@christianirack/brainllm-runtime 0.3.1 → 0.4.0

package/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,211 @@
+web-features 3.44.0
+Source: https://github.com/web-platform-dx/web-features
+Official npm archive: https://registry.npmjs.org/web-features/-/web-features-3.44.0.tgz
+Published: 2026-10-22T16:30:26.001Z
+Data SHA-256: 72577e8df9c8abe8a8af86a03bc161ac06be21488d76857f157c7f83f017f706
+The license below is reproduced from package/LICENSE.txt in the integrity-verified official npm archive.
+Only the trailing blank line is omitted.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+Native compiler dependency licenses accompany each platform package in THIRD_PARTY_NOTICES.txt, CARGO_NOTICES.txt, CARGO_DEPENDENCIES.json RUST_STD_COPYRIGHT.html and RUST_TOOLCHAIN_COPYRIGHT.html. Launcher/initializer/runtime-only packages do not embed a Rust compiler binary.

package/brain-budget.js

@@ -0,0 +1,142 @@
+// Preventive checkpoints for compiler-owned code. Native/foreign calls cannot be preempted here.
+import { _rt, fx } from './brain.js'
+const I = _rt(), owners = new WeakMap(), active = []
+const LIMITS = Object.freeze({ steps: 1000000, depth: 128, ms: 200, rows: 100000, signals: 100000, resources: 1024, pending: 32, workerMs: 30000 })
+const now = () => globalThis.performance ? performance.now() : Date.now()
+const metaOf = m => ({ file: typeof m?.file === 'string' ? m.file.slice(0, 256) : null, component: typeof m?.component === 'string' ? m.component.slice(0, 80) : null, line: Number.isSafeInteger(m?.line) && m.line > 0 ? m.line : null, column: Number.isSafeInteger(m?.column) && m.column > 0 ? m.column : null })
+const limitsOf = options => Object.fromEntries(Object.entries(LIMITS).map(([k, max]) => [k, Number.isFinite(options?.[k]) && options[k] >= 1 ? Math.min(max, options[k]) : max]))
+const failure = (code, kind, limit, meta) => Object.assign(new Error(`${code}: ${kind} budget exceeded`), { code, kind: 'budget', budget: kind, limit, ...metaOf(meta), fix: kind === 'ms' || kind === 'steps' || kind === 'depth' ? 'Bound the work or move it to an owned worker.' : 'Bound the collection and dispose resources with their owner.' })
+function charge(root) {
+  if (root.running) { const t = now(); root.work += Math.max(0, t - root.started); root.started = t }
+}
+function enforce(frame, kind, value) {
+  const r = frame.root
+  if (r.error) throw r.error
+  if (value > r.limits[kind]) throw (r.error = failure('B0910', kind, r.limits[kind], frame.meta))
+}
+export function budgetOwner() { return I.owner() }
+export function budgetEnter(meta, owner = I.owner(), options) {
+  const parent = active[active.length - 1]
+  const root = parent?.root || { limits: limitsOf(options), steps: 0, work: 0, depth: 0, running: false, started: 0, error: null }
+  const f = { root, meta: metaOf(meta), owner, state: 'active' }
+  charge(root)
+  enforce(f, 'depth', root.depth + 1)
+  root.depth++
+  if (!root.running) { root.running = true; root.started = now() }
+  active.push(f)
+  return f
+}
+export function budgetStep(frame, site) {
+  if (!frame || frame.state !== 'active') throw failure('B0910', 'inactive-frame', 0, site)
+  if (site) frame.meta = metaOf(site)
+  const r = frame.root
+  charge(r)
+  enforce(frame, 'steps', ++r.steps)
+  enforce(frame, 'ms', r.work)
+}
+function detach(f) {
+  if (f.state !== 'active') return
+  const index = active.lastIndexOf(f)
+  if (index >= 0) active.splice(index, 1)
+  const r = f.root
+  charge(r)
+  r.depth--
+  if (!active.some(x => x.root === r)) r.running = false
+}
+export function budgetLeave(frame) {
+  if (!frame || frame.state === 'closed') return
+  detach(frame)
+  frame.state = 'closed'
+}
+// The outcome always resolves: the generated resume runs even on a rejected await, preserving catch/finally.
+export function budgetSuspend(frame, promise) {
+  detach(frame)
+  frame.state = 'suspended'
+  return Promise.resolve(promise).then(value => ({ ok: true, value }), error => ({ ok: false, error }))
