@kudzujs/core 0.13.3 → 0.14.1

package/PERFORMANCE.md

@@ -2,10 +2,64 @@
 
 Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, and `npm run benchmark:source-scale` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
 
+## 0.14.1 Nested Object-State Collections
+
+Measured 2026-08-26 on Linux x64 with Node 24.14.0 and Chrome
+142.0.7444.175.
+
+The project route now roots its selected project table and nested issue rows in
+one direct `projectData.projects` field. Required Chrome proves immutable
+whole-object replacement, nested insert/update/reorder/remove/re-add, retained
+identity, latest handlers, descendant state release, and fresh remount. `/help`
+remains 0 B JavaScript.
+
+The application emits 44 files totaling 164,305 raw / 52,185 aggregate gzip
+bytes with deploy SHA-256
+`0a3b7e10b3447a76a9c04ef34ad7c2bfa30400ea53c9d16fc85b1c7cbf2ea203`.
+The two-route session remains 17 JavaScript files and totals 74,826 raw / 26,204
+aggregate gzip bytes. The delta from `0.14.0` includes the authored nested issue
+controls and handlers plus one build-time validation-line edit and one production
+list-runtime line; no semantic primitive, IR kind, compiler pass, runtime concept,
+or public API was added.
+
+Table update samples are
+`[0.8, 0.8, 0.7, 0.8, 0.9, 0.8, 0.8]` ms, with a 0.8 ms median and 0.7/0.9 ms
+minimum/maximum. Navigation samples are
+`[3.7, 4.1, 4.5, 3.9, 4.2, 3.9, 4.3]` ms, with a 4.1 ms median and 3.7/4.5 ms
+minimum/maximum. The navigation ranges overlap the `0.14.0` release evidence;
+no improvement or regression claim is made.
+
 `npm run benchmark:source-scale` generates its fixture outside the repository so 50,000 lines of synthetic source are not tracked. The default topology is 50 pages plus 450 route-owned imported modules. Generation is excluded from timing; fresh-process samples separately report source reads, reachable-graph discovery, source compilation, clean production build, compiler-result and deploy digests, output files/bytes, cache counters, and peak RSS. `ROUTES`, `MODULES_PER_ROUTE`, `FILLER_LINES`, `WARMUPS`, and `RUNS` may reduce or expand the fixture without changing the default acceptance floor. `TARGET_ROOT` measures another checkout; `BASELINE_ROOT` alternates that checkout with the current tree and requires identical deploy output.
 
 The maintained 2026-08-13 comparison used Node 24.14.0 and an Intel Core i5-9500 Linux x64 host, one warm-up, and seven alternating fresh-process samples against clean `v0.8.44`. A narrow fast path skips Kudzu semantic transformation for 450 plain `.ts` modules whose runtime edges are exclusively resolvable relative TypeScript imports or exports; all other modules retain the existing transformer. Compile median fell from 2,323.9 ms to 1,413.2 ms (39.2%) and clean-build median from 3,325.3 ms to 2,382.4 ms (28.4%); every paired sample improved. Compile peak-RSS median fell from 571.2 MiB to 552.6 MiB, while build peak RSS was 570.9 MiB versus 568.8 MiB. Compiler scratch fell from 7,328,390 to 1,971,061 bytes. Both targets emitted the same 50 static HTML files, 10,980 bytes, and deploy SHA-256 `e107d78a7f55bc8a1af0ea6e53efeffa19b3d44d21c892484d103fa346e7ba7b`. This is a source-scale compiler comparison, not a cross-framework result.
 
