@kudzujs/core 0.16.1 → 0.16.3

package/MIGRATION_ROADMAP.md

@@ -51,7 +51,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - stronger JavaScript failure resilience;
 - no remaining material large-route build-scaling weakness.
 
-The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.16.2` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
+The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.16.4` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
 
 ### 0.10.0 Through 0.21.x: Application Capability Release Train
 
@@ -129,6 +129,8 @@ The following are available building blocks, not future vertical roadmaps:
 - Mount and dependency effects with cleanup, route/layout lifetimes, conditional/keyed ownership, stale-write isolation, and relative TypeScript Workers.
 - Direct browser-only package references in inline effect setup/cleanup callbacks bundle into route-owned effect ESM without entering build-time component execution or static sibling output.
 - A CodeMirror-class editor may retain one package instance across one mount effect and later dependency update effects through a null-initialized ref with one direct setup assignment and null-reset cleanup. The ref lowers to existing owner-scoped object state; package DOM, bidirectional updates, errors, accessibility, conditional disposal, and fresh remount require no widget runtime or React island.
+- A Chart.js-class canvas instance uses the same retained-handle contract. One mount effect owns construction, resize listeners, and destroy/reset cleanup; later data effects read the instance without replacing it. Enhanced route disposal and fresh remount require no chart runtime or package-specific IR.
+- A SortableJS-class drag engine may temporarily move keyed DOM during a gesture, but Kudzu state remains the durable order owner. The package callback restores authored DOM order before one immutable state reorder; existing keyed reconciliation then preserves row identity. Keyboard controls use the same state operation, package disposal is effect-owned, and static siblings exclude the package.
 - Keyed local-state and imported static collections, pure selectors, nested direct-property lists, recursive and directly exported row specialization, static/keyed component reuse, analyzable specialized prop spreads, serializable literal defaults, direct intrinsic rest forwarding, forwarded JSX children, latest-item handlers, row state/effects/refs, and stable keyed identity.
 - Direct object-state props with one-segment binding/effect/list consumers when the child directly maps an array field; ComponentAnalysis links every consumer to the parent SignalIR without authored field state or a browser component.
 - Complete-document native fallback and optional shared-layout navigation groups with parameter initialization, finite prefetch caching, focus, history, cleanup, and independent capability output.

package/PERFORMANCE.md

@@ -2,6 +2,21 @@
 
 Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, and `npm run benchmark:source-scale` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
 
+## 0.16.3 State-Owned Drag And Drop
+
+Measured 2026-08-28 on Linux x64 with Node 24.14.0 and Chrome. The real
+SortableJS fixture emits 10 JavaScript files totaling 72,251 raw / 26,603
+aggregate gzip bytes, while its static sibling emits zero JavaScript. Required
+Chrome proves drag and keyboard reorder, retained row/input identity, invalid
+package-index recovery, conditional and document disposal, and fresh remount.
+
+The maintained Worker benchmark remains byte-identical at 907 raw / 477 gzip B
+for the Worker graph and 14,456 raw / 6,159 gzip B for the window graph. Seven
+clean builds record a 999.7 ms median on this host. Timing is not compared with
+the prior macOS sweep. The change adds no runtime file or drag/drop abstraction;
+it classifies `HTMLElement` with the existing browser globals used by bundled
+effect callbacks.
+
 ## 0.16.1 Retained Editor Ownership
 
 Measured 2026-08-28 on Linux x64 with Node 24.14.0 and Chrome. The new

package/README.md

@@ -12,9 +12,9 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 *Watch: React-shaped TSX to static HTML and route-specific ESM in 22 seconds.*
 
