# Reactive architecture and workflow

Core owns HTTP/session/auth/database/template services. Reactive owns component
registration, state validation, signed context, the update endpoint, and browser
lifecycle. Admin will own component schemas and visual styling above Reactive.
Neither Core nor the skeleton requires Reactive or Admin.

Initial render: registered alias → initialize trusted state → authorize → mount →
query state → authorize → render body and signed wrapper.

Update: method/size/CSRF → verify signed session/context and query metadata → refresh authentication →
registered alias → restore snapshot → authorize → validate/apply writable changes →
authorize → component validation → allowlisted action permission/execution →
authorize → HTML, response-only refresh targets, and fresh signed wrapper.

Accepted state is applied as a complete batch before changed-property hooks run
in declaration order. Save actions may throw Core ValidationException to return
field errors with 422; database transactions belong to the action/application.
Initial query-state restoration omits update hooks so bookmarked search/page
combinations survive reloads.

Transport is htmx. The adapter deliberately disables htmx's DOM swap and hands
component updates to Alpine Morph. State binding belongs to the adapter; Alpine
remains available for local interactions. One runtime owns each lifecycle stage.
Per-component serialized requests prevent concurrent writes; sequence counters
prevent display of obsolete responses. URL merging updates only that component's
query keys. Browser history restoration currently uses a full reload.

The examples include a ProductTable with an edit modal and a dependent LocationForm. The form uses
the authenticated owner identity, reloads lookups and saves inside a transaction,
and keeps incomplete drafts separate from required-on-save validation. No form
schema or nested state API is introduced yet. Runtime contracts are proven with
regressions for tampering, typed/locked state, action permissions, revoked access,
expired sessions, multiple tables, slow responses, focus, strict CSP, and RTL.

The dialog adapter uses native dialog modality, preserves its open state through
morphing, wraps Tab focus, and closes locally before an explicit server discard
request. Save actions own transactions and optimistic record/version checks.
Successful mutation effects refresh other independent instances through their own
normal authorized endpoints; effects never become persistent snapshot state.
Server-side ownership/scope and version checks remain necessary across browsers.

Next milestones:

1. Resolve the outstanding Admin correctness findings, then integrate one Admin
   table and one Admin form; keep Core/Admin optionality tests.
2. Expand shared Actions, Forms, Tables and notification contracts from those integrations.
3. Evaluate typed nested form state, nested components, temporary uploads, durable component state, richer
   response effects, and navigation after the initial contracts are proven.

Do not expose arbitrary PHP methods or object hydration, or add uploads/navigation
to the initial milestone. Any extension to Core must be a general capability with
regressions proving existing MVC behavior remains compatible.