@kudzujs/core 0.16.15 → 0.16.17

package/MIGRATION_ROADMAP.md

@@ -57,7 +57,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - stronger JavaScript failure resilience;
 - no remaining material large-route build-scaling weakness.
 
-The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.21.1` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
+The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.21.3` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
 
 ### 0.10.0 Through 0.21.x: Application Capability Release Train
 

package/PERFORMANCE.md

@@ -2,18 +2,83 @@
 
 Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, `npm run benchmark:source-scale`, and `npm run benchmark:ai-delivery` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
 
-## 0.21.1 Compiler And Route Scale (Partial)
+## 0.21.2 Browser Performance And Memory
+
+Measured 2026-09-03 at revision
+`fcb42ae388c733ff9098f8c4a059690a21a56ed3` on Linux x64 with Node 24.14.0,
+Chrome 152.0.7977.64, an Intel i5-9500, six logical CPUs, and 31.2 GiB RAM.
+These are same-revision application gates, not cross-framework or historical
+regression claims. Each timing benchmark ran alone with seven fresh Chrome
+profiles; the list decision rotates strategies. Median browser budgets are 100
+ms for measured interactions and enhanced navigation, 1,000 ms for bounded-list
+load, and 2,000 ms for the complete static 10,000-row document.
+
+| Fixture | Metric | Raw samples | Median / budget |
+|---|---|---|---:|
+| 2,000 keyed rows | Append 33 | `[9.6, 13.9, 10.8, 12.3, 8.6, 8.8, 7.0]` ms | 9.6 / 100 ms |
+| 2,000 keyed rows | Filter to one | `[16.0, 17.6, 20.4, 21.1, 17.6, 16.3, 16.9]` ms | 17.6 / 100 ms |
+| 2,000 keyed rows | Restore 1,999 | `[66.9, 84.5, 95.3, 78.5, 94.6, 76.4, 98.1]` ms | 84.5 / 100 ms |
+| 2,000 keyed rows | Reverse 2,000 | `[19.4, 18.8, 19.4, 18.7, 18.8, 27.3, 19.6]` ms | 19.4 / 100 ms |
+| Project application | Table save | `[0.8, 0.9, 0.9, 0.9, 0.8, 2.8, 1.0]` ms | 0.9 / 100 ms |
+| Project application | List-to-detail navigation | `[4.2, 9.5, 4.9, 4.2, 6.4, 11.7, 4.1]` ms | 4.9 / 100 ms |
+| 10,000-row direct | Complete load | `[999.8, 1030.9, 982.2, 1070.1, 1047.2, 939.0, 994.3]` ms | 999.8 / 2,000 ms |
+| 100-row pagination | Complete load | `[327.3, 133.9, 163.1, 145.1, 150.5, 417.1, 190.1]` ms | 163.1 / 1,000 ms |
+| 100-row pagination | Next range | `[39.3, 13.3, 14.1, 22.1, 14.6, 18.1, 22.3]` ms | 18.1 / 100 ms |
+| 100-row window | Complete load | `[185.1, 472.8, 247.9, 315.0, 251.7, 148.4, 260.6]` ms | 251.7 / 1,000 ms |
+| 100-row window | Next range | `[23.7, 14.4, 14.0, 48.5, 19.5, 50.5, 26.7]` ms | 23.7 / 100 ms |
+
+The keyed graph is nine JavaScript files totaling 30,048 raw / 11,748
+aggregate gzip B. The project list/detail session owns 17 unique JavaScript
+files totaling 81,200 raw / 27,885 aggregate gzip B; its initial list and
+concrete detail route graphs are 69,178 / 24,183 and 67,702 / 23,556 raw/gzip B.
+These are structural route/session artifact bytes from the exact ownership
+report, not compressed network-transfer measurements from the local uncompressed
+server.
+
+The lazy editor initially owns 12,982 raw / 6,153 gzip B and defers one 250,086
+raw / 80,890 gzip B CodeMirror chunk. Two route owners share that one deferred
+chunk while owning 21,599 / 9,466 and 21,609 / 9,468 eager raw/gzip B; the static
+sibling owns zero JavaScript. Focused required-Chrome tests pass 3/3, proving no
+deferred request before activation, one native module request, reuse by later
+owners, and exact conditional/document cleanup.
+
+The 10,000-row static control retains 10,000 rows, 50,015 elements, 90,023 DOM
+nodes, zero listeners, 534,292 forced-GC heap bytes, and zero JavaScript. Both
+bounded strategies retain exactly 100 rows: pagination records 1,467 nodes, one
+listener, and 1,423,560 median heap bytes; windowing records 1,468 nodes, two
+listeners, and 1,528,288 median heap bytes. Off-range state is released and
+recreated while retained-row identity remains correct.
+
+The default endurance gate passes five warm-ups, ten stale-prefetch races, and
+30 ownership cycles in one profile. Across 101 navigations, editor
+mounts/disposals balance at 71/71, browser state remains zero, documents remain
+six, listeners remain seven, nodes move 164 to 165, and forced-GC heap moves
+1,969,344 to 2,049,332 bytes: a 79,988 B increase under the existing 2 MiB or
+15% alarm. No browser exception or failed request occurs. The raw ignored
+artifacts are under
+`test-results/endurance/2026-09-02T23-54-34-324Z/`.
+
+The packet adds median alarms to three existing browser benchmarks and permits
+the existing artifact collector to name the active packet. It changes no
+production source, semantic primitive, compiler pass, runtime concept, deploy
+artifact, public API, or browser byte.
+
+## 0.21.1 Compiler And Route Scale
 
