@kudzujs/core 0.16.18 → 0.16.21

package/MIGRATION_ROADMAP.md

@@ -57,7 +57,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - stronger JavaScript failure resilience;
 - no remaining material large-route build-scaling weakness.
 
-The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.21.4` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
+The completed 0.9 plan defines the cross-framework comparison and release gate. Packet `0.21.4` is measured at Kudzu 11/25 attributable successes versus React + Vite 24/25 and blocks `1.0.0`; subsequent work must come from those recorded failures. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
 
 ### 0.10.0 Through 0.21.x: Application Capability Release Train
 

package/PERFORMANCE.md

@@ -1,6 +1,69 @@
 # Performance Records
 
-Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, `npm run benchmark:source-scale`, and `npm run benchmark:ai-delivery` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
+Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, `npm run benchmark:source-scale`, `npm run benchmark:ai-delivery`, and `npm run benchmark:ai-delivery-production` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
+
+## 0.21.4 Corrected AI Delivery Proof
+
+Measured 2026-09-03 on Linux x64 with Node 24.14.0, Chrome 152.0.7977.64,
+OpenCode 1.18.27, and `openai/gpt-5.6-sol`. Each of five production-shaped task
+classes ran five predeclared interleaved attempts per framework with identical
+model, tools, public-context, 300-second, 400,000-input-token, and 40-tool-call
+limits. Failed and incomplete attempts remain in success and cost denominators.
+Provider-reported subscription cost was zero, so tokens are the cost comparator.
+
+| Task | Kudzu success | React + Vite success | Kudzu tokens / success | React tokens / success |
+|---|---:|---:|---:|---:|
+| Content search | 0/5 | 5/5 | unavailable | 99,779 |
+| Password confirmation | 5/5 | 5/5 | 85,821 | 116,307 |
+| CRUD/shared filter | 1/5 | 5/5 | 2,088,870 | 119,430 |
+| Commerce-derived shipping | 0/5 | 5/5 | unavailable | 57,979 |
+| Realtime ownership | 5/5 | 4/5 | 261,327 | unavailable |
+| **Overall** | **11/25 (44%)** | **24/25 (96%)** | **unavailable** | **unavailable** |
+
+All final builds passed. Browser acceptance passed for 17/25 Kudzu attempts and
+24/25 React attempts; six otherwise-correct Kudzu attempts lost only on frozen
+budgets. The one remaining React attempt timed out in the adapter at 300 seconds,
+produced no attribution trace, and is retained as incomplete rather than
+selectively replaced. Therefore the failure-inclusive realtime and aggregate
+React cost claims are unavailable. No successful retained source used imperative
+DOM replacement, changed dependencies, or embedded acceptance-specific shortcuts.
+
+| Task with accepted output | Kudzu median raw / gzip artifact | React median raw / gzip artifact | Kudzu / React median transferred JS |
+|---|---:|---:|---:|
+| Content | 91,681 / 34,905 B | 206,483 / 66,401 B | 36,114 / 199,137 B |
+| Forms | 24,238 / 9,801 B | 202,702 / 64,305 B | 15,328 / 198,467 B |
+| CRUD | 49,526 / 16,860 B | 203,412 / 64,483 B | 36,127 / 198,495 B |
+| Realtime | 45,854 / 16,138 B | 202,520 / 64,245 B | 36,111 / 199,043 B |
+
+Kudzu retained complete zero-JavaScript static siblings in every accepted output.
+Commerce has no accepted Kudzu output and therefore no Kudzu byte comparison.
+Lower browser output does not offset the failed success-rate and task-cost gate.
+
+The corrected revision-2 protocol SHA-256 values are:
+
+- content `773ac7cf998006bc54f66a6fa278d4f40a2905a558f7c309acf632f201d532a0`;
+- forms `a004d6a65d6a255ba93965f208ca9afe834c8abeeb6ed0f8234a8b01435d55a1`;
+- CRUD `371f491984c582802452f85d3c2c5cca147f74f34197495627369092e87535f5`;
+- commerce `d1b670d72ebadbfc0b2a9a1f9060574fa10d742f99629aadc031c0133726197f`;
+- realtime `c6ae3dfbac72ca07b5e7a95e0e55282aa8a8c2624c391395886376e2b210bf66`.
+
+The first batch, Kudzu 8/25 versus React 16/25, is invalid for ranking. Its
+acceptance SHA changed from
+`78478ae8ae141d7c787b930ce345bf7d4cf62142c64a3b3a5e495149adc14c30`
+to `c1320b8c87c1d3c2303ac20a5385fae9c3935d121ff31aab4bb9a899bd7e7a06`
+after correcting React controlled-input dispatch, hidden live-region and form
+field selectors, incomplete CRUD/realtime journeys, one broken Kudzu CRUD
+starter behavior, and inconsistent React versions. Revision 2 also hashes the
+written acceptance contracts. Both batches remain in the release archive
+[`kudzu-ai-delivery-0.21.4-gpt-5.6-sol.tar.gz`](https://github.com/kudzujs/kudzu/releases/download/v0.16.19/kudzu-ai-delivery-0.21.4-gpt-5.6-sol.tar.gz),
+SHA-256 `4e37d15b4c4b0cf88720a3a7743996794b2e0172dbc43d40514f944fb01bd0f8`.
+
+The measured next blockers are ordinary reactive collection normalization and
+count reuse, plus reactive text ownership inside selected conditional branches.
+Kudzu does not have the highest or tied success rate or a valid lowest aggregate
+cost, so this proof does not authorize `1.0.0`. This evidence packet changes no
+compiler, runtime, public API, dependency, generated application, or browser
+artifact.
 