-> Experimental `0.15.x`: the compiler API and supported TSX surface may change.
+> Experimental `0.16.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.16.1 - Retained external editor ownership.** A CodeMirror-class editor can retain one package instance across mount and dependency effects while Kudzu keeps disposal, remount, errors, and static exclusion owner-bounded. Read the [release notes](./RELEASES.md#0161---retained-external-editor-ownership), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.1), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.16.3 - State-owned drag and drop.** A real SortableJS effect may move DOM during a gesture while keyed Kudzu state remains the durable order and identity owner, with keyboard parity, exact disposal, and static exclusion. Read the [release notes](./RELEASES.md#0163---state-owned-drag-and-drop), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.3), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,41 @@
 # Kudzu Releases
 
+## 0.16.3 - State-Owned Drag And Drop
+
+Kudzu 0.16.3 proves that a real SortableJS drag engine can remain a bounded
+effect while existing keyed state owns durable order and DOM identity.
+
+### Changed in 0.16.3
+
+- Treats the browser `HTMLElement` constructor as a platform global inside
+  bundled effect callbacks while preserving lexical shadowing.
+- Restores package-moved DOM before applying one immutable state reorder, so
+  Kudzu remains the only durable keyed DOM owner.
+- Uses the same state operation for drag, keyboard movement, and reset.
+- Recovers invalid package indexes without changing application state.
+- Disposes on conditional and document release; remount creates a fresh package
+  instance.
+- Adds no drag/drop IR, animation frame, runtime concept, React, VDOM, hydration,
+  or retained component tree.
+- Updates `create-kudzu@0.1.128` to generate projects on
+  `@kudzujs/core@^0.16.3`.
+
+### Output And Browser Evidence
+
+- The SortableJS fixture emits 10 JavaScript files totaling 72,251 raw / 26,603
+  aggregate gzip bytes; its static sibling emits zero JavaScript.
+- Required Chrome proves drag and keyboard reorder, state synchronization,
+  retained row/input identity, invalid-input recovery, disposal, and fresh
+  remount.
+- The maintained Worker and window graphs remain 907 raw / 477 gzip bytes and
+  14,456 raw / 6,159 gzip bytes respectively.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.3
+```
+
 ## 0.16.1 - Retained External Editor Ownership
 
 Kudzu 0.16.1 lets one CodeMirror-class package instance remain owned across a

package/docs/next-architecture/README.md

@@ -15,7 +15,7 @@ The completed `0.9.0` milestone is recorded in [`0.9-semantic-compression.md`](.
 
 [`1.0-large-application-compatibility-audit.md`](./1.0-large-application-compatibility-audit.md) records the first post-0.9 probes against Memos, Apache Answer, and Actual Budget. The audit finds that reduced slices build but whole-application source retention and behavior parity do not yet pass.
 
-[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.16.2`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
+[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.16.4`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
 
 ## Required Invariants
 

package/docs/next-architecture/application-capability-release-plan.md

@@ -1210,6 +1210,24 @@ unchanged.
 - **Stop condition:** package-specific concepts enter generic IR/runtime.
 - **Done condition:** one lifecycle model covers editor and chart/map evidence.
 
+**Result:** closed through the `0.16.1` retained-instance contract. A reduced
+Mattermost Chart.js doughnut chart first reproduced the existing diagnostic when
+its dependency effect both created and updated the retained instance. Moving
+acquisition, resize-listener registration, and exact destroy/reset cleanup into
+one mount effect leaves later data effects read-only and lowers the handle to the
+same owner-scoped object state used by CodeMirror. Required Chrome proves initial
+drawing, retained data and resize updates, listener removal, enhanced route
+disposal, fresh remount, accessibility, and package exclusion from the static
+sibling. The interactive graph is 208,686 raw / 73,312 aggregate gzip bytes
+across six JavaScript files; the static sibling emits zero. Semantic primitives,
+IR kinds, compiler passes, core/compiler LOC, normalization rules, runtime
+concepts, runtime files, and public APIs change by zero. One positive fixture and
+one browser contract were added. The maintained Worker/effect benchmark remains
+907 raw / 477 gzip bytes for the Worker graph and 14,456 raw / 6,159 gzip bytes
+for the window graph; its seven-run Linux median was 2,464.9 ms, recorded without
+a timing comparison because the host differs from the published baseline. No
+production source changed, so no release was consumed.
+
 ### `0.16.3`: Grid And Drag/Drop Decision
 
 - **Purpose:** test external data-grid or drag engine ownership against keyed
@@ -1220,6 +1238,45 @@ unchanged.
 - **Done condition:** either bounded ownership is proven or the package is
   explicitly unsupported with a migration path.
 