+}
+export function budgetResume(frame, outcome) {
+  if (frame.state !== 'suspended') throw failure('B0910', 'inactive-frame', 0, frame.meta)
+  const r = frame.root
+  if (!r.running) { r.running = true; r.started = now() }
+  r.depth++
+  frame.state = 'active'
+  active.push(frame)
+  // Preserve the original rejection; a later checkpoint still sees a poisoned root.
+  if (!outcome.ok) throw outcome.error
+  budgetStep(frame)
+  return outcome.value
+}
+function ledger(owner, meta, options) {
+  if (!owner || typeof owner !== 'object') throw failure('B0911', 'missing-owner', 0, meta)
+  if (owner.s === 3) throw failure('B0911', 'disposed-owner', 0, meta)
+  let l = owners.get(owner)
+  if (!l) {
+    l = { limits: limitsOf(options), counts: Object.create(null), releases: new Set(), disposed: false }
+    owners.set(owner, l)
+    I.root(() => fx(() => () => {
+      l.disposed = true
+      owners.delete(owner)
+      for (const release of [...l.releases]) release()
+    }), owner)
+  }
+  if (l.disposed) throw failure('B0911', 'disposed-owner', 0, meta)
+  return l
+}
+// Core hook before owned sig construction / list materialization. Arrays may already exist at this point.
+export function budgetAllocation(kind, owner, units) {
+  if (!owner) return // Module-level shared state has no disposable component owner.
+  if (!['rows', 'signals'].includes(kind) || !Number.isSafeInteger(units) || units < 0) throw failure('B0911', 'invalid-allocation', 0, null)
+  const frame = active[active.length - 1]
+  const meta = frame?.meta
+  const l = ledger(owner, meta)
+  const next = kind === 'signals' ? (l.counts.signals || 0) + units : units
+  if (next > l.limits[kind]) throw failure('B0911', kind, l.limits[kind], meta)
+  l.counts[kind] = next
+}
+export function budgetClaim(owner, kind, units = 1, dispose, meta, options) {
+  const l = ledger(owner, meta, options)
+  if (!['rows', 'signals', 'resources', 'pending'].includes(kind) || !Number.isSafeInteger(units) || units < 0) throw failure('B0911', 'invalid-claim', 0, meta)
+  const count = l.counts[kind] || 0
+  if (count + units > l.limits[kind]) throw failure('B0911', kind, l.limits[kind], meta)
+  // Bound disposal bookkeeping independently of units (including zero-unit claims).
+  if (l.releases.size >= LIMITS.resources) throw failure('B0911', 'resources', LIMITS.resources, meta)
+  l.counts[kind] = count + units
+  let live = true
+  const release = () => {
+    if (!live) return
+    live = false
+    l.releases.delete(release)
+    l.counts[kind] -= units
+    if (dispose) {
+      try { dispose() } catch { I.oops(failure('B0911', 'cleanup', 0, meta), owner, 'budget') }
+    }
+  }
+  l.releases.add(release)
+  return release
+}
+// Caller must supply a Worker it created exclusively, never an unrelated shared worker.
+export function budgetWatchWorker(ownedWorker, rejectAll, meta, options) {
+  const limits = limitsOf(options), tasks = new Map()
+  let closed = false
+  const stop = (error = failure('B0911', 'worker-disposed', 0, meta)) => {
+    if (closed) return
+    closed = true
+    for (const timer of tasks.values()) clearTimeout(timer)
+    tasks.clear()
+    ownedWorker.terminate()
+    rejectAll(error)
+  }
+  return {
+    track(id) {
+      if (closed) throw failure('B0911', 'worker-disposed', 0, meta)
+      if (tasks.has(id)) throw failure('B0911', 'duplicate-worker-task', 0, meta)
+      if (tasks.size >= limits.pending) throw failure('B0911', 'pending', limits.pending, meta)
+      tasks.set(id, setTimeout(() => stop(failure('B0910', 'workerMs', limits.workerMs, meta)), limits.workerMs))
+      let live = true
+      return () => { if (live) { live = false; clearTimeout(tasks.get(id)); tasks.delete(id) } }
+    },
+    dispose: stop,
+  }
+}
+// Optional small core hook; old runtimes remain loadable while the compiler/runtime version gate handles upgrades.
+I.budget?.(budgetAllocation)