 ## 0.21.2 Browser Performance And Memory
 

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.16.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.16.18 - AI attribution integrity.** Kudzu's delivery harness now rejects successful-looking attempts that omit their raw attribution trace instead of counting them as zero-cost successes. No framework ranking is claimed; the production-shaped `0.21.4` comparison remains active. Read the [release notes](./RELEASES.md#01618---ai-attribution-integrity), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.18), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.16.21 - AI evidence npm recovery.** The production-shaped `0.21.4` comparison measured Kudzu at 11/25 attributable successes and React + Vite at 24/25, so the `1.0.0` gate remains blocked while content, CRUD, and commerce compiler boundaries are investigated. This patch retries the unchanged evidence after npm rejected the `0.16.20` trusted-publishing certificate. Read the [release notes](./RELEASES.md#01621---ai-evidence-npm-recovery), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.21), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,98 @@
 # Kudzu Releases
 
+## 0.16.21 - AI Evidence npm Recovery
+
+Kudzu 0.16.21 retries npm publication of the unchanged corrected `0.21.4` AI
+delivery evidence after npm rejected the `0.16.20` trusted-publishing signing
+certificate with HTTP 403.
+
+### Changed in 0.16.21
+
+- Preserves the corrected protocols, 11/25 Kudzu versus 24/25 React + Vite
+  result, failed `1.0.0` gate, and `v0.16.19` raw evidence archive unchanged.
+- Preserves the public `v0.16.20` tag and records its failed npm transaction
+  rather than moving or reusing it.
+- Adds no compiler, runtime, public API, dependency, generated behavior, or
+  browser byte.
+- Updates `create-kudzu@0.1.146` to generate projects on
+  `@kudzujs/core@^0.16.21`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.21
+```
+
+## 0.16.20 - AI Evidence Forward Release
+
+Kudzu 0.16.20 forward-publishes the unchanged `0.16.19` AI delivery evidence
+packet after that GitHub release's npm workflow stopped on an unrelated flaky
+project browser journey before either package was published.
+
+### Changed in 0.16.20
+
+- Preserves the corrected `0.21.4` protocols, 11/25 Kudzu versus 24/25 React +
+  Vite result, failed `1.0.0` gate, and raw evidence archive byte-for-byte.
+- Moves no tag and republishes no npm version; `0.16.19` remains the immutable
+  GitHub evidence release.
+- Adds no compiler, runtime, public API, dependency, generated behavior, or
+  browser byte.
+- Updates `create-kudzu@0.1.145` to generate projects on
+  `@kudzujs/core@^0.16.20`.
+- Its npm workflow passed every repository gate, then npm rejected the core
+  trusted-publishing signing certificate with HTTP 403 before either package
+  was published. The immutable recovery release is `0.16.21` with generator
+  `0.1.146`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.20
+```
+
+## 0.16.19 - Corrected AI Delivery Evidence
+
+Kudzu 0.16.19 publishes the corrected five-task `0.21.4` AI delivery proof and
+records that the `1.0.0` gate did not pass.
+
+### Changed in 0.16.19
+
+- Adds five paired production-shaped Kudzu and React + Vite starters, frozen
+  prompts, independently hashed acceptance contracts, an OpenCode adapter, and
+  browser acceptance for content, forms, CRUD/shared state, commerce-derived
+  state, and realtime resource ownership.
+- Excludes the first diagnostic batch after finding hidden content/form selector