 Measured 2026-09-01 on Linux x64 with Node 24.14.0, an Intel i5-9500, six
-logical CPUs, and 31.2 GiB RAM. Each recorded scale uses one warm-up and three
-measured fresh-process samples. The generated topology contains nine imported
-modules plus one page per route and 1,011 lines per route. Fixture generation is
-excluded. These are absolute candidate measurements, not regression claims.
+logical CPUs, and 31.2 GiB RAM. The 100- and 1,000-route scales use one warm-up
+and three measured fresh-process samples. The 10,000-route scale records one
+complete full-contract run with no warm-up after two diagnostic runs completed
+the measured stages but exposed cleanup and recovery-timeout harness defects.
+The generated topology contains nine imported modules plus one page per route
+and 1,011 lines per route. Fixture generation is excluded. These are absolute
+candidate measurements, not cross-framework claims.
 
 | Routes | Modules / lines | Graph median | TypeScript parse median | Normalize median | Compile/transform median | Render median | Write median | Clean median / RSS | Incremental median / retained-session peak RSS |
 |---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
 | 100 | 1,000 / 101,100 | 1,184.4 ms | 1,796.7 ms | 37.9 ms | 2,428.1 ms | 456.5 ms | 70.4 ms | 7,444.3 ms / 672.3 MiB | 1,838.0 ms / 680.9 MiB |
 | 1,000 | 10,000 / 1,011,000 | 12,152.6 ms | 18,717.6 ms | 302.9 ms | 23,681.5 ms | 4,919.4 ms | 521.7 ms | 77,515.9 ms / 3,182.3 MiB | 18,132.1 ms / 3,281.1 MiB |
+| 10,000 | 100,000 / 10,110,000 | 103,200.9 ms | 232,840.3 ms | 2,350.3 ms | 244,578.3 ms | 44,885.7 ms | 6,690.1 ms | 1,117,753.0 ms / 5,461.0 MiB | 643,697.2 ms / 8,266.9 MiB |
 
 The exact 100-route runs are source read `[30.5, 30.3, 24.7]`, graph
 `[1273.8, 1138.8, 1184.4]`, parse `[1749.8, 1911.6, 1796.7]`, normalize
@@ -33,6 +98,13 @@ incremental build `[22359.7, 18132.1, 17097.2]` ms. Clean-build RSS is
 `[3181.5, 3182.3, 3188.5]` MiB and retained-session peak RSS is
 `[3281.0, 3281.1, 3284.5]` MiB.
 
