fix: Keep queries and projections read-only

Reject actor state changes and durable intents from queries and
observable projections before they can commit. Fail these violations
without retrying, matching the JavaScript runtime.

Pin reserved JSON names with shared fixtures and correct reminder
limits and dead-transmit recovery documentation.

Author: cardmagic

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- Reject query and observable state mutation and staged durable work with
+  terminal `QueryMutatedState` errors. Cover individual snapshot projections and
+  preserve ordinary operations' already-staged work while reading projections.
+- Pin reserved JSON property names with shared Ruby/JS fixtures. Document the
+  reminder-name limit difference and the authorized dead-transmit retry API.
+
 - Reauthorize every message-reference status, result, and outcome read against
   the original invocation. Pass `authorization_context:` on every read.
 - Retain immutable JSON results for background and internal messages as well as

compatibility/json-values.json

@@ -0,0 +1,14 @@
+[
+  {
+    "name": "object prototype key",
+    "value": { "__proto__": { "role": "ordinary data" }, "value": 1 }
+  },
+  { "name": "scalar prototype key", "value": { "__proto__": "ordinary data" } },
+  { "name": "null prototype key", "value": { "__proto__": null } },
+  {
+    "name": "nested reserved names",
+    "value": {
+      "items": [{ "__proto__": { "constructor": "data" }, "prototype": true, "hasOwnProperty": 1 }]
+    }
+  }
+]

docs/architecture.md

@@ -167,10 +167,12 @@ creating a message or activation, applies required state migrations in memory,
 and returns deeply frozen declared attributes. It can race with an in-flight
 turn. `SolidObjects.mutable_copy` creates an independent mutable JSON value.
 
-`message` and `query` both execute as durable mailbox turns. A query may not
-mutate state. The executor detects query mutation and fails the message. An
-observable is a named projection of state used by server rendering and realtime
-updates. Its durable broadcast row stores only an empty invalidation marker by
+`message` and `query` both execute as durable mailbox turns. Queries and
+observables must not mutate state or stage effects, recovery checks, commit
+actions, reminders, or outbound messages. Violations raise `QueryMutatedState`
+and fail the message without retrying or committing its work. Individual snapshot
+projections enforce the same rule. An observable is a named projection used by
+server rendering and realtime updates. Its durable broadcast row stores only an empty invalidation marker by
 default. `broadcast: :value` explicitly opts into storing and sharing the
 projected value.
 

docs/reminders.md

@@ -65,7 +65,9 @@ key only decides which alarm is which.
 
 A key must be non-empty, and the name it becomes must fit the 191-character
 column, which is checked on the composed name rather than the key alone so a
-long operation and a short key are caught too.
+long operation and a short key are caught too. JavaScript allows 255 UTF-16 code
+units for the same combined name. These existing schema limits remain different;
+use at most 191 ASCII characters for names shared across runtimes.
 
 The key is separated from the operation by a colon, so an operation may not hold
 one. Otherwise an unkeyed `deliver:item` and a `deliver` keyed `item` would be

docs/roadmap.md

@@ -7,6 +7,9 @@
 
 - Rails engine, install generator, migration, and CLI
 - Explicit actor registry, references, JSON state, and state migrations
+- Queries and observable projections reject state mutation and staged durable
+  work with terminal `QueryMutatedState` errors, matching JavaScript. Shared JSON
+  fixtures preserve reserved property names as ordinary data in both runtimes.
 - Fluent direct synchronous RPC, configured `sync`, and durable `async`
 - Durable message history plus ready/claimed membership tables
 - Concurrent sequence allocation and actor creation. An enqueue finds the