package/brain-data.js

@@ -327,9 +327,16 @@ function slot(origin, pri, sg) {
 // paths in api() are the app's own (`/users`): `<meta http base>` then the app's base path (<meta name="brain-base">)
 const appBase = () => {
   const m = G.document && document.querySelector('meta[name=brain-base]')
-  return m ? m.getAttribute('content').replace(/\/$/, '') : ''
+  const base = m && m.getAttribute('content') || ''
+  if (base && (!base.startsWith('/') || base.startsWith('//') || /[\\?#\x00-\x20]/.test(base))) throw Error('Invalid application base')
+  return base.replace(/\/$/, '')
+}
+const full = u => {
+  if (!u.startsWith('/') || u.startsWith('//')) return u
+  // Native account/media endpoints never inherit a foreign API base or send account credentials off origin.
+  if (u === '/_brain' || u.startsWith('/_brain/')) return appBase() + u
+  return (/^(?:https?:)?\/\//i.test(P.base) ? '' : appBase()) + P.base + u
 }
-const full = u => (u.startsWith('/') && !u.startsWith('//') ? appBase() + P.base + u : u)
 
 async function once(u, M, body, sg, pri, up) {
   const url = full(u), origin = new URL(url, G.location ? location.href : 'http://localhost').origin
@@ -368,7 +375,10 @@ async function once(u, M, body, sg, pri, up) {
   if (st >= 200 && st < 300) return { value: j, cacheable: !/no-store|private/i.test(h('cache-control') || '') }
   const ra = h('retry-after'), retryAfter = ra == null ? undefined : isNaN(ra) ? Math.max(0, (Date.parse(ra) - Date.now()) / 1e3) : +ra
   if (st === 401 && P.login && G.location && !location.pathname.endsWith(P.login)) location.assign(appBase() + P.login + '?next=' + encodeURIComponent(location.pathname + location.search))
-  throw new ApiError('http', (j && j.error) || `${M} ${u}: ${st}`, { status: st, errors: j && j.errors, retryAfter, id: h('x-request-id') || undefined })
+  const native = j && j.schemaVersion === 1 && j.error && typeof j.error === 'object' && typeof j.error.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(j.error.code)
+  const generic = st === 401 ? 'Authentication failed. Sign in again.' : st === 403 ? 'You do not have permission to continue.' : st === 422 ? 'Check the highlighted fields.' : st === 429 ? 'Too many requests. Wait before trying again.' : `Request failed (${st}).`
+  const message = !native && st < 500 && typeof j?.error === 'string' && j.error.length <= 512 && !/[\r\n]|(?:TypeError|ReferenceError|SyntaxError|Error):/.test(j.error) ? j.error : generic
+  throw new ApiError('http', message, { status: st, errors: native && st === 422 ? j.error.fields : j && j.errors, retryAfter, id: h('x-request-id') || undefined, ...(native ? { backendCode: j.error.code, fix: typeof j.error.fix === 'string' ? j.error.fix.slice(0,1024) : undefined } : {}) })
 }
 