+The complete 10,000-route run records source read `17077.4`, graph `103200.9`,
+TypeScript parse `232840.3`, normalize `2350.3`, compile/transform `244578.3`,
+render `44885.7`, write `6690.1`, clean build `1117753.0`, and incremental
+build `643697.2` ms. Compile-only RSS is 5,561.4 MiB, clean-build RSS is
+5,461.0 MiB, and retained-session peak RSS is 8,266.9 MiB under
+`--max-old-space-size=10240`.
+
 Graph time excludes measured TypeScript parsing. Compile/transform excludes
 measured TypeScript parse and Kudzu normalization, but includes the indivisible
 esbuild parse/transform call for proven import-free modules. Render includes
@@ -52,14 +124,19 @@ At 1,000 routes, clean output is 1,000 files / 221,780 B with digest
 `ccdd2630bcaf9fac4a481b64c69982c341e4798205bb9fbb4cac67d528246635`;
 the source change produces digest
 `024811a5f4598d5025abc57320695503b2d63d0fd6aa54bcf79efde848c2a94e`.
-Both failure probes reject invalid source without changing the prior deploy and
-recover to the clean digest after source restoration.
-
-The default 10,000-route topology would contain 100,000 modules and 10,110,000
-lines. Extrapolating from the measured 1,000-route RSS is not acceptance
-evidence, and this 31.2 GiB host is not used for an unsafe or reduced substitute.
-The packet remains incomplete until the full topology runs on a separately
-provisioned host. Opt-in internal timing adds no semantic primitive, compiler
+At 10,000 routes, clean output is 10,000 files / 2,237,780 B with digest
+`7a48bc40ff33c4faaef8a01ab90fcfe611a4bada5364a6fedca42f80ad5070d3`;
+the source change emits 2,237,788 B with digest
+`09a42f84b4ce16c994a8bd55b92e5b645c716168f9290d241cfe27903ccfe98f`.
+Both clean and retained-session failure probes reject invalid source without
+changing the prior deploy and recover to the expected digest.
+
+The first full 10,000-route attempt exhausted a 10,240 MiB V8 heap while the
+unbounded canonical module cache retained roughly 90,000 parent-linked
+TypeScript ASTs. Bounding complete canonical records to 1,024 retains stable
+position-based symbols while allowing old ASTs to be collected. The identical
+100,000-module / 10,110,000-line topology then completed under the same heap cap.
+This adds eight net production compiler lines, no semantic primitive, compiler
 pass, runtime concept, public API, deploy file, or browser byte.
 
 ## 0.21.0 Functional Parity Matrix

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.16.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.16.15 - Production evidence gates.** Kudzu now records compiler phase and retained-session scale evidence, rejects incomplete AI attribution, and runs the 10,000-item pagination decision as ordinary browser acceptance. Read the [release notes](./RELEASES.md#01615---production-evidence-gates), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.15), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.16.17 - Browser performance gates.** Kudzu now enforces maintained median budgets for keyed collections, bounded 10,000-item ranges, and enhanced navigation while preserving its existing lazy-load and long-session memory bounds. Read the [release notes](./RELEASES.md#01617---browser-performance-gates), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.17), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,62 @@
 # Kudzu Releases
 
