@kudzujs/core 0.13.2 → 0.13.3

package/PERFORMANCE.md

@@ -6,6 +6,34 @@ Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm ru
 
 The maintained 2026-08-13 comparison used Node 24.14.0 and an Intel Core i5-9500 Linux x64 host, one warm-up, and seven alternating fresh-process samples against clean `v0.8.44`. A narrow fast path skips Kudzu semantic transformation for 450 plain `.ts` modules whose runtime edges are exclusively resolvable relative TypeScript imports or exports; all other modules retain the existing transformer. Compile median fell from 2,323.9 ms to 1,413.2 ms (39.2%) and clean-build median from 3,325.3 ms to 2,382.4 ms (28.4%); every paired sample improved. Compile peak-RSS median fell from 571.2 MiB to 552.6 MiB, while build peak RSS was 570.9 MiB versus 568.8 MiB. Compiler scratch fell from 7,328,390 to 1,971,061 bytes. Both targets emitted the same 50 static HTML files, 10,980 bytes, and deploy SHA-256 `e107d78a7f55bc8a1af0ea6e53efeffa19b3d44d21c892484d103fa346e7ba7b`. This is a source-scale compiler comparison, not a cross-framework result.
 
+## 0.13.3 File Upload Boundary
+
+Measured 2026-08-25 on Linux x64 with Node 24.14.0 and Chrome
+142.0.7444.175. Required Chrome proves plain-text type and 1 KiB size
+validation before any request, native file reading, `FormData`/fetch upload,
+user cancellation, delayed failure and retry, route-departure abort, and
+successful keyed attachment mutation.
+
+The application emits 44 files totaling 150,023 raw / 50,240 aggregate gzip
+bytes with deploy SHA-256
+`a16fd5dbc08086aa6a7c0ec0aba3a38fbe2a63b96005a81e8747a7f4e45e214e`.
+The two-route session remains 17 JavaScript files and totals 71,031 raw / 25,304
+aggregate gzip bytes, 2,367 raw / 557 gzip bytes above `0.13.2`. `/help`
+remains 0 B JavaScript. The added bytes are route-specific authored file
+validation, multipart upload, effect cleanup, and keyed attachment behavior;
+there is no upload runtime.
+
+Navigation samples are `[3.7, 5.0, 3.5, 3.7, 3.8, 3.8, 4.0]` ms, with a 3.8
+ms median and 3.5/5.0 ms minimum/maximum. This changes the destination, so no
+same-content runtime regression or improvement claim is made.
+
+Core semantic LOC remains 5,682 with zero new semantic primitives, IR kinds,
+compiler passes, production compiler/runtime lines, normalization rules,
+adapters, runtime concepts, public APIs, upload schedulers, or transfer
+runtimes. Fetch does not expose upload progress, so the application states that
+boundary instead of fabricating progress. Chunking, resume, background sync,
+and files above the authored 1 KiB in-memory text limit remain unsupported.
+
 ## 0.13.2 Multistep Draft And Autosave
 
 Measured 2026-08-25 on Linux x64 with Node 24.14.0 and Chrome

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.13.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.13.2 - Multistep draft and autosave.** Native step validation, debounced versioned saves, stale-write rejection, navigation and reload restoration, conflict retention, and reset compose without a wizard or autosave runtime. Read the [release notes](./RELEASES.md#0132---multistep-draft-and-autosave), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.13.2), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.13.3 - File upload boundary.** Native file validation, multipart upload, cancellation, failure and retry, route cleanup, and keyed attachment mutation compose without an upload runtime. Read the [release notes](./RELEASES.md#0133---file-upload-boundary), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.13.3), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,59 @@
 # Kudzu Releases
 