 // multipart upload with progress (fetch has no upload progress)

package/brain-dev.js

@@ -1,12 +1,13 @@
 // BRAINLLM dev (SPEC §6.2): HMR that keeps sig state by name. Development only.
 // Served next to the core under /@brain/ and imports ./brain.js relatively: a single instance of the signal graph.
 // The dev codegen wraps each component: `export default dev(Counter)` and emits `sig(v, 'name')`.
-// v0 limit: if after an hmr a parent removes that row or branch, it removes the old nodes; then do a full reload.
+// Static proof retains node identity; incompatible nested updates rebuild a proven owner boundary before parent ranges can become stale.
 // Registry for brain-inspect (§9): `live` (hash → instances), `inst` (root node N → instance) and the event `bus`.
-import { _dev, fx } from './brain.js'
+import { _dev, fx, tpl } from './brain.js'
 
 let cur = null // instance under construction: { m: Map name→sig, r: Map name→value to restore | null }
 let quiet = 0 // >0 during hmr: the bus emits `hmr` instead of mount/dispose
+const definitions = new Map() // bounded current implementations for future mounts through an older import
 export const live = new Map()
 export const inst = new WeakMap()
 export const bus = new Set() // fn(kind, data): 'mount' | 'dispose' | 'hmr' | 'hydrate'
@@ -30,18 +31,22 @@ export { owner }
 
 function build(i, restore) {
   const pc = cur
-  cur = { m: new Map(), r: restore, f: i.C.f || i.h || null }
+  cur = { m: new Map(), r: restore, f: i.C.f || i.h || null, i }
   try {
     return root(d => {
       i.r = owner() // register before C(): fx from the first run already have an owner (inspector)
       inst.set(i.r, i)
       const t = performance.now()
-      const out = i.C(i.$p)
+      i.fragments = new Set()
+      i.fragmentRefs = 0
+      i.fragmentOverflow = false
+      let out = i.C(i.$p)
       i.$mt = performance.now() - t
       mounts.unshift({ comp: i.C.f || i.h || null, ms: Math.round(i.$mt * 100) / 100, at: Date.now(), hmr: quiet > 0 })
       if (mounts.length > 50) mounts.length = 50
       // a component may return a node, a fragment or an array (guard() returns its nodes plus an anchor)
-      i.n = Array.isArray(out) ? out.flat(Infinity) : out.nodeType === 11 ? [...out.childNodes] : [out]
+      i.n = out == null ? [] : Array.isArray(out) ? out.flat(Infinity) : out.nodeType === 11 ? [...out.childNodes] : [out]
+      if (!i.n.length) { out = document.createComment(''); i.n = [out] }
       for (const x of i.n) if (x.nodeType === 1) x.$i = i
       i.d = d
       i.m = cur.m
@@ -51,7 +56,9 @@ function build(i, restore) {
       // (last hovered or focused element, accessibility tree) and must not keep the whole instance with it
       fx(() => () => {
         set.delete(i)
+        if (!set.size) live.delete(i.h)
         for (const x of i.n || []) if (x.nodeType === 1 && x.$i === i) x.$i = null
+        if (!quiet) for (const node of i.n || []) node.remove()
         quiet || emit('dispose', i)
       })
       if (!quiet) emit('mount', i)
@@ -63,38 +70,194 @@ function build(i, restore) {
 }
 
 export function dev(C) {
-  const W = $p => build({ C, $p, h: C.h, p: owner(), n: null, d: null, m: null, r: null }, null)
+  const registered = typeof C.h === 'string' && (definitions.has(C.h) || definitions.size < 1024)
+  if (registered) definitions.set(C.h, C)
+  const W = $p => build({ C: definitions.get(C.h) || C, $p, h: C.h, p: owner(), n: null, d: null, m: null, r: null }, null)
   Object.assign(W, C) // h, p, form, seo, head… whatever the compiler (or guard) put on it
   W.C = C
+  if (typeof C.h === 'string' && !registered) W.$hmrUnsupportedReason = 'definition-registry-budget'
   return W
 }
 
