                             | Native         | Playwright exercises subscription replay over native WebSocket, incarnation/revision fences, payload delivery, component batching, and cancellation in Chromium.                                                                                                                                                   |
+| Capability                                                   | Status         | TypeScript shape or remaining work                                                                                                                                                                                                                                                                                                                     |
+| ------------------------------------------------------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Explicit observable projection and durable invalidations     | Native         | `observables()` is opt-in and invalidation-only by default. `broadcastValue()` sends changed values; `broadcastInvalidation()` explicitly sends only changed names while comparing the real value. Private or subscriber-specific values belong behind invalidation-only component endpoints or in typed payloads.                                     |
+| Action Cable channels and signed stream names                | Not applicable | `runtime.realtime` provides authenticated transport-neutral sessions; the host owns its HTTP/WebSocket server and authentication.                                                                                                                                                                                                                      |
+| Authorized subscriptions                                     | Native         | Each request is denied by default and authorized before actor lookup; sessions replay committed observables and fence ordered durable revisions. Multi-process hosts explicitly bridge their shared transport.                                                                                                                                         |
+| Turbo scalar replacement                                     | Not applicable | The browser client exposes invalidations to application rendering code. Framework adapters can be separate packages.                                                                                                                                                                                                                                   |
+| Keyed component refresh, morph/replace, and batch coalescing | Native         | A typed framework-neutral registry selects explicit dependencies, coalesces batch requests, aborts superseded work, fences each target, and delegates synchronous application strategy to the host.                                                                                                                                                    |
+| Personalized payload broadcasts                              | Native         | Both runtimes evaluate each personalized payload on an isolated actor from the same committed snapshot, including generated defaults, reject state mutation and staged work, prevent application database writes, and enforce the configured payload byte limit. They reauthorize as queries, isolate failures, and carry independent revision fences. |
+| Real-browser compatibility suite                             | Native         | Playwright exercises subscription replay over native WebSocket, incarnation/revision fences, payload delivery, component batching, and cancellation in Chromium.                                                                                                                                                                                       |
 
 ## JavaScript-only: the browser runtime
 
@@ -257,6 +260,8 @@ and [#48](https://github.com/cardmagic/solid-objects-ruby/issues/48)):
 with `register_transmit` is the staging side. Identifiers differ by
 runtime idiom, but both sides guarantee the same wire contract:
 
+- transmit siblings preserve staging order within each source message, including retries;
+- explicit `arguments: null` is invalid; only omission defaults to an empty object;
 - envelope keys are camelCase (`effectId`, `actorType`, `actorId`,
   `operation`, and an optional `arguments` that defaults to an empty
   object);
@@ -264,6 +269,13 @@ runtime idiom, but both sides guarantee the same wire contract:
 - a replay with changed arguments raises the idempotency conflict on both
   sides and leaves the first application intact.
 
+JavaScript schema migration 14 adds an effect position for ordering within a
+source message. Ruby uses its existing sequential effect primary key. Existing
+JS rows receive position zero and retain their earlier ID-based tie-break;
+their original staging order cannot be reconstructed. Run `runtime.install()`
+before starting upgraded workers. The stronger ordering applies to effects
+staged by upgraded workers.
+
 `compatibility/transmit-envelopes.json` is committed to both repositories
 with a consuming test on each side, so the contract is enforced from both
 sides of the repository boundary. Manual cross-runtime QA (Node to Rails
@@ -310,3 +322,8 @@ checks. Per-effect recovery timeouts extend the runtime heartbeat threshold
 (milliseconds in JS, seconds in Ruby). Cloudflare returns emit handles but rejects
 process-heartbeat recovery options and intents before commit. See
 [the transaction protocol](effect-recovery.md).
+
+On SQLite, both runtimes mark the `status = 'processing'` test in the recovery
+candidate query with `likelihood()`. The candidate scan then starts from the
+effects poll index, also when `sqlite_stat1` shows that most effects have one
+status.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solid-objects",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Race-free realtime state per application identity, backed by your SQL database",
   "type": "module",
   "license": "MIT",
@@ -115,8 +115,8 @@
     "test": "vitest run",
     "test:browser": "pnpm run build && playwright test",
     "test:coverage": "vitest run --coverage",
-    "test:postgresql": "vitest run test/postgresql.test.ts test/effect-recovery.test.ts test/instance-retention.test.ts",
-    "test:mysql": "vitest run test/mysql.test.ts test/effect-recovery.test.ts test/instance-retention.test.ts",
+    "test:postgresql": "vitest run test/postgresql.test.ts test/effect-recovery.test.ts test/instance-retention.test.ts test/transmit-ordering.test.ts",
+    "test:mysql": "vitest run test/mysql.test.ts test/effect-recovery.test.ts test/instance-retention.test.ts test/transmit-ordering.test.ts",
     "test:package": "node scripts/release-artifact-smoke.mjs",
     "test:recovery": "pnpm run build && node examples/failure-recovery/demo.ts",
     "test:at-least-once": "pnpm run build && node examples/at-least-once/demo.ts",