+**Result:** complete through existing keyed state and effect ownership. A
+THRM-derived SortableJS fixture reproduced one compiler failure because the
+browser `HTMLElement` constructor was classified as an effect capture and then
+evaluated during the Node build. Adding that platform constructor to the
+existing browser-global set fixes the shared root cause while lexical shadowing
+remains covered. During a gesture SortableJS may move DOM temporarily, but its
+`onEnd` callback restores authored order before one immutable state reorder;
+Kudzu's keyed reconciler remains the durable DOM owner and preserves retained
+row and input identity. The same state operation provides keyboard movement and
+reset, while invalid package indexes restore DOM without changing state.
+Required Chrome proves drag and keyboard reorder, state synchronization,
+identity, invalid-input recovery, conditional/document disposal, and fresh
+remount. The interactive graph is 72,251 raw / 26,603 aggregate gzip bytes
+across ten JavaScript files; the static sibling emits zero. Its normalized
+deploy archive SHA-256 is
+`a55c18e14ba29df3f1f8ccdc7bcae936092508a01d05abdb887417e6fffb2ecf`.
+Semantic primitives, IR kinds, compiler passes, normalization rules, runtime
+concepts, runtime files, drag/drop abstractions, and public APIs change by zero;
+one existing compiler lookup gains one token. One positive fixture, one browser
+contract, and one browser-global shadowing case were added. The maintained
+Worker/effect benchmark remains 907 raw / 477 gzip bytes for the Worker graph
+and 14,456 raw / 6,159 gzip bytes for the window graph; its seven-run Linux
+median was 999.7 ms, recorded without a timing comparison because the host
+differs from the published baseline.
+
+### `0.16.4`: GSAP Animation Lifecycle
+
+- **Purpose:** validate one real GSAP landing-page animation against existing
+  DOM-ref and effect ownership.
+- **Expected boundary:** one owned effect and native reduced-motion behavior;
+  no animation IR or scheduler runtime.
+- **Acceptance:** mount, deterministic static fallback, scoped targets,
+  prefers-reduced-motion behavior, dependency update where required, route and
+  conditional disposal, fresh remount, and static sibling asset exclusion.
+- **Stop condition:** package timelines compete with Kudzu for durable DOM
+  structure or require a retained component renderer.
+- **Done condition:** GSAP owns only bounded presentation changes and exact
+  cleanup while Kudzu retains document structure and lifetime ownership.
+
 ## `0.17.x`: Long-Lived Applications
 
 ### `0.17.0`: Endurance Harness
@@ -1594,4 +1651,6 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.15.3` | Closed by stop condition | Preserve native top-layer and in-place composition until three independent authored-range failures exist. | Zero qualifying failures; no release consumed |
 | `0.16.0` | Closed by existing effect ownership | Preserve real package mount, replacement, disposal, remount, and static exclusion evidence. | No production change; no release consumed |
 | `0.16.1` | Released | Preserve the retained CodeMirror instance boundary, bidirectional updates, error recovery, accessibility, and exact cleanup. | None |
-| `0.16.2` | Active | Validate the same lifecycle against one unrelated real chart or map package. | None |
+| `0.16.2` | Closed by existing effect ownership | Preserve retained Chart.js data/resize updates, listener and route cleanup, fresh remount, accessibility, and static exclusion. | No production change; no release consumed |
+| `0.16.3` | Released | Preserve state-owned order, keyed identity, keyboard parity, invalid-input recovery, package disposal, and static exclusion. | None |
+| `0.16.4` | Active | Validate one real GSAP landing-page animation through bounded effect ownership. | None |

