Harden Inertia request state and SSR lifecycle

docs/plans/2026-07-12-0900-framework-coroutine-state-lifecycle-audit.md

@@ -990,9 +990,9 @@ An exceptionally large shared work unit may receive its own linked detail plan w
 
 This compact index routes the completed-work history that must be consulted with the full plan after compaction. Detailed history remains in the [companion ledger](2026-07-12-0915-framework-coroutine-state-lifecycle-audit-ledger.md).
 
-- **Active package or work unit:** None. `socialite` is complete; detail plan `2026-08-07-1416-socialite-correctness-first-party-extensibility-and-lifecycle.md`.
-- **Ledger entries required for the active work:** None. The completed Socialite work is recorded under `Complete Socialite correctness, first-party extensibility, and lifecycle`, with its cross-package findings recorded at their owning package entries.
-- **Pending revalidation carried into the active work:** None. Socialite revalidated `support-02` and completed `support-34`, `object-pool-04`, and `reverb-40` at their owning boundaries.
+- **Active package or work unit:** `inertia`; correctness and SSR lifecycle maintenance is recorded under `Complete Inertia correctness and SSR lifecycle maintenance`; detail plan `2026-08-07-2018-inertia-correctness-ssr-lifecycle-and-current-parity.md`. Current upstream DevTools is the next Inertia work unit.
+- **Ledger entries required for the active work:** `Complete Inertia correctness and SSR lifecycle maintenance`.
+- **Pending revalidation carried into the active work:** None. Inertia revalidated `support-02`; current upstream DevTools remains separately scoped before the package checklist can be completed.
 
 Update these three lines when a package starts, completes, or gains a cross-package dependency. Name exact work-unit headings or shared finding IDs from the companion ledger; never use “see recent entries” or require a full-ledger reread.
 
@@ -1053,7 +1053,7 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `queue-11` | `queue` | `events`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-11` |
 | `queue-12` | `bus`, `queue` | `events`, `bus`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-12` |
 | `foundation-01` | `foundation` | `support` and `foundation` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `foundation-01` |
-| `support-02` | `support` | `auth` (revalidation complete), `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia`, `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission`, `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing` (revalidation complete), `sanctum` (revalidation complete), `scout`, `session` (revalidation complete), `socialite` (revalidation complete), `telescope`, `testbench`; `translation` (revalidation complete); later full remaining consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
+| `support-02` | `support` | `auth` (revalidation complete), `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia` (revalidation complete), `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission`, `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing` (revalidation complete), `sanctum` (revalidation complete), `scout`, `session` (revalidation complete), `socialite` (revalidation complete), `telescope`, `testbench`; `translation` (revalidation complete); later full remaining consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
 | `macroable-03` | `macroable` | `cookie`, `log`, and `notifications` (revalidation complete); later full `jwt` audit | `Complete Macroable callable and test-state handling`; finding `macroable-03` |
 | `auth-01` | `support`, `auth` | `auth` (revalidation complete) | `Correct Support utility boundaries and authentication timing isolation`; finding `auth-01` |
 | `encryption-03` | `encryption` | `contracts`, `support`, `filesystem`, and `foundation` (revalidation complete) | `Harden encryption rotation, key publication, and global lifecycle state`; finding `encryption-03` |

docs/plans/2026-07-12-0915-framework-coroutine-state-lifecycle-audit-ledger.md

@@ -1967,6 +1967,31 @@ Append package entries in checklist order. Keep each entry compact but complete
 - **Validation and review:** Changed tests passed during implementation; focused Socialite, Support, Object Pool, and Reverb coverage, root and split Composer validation, facade and documentation checks, stale-symbol scans, formatting, both PHPStan configurations, the complete parallel components suite, Testbench package mode, dogfood, and `git diff --check` passed. Review independently reproduced the provider-namespace collision, stale config rebinding, nonce-disabled failure, partial-user memoization, and response-state risks, then signed off after every source and plan correction landed.
 - **Assessment:** Socialite is coroutine-safe, worker-lifecycle-aware, protocol-correct, current at the supported Laravel surface, and first-party extensible without ecosystem-manager machinery. Every accepted finding is fixed at its lowest owner; no stale response state, compatibility workaround, speculative abstraction, unresolved accepted defect, meaningful performance regression, or deferred TODO remains.
 
