# Browser Runtime

The browser runtime is the human-facing proof surface for TinyRustLM. It is not a remote chat service. It is a local static app that loads local project artifacts and calls the Rust/WASM runtime.

## What loads in the browser

The browser shell includes:

- static `index.html`;
- custom `app.css`;
- handwritten `app.js`;
- `runtime/tinyrustlm.wasm`;
- `runtime/tinyrustlm.wasm.manifest`;
- local `.slm` model files and `.slm.manifest` sidecars;
- optional `models/selector.registry`;
- generated `.module-plan.receipt`, `.assembly.receipt`, `.adapter-family.receipt`, and adapter manifests when a generated bundle is being tested.

## Runtime controls

The browser app can expose:

- model selection;
- prompt entry;
- deterministic and stochastic decoding controls;
- Generate;
- Step Token;
- Reset runtime context;
- Clear transcript;
- Adapter Sidecar apply;
- Model Provenance;
- Module Plan;
- Assembly Evidence;
- diagnostics and developer console.

## Local-only privacy boundary

The app is designed around local files and same-origin fetches. It should not silently call remote inference APIs. It should not download hidden model files from external hosts. It should not add telemetry, analytics, or remote logging unless the project explicitly changes that boundary.

## Browser-owned state versus Rust-owned state

The browser owns UI state and transcript rendering. Rust owns runtime state, model state, adapter apply state, diagnostics, and generation boundaries.

This matters because Clear should only clear browser transcript history, while Reset should clear runtime context/output state. Mixing those two actions would make diagnostics less trustworthy.

## Failure states are product behavior

The browser app should visibly handle:

- missing model files;
- malformed model files;
- checksum mismatches;
- model byte-budget rejection;
- text-sidecar budget rejection;
- oversized prompt bytes;
- context overflow;
- adapter identity mismatch;
- adapter checksum mismatch;
- generated receipt drift;
- failed WASM ABI calls.

These are not polish issues. They are the evidence that the runtime boundary is real.