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.16.1` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.16.2`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.16.3` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.16.4`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.16.2`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.16.4`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
-[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.16.2`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
+[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.16.4`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
 
 ## Product Outcome
 
@@ -483,4 +483,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-All listed foundation and `0.9` slices are complete. Current work continues at `0.16.2` Chart And Map Lifecycle under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.
+All listed foundation and `0.9` slices are complete. Current work continues at `0.16.4` GSAP Animation Lifecycle under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.16.2`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
+This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.16.4`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.127` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.1`.
+`create-kudzu@0.1.128` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.3`.
 
 ## Release Boundary
 

package/framework/compiler/analysis/binding-index.mjs

@@ -1,7 +1,7 @@
 import ts from "typescript"
 
 export const knownGlobalNames = new Set([
-  "Array", "ArrayBuffer", "BigInt", "Blob", "Boolean", "Date", "Error", "Event", "FileReader", "FormData", "Infinity", "IntersectionObserver", "Intl", "JSON", "Map", "Math", "NaN", "Number", "Object", "Promise", "Proxy", "RangeError", "ReferenceError", "Reflect", "RegExp", "Set", "String", "Symbol", "TypeError", "URL", "URLSearchParams", "WeakMap", "WeakSet", "WebSocket", "Worker", "alert", "atob", "btoa", "cancelAnimationFrame", "clearInterval", "clearTimeout", "console", "crypto", "document", "fetch", "globalThis", "history", "isFinite", "isNaN", "localStorage", "location", "navigator", "parseFloat", "parseInt", "performance", "queueMicrotask", "requestAnimationFrame", "setInterval", "setTimeout", "structuredClone", "undefined", "window"
+  "Array", "ArrayBuffer", "BigInt", "Blob", "Boolean", "Date", "Error", "Event", "FileReader", "FormData", "HTMLElement", "Infinity", "IntersectionObserver", "Intl", "JSON", "Map", "Math", "NaN", "Number", "Object", "Promise", "Proxy", "RangeError", "ReferenceError", "Reflect", "RegExp", "Set", "String", "Symbol", "TypeError", "URL", "URLSearchParams", "WeakMap", "WeakSet", "WebSocket", "Worker", "alert", "atob", "btoa", "cancelAnimationFrame", "clearInterval", "clearTimeout", "console", "crypto", "document", "fetch", "globalThis", "history", "isFinite", "isNaN", "localStorage", "location", "navigator", "parseFloat", "parseInt", "performance", "queueMicrotask", "requestAnimationFrame", "setInterval", "setTimeout", "structuredClone", "undefined", "window"
 ])
 
 export function createBindingIndex(sourceFile) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",
@@ -53,7 +53,7 @@
     "build": "node ./bin/kudzu.mjs build",
     "dev": "node ./bin/kudzu.mjs dev",
     "check": "tsc --noEmit && tsc -p test/fixtures/tsconfig.json --noEmit && node ./bin/kudzu.mjs build",
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test test/project-application.test.mjs && node --test --test-skip-pattern='^establishes the 0\\.15\\.2 notification ownership contract$' test/*.test.mjs",
     "test:package": "node test/package-smoke.mjs",
     "benchmark": "node test/performance.mjs",
     "benchmark:keyed": "node test/keyed-performance.mjs",
@@ -74,6 +74,9 @@
   },
   "devDependencies": {
     "@codemirror/view": "^6.43.9",
+    "@types/sortablejs": "^1.15.9",
+    "chart.js": "^3.8.2",
+    "sortablejs": "^1.15.7",
     "typed.js": "^3.0.0",
     "wrangler": "^4.112.0"
   }