-// Remounts in place every live instance of `hash` with the new component from `mod`.
+// Compiler-only fragment factories record pristine references before dynamic holes insert/move siblings.
+// Per-owner cleanup prevents inactive branches/rows from retaining detached nodes.
+export function fragment(create, hash, index) {
+  let cached = null, factory = create
+  return () => {
+    let i = cur?.i?.h === hash ? cur.i : null
+    for (let o = owner(); !i && o; o = o.p) { const found = inst.get(o); if (found?.h === hash) i = found }
+    const html = i?.C?.$hmr?.templates?.[index]
+    if (typeof html === 'string' && html !== cached) { cached = html; factory = tpl(html) }
+    const out = factory()
+    if (!i || i.fragmentOverflow) return out
+    const nodes = [], roots = out.nodeType === 11 ? [...out.childNodes] : [out]
+    const rootSet = new Set(roots)
+    const visit = (node, depth) => {
+      if (depth > 64 || nodes.length >= 4096) return false
+      nodes.push({ node, parent: node.parentNode, root: rootSet.has(node) })
+      for (const child of node.childNodes || []) if (!visit(child, depth + 1)) return false
+      return true
+    }
+    if (!roots.every(node => visit(node, 0)) || i.fragmentRefs + nodes.length > 8192 || i.fragments.size >= 2048) { i.fragmentOverflow = true; return out }
+    const record = { index, nodes, owner: owner() }
+    i.fragments.add(record)
+    i.fragmentRefs += nodes.length
+    fx(() => () => { if (i.fragments.delete(record)) i.fragmentRefs -= nodes.length })
+    return out
+  }
+}
+
+export let lastUpdate = { mode: 'none', patched: 0, remounted: 0, reason: 'not-run' }
+const safeAttribute = name => ['class', 'title', 'alt', 'placeholder', 'style'].includes(name) || name.startsWith('aria-') || name.startsWith('data-') && !['data-b', 'data-cv-ref'].includes(name)
+const attributes = node => new Map([...node.attributes].map(attribute => [attribute.name, attribute.value]))
+function metadata(value) {
+  return value?.version === 1 && typeof value.wiring === 'string' && value.wiring.length <= 65536 && Array.isArray(value.templates) && value.templates.length <= 64 && value.templates.every(html => typeof html === 'string') && value.templates.reduce((n, html) => n + html.length, 0) <= 65536
+}
+function templateChanges(before, after) {
+  const changes = [], shapes = []
+  let visits = 0
+  for (let index = 0; index < before.length; index++) {
+    const old = tpl(before[index])(), next = tpl(after[index])(), flat = []
+    const walk = (a, b, depth) => {
+      if (++visits > 8192 || depth > 64) throw Error('template-budget')
+      if (!a || !b || a.nodeType !== b.nodeType || a.nodeName !== b.nodeName || a.namespaceURI !== b.namespaceURI) throw Error('template-topology')
+      const position = flat.length
+      flat.push(a)
+      if (a.nodeType === 3 && a.data !== b.data) changes.push({ index, position, kind: 'text', before: a.data, after: b.data })
+      else if (a.nodeType === 8 && a.data !== b.data) throw Error('anchor-topology')
+      if (a.nodeType === 1) {
+        const previous = attributes(a), current = attributes(b)
+        for (const name of new Set([...previous.keys(), ...current.keys()])) if (previous.get(name) !== current.get(name)) {
+          if (!safeAttribute(name)) throw Error('stateful-or-unsupported-attribute')
+          changes.push({ index, position, kind: 'attribute', name, before: previous.get(name) ?? null, after: current.get(name) ?? null })
+        }
+      }
+      if (a.childNodes.length !== b.childNodes.length) throw Error('template-topology')
+      for (let n = 0; n < a.childNodes.length; n++) walk(a.childNodes[n], b.childNodes[n], depth + 1)
+    }
+    const a = old.nodeType === 11 ? [...old.childNodes] : [old], b = next.nodeType === 11 ? [...next.childNodes] : [next]