+## 0.13.3 - File Upload Boundary
+
+Kudzu 0.13.3 composes a bounded file-upload lifecycle from native controls,
+ordinary state, owned effects, and keyed rows without an upload runtime.
+
+### Changed in 0.13.3
+
+- Added one native plain-text file input with type and 1 KiB size validation
+  before any request.
+- Added application-owned `FormData` and fetch upload with an owned
+  `AbortController`.
+- Added explicit user cancellation, delayed transport failure, and retry without
+  requiring file reselection.
+- Aborted in-flight upload work when enhanced navigation releases the route.
+- Added successful keyed attachment mutation and an explicit statement that
+  fetch does not expose upload progress.
+- Updated `create-kudzu@0.1.121` to generate projects on
+  `@kudzujs/core@^0.13.3`.
+
+### Output Evidence
+
+- The application emits 44 files totaling 150,023 raw / 50,240 aggregate gzip
+  bytes with deploy digest
+  `a16fd5dbc08086aa6a7c0ec0aba3a38fbe2a63b96005a81e8747a7f4e45e214e`.
+- The maintained two-route session remains 17 JavaScript files and totals
+  71,031 raw / 25,304 aggregate gzip bytes; `/help` remains 0 B JavaScript.
+- No semantic primitive, IR kind, compiler pass, production compiler/runtime
+  line, normalization rule, adapter, runtime concept, public API, upload
+  scheduler, or transfer runtime was added.
+
+### Validation
+
+- Required Chrome proves pre-request validation, user cancellation, delayed
+  `503` feedback, retry, successful attachment mutation, and route-departure
+  cancellation.
+- The complete suite passes 273 tests, including the preserved draft, nested
+  form, authentication, routing, and server retry journeys.
+- Seven fresh Chrome profiles record a 3.8 ms list-to-detail median with a
+  3.5-5.0 ms range. The destination changed, so no same-content latency change
+  is claimed.
+
+### Limits
+
+Fetch upload progress is unavailable and no fake progress is rendered. Chunking,
+resume, background sync, binary formats, concurrent files, and files above the
+authored 1 KiB in-memory text limit remain unsupported until a real application
+requires a different transport.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.13.3
+```
+
 ## 0.13.2 - Multistep Draft And Autosave
 
 Kudzu 0.13.2 composes a persistent two-step draft and debounced server save

package/docs/next-architecture/application-capability-release-plan.md

@@ -834,6 +834,38 @@ no same-content latency regression or improvement is claimed.
 - **Done condition:** the supported transport and unsupported progress/resume
   boundary are explicit and tested.
 
+Development evidence is complete. The Alpha application accepts one plain-text
+attachment up to 1 KiB, rejects invalid type and size before any request, reads
+the selected file into bounded route state, and reconstructs it as a `Blob` in
+one dependency effect that owns `FormData`, fetch, and `AbortController`.
+Required Chrome proves explicit user cancellation, delayed `503` feedback,
+retry without reselection, successful keyed attachment mutation, and exact
+abort when enhanced navigation releases the route.
+
+The first failing fixture was the `0.13.3` project-application contract against
+the released `0.13.2` Alpha route. Existing native file handlers, ordinary
+state, dependency invalidation, effect cleanup, owned fetch, route release, and
+keyed list identity close it without a semantic primitive, IR kind, compiler
+pass, production compiler/runtime line, normalization rule, adapter, runtime
+concept, public API, upload scheduler, or transfer runtime. The machine-readable
+decision is `closed-by-application-composition`.
+
+Fetch does not expose upload progress, so the application renders that boundary
+explicitly and does not emit a fake progress element. Chunking, resume,
+background sync, binary formats, multiple concurrent files, and files above the
+authored 1 KiB in-memory text limit remain unsupported. Add a different
+transport only when a real application requires one of those capabilities.
+
+The application emits 44 files totaling 150,023 raw / 50,240 aggregate gzip
+bytes with deploy SHA-256
+`a16fd5dbc08086aa6a7c0ec0aba3a38fbe2a63b96005a81e8747a7f4e45e214e`.
+The maintained two-route session remains 17 JavaScript files and grows by 2,367
+raw / 557 aggregate gzip bytes to 71,031 / 25,304 bytes; `/help` remains 0 B
+JavaScript. Seven fresh Linux x64 Chrome 142 profiles record list-to-detail
+samples of `[3.7, 5.0, 3.5, 3.7, 3.8, 3.8, 4.0]` ms, a 3.8 ms median and
+3.5/5.0 ms range. The destination content changed, so no same-content latency
+regression or improvement is claimed.
+
 ## `0.14.x`: Lists, Tables, And Virtualization
 
 ### `0.14.0`: Project Table CRUD And Identity
@@ -1332,5 +1364,6 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.13.0` | Released | Preserve native constraints, server feedback, focused field errors, retained input, and retry evidence. | None |
 | `0.13.1` | Released | Preserve application-owned nested metadata, keyed row identity, release, and reset evidence. | None |
 | `0.13.2` | Released | Preserve multistep validation, versioned persistence, stale-save rejection, conflict retention, and reset evidence. | None |
-| `0.13.3` | Active | Complete the file upload boundary packet. | None |
-| `0.14.0` onward | Blocked | Complete the `0.13.3` release transaction first. | Ordered patch boundary |
+| `0.13.3` | Released | Preserve the published upload validation, cancellation, retry, route cleanup, and attachment mutation evidence. | None |
+| `0.14.0` | Active | Add the first failing project-table CRUD and retained-identity fixture. | None |
+| `0.14.1` onward | Blocked | Complete or explicitly close `0.14.0` first. | Ordered patch boundary |

package/docs/next-architecture/versioning.md

@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.120` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.13.2`.
+`create-kudzu@0.1.121` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.13.3`.
 
 ## Release Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",