Summary

• make ordinary observables invalidation-only by default
• require broadcast: :value before a projection may be persisted or sent as a scalar Turbo replacement
• keep default observables available to authorized component rendering and change detection
• bump the gem to 0.13.0 and update the README, realtime/security guidance, examples, architecture, schema documentation, ADR, roadmap, changelog, and lockfile

observable :recent_messages
observable :message_count, broadcast: :value

Security and compatibility

This is a breaking default change. An unqualified observable that rendered as a scalar in 0.12.x must add broadcast: :value. Forgetting the opt-in now produces a visible scalar-rendering error instead of silently persisting and sharing the value with every authorized actor subscriber.

No database migration is required. The 0.12.1 runtime already supports both broadcast modes, stores {} for invalidation-only rows, suppresses their scalar Turbo frames, and refreshes dependent components from committed state.

v0.12.1 is already published and did not include a deprecation warning for implicit value broadcasts. This 0.13.0 branch cannot add that warning retroactively, and warning after the safe default takes effect would penalize the intended API. If a warning period is required, publish a separate 0.12.2 maintenance release before merging and tagging this PR.

Test-first evidence

Before changing the default:

ActorTest#test_observables_default_to_invalidation-only
Expected true to not be truthy.

After implementation:

• bundle exec ruby -Itest test/unit/actor_test.rb
• bundle exec ruby -Itest test/integration/broadcasts_test.rb
• bundle exec ruby -Itest test/integration/actor_helper_test.rb
• bundle exec ruby -Itest test/integration/actor_channel_test.rb
• bundle exec rake test — 439 runs, 1,472 assertions, 0 failures, 0 errors, 14 environment-gated adapter skips before the final subscription-boundary assertion
• bundle exec rake rbs
• bundle exec rake — 440 runs, 1,474 assertions, 0 failures, 0 errors, 14 environment-gated adapter skips; Standard Ruby, RuboCop, RBS generation and validation, Steep, and Brakeman all passed; 0 security warnings

The skipped tests are PostgreSQL/MySQL version and reconciliation checks, PostgreSQL/Redis wake-up adapters, and database-specific lock cases. Observable persistence and rendering coverage was not skipped.