+## 0.14.0 Project Table CRUD And Identity
+
+Measured 2026-08-26 on Linux x64 with Node 24.14.0 and Chrome
+142.0.7444.175. Required Chrome proves native table insert, update, delete,
+reorder, sort, filter, selection, keyboard focus, row-local edit state, and
+retained keyed DOM identity.
+
+The application emits 44 files totaling 159,258 raw / 51,627 aggregate gzip
+bytes with deploy SHA-256
+`ebb3358e7a03612459e723ae765c39d105498db9d293415b924f1066cddf4793`.
+The two-route session remains 17 JavaScript files and totals 73,304 raw / 25,930
+aggregate gzip bytes, 2,273 raw / 626 gzip bytes above `0.13.3`. `/help`
+remains 0 B JavaScript. The added bytes are route-specific authored table
+handlers, bindings, selectors, and keyed row state; there is no data-grid
+runtime.
+
+Table update samples are `[0.7, 0.8, 1.0, 0.7, 1.1, 0.7, 0.8]` ms, with a 0.8
+ms median and 0.7/1.1 ms minimum/maximum. Navigation samples are
+`[3.9, 3.9, 5.5, 4.2, 6.1, 3.5, 3.4]` ms, with a 3.9 ms median and 3.4/6.1 ms
+minimum/maximum. Table update is a new measurement, so no same-content latency
+delta is claimed.
+
+Core semantic LOC remains 5,682 with zero new semantic primitives, IR kinds,
+compiler passes, production compiler/runtime lines, normalization rules,
+adapters, runtime concepts, public APIs, or data-grid runtimes. Infinite loading,
+windowing, and the 10,000-row strategy remain later measured decisions.
+
 ## 0.13.3 File Upload Boundary
 
 Measured 2026-08-25 on Linux x64 with Node 24.14.0 and Chrome

package/README.md

@@ -12,9 +12,9 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 *Watch: React-shaped TSX to static HTML and route-specific ESM in 22 seconds.*
 
-> Experimental `0.13.x`: the compiler API and supported TSX surface may change.
+> Experimental `0.14.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.13.3 - File upload boundary.** Native file validation, multipart upload, cancellation, failure and retry, route cleanup, and keyed attachment mutation compose without an upload runtime. Read the [release notes](./RELEASES.md#0133---file-upload-boundary), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.13.3), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.14.1 - Nested and object-state collections.** Direct immutable array fields of ordinary object state now compose root and nested keyed ownership with retained identity, latest handlers, and exact row-state release. Read the [release notes](./RELEASES.md#0141---nested-and-object-state-collections), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.14.1), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,101 @@
 # Kudzu Releases
 