+    if (a.length !== b.length) throw Error('template-topology')
+    for (let n = 0; n < a.length; n++) walk(a[n], b[n], 0)
+    shapes.push(flat)
+  }
+  return { changes, shapes }
+}
+function staticPlan(i, C) {
+  const before = i.C.$hmr, after = C.$hmr
+  if (!metadata(before) || !metadata(after)) return 'metadata-unavailable-or-budget'
+  if (before.wiring !== after.wiring) return 'compiled-wiring-changed'
+  if (before.templates.length !== after.templates.length) return 'template-topology'
+  if (i.fragmentOverflow) return 'instance-reference-budget'
+  let analysis
+  try { analysis = templateChanges(before.templates, after.templates) } catch (error) { return ['template-budget', 'template-topology', 'anchor-topology', 'stateful-or-unsupported-attribute'].includes(error.message) ? error.message : 'template-proof-failed' }
+  const operations = []
+  for (const record of i.fragments || []) {
+    const shape = analysis.shapes[record.index]
+    if (!shape || shape.length !== record.nodes.length) return 'instance-shape-conflict'
+    for (const change of analysis.changes) if (change.index === record.index) {
+      const entry = record.nodes[change.position], node = entry?.node
+      if (!node || node.nodeType !== shape[change.position].nodeType || !entry.root && node.parentNode !== entry.parent) return 'instance-node-conflict'
+      if (change.kind === 'text' ? node.data !== change.before : node.getAttribute(change.name) !== change.before) return 'runtime-owned-content-conflict'
+      operations.push({ node, ...change })
+      if (operations.length > 8192) return 'instance-operation-budget'
+    }
+  }
+  return { i, C, operations }
+}
+function applyStaticPlan({ i, C, operations }) {
+  // Plan first; preserve live handlers/effects/owners and target the original nodes only.
+  const selection = document.getSelection?.()
+  const saved = selection?.rangeCount ? { anchor: selection.anchorNode, anchorOffset: selection.anchorOffset, focus: selection.focusNode, focusOffset: selection.focusOffset } : null
+  try {
+    for (const operation of operations) {
+      if (operation.kind === 'text') operation.node.data = operation.after
+      else if (operation.after === null) operation.node.removeAttribute(operation.name)
+      else operation.node.setAttribute(operation.name, operation.after)
+    }
+  } catch { return 'native-dom-patch-failed' }
+  if (saved && selection.setBaseAndExtent) {
+    const length = node => node?.nodeType === 3 ? node.data.length : node?.childNodes.length || 0
+    try { selection.setBaseAndExtent(saved.anchor, Math.min(saved.anchorOffset, length(saved.anchor)), saved.focus, Math.min(saved.focusOffset, length(saved.focus))) } catch {}
+  }
+  i.C = C
+  return null
+}
+
+// A parent list/branch keeps its own node range. Replacing a child range directly would leave those
+// captured roots stale, so incompatible nested updates rebuild the outermost owned component once.
+function boundary(i) {
+  let target = i, count = 0
+  for (let owner = i.p; owner; owner = owner.p) {
+    if (++count > 256) return null
+    const ancestor = inst.get(owner)
+    if (ancestor) target = ancestor
+  }
+  return !target.p || !target.p.f && !target.p.p ? target : null
+}
+function under(i, ancestor) {
+  if (i === ancestor) return true
+  let count = 0
+  for (let owner = i.p; owner && ++count <= 256; owner = owner.p) if (owner === ancestor.r) return true
+  return false
+}
+function remount(i, C) {
+  const old = i.n, parent = old[0]?.parentNode
+  const anchor = document.createComment('')
+  if (parent) parent.insertBefore(anchor, old[0])
+  const values = new Map([...i.m].map(([name, node]) => [name, node._]))
+  i.d()
