- sync state antar tab
- jalankan pekerjaan berat di worker
- refresh token jangan dobel
- logout semua tab
- cache data offline

onmessage -> if type A -> update X
visibilitychange -> maybe refresh Y
storage -> maybe sync Z
worker.onmessage -> setState

Logout harus sync antar tab.

Saat user logout dari salah satu tab, semua tab same-origin yang menggunakan session yang sama harus berhenti mengirim authenticated request secepat mungkin. Tab yang sedang hidden atau frozen harus mendeteksi session revoked sebelum melakukan action authenticated berikutnya setelah resume. Jika broadcast logout hilang, tab tetap harus menemukan status revoked dari durable session store atau server validation.

broadcast('logout')

When <trigger>, all <affected participants> must <observable behavior>
within <time/ordering expectation>, unless <explicit degraded condition>.
If <failure mode>, the system must <recovery behavior> without <forbidden outcome>.

When any tab detects that the access token is near expiry, exactly one active participant should attempt refresh for the session epoch. Other tabs must wait for the session store to update or revalidate before sending authenticated requests. If the refreshing participant dies, another participant may retry after the refresh lease expires. Duplicate refresh attempts must not corrupt the session state.

type ConsistencyLevel =
  | 'local-only'
  | 'eventual-cross-tab'
  | 'read-your-write'
  | 'single-owner'
  | 'durable-ordered'
  | 'security-critical';

interface DomainConsistencyRequirement {
  domain: string;
  level: ConsistencyLevel;
  sourceOfTruth: 'memory' | 'indexeddb' | 'cache-api' | 'server' | 'hybrid';
  staleReadAllowedForMs: number;
  duplicateAllowed: boolean;
  lostMessageTolerated: boolean;
}

const authSessionRequirement: DomainConsistencyRequirement = {
  domain: 'auth-session',
  level: 'security-critical',
  sourceOfTruth: 'hybrid',
  staleReadAllowedForMs: 0,
  duplicateAllowed: false,
  lostMessageTolerated: true,
};

Hanya satu tab yang jalanin sync.

At most one participant may own background sync for a given user/session/resource epoch. Ownership must be represented as a lease with an epoch. Side effects must include the owner epoch and be rejected if the owner is stale. If the owner stops heartbeating or the lock is released, another participant may acquire ownership after the lease expires.

interface OwnershipRequirement {
  resource: string;
  ownerScope: 'origin' | 'user-session' | 'tenant' | 'entity' | 'queue';
  acquisition: 'web-lock' | 'idb-lease' | 'sharedworker-arbiter' | 'server-lease';
  leaseMs: number;
  fencingRequired: boolean;
  staleOwnerAction: 'reject' | 'ignore' | 'revalidate' | 'force-release';
}

const tokenRefreshOwnership: OwnershipRequirement = {
  resource: 'auth-token-refresh',
  ownerScope: 'user-session',
  acquisition: 'web-lock',
  leaseMs: 15_000,
  fencingRequired: true,
  staleOwnerAction: 'reject',
};

Duplicate work may happen. Duplicate committed effect must not happen.

interface MessageEnvelope<TPayload> {
  messageId: string;
  protocolVersion: number;
  minConsumerVersion: number;
  type: string;
  kind: 'command' | 'event' | 'query' | 'response' | 'invalidation' | 'lease-signal';
  source: {
    tabId?: string;
    workerId?: string;
    serviceWorkerVersion?: string;
    appBuildId: string;
  };
  correlationId?: string;
  causationId?: string;
  idempotencyKey?: string;
  resource?: string;
  epoch?: number;
  sentAt: number;
  expiresAt?: number;
  payload: TPayload;
}

Worker task command uses at-least-once delivery from task journal to worker execution, but result commit is effectively-once by taskId.

interface StateRequirement {
  name: string;
  sourceOfTruth: 'memory' | 'indexeddb' | 'cache-api' | 'opfs' | 'server' | 'hybrid';
  durability: 'transient' | 'session' | 'persistent' | 'authoritative';
  versioned: boolean;
  transactional: boolean;
  sensitive: boolean;
  evictionImpact: 'none' | 'degraded' | 'data-loss-risk' | 'security-risk';
}

const offlineQueueState: StateRequirement = {
  name: 'offline-mutation-queue',
  sourceOfTruth: 'indexeddb',
  durability: 'persistent',
  versioned: true,
  transactional: true,
  sensitive: true,
  evictionImpact: 'data-loss-risk',
};

