29. v0.13.0 — Browser market ownership safety

Release candidate prepared 2026-09-03. This release adds the first default-off browser-owner slice for eligible Massive bar-only streams, including routed-owner chart panes, and hardens compatibility, handoff, alert recovery, and reconnect behavior before those controls can be enabled. Massive requests that actually carry trades remain on the existing per-tab connector.

Added

• Compatible tabs can share one fenced Massive bars socket through an elected browser owner. Exact-value rollout controls remain off by default and require a compatible-build adoption window before enablement.
• Routed-owner Massive charts use coordinated bars and the bar-driven price line. They intentionally omit the trade-tick live-price overlay; compatibility/custom Massive clients and non-Massive providers retain their current trade behavior.
• Live paper execution on those routed-owner Massive panes also uses execution-eligible aggregate bar samples rather than trade ticks. Market/executable last is the aggregate close; resting orders can traverse only the newly observed incremental OHLC segment, and the first reconnect/startup snapshot cannot execute.
• Active-owner diagnostics expose categorical readiness, bounded counts—including unsupportedProtocolMinorCount—and a distinct awaiting-close state without exposing rejected versions or frames, credentials, symbols, resource keys, prices, URLs, hashes, or protocol frames.
• The chart workspace uses one persistent Sonner safety notice: pending exact-socket closure shows a warning, poisoned or quarantined ownership upgrades the same notice to an error, and recovery dismisses it without notification spam.
• Chromium, WebKit, and pinned sandboxed Linux Firefox use the same six-scenario ownership gate. The gate evaluates the production chart policy against the routed client and retains the combined-to-coordinated follower-delivery proof; its diagnostics streams are not full chart-history/rendering evidence.

Fixed

Compatibility and authentication transitions

• Missing owner prerequisites or a clean owner-start failure no longer leaves the application blank. The current per-tab client remains available when no coordinated owner could have opened.
• If teardown cannot prove that prior ownership closed, the application remains usable through a quarantine client while Massive realtime streams stay blocked fail-closed.
• Returning quickly to a previously ready authentication revision cannot reuse stale readiness and expose the raw Massive client before the replacement router is active.
• The owner runtime now starts before its client. Bars-only demand created before authority discovery stays in the coordinated path, publishes only an empty discovery frame at first, and is advertised in full when authenticated lineage arrives; unknown lineage no longer creates a sticky legacy reservation.
• useMarketDataClient now throws outside MarketDataClientProvider, preventing a future market consumer on an ungated route from silently bypassing ownership. The provider still defaults explicitly to the compatibility client where it is mounted.
• Ownership readiness now applies only to dynamic chart and diagnostics routes. Landing, documentation, pricing, account, and the /chart launcher retain server-rendered content when owner controls are enabled because they mount no market consumers.

Reservations and physical ownership

• Coordinated demand arriving during a legacy reservation is explicitly deferred instead of being acknowledged without a resource fence. Existing followers are suppressed before their old resource closes, and all retained followers receive fresh ready fences immediately when the final reservation releases.
• Coordinated admission is bounded at five seconds. A reservation-blocked stream that cannot become ready closes its logical demand and reports a categorical timeout without racing into legacy ownership. If no authority appears in that bound, a chart pane's realtime open rejects and may remain without realtime until its stream key changes; alerts continue through their retry loop.
• Empty non-reservation demand now acknowledges release as soon as it is recorded, independent of unrelated resource readiness. The host retries coordinated physical-lock probes every 25 ms for up to 250 ms, retains prior demand transactionally on failure, and no longer turns a transient WebKit post-release miss into fallback. If retained demand still encounters a gate miss, only that retryable outcome is reconciled again every 250 ms within a five-second outer budget; authority, reservation, configuration, expiry, drain, and success fence or cancel the timer.
• Releasing clients republish at 100, 200, 400, 800, 1000… ms and fail closed after five seconds if no accepted authenticated acknowledgement arrives. A timeout never pretends ownership was released and raises the persistent redacted safety notice.
• Alert subscriptions recover from transient open rejection without an edit or reload. Retries start after one second, use exponential backoff capped at 30 seconds, cannot double-open, and stop when the alert is removed or the engine is disposed.
• A legacy socket that misses the two-second close-confirmation deadline remains excluded, but the exact old socket can now recover the tab when it later confirms closure. The router releases the physical Web Lock and authenticated reservation before resetting the retained manager or admitting replacement work.

Massive reconnect bars

• Every new legacy Massive socket generation now clears its previous source aggregation buckets. Multi-minute and daily bars after reconnect no longer combine fresh provider updates with stale pre-reconnect minute data.

Security and rollout

• Provider credentials remain confined to the Massive authentication frame and are absent from coordination protocol messages, diagnostics, reports, and evidence.
• Owner controls must stay off until old pre-coordination tabs are operationally absent; an old tab cannot honor the newer reservation or physical Web Lock.
• Active protocol revision 1.1 requires an exact homogeneous build. Older and newer minor revisions both fail closed; future additive revisions require explicit capability negotiation and version-specific schemas.
• Synthetic freeze coverage proves the product handoff path only. It is not native hidden-tab, bfcache, or crash evidence.

Verification

• Exact Node v24.15.0 remains mandatory for deterministic validation and browser runners.
• Evidence generated before the fourth-pass startup, release-race, provider-context, paper-documentation, and protocol-observability repairs is historical.
• The final result is authoritative only through generated aggregate evidence whose Git head, source fingerprint, file count, engine reports, credential scans, teardown proof, retry/timeout posture, and pinned Firefox sandbox posture match the released tree.

Next steps

Back to the release list.

Next: Release Notes