+### Complete Inertia correctness and SSR lifecycle maintenance
+
+- **Status and inspected surface:** Maintenance implementation, focused validation, the authoritative gate, fresh self-review, and independent code review are complete. The work covered every reported Inertia finding plus related request-state, response, resolver, SSR transport, command, provider, documentation, and test surfaces. Current upstream DevTools remains the next separate Inertia work unit, so the package checklist stays open. The detailed design is recorded in [`2026-08-07-2018-inertia-correctness-ssr-lifecycle-and-current-parity.md`](2026-08-07-2018-inertia-correctness-ssr-lifecycle-and-current-parity.md).
+
+| Findings | Final decision |
+|---|---|
+| `inertia-01`, `inertia-18`, `inertia-19`, `inertia-22` | Replicate one provider-boot state baseline into each request, centralize dispatch-once state, reserve the authoritative page payload, and clone mutable scroll props at each resolver path. |
+| `inertia-02`, `inertia-04`, `inertia-16` | Restore the version response header, append and deduplicate `Vary: X-Inertia` on the returned response, and replace only exact empty-string content. |
+| `inertia-03`, `inertia-15` | Add a configurable hot URL, let falsey environment configuration fall back to the Vite hot file, and treat a checked hot-file publication race as normal client rendering without a failure event. |
+| `inertia-05`–`inertia-08`, `inertia-23` | Throw on invalid page JSON, skip duplicate fallback encoding after successful SSR, preserve exact falsey protocol values, memoize resolved null scroll values, normalize numeric prop keys only at the string-path boundary, use strict protocol-list membership, and correct the owner annotations and method types that encoded the same false string-only assumption. |
+| `inertia-09`, `inertia-21` | Report actual SSR start/stop outcomes, keep runtime selection neutral, and use coroutine-scoped command signal ownership. |
+| `inertia-10`, `inertia-11` | Back off only after connection or malformed-transport failures, validate the exact SSR success shape, and normalize untrusted error metadata. |
+| `inertia-12`, `inertia-13`, `inertia-17` | Reuse one page finder, modernize provider resolution, and give the gateway contract and concrete class one worker identity. |
+| `inertia-14` | Add indexed Laravel-style SSR configuration guidance, document the raw-client testing seam and shutdown exception, and correct focused docblocks and test types. |
+| `inertia-20` | Keep current upstream DevTools as the immediately following implementation and documentation work unit. |
+
+- **Architecture and worker ownership:** One non-coroutine `InertiaState` stores provider-boot defaults; first request access shallow-clones it into coroutine context. Request state, page data, SSR dispatch/result, and request configuration never flow back to the baseline. The raw cookie-free SSR client, transport backoff, bundle detection, and successful page-finder cache remain bounded worker state. Mutable `ScrollProp` resolution is isolated per logical path without cloning arbitrary user props or walking the complete shared tree. `support-02` is revalidated through all Inertia identifier boundaries.
+- **DevTools follow-up:** Implement from current upstream after reviewing implementation PR `inertiajs/inertia-laravel#892`, follow-ups `#894`–`#897`, and documentation PR `inertiajs/docs#79`. PR `#895` landed, was reverted, and later re-landed, so use the current source rather than an intermediate diff. The current surface is `Collector.php`; `Data/{IncomingEntry,PropType,RequestType}.php`; `DevTools.php`; `DevToolsHeader.php`; `DevToolsServiceProvider.php`; `EntriesRepository.php`; `EntryStore.php`; `Http/{Authorize,EntriesController,PreserveFlashData,PreventPreviousUrlTracking}.php`; `IncomingEntryBuilder.php`; `PropClassifier.php`; `RedactsSensitiveData.php`; `RequestAttribute.php`; `RequestRecorder.php`; and `SourceLocator.php`.
+- **Important rejected concerns:** Do not replace the reusable SSR client with per-request facade calls; deep-clone arbitrary props or complete context; synchronize breaker discovery; retry failed renders; add a generic response schema, DTO hierarchy, clock, shutdown capability interface, file synchronization, cache invalidation registry, watcher, polling, raw socket, or daemon manager; or treat remote error metadata as authority over worker backoff.
+- **Regression coverage:** Tests prove boot/request state inheritance and sibling isolation; exact response headers and falsey boundaries; authoritative page rendering; JSON failure chains and SSR encoding short-circuiting; numeric prop paths and non-coercing reset/once membership; null, provider-produced, shared, and multi-path scroll props; configured, falsey, and file-backed hot URL selection plus publication races without synthetic failure events; every valid and malformed SSR response family; remote metadata normalization; event and throw behavior; connection/malformed backoff and healthy recovery; gateway/finder identity and cache behavior; Node, Bun, absolute runtime, signal ownership, child exit, health, refusal, and response-less shutdown paths; documentation claims; and cleanup/state invariants.
+- **Performance and complexity:** Healthy SSR preserves one reusable client and connection pool while removing a second full-page JSON encode. First request access performs one shallow state clone instead of allocating an unconfigured state; each resolved scroll prop adds one necessary shallow clone. Other request additions are bounded header-list, string, and response-shape checks. Finder singleton reuse preserves its existing successful lookup cache. No request path gains a lock, retry, poll, serializer layer, container loop, extra ordinary network round trip, unbounded cache, or retained request state.
+- **Laravel-facing result:** Supported Inertia methods, named arguments, props, middleware contracts, helpers, command options, runtimes, and protected extension points remain compatible. Hypervel retains its coroutine-safe state and reusable-client optimizations. Reserving the framework-owned `page` view key and strict-type key normalization correct internal protocol inconsistencies rather than removing documented application APIs.
+- **Validation and review:** Every changed test file and the complete Inertia suite passed. The final authoritative `composer fix` gate passed formatting, both PHPStan configurations, the complete parallel suite, Testbench package mode, and dogfood after the review corrections for falsey hot configuration, strict protocol membership, precise view-data precedence, complete method typing, and documentation. The boot-shared scroll regression added during self-review also passed its focused file. The prop annotations were corrected for contract truthfulness rather than a PHPStan failure. `git diff --check`, stale-symbol scans, caller/callee, API, state-lifetime, hot-path, failure-path, and overengineering review, and independent code-review sign-off are complete.
+- **Assessment:** The maintenance surface is coroutine-safe, failure-truthful, cache-preserving, and bounded for long-lived workers. Every accepted maintenance finding is fixed at its lowest owner without a workaround, speculative abstraction, meaningful performance regression, unintended Laravel API break, stale superseded path, or deferred defect. DevTools is the only remaining planned Inertia parity work.
+
 ### Complete Fortify correctness, current parity, and configuration contracts
 
 - **Status and inspected surface:** Complete; implementation, focused validation, the authoritative gate, fresh self-review, and independent code review are signed off. The audit covered Fortify source and tests, Foundation/Auth configuration ownership, package and Boost documentation, published configuration, current Laravel Fortify source and tests, originating changes, and carried `fortify-01`, `fortify-02`, and `auth-12`. The detailed design is recorded in [`2026-08-07-1807-fortify-correctness-current-parity-and-configuration-contracts.md`](2026-08-07-1807-fortify-correctness-current-parity-and-configuration-contracts.md).