Realm — an isolated JS execution environment with its own global
object, call stack, and event loop (a tab, an iframe, or a worker each get
their own).
Hidden class / Shape — V8's internal representation of an object's
property layout, used to make property access fast for objects with
consistent shapes (§49).
Structured clone — the copying algorithm used by postMessage,
structuredClone(), and IndexedDB, supporting most built-in types but not
functions or DOM nodes (§38).
Cross-origin isolation — the COOP+COEP header combination required
to re-enable SharedArrayBuffer after the 2018 Spectre-driven lockdown
(§39).
Hydration — attaching client-side interactivity to server-rendered
static HTML without re-creating the DOM (§34).
Jank — a dropped or late frame, perceived as visual stutter, caused by
exceeding the ~16.6ms frame budget (§22).
Trap — a Proxy handler method that intercepts one internal operation
such as get, set or deleteProperty (§53).
Backpressure — a slow consumer signalling a fast producer to pause,
built into Web Streams through queue high-water marks (§54).
Temporal — the immutable, time-zone-aware date/time API that replaces
Date (§55).
WebGPU — the browser API for general-purpose GPU compute and
rendering, which in-browser ML runtimes are built on (§57).
Quantization — storing model weights in fewer bits (for example
4-bit), which shrinks LLM downloads and memory several times over (§58).
Tool calling — a model asking the application to run a named function
with JSON arguments, which is the basis of agents (§60).
Generative / actionable UI — interfaces chosen by an agent at run time
from a catalog of trusted components (§61).
Edge function — code that runs in V8 isolates in data centers near the
user, using web-standard Request/Response (§62).
IDOR — insecure direct object reference: an API trusting an object ID
from the client without checking ownership (§65).
Trusted Types — a CSP feature that makes DOM XSS sinks reject plain
strings (§65).
Prompt injection — instructions hidden in content an LLM reads,
hijacking its behavior (§66).
PKCE — Proof Key for Code Exchange: binds an OAuth authorization code
to the client that requested it (§67).
Passkey — a WebAuthn credential: a phishing-resistant key pair that
replaces passwords (§67).
Signal — a reactive value that tracks its readers and updates exactly
what depends on it (§71).
Browser context — Playwright's isolated, incognito-like browser
profile; one per test (§74).
Flaky test — a test that passes and fails on the same code;
--repeat-each finds them (§78).
INP — Interaction to Next Paint, the Core Web Vital for
responsiveness (§35, §83).