+## 0.16.17 - Browser Performance Gates
+
+Kudzu 0.16.17 turns existing browser performance and memory evidence into
+maintained release alarms without changing production compiler or runtime code.
+
+### Changed in 0.16.17
+
+- Enforces 100 ms median budgets for 2,000-row append, filter, restore, and
+  reverse operations and project table-save and enhanced-navigation actions.
+- Enforces 1,000 ms bounded-list and 2,000 ms complete static 10,000-row load
+  budgets while preserving retained identity and fresh off-range state.
+- Records exact initial, session, and lazy JavaScript ownership, including one
+  shared deferred CodeMirror chunk and zero JavaScript on static siblings.
+- Revalidates 30 ownership cycles and 101 navigations with balanced editor
+  handles, stable document/listener/cache counts, and 79,988 B forced-GC heap
+  growth under the existing alarm.
+- Keeps single-run diagnostic acceptance outside statistical median enforcement.
+- Adds no semantic primitive, compiler pass, production source, runtime concept,
+  public API, deploy artifact, or browser byte.
+- Updates `create-kudzu@0.1.142` to generate projects on
+  `@kudzujs/core@^0.16.17`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.17
+```
+
+## 0.16.16 - Bounded Compiler Module Cache
+
+Kudzu 0.16.16 bounds canonical TypeScript AST retention so the complete
+10,000-route production-scale contract runs under a 10 GiB V8 heap.
+
+### Changed in 0.16.16
+
+- Bounds complete canonical module records to a 1,024-entry LRU while preserving
+  stable position-based module symbols and reparsing evicted source on demand.
+- Fixes the measured 10,000-route failure where roughly 90,000 retained
+  parent-linked TypeScript ASTs exhausted a 10,240 MiB heap.
+- Completes the identical 100,000-module / 10,110,000-line topology with 5,461.0
+  MiB clean-build RSS and 8,266.9 MiB retained-session peak RSS.
+- Verifies 10-module / one-page incremental scope, byte-identical changed-clean
+  output, deterministic digests, and clean and retained-session recovery.
+- Adds scale-aware recovery timeout, diagnostic stage progress, and bounded
+  temporary-fixture cleanup retries to the maintained benchmark harness.
+- Adds eight net production compiler lines, no semantic primitive, compiler
+  pass, runtime concept, application API, dependency, deploy artifact, or
+  browser byte.
+- Updates `create-kudzu@0.1.141` to generate projects on
+  `@kudzujs/core@^0.16.16`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.16
+```
+
 ## 0.16.15 - Production Evidence Gates
 
 Kudzu 0.16.15 turns compiler scale, large-list parity, and AI attribution gaps

package/docs/next-architecture/README.md

@@ -15,7 +15,7 @@ The completed `0.9.0` milestone is recorded in [`0.9-semantic-compression.md`](.
 
 [`1.0-large-application-compatibility-audit.md`](./1.0-large-application-compatibility-audit.md) records the first post-0.9 probes against Memos, Apache Answer, and Actual Budget. The audit finds that reduced slices build but whole-application source retention and behavior parity do not yet pass.
 
-[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.21.1`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
+[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.21.3`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
 
 ## Required Invariants
 

package/docs/next-architecture/application-capability-release-plan.md

@@ -1987,7 +1987,7 @@ inventory pass. No production feature changed, so no release is consumed.
 - **Done condition:** repeated measurements and all material regressions are
   explained or fixed.
 
-**Progress:** opt-in internal telemetry now records source reads, reachable
+**Result:** opt-in internal telemetry records source reads, reachable
 graph discovery, TypeScript parse, normalize, compile/transform, render, and
 write boundaries without changing deploy output. Compile/transform excludes
 the measured TypeScript parse and Kudzu normalization but includes indivisible
@@ -2009,10 +2009,21 @@ incremental medians are 1,838.0 and 18,132.1 ms, recompiling exactly 10 modules
 and rendering one page in every sample. Clean and changed digests differ,
 incremental output equals a clean changed-source build, and clean and retained
 failure probes preserve then recover the expected digest. Exact phase samples,
-bytes, and digests are recorded in `PERFORMANCE.md`. The full 10,000-route,
-100,000-module, 10,110,000-line run remains explicitly incomplete pending a
-separately provisioned host; no projection or reduced topology is counted as a
-pass, so this packet does not yet authorize a version or release.
+bytes, and digests are recorded in `PERFORMANCE.md`.
+
+The full 10,000-route / 100,000-module / 10,110,000-line topology initially
+exhausted a 10,240 MiB V8 heap because the canonical module cache retained about
+90,000 complete TypeScript ASTs. A 1,024-record LRU bounds that existing cache
+without changing stable position-based symbols. The identical topology then
+completed under the same heap cap with 5,461.0 MiB clean-build RSS and 8,266.9
+MiB retained-session peak RSS. It emits 10,000 files / 2,237,780 B with clean
+digest `7a48bc40ff33c4faaef8a01ab90fcfe611a4bada5364a6fedca42f80ad5070d3`;
+incremental output matches a clean changed-source build, recompiles 10 modules,
+renders one page, and clean and retained recovery pass. One complete measured
+run is retained after two diagnostic runs completed measured stages but exposed
+cleanup and timeout defects; no projection or reduced topology is counted.
+The memory fix adds eight net production lines, no semantic primitive, pass,
+runtime concept, public API, deploy artifact, or browser byte.
 