docs/transmission.md

@@ -87,11 +87,19 @@ SolidObjects.configure do |configuration|
 end
 ```
 
-These settings apply to every effect, not only transmits. A dead transmit
-effect has no retry API; the dashboard lists it, and recovery means
-returning its row to `pending` with a cleared `attempt_count`. Order
-survives that recovery, because the drain orders by mailbox sequence, not
-by retry time.
+These settings apply to every effect, including transmits. Retry a dead transmit
+through the authorized administration API:
+
+```ruby
+SolidObjects.dead_letters.effects.retry(effect_id, authorization_context: operator)
+```
+
+Retry resets attempts and returns the effect to pending with its stable identity,
+so the receiver still deduplicates replays. The administration policy must allow
+`retry` on `effect_dead_letters`; the action is recorded in the audit log. Use
+`SolidObjects.dead_letters.effects.redrive(authorization_context: operator)` to
+recover a scope in bounded batches. Order survives recovery because the drain
+orders by source sequence and staging order.
 
 ## Wire contract
 

lib/solid_objects/actor.rb

@@ -459,7 +459,9 @@ def invoke(operation, arguments)
 
     # @rbs () -> Hash[String, untyped]
     def observable_values
-      guard_application_writes("observables") do
+      return {} if self.class.definition.observables.empty?
+
+      read_projection("observables") do
         self.class.definition.observables.each_with_object({}) do |(name, handler), values|
           values[name.to_s] = Serialization.dump(instance_exec(&handler.block))
         end
@@ -472,7 +474,7 @@ def observable_value(name)
       handler = self.class.definition.observables[observable_name]
       raise UnknownMessage, "unknown observable #{name.inspect}" unless handler
 
-      guard_application_writes("observable.#{observable_name}") do
+      read_projection("observable.#{observable_name}") do
         Serialization.dump(instance_exec(&handler.block))
       end
     end
@@ -537,6 +539,12 @@ def discard_intents
       outbound_message_intents.clear
     end
 
+    # @rbs () -> Integer
+    def intent_count
+      effect_intents.length + effect_recovery_intents.length + commit_action_intents.length +
+        reminder_intents.length + outbound_message_intents.length
+    end
+
     private
 
     attr_reader :effect_intents,
@@ -545,6 +553,18 @@ def discard_intents
       :reminder_intents,
       :outbound_message_intents
 
+    # @rbs (String) { () -> untyped } -> untyped
+    def read_projection(operation)
+      state_before = state.to_h
+      intents_before = intent_count
+      result = guard_application_writes(operation) { yield }
+      unless state.to_h == state_before && intent_count == intents_before
+        raise QueryMutatedState, "observables must not mutate actor state or stage durable work"
+      end
+
+      result
+    end
+
     # @rbs (String) { () -> untyped } -> untyped
     def guard_application_writes(operation, &block)
       ApplicationWriteGuard.call(

lib/solid_objects/errors.rb

@@ -7,6 +7,9 @@ class Error < StandardError
   class NonRetryableError < Error
   end
 
+  class QueryMutatedState < NonRetryableError
+  end
+
   class UnsupportedDatabase < Error
   end
 

lib/solid_objects/executor.rb

@@ -31,7 +31,7 @@ def call
       result = invoke_actor(message_context)
       observable_changes = changed_observables(observables_before, actor.observable_values)
       state_after = actor.state.to_h_with_byte_size
-      ensure_query_did_not_mutate_state!(state_before, state_after.value)
+      ensure_query_is_read_only!(state_before, state_after.value)
       complete(
         result,
         observable_changes,
@@ -70,12 +70,11 @@ def invoke_actor(message_context)
     end
 
     # @rbs (Hash[String, untyped], Hash[String, untyped]) -> void
-    def ensure_query_did_not_mutate_state!(state_before, state_after)
-      return unless message.delivery_mode == "sync"
+    def ensure_query_is_read_only!(state_before, state_after)
       return unless actor.class.definition.queries.key?(message.operation.to_sym)
-      return if state_after == state_before
 
-      raise InvalidActor, "query #{message.operation.inspect} mutated actor state"
+      raise QueryMutatedState, "query #{message.operation.inspect} mutated actor state" if state_after != state_before
+      raise QueryMutatedState, "query #{message.operation.inspect} staged durable work" if actor.intent_count.positive?
     end
 
     # @rbs (Hash[String, untyped], Hash[String, untyped]) -> Hash[String, untyped]

sig/generated/lib/solid_objects/actor.rbs

@@ -348,6 +348,9 @@ module SolidObjects
     # @rbs () -> void
     def discard_intents: () -> void
 
+    # @rbs () -> Integer
+    def intent_count: () -> Integer
+
     private
 
     attr_reader effect_intents: untyped
@@ -360,6 +363,9 @@ module SolidObjects
 
     attr_reader outbound_message_intents: untyped
 
+    # @rbs (String) { () -> untyped } -> untyped
+    def read_projection: (String) { () -> untyped } -> untyped
+
     # @rbs (String) { () -> untyped } -> untyped
     def guard_application_writes: (String) { () -> untyped } -> untyped