+## 0.14.1 - Nested And Object-State Collections
+
+Kudzu 0.14.1 lets one direct immutable array field of ordinary object state own
+a root keyed collection and its nested direct-property lists.
+
+### Changed in 0.14.1
+
+- Allowed compiler-proven object-state collection roots without authored field
+  state.
+- Initialized binding-backed roots before nested row ownership mounts.
+- Preserved project and issue DOM identity through immutable replacement and
+  nested update, reorder, and removal.
+- Preserved latest-item handlers and released descendant row state exactly.
+- Recreated removed and re-added nested rows with fresh local state.
+- Updated `create-kudzu@0.1.123` to generate projects on
+  `@kudzujs/core@^0.14.1`.
+
+### Output Evidence
+
+- The application emits 44 files totaling 164,305 raw / 52,185 aggregate gzip
+  bytes with deploy digest
+  `0a3b7e10b3447a76a9c04ef34ad7c2bfa30400ea53c9d16fc85b1c7cbf2ea203`.
+- The maintained two-route session remains 17 JavaScript files and totals
+  74,826 raw / 26,204 aggregate gzip bytes; `/help` remains 0 B JavaScript.
+- No semantic primitive, IR kind, compiler pass, runtime concept, or public API
+  was added. One build-time validation line changed and one list-runtime line
+  was added.
+
+### Validation
+
+- Required Chrome proves immutable whole-object replacement, nested issue
+  insert, update, reorder, removal, re-addition, retained identity, latest
+  handlers, descendant state release, and fresh remount.
+- The complete suite passes 274 tests, package smoke, and serialized required-
+  Chrome execution.
+- Seven fresh Chrome profiles record a 0.8 ms table-update median with a
+  0.7-0.9 ms range and a 4.1 ms navigation median with a 3.7-4.5 ms range.
+
+### Limits
+
+Collection roots require one direct static array field and immutable whole-
+object replacement. Dynamic or computed paths, mutation, and non-array fields
+remain unsupported.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.14.1
+```
+
+## 0.14.0 - Project Table CRUD And Identity
+
+Kudzu 0.14.0 composes a complete native project table from ordinary state,
+collection selectors, and keyed ownership without a data-grid runtime.
+
+### Changed in 0.14.0
+
+- Replaced the project article list with valid native table structure.
+- Added project insertion, inline name editing, save, and deletion.
+- Added reorder, immutable name sorting, active filtering, and row selection.
+- Preserved keyed row and draft-input identity through reorder and sort.
+- Recreated removed rows with fresh local state after filter restoration.
+- Kept editor controls mounted with native `hidden` and verified keyboard focus.
+- Updated `create-kudzu@0.1.122` to generate projects on
+  `@kudzujs/core@^0.14.0`.
+
+### Output Evidence
+
+- The application emits 44 files totaling 159,258 raw / 51,627 aggregate gzip
+  bytes with deploy digest
+  `ebb3358e7a03612459e723ae765c39d105498db9d293415b924f1066cddf4793`.
+- The maintained two-route session remains 17 JavaScript files and totals
+  73,304 raw / 25,930 aggregate gzip bytes; `/help` remains 0 B JavaScript.
+- No semantic primitive, IR kind, compiler pass, production compiler/runtime
+  line, runtime concept, public API, or data-grid runtime was added.
+
+### Validation
+
+- Required Chrome proves insert, update, delete, reorder, sort, filter,
+  selection, keyboard access, row-local edit state, and retained DOM identity.
+- The complete suite passes 273 tests.
+- Seven fresh Chrome profiles record a 0.8 ms table-update median with a
+  0.7-1.1 ms range and a 3.9 ms navigation median with a 3.4-6.1 ms range.
+
+### Limits
+
+This is an ordinary bounded table, not virtualization. Infinite loading,
+windowing, dynamic row measurement, and 10,000-row strategy selection remain
+separate evidence packets.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.14.0
+```
+
 ## 0.13.3 - File Upload Boundary
 
 Kudzu 0.13.3 composes a bounded file-upload lifecycle from native controls,

package/docs/next-architecture/application-capability-release-plan.md

@@ -877,6 +877,35 @@ regression or improvement is claimed.
 - **Stop condition:** a data-grid runtime is introduced for ordinary tables.
 - **Done condition:** complete CRUD behavior passes with measured update latency.
 
+Evidence complete. The first failing fixture was the
+`0.14.0` project-application contract against the previous article list. It now
+uses a native table, ordinary array/object state, the existing pure collection
+selector, three existing keyed row-state slots, and native button/input keyboard
+behavior for insert, update, delete, reverse, sort, filter, selection, and edit.
+The browser journey proves retained row and draft-input identity through reorder
+and sort, fresh identity/state after filter removal and restoration, and focused
+keyboard reachability. Native `hidden` keeps the editor mounted rather than
+introducing a conditional callback-scope adapter or data-grid runtime.
+
+This slice adds zero semantic primitives, zero compiler passes, zero core LOC,
+and zero runtime concepts. It changes one real fixture, its contract, the
+machine-readable capability record, and the existing project benchmark. The
+application remains 44 files and changes from the `0.13.3` baseline by +9,235
+raw / +1,387 aggregate gzip bytes to 159,258 / 51,627 bytes, with deploy SHA-256
+`ebb3358e7a03612459e723ae765c39d105498db9d293415b924f1066cddf4793`.
+The maintained two-route session remains 17 JavaScript files and grows by 2,273
+raw / 626 aggregate gzip bytes to 73,304 / 25,930 bytes; `/help` remains 0 B
+JavaScript.
+
+Seven fresh Linux x64 Chrome 142 profiles record table Save-click-to-committed-
+DOM samples of `[0.7, 0.8, 1.0, 0.7, 1.1, 0.7, 0.8]` ms, a 0.8 ms median and
+0.7/1.1 ms range. This is the first equivalent table-update measurement, so no
+same-content latency delta is claimed. The same runs record list-to-detail
+samples of `[3.9, 3.9, 5.5, 4.2, 6.1, 3.5, 3.4]` ms, a 3.9 ms median and
+3.4/6.1 ms range. No compiler/runtime production logic changed; `0.14.0`
+publishes the accepted application-capability packet and `create-kudzu@0.1.122`
+generates projects on `@kudzujs/core@^0.14.0`.
+
 ### `0.14.1`: Nested And Object-State Collections
 