 ### `0.21.2`: Browser Performance And Memory
 
@@ -2024,6 +2035,31 @@ pass, so this packet does not yet authorize a version or release.
 - **Done condition:** complete features meet declared thresholds with bounded
   long-session growth.
 
+**Result:** closed through existing route artifacts, keyed ownership, enhanced
+navigation, native ESM loading, and the released endurance harness. Seven fresh
+Chrome profiles keep 2,000-row append, filter, restore, and reverse medians at
+9.6, 17.6, 84.5, and 19.4 ms against a 100 ms median alarm. Project table save
+and list-to-detail navigation medians are 0.9 and 4.9 ms against the same alarm;
+the exact session graph owns 17 JavaScript files totaling 81,200 raw / 27,885
+aggregate gzip bytes. The static 10,000-row document loads in a 999.8 ms median
+against a 2,000 ms alarm. Pagination and windowing keep the DOM at 100 rows,
+load in 163.1 and 251.7 ms against a 1,000 ms alarm, and change range in 18.1
+and 23.7 ms against a 100 ms alarm.
+
+The lazy editor retains 12,982 raw / 6,153 gzip eager bytes and one 250,086 raw
+/ 80,890 gzip deferred CodeMirror chunk; two route owners share one native ESM
+module request and the static sibling remains zero JavaScript. Focused Chrome
+acceptance passes 3/3. The endurance gate passes five warm-ups, ten stale-
+prefetch races, 30 ownership cycles, and 101 navigations: editor mounts and
+disposals balance 71/71, browser state stays zero, documents and listeners stay
+at six and seven, DOM nodes move by one, and forced-GC heap grows 79,988 B under
+the existing 2 MiB or 15% alarm. No exception or failed request occurs. Three
+existing benchmark entry points now fail when their declared median budgets are
+exceeded; the artifact collector may name the current packet. Production source,
+semantic primitives, compiler passes, runtime concepts, APIs, deploy artifacts,
+and browser bytes change by zero. Exact samples and limitations are recorded in
+`PERFORMANCE.md`; no package release is consumed.
+
 ### `0.21.3`: Package And Release Candidate
 
 - **Purpose:** verify the exact candidate as an installed product.
@@ -2033,6 +2069,28 @@ pass, so this packet does not yet authorize a version or release.
 - **Stop condition:** version metadata changes before the exact candidate passes.
 - **Done condition:** the reviewed commit is independently publishable.
 
+**Candidate evidence:** accepted as `@kudzujs/core@0.16.17` and
+`create-kudzu@0.1.142`. The exact versioned tree passes `npm run check`, all 301
+remaining tests after the application contract, package smoke, generator
+creation, and both registry dry runs. Tarball inspection records the expected 85
+core files and four generator files with no bundled dependencies. The Node 22
+no-browser lane initially attempted the list acceptance despite
+`KUDZU_SKIP_BROWSER`; that test now follows the existing skip contract while the
+Node 24 required-Chrome lane retains the browser acceptance.
+
+Seven fresh exact-candidate Chrome profiles pass every maintained alarm. The
+project table-save/navigation medians are 0.7/3.6 ms; direct, pagination, and
+window load medians are 849.2, 166.6, and 184.5 ms; bounded range medians are
+13.0 and 19.7 ms. The keyed benchmark also passes all four 100 ms alarms. A
+fresh endurance run balances editor mounts/disposals at 71/71 across 101
+navigations, with zero document/listener growth, one additional DOM node, and
+144,172 B forced-GC heap growth under the 2 MiB alarm. Package contents preserve
+the existing production compiler/runtime and introduce no semantic primitive,
+pass, runtime concept, API, deploy artifact, or browser byte. The immutable
+rollback contract remains forward-only: a failed push, tag, publication, or
+registry verification keeps this packet active; a published npm version or tag
+is never moved and requires a forward-fix patch.
+
 ### `0.21.4`: AI Delivery Proof
 