type WriteResult<TVersion> =
  | { ok: true; version: TVersion }
  | { ok: false; reason: 'conflict'; currentVersion: TVersion }
  | { ok: false; reason: 'quota-exceeded' }
  | { ok: false; reason: 'blocked' }
  | { ok: false; reason: 'unavailable' }
  | { ok: false; reason: 'unknown'; error: unknown };

await saveState(next);
notifyTabs();

const result = await saveState(next);

if (!result.ok) {
  await enterDegradedMode(result.reason);
  return;
}

await notifyTabs({
  type: 'state.invalidated',
  version: result.version,
});

interface LifecyclePolicy {
  canAcquireLeadership(input: {
    visibilityState: DocumentVisibilityState;
    lastExecutionGapMs: number;
    batterySaverKnown?: boolean;
  }): boolean;

  mustRevalidateBeforeNetwork(input: {
    hiddenForMs: number;
    sessionCritical: boolean;
  }): boolean;

  heartbeatIntervalMs(input: {
    visibilityState: DocumentVisibilityState;
  }): number;
}

const lifecyclePolicy: LifecyclePolicy = {
  canAcquireLeadership(input) {
    return input.visibilityState === 'visible' && input.lastExecutionGapMs < 30_000;
  },

  mustRevalidateBeforeNetwork(input) {
    return input.sessionCritical || input.hiddenForMs > 10_000;
  },

  heartbeatIntervalMs(input) {
    return input.visibilityState === 'visible' ? 5_000 : 15_000;
  },
};

Any tab that becomes visible after being hidden for more than 10 seconds must reload session state, app version state, queue ownership state, and pending mutation summary before sending authenticated writes.

If <actor> fails during <operation>, then <other actor/runtime> must detect it by <signal> within <bound/condition>, and recover by <action>. Duplicate recovery must be safe because <idempotency/fencing/version rule>.

If the tab owning offline replay closes while a mutation batch is in progress, another visible tab may acquire the replay lock after the replay lease expires. Mutations already committed to the server must not be replayed with a different idempotency key. The queue reconciler must mark server-confirmed mutations as completed before sending the next batch.

If timeout, retry.

If timeout occurs, the operation state becomes unknown. The runtime must first check whether a committed result exists using taskId/idempotencyKey. If no committed result exists and retry budget remains, it may retry with the same idempotency key.

channel.postMessage({ type: 'admin.delete-cache' });

interface PerformanceRequirement {
  domain: string;
  maxMainThreadBlockingMs: number;
  maxMessagePayloadBytes: number;
  maxWorkerStartupMs: number;
  maxInFlightTasks: number;
  maxMemoryBytes: number;
  cancellationRequired: boolean;
  backpressureStrategy: 'drop' | 'merge' | 'queue-bounded' | 'reject' | 'latest-wins';
}

const searchIndexWorkerRequirement: PerformanceRequirement = {
  domain: 'client-side-search-index',
  maxMainThreadBlockingMs: 16,
  maxMessagePayloadBytes: 2_000_000,
  maxWorkerStartupMs: 200,
  maxInFlightTasks: 2,
  maxMemoryBytes: 128 * 1024 * 1024,
  cancellationRequired: true,
  backpressureStrategy: 'latest-wins',
};

No orchestration handler may perform unbounded synchronous work on the main thread. Message handlers must validate, enqueue, mark dirty, or schedule work; heavy computation goes to worker or incremental task scheduling.

Large binary payloads must use Transferable objects or OPFS/IndexedDB references instead of repeated structured clone across contexts.

type OrchestrationTelemetryEvent =
  | { type: 'tab.registered'; tabId: string; visible: boolean; at: number }
  | { type: 'tab.expired'; tabId: string; lastSeenAgeMs: number; at: number }
  | { type: 'leader.acquired'; resource: string; ownerTabId: string; epoch: number; at: number }
  | { type: 'leader.rejected-stale'; resource: string; ownerTabId: string; epoch: number; currentEpoch: number; at: number }
  | { type: 'message.invalid'; channel: string; reason: string; at: number }
  | { type: 'message.timeout'; messageType: string; correlationId: string; at: number }
  | { type: 'worker.task.started'; taskId: string; kind: string; attempt: number; at: number }
  | { type: 'worker.task.completed'; taskId: string; durationMs: number; at: number }
  | { type: 'worker.task.failed'; taskId: string; reason: string; at: number }
  | { type: 'storage.write.failed'; store: string; reason: string; at: number }
  | { type: 'runtime.revalidated'; reason: string; durationMs: number; at: number };