 - **Purpose:** prove project/group/issue/checklist nesting from ordinary object
@@ -889,6 +918,37 @@ regression or improvement is claimed.
 - **Done condition:** direct immutable paths cover the application journey and
   nearby dynamic forms fail clearly.
 
+Release evidence complete. The first failure replaced the project route's
+separate array state with one direct `projectData.projects` field and failed at
+build time because nested lists required their source ownership signal itself to
+contain an array. The compiler already emitted a binding-backed root
+`KeyedBlockIR`, its selector states, and the nested issue child block. Build-time
+list validation now allows an object-valued signal only for a compiler-proven
+`ownerField`; root lists still require arrays and nested non-array fields still
+fail. Browser mounting initializes binding-backed roots with children from their
+serialized state before the evaluator module loads, preserving the existing
+parent prototype and ownership path.
+
+Required Chrome proves immutable whole-object replacement, nested issue insert,
+update, reorder, removal, re-addition, retained project/issue identity, latest
+issue handlers, descendant state release, and fresh remount. Existing dynamic
+object-property, alias, mutation, mutating-sort, and non-array diagnostics retain
+the negative boundary, while `/help` remains complete HTML with 0 B JavaScript.
+The slice adds zero semantic primitives, IR kinds, compiler passes,
+normalization rules, adapters, runtime concepts, or public APIs. It changes one
+build-time validation line and adds one production list-runtime line.
+
+The release emits 44 files totaling 164,305 raw / 52,185 aggregate gzip bytes
+with deploy SHA-256
+`0a3b7e10b3447a76a9c04ef34ad7c2bfa30400ea53c9d16fc85b1c7cbf2ea203`.
+The two-route session remains 17 JavaScript files totaling 74,826 raw / 26,204
+aggregate gzip bytes. Seven fresh Chrome 142 profiles record table
+update samples of `[0.8, 0.8, 0.7, 0.8, 0.9, 0.8, 0.8]` ms, a 0.8 ms median and
+0.7/0.9 ms range, plus navigation samples of
+`[3.7, 4.1, 4.5, 3.9, 4.2, 3.9, 4.3]` ms, a 4.1 ms median and 3.7/4.5 ms range.
+`0.14.1` publishes this accepted packet, and `create-kudzu@0.1.123` generates
+projects on `@kudzujs/core@^0.14.1`.
+
 ### `0.14.2`: Infinite Loading Composition
 
 - **Purpose:** prove sentinel-driven incremental loading before virtualization.
@@ -1365,5 +1425,7 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.13.1` | Released | Preserve application-owned nested metadata, keyed row identity, release, and reset evidence. | None |
 | `0.13.2` | Released | Preserve multistep validation, versioned persistence, stale-save rejection, conflict retention, and reset evidence. | None |
 | `0.13.3` | Released | Preserve the published upload validation, cancellation, retry, route cleanup, and attachment mutation evidence. | None |
-| `0.14.0` | Active | Add the first failing project-table CRUD and retained-identity fixture. | None |
-| `0.14.1` onward | Blocked | Complete or explicitly close `0.14.0` first. | Ordered patch boundary |
+| `0.14.0` | Released | Preserve native table CRUD, retained identity, keyboard access, and measured update evidence. | None |
+| `0.14.1` | Released | Preserve immutable object-state replacement, nested keyed identity, latest handlers, and exact row release. | None |
+| `0.14.2` | Active | Add the first failing infinite-loading composition fixture. | None |
+| `0.14.3` onward | Blocked | Complete or explicitly close `0.14.2` first. | Ordered patch boundary |

package/docs/next-architecture/versioning.md

@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.121` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.13.3`.
+`create-kudzu@0.1.123` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.14.1`.
 
