Sync engine

The host keeps every open page live. The browser holds only the rows it shows; the host plans each read, routes each commit to the views it changes, and streams the change.

The wire

• POST /__bolt/q — reads and collection queries
• POST /__bolt/act — every write and action, start, and approval decisions, each with an idempotency key
• GET and POST /__bolt/live — one SSE stream per visible tab, and view registration
• PUT and GET /__bolt/files/<key> — uploads to a named field, and downloads by file reference
• /__bolt/session/… — sign-in and invitations

Routing a commit

A write’s commit record is its RETURNING set. The host evaluates each registered view in memory against the pre- and post-images, and keeps each view’s current answer. A decided hit is sent as a patch frame — upsert a row at an index, or remove a row by id — built from the post-image with no read, and projected through the view’s select, the viewer’s field masks and its orderBy.

A change that cannot be placed exactly falls back as narrowly as it can: a primary-key read of one row, or a re-read of the view when it is searched, aggregated, paged past a boundary, or sorted by a related field that changed. Every fallback is counted.

Read your writes

/act replies with the sequence of its last commit, and the client resolves the write once its stream has applied that sequence — at most 5 s, and only while the stream is open.

Authority and releases

When a viewer’s authority changes, the affected views are answered again. A release change, a reset, a restore or a fork closes the connections with the new release.

Limits

A subscription over 2 MiB, the 501st subscription on a connection, or a registration over the retained budget gets its own typed error, and the stream is untouched. A tab hidden for 30 s closes its stream.

What is not here

There is no browser database, no offline queue and no cross-tab broker. SSE carries only the browser’s live stream; integration links keep their own connections.