 - **Purpose:** run the final equal-condition comparison on production-shaped
@@ -2186,4 +2244,6 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.20.4` | Released as `0.16.14` | Preserve pinned equal conditions, isolated paired attempts, raw failures, independent acceptance, attribution, failure-inclusive costs, source retention, and browser artifact evidence. | Deterministic fixture validates the protocol only; no framework ranking claimed |
 | `0.20.5` | Closed by measured stop condition | Preserve the negative tooling-cost result and do not present structured tools as an AI cost reduction. | Tool-assisted attempts cost 16,933 more tokens per success; no release consumed |
 | `0.21.0` | Closed by existing semantics | Preserve the complete browser parity matrix, large-list keyboard/release acceptance, and static exclusion controls. | No production change; no release consumed |
-| `0.21.1` | Active; telemetry released as `0.16.15` | Preserve the 100/1,000-route phase, RSS, output, digest, incremental-equivalence, and recovery evidence, then run the full separately provisioned 10,000-route topology. | 10,000-route / 100,000-module run remains pending; no projection is accepted |
+| `0.21.1` | Released as `0.16.16` | Preserve 100/1,000/10,000-route phase, RSS, output, digest, incremental-equivalence, recovery, and bounded canonical-AST retention evidence. | Full 10,000-route report has one complete measured run after two measured-stage diagnostics; no projection used |
+| `0.21.2` | Closed by existing semantics | Preserve initial/session/lazy bytes, keyed/range/navigation median alarms, and bounded endurance ownership evidence. | Same-revision absolute gates; structural artifact bytes are not compressed network transfer |
+| `0.21.3` | Candidate accepted as `0.16.17` | Complete the immutable release transaction, then advance to `0.21.4`. | One initial navigation benchmark invocation stalled at the outer timeout; its clean seven-profile rerun passed all alarms |

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.16.15` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.21.1`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.16.17` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.21.3`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.21.1`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.21.3`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
-[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.21.1`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
+[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.21.3`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
 
 ## Product Outcome
 
@@ -483,4 +483,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-All listed foundation and `0.9` slices are complete. Current work continues at `0.21.1` compiler and route scale under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.
+All listed foundation and `0.9` slices are complete. Current work continues at `0.21.3` package and release candidate proof under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.21.1`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
+This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.21.3`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.140` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.15`.
+`create-kudzu@0.1.142` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.17`.
 
 ## Release Boundary
 

package/framework/compiler/project-session.mjs

@@ -28,6 +28,7 @@ export function createProjectSession(projectRoot = process.cwd(), { counters, so
 }
 
 function createModuleCache(root, sourceIndex, graph, counters, timings) {
+  const recordLimit = 1024
   const records = new Map()
   let resolvedExports = new WeakMap()
   const moduleName = file => relative(root, file).replaceAll(sep, "/")
@@ -46,7 +47,11 @@ function createModuleCache(root, sourceIndex, graph, counters, timings) {
   const read = (file, source = sourceIndex.get(file)) => {
     if (typeof source !== "string") throw new Error(`Source text is unavailable for ${file}`)
     const cached = records.get(file)
-    if (cached?.source === source) return cached
+    if (cached?.source === source) {
+      records.delete(file)
+      records.set(file, cached)
+      return cached
+    }
     const parseBefore = timings ? ts.performance.getDuration("Parse") : 0
     const sourceFile = graph.parseSourceFile(file, source)
     if (timings) timings.parseMs = (timings.parseMs ?? 0) + ts.performance.getDuration("Parse") - parseBefore
@@ -54,7 +59,9 @@ function createModuleCache(root, sourceIndex, graph, counters, timings) {
     const summary = summarizeModule(file, sourceFile, moduleSymbol, siteId)
     increment("exportSummaries")
     const record = { source, sourceFile, ...summary }
+    records.delete(file)
     records.set(file, record)
+    if (records.size > recordLimit) records.delete(records.keys().next().value)
     resolvedExports = new WeakMap()
     return record
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.16.15",
+  "version": "0.16.17",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",