 ## Release Boundary
 

package/framework/README.md

@@ -100,6 +100,6 @@ A direct setter or inline/simple `const` setter callback may cross one same-file
 
 `kudzu.config` may opt one emitted shared-layout group into same-document navigation with legacy `navigation: { routes: ["/product", "/items/[id]"] }`, or multiple groups with `navigation: { groups: [{ routes: [...] }, { routes: [...] }] }`. The forms are mutually exclusive. Identities are globally unique emitted exact paths or `runtimeParams` patterns; each group uses one page-exported layout function identity. Runtime records securely match concrete pathnames under `base`, and their cache-safe parameter initializer runs before route DOM/effects mount on every transition. Each group receives a deterministic route-hashed asset specialized to only its records, pattern decoder, and effect/parameter lifecycle needs. Cross-group and ungrouped anchors remain native and are not prefetched; overlapping path domains across groups fail the build. Route effect entries export cache-safe layout and route mount functions: layout effects, including conditional/keyed DOM-owned effects, persist for the group session; route effects receive a fresh owner registry after each route insertion; and non-persisted page disposal cleans route before layout. Direct primitive state, runtime parameter, and keyed-item property dependencies and cleanup are supported. Fragment payloads and coordinated View Transitions are not implemented.
 
-A direct object-state prop may expose one-segment static fields when its same-file or relative-imported child directly maps an array field. Scalar bindings and that selected array effect dependency reuse the parent signal, existing `Object.is` comparison, and binding-backed keyed ownership without field state or a browser component. Dynamic paths, aliases, mutation, child state/ref/ID hooks, and opaque call-site values remain unsupported.
+A direct object-state prop may expose one-segment static fields when its same-file or relative-imported child directly maps an array field. Scalar bindings and that selected array effect dependency reuse the parent signal, existing `Object.is` comparison, and binding-backed keyed ownership without field state or a browser component. A direct static array field of local object state may also root a keyed selector pipeline with nested direct-property lists; immutable whole-object replacement reuses the same binding-backed root and nested ownership. Dynamic paths, aliases, mutation, child state/ref/ID hooks, opaque call-site values, and non-array collection fields remain unsupported.
 
 Cross-framework performance tables are historical snapshots from excluded workspaces and are not current rankings. `npm run benchmark` tracks the Worker build/graph fixture; `RUNS=21 npm run benchmark:keyed` tracks large keyed restoration; `BASELINE_ROOT=... npm run benchmark:native` tracks native dispatch and exact artifact changes. Current methodology, raw arrays, external-fixture limits, and artifact deltas live in `PERFORMANCE.md` and the web docs.

package/framework/core.mjs

@@ -316,7 +316,7 @@ export function list(items, keyField, render, ownerField, selector = [], indexed
   const source = items?.[bindingMarker] ? bindingDescriptor(items) : undefined
   if (source) items = createInternalState(items.value)
   if (Array.isArray(items)) items = createInternalState(items)
-  if (!items?.[signalMarker] || !Array.isArray(items.value)) throw new Error("A keyed list must use local array state or a supported imported static array")
+  if (!items?.[signalMarker] || (!ownerField && !Array.isArray(items.value))) throw new Error("A keyed list must use local array state or a supported imported static array")
   const selectorStateMap = new Map(selectorStates)
   for (const [name, state] of selectorStateMap) if (!state?.[signalMarker]) throw new Error(`Rendered collection selector state ${JSON.stringify(name)} must be framework state`)
   let values = items.value

package/framework/list-runtime.js

@@ -96,6 +96,7 @@ function mountLists(root) {
       ownedLists.set(list.owner, lists)
       listRegistrations.set(start, { list, owner: list.owner })
     } else if (descriptor.source) {
+      if (descriptor.children) updateList(list)
       const load = {}
       listLoads.set(start, load)
       loadListEvaluator(descriptor.source).then(evaluator => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.13.3",
+  "version": "0.14.1",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",