interface RuntimeDebugSnapshot {
  tab: {
    tabId: string;
    visible: boolean;
    hiddenForMs: number;
    appBuildId: string;
    protocolVersion: number;
  };
  presence: {
    activeCount: number;
    staleCount: number;
    oldestLastSeenAgeMs: number;
  };
  leadership: Array<{
    resource: string;
    ownerTabId: string;
    epoch: number;
    expiresInMs: number;
  }>;
  workerQueues: Array<{
    name: string;
    queued: number;
    running: number;
    failed: number;
  }>;
  storage: {
    schemaVersion: number;
    lastWriteFailure?: string;
  };
}

1. Two tabs open; one logs out; hidden tab resumes; hidden tab must not send authenticated request.
2. Two tabs attempt token refresh; only one session write is accepted.
3. Leader tab closes during sync; follower resumes sync after lease expiry.
4. Worker crashes during task; task is retried or marked failed according to policy.
5. Duplicate worker result arrives; result committed once.
6. Old protocol message arrives; receiver rejects and logs message.invalid.
7. IndexedDB upgrade blocked by old tab; reload-required flow triggers.
8. BroadcastChannel message is lost; state still reconciles from durable store.
9. Storage quota failure; UI enters degraded mode instead of pretending saved.
10. Tab resumes after long execution gap; runtime revalidates before side effect.

interface RuntimeDependencies {
  bus: RuntimeBus;
  store: RuntimeStore;
  lockManager: RuntimeLockManager;
  workerClient: WorkerClient;
  clock: Clock;
  lifecycle: LifecycleSource;
  telemetry: TelemetrySink;
}

interface CompatibilityRequirement {
  appBuildId: string;
  protocolVersion: number;
  minProtocolVersion: number;
  schemaVersion: number;
  serviceWorkerVersion?: string;
  migrationPolicy: 'online-only' | 'lazy-compatible' | 'upgrade-barrier' | 'force-reload-old-tabs';
}

If a tab with protocolVersion 3 receives a message from protocolVersion 1 and min supported version is 2, it must reject the message, emit message.invalid with reason incompatible-protocol, and publish app.reload-required without executing side effects.

Kita pakai BroadcastChannel buat sync semua state.

State mana yang durable?
Message mana yang hint?
Message mana yang command?
Apa yang terjadi kalau message lost?
Apa consistency level-nya?
Apa failure mode paling bahaya?

# Auth Session Multi-Tab Requirement

## Product Semantics
When the user logs out from any tab, all same-origin tabs for the same user session must stop sending authenticated requests. Hidden/restored tabs must detect revoked session before the next authenticated write.

## Consistency
- Security-critical.
- Session revoked state is durable.
- Broadcast is invalidation only.
- Lost broadcast must not break correctness.

## Ownership
- Token refresh is single-owner per session epoch.
- Acquisition uses Web Lock where available.
- Session writes require epoch fencing.
- Duplicate refresh attempts must not corrupt session.

## Messaging
- `session.changed` is invalidation.
- `session.refresh.requested` is command-like but must be lock-backed.
- All messages include protocolVersion, messageId, sentAt, sessionEpoch.

## Storage
- Durable session metadata stored in IndexedDB or equivalent session store.
- Tokens are not broadcast.
- Sensitive logs are redacted.

## Lifecycle
- On visible resume, tab revalidates session before authenticated write.
- Hidden tab may not acquire refresh leadership unless no visible candidate exists and policy allows.

## Failure
- If refresher dies, refresh lease expires and another tab may retry.
- Timeout means unknown; reconciler checks session store/server before retry.
- Stale epoch write is rejected.

## Observability
- Log refresh lock acquired/released/timeout.
- Log stale write rejected.
- Count concurrent refresh attempts.

## Tests
- Two tabs refresh simultaneously.
- Logout while refresh in flight.
- Hidden tab resumes after logout.
- Broadcast lost; durable session still wins.

1. Every cross-context state change has a source of truth.
2. Every critical message has a declared delivery semantic.
3. Every owner is leased and, if needed, fenced.
4. Every participant can disappear without cleanup.
5. Every resumed tab revalidates before critical side effects.
6. Every duplicate command is safe or rejected.
7. Every stale update is version-checked.
8. Every storage failure has a degraded behavior.
9. Every protocol has a version and compatibility rule.
10. Every production runtime has telemetry and a debug snapshot.