+  emit('dispose', { h: i.h, C: i.C, n: old, r: null, hmr: 1 })
+  i.C = C
+  build(i, values)
+  if (parent) for (const node of i.n) parent.insertBefore(node, anchor)
+  for (const node of old) node.remove()
+  anchor.remove()
+}
+// Safe static fragments retain node identity. Other updates rebuild a proven owner boundary.
 export function hmr(hash, mod) {
-  const W = Object.values(mod).find(c => c && c.h === hash)
+  const W = Object.values(mod).find(component => component && component.h === hash)
   if (!W) return 0
   const C = W.C || W
-  let k = 0
+  if (W.$hmrUnsupportedReason) { lastUpdate = { mode: 'reload-required', patched: 0, remounted: 0, reason: W.$hmrUnsupportedReason }; return 0 }
+  const instances = [...(live.get(hash) || [])].filter(i => i.r?.s !== 3)
+  const plans = [], rebuild = new Map(), reasons = new Set(), patched = new Set()
+  for (const i of instances) {
+    let plan
+    try { plan = staticPlan(i, C) } catch { plan = 'native-proof-operation-failed' }
+    if (typeof plan !== 'string') { plans.push(plan); continue }
+    const target = boundary(i)
+    if (!target) { lastUpdate = { mode: 'reload-required', patched: 0, remounted: 0, reason: 'parent-range-owner-unavailable' }; return 0 }
+    reasons.add(plan)
+    if (target !== i) reasons.add('ancestor-remount-for-parent-owned-range')
+    rebuild.set(target, definitions.get(target.h) || target.C)
+  }
+  let affected = 0, remounted = 0, ancestors = 0
   quiet++
   try {
-    for (const i of [...(live.get(hash) || [])]) {
-      const old = i.n, pa = old[0].parentNode
-      // an anchor that survives the dispose (guard() removes its own nodes when its owner is disposed)
-      const first = document.createComment('')
-      if (pa) pa.insertBefore(first, old[0])
-      const vals = new Map([...i.m].map(([name, n]) => [name, n._]))
-      i.d()
-      emit('dispose', { h: i.h, C: i.C, n: old, r: null, hmr: 1 })
-      i.C = C
-      build(i, vals)
-      if (pa) for (const x of i.n) pa.insertBefore(x, first)
-      for (const x of old) x.remove()
-      first.remove()
-      k++
+    for (const plan of plans) {
+      if ([...rebuild.keys()].some(target => under(plan.i, target))) continue
+      const failure = applyStaticPlan(plan)
+      if (!failure) patched.add(plan.i)
+      else {
+        const target = boundary(plan.i)
+        if (!target) { lastUpdate = { mode: 'reload-required', patched: patched.size, remounted, reason: 'native-patch-failed-without-owned-range' }; return 0 }
+        rebuild.set(target, definitions.get(target.h) || target.C)
+        reasons.add(failure)
+        if (target !== plan.i) reasons.add('ancestor-remount-for-parent-owned-range')
+      }
     }
-  } finally {
-    quiet--
-  }
-  emit('hmr', { h: hash, n: k })
-  return k
+    for (const [target, implementation] of rebuild) {
+      if (target.r?.s === 3) continue
+      const covered = instances.filter(i => under(i, target)).length
+      for (const i of patched) if (under(i, target)) patched.delete(i)
+      if (target.h !== hash) ancestors++
+      remount(target, implementation)
+      affected += covered
+      remounted++
+    }
+  } finally { quiet-- }
+  const count = patched.size + affected
+  lastUpdate = { mode: !count ? 'future-mount-updated' : remounted ? patched.size ? 'mixed' : ancestors ? 'ancestor-remount' : 'component-remount' : 'static-fragment', patched: patched.size, remounted, ancestorRemounted: ancestors, reason: [...reasons].join(',') || (!count ? 'no-live-instance; current-definition-retained' : 'exact-compiled-wiring-and-template-shape'), stateRestoration: ancestors ? 'ancestor-named-state; descendant-instances-recreated' : 'named-state-or-static-identity' }
+  emit('hmr', { h: hash, n: count, ...lastUpdate })
+  return count
 }