+  assumptions and inconsistent React versions; retains that batch in the raw
+  archive instead of presenting it as framework evidence.
+- Records the corrected result: Kudzu 11/25 attributable successes (44%) and
+  React + Vite 24/25 (96%), with one React realtime adapter timeout correctly
+  retained as incomplete.
+- Records that Kudzu has no successful task-level result for content or commerce,
+  so its aggregate median token cost per successful task is unavailable and the
+  `1.0.0` success-and-cost gate is not authorized.
+- Keeps React's aggregate failure-inclusive cost unavailable because its timed-out
+  realtime attempt has no attribution trace.
+- Names the measured blockers: excessive correction cost for ordinary reactive
+  content search, filtered-collection count reuse in CRUD, and reactive text
+  frozen inside the selected commerce conditional branch.
+- Publishes both batches as the release asset
+  `kudzu-ai-delivery-0.21.4-gpt-5.6-sol.tar.gz` with SHA-256
+  `4e37d15b4c4b0cf88720a3a7743996794b2e0172dbc43d40514f944fb01bd0f8`.
+- Adds no semantic primitive, compiler pass, runtime concept, public API,
+  dependency, generated application behavior, or browser byte.
+- Updates `create-kudzu@0.1.144` to generate projects on
+  `@kudzujs/core@^0.16.19`.
+- The GitHub release and raw asset were published, but its npm workflow stopped
+  before publication on an unrelated project browser-test failure. The immutable
+  forward chain starts at `0.16.20` with generator `0.1.145`; npm recovery is
+  `0.16.21` with generator `0.1.146`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.19
+```
+
 ## 0.16.18 - AI Attribution Integrity
 
 Kudzu 0.16.18 makes the AI delivery evidence boundary fail closed before the

package/docs/next-architecture/README.md

@@ -15,7 +15,7 @@ The completed `0.9.0` milestone is recorded in [`0.9-semantic-compression.md`](.
 
 [`1.0-large-application-compatibility-audit.md`](./1.0-large-application-compatibility-audit.md) records the first post-0.9 probes against Memos, Apache Answer, and Actual Budget. The audit finds that reduced slices build but whole-application source retention and behavior parity do not yet pass.
 
-[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.21.4`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
+[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue. Its `0.21.4` AI delivery proof is measured at Kudzu 11/25 versus React + Vite 24/25 and blocks `1.0.0`; the next packet must be selected from those measured failures. The plan assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
 
 ## Required Invariants
 

package/docs/next-architecture/application-capability-release-plan.md

@@ -2128,6 +2128,32 @@ and complete acceptance journeys for those five classes, then run at least five
 interleaved attempts per framework and task under one model, tool, context, and
 time contract.
 
+The corrected production comparison was recorded in GitHub release `v0.16.19`.
+Its npm workflow stopped before publication on an unrelated flaky project browser
+journey. The `v0.16.20` forward release passed every repository gate, but npm
+rejected its trusted-publishing signing certificate with HTTP 403. The immutable
+recovery release `@kudzujs/core@0.16.21` carries the unchanged evidence and
+`create-kudzu@0.1.146` targets it.
+The first batch is retained but excluded from ranking after hidden content/form
+selector assumptions and inconsistent React versions were found. Revision 2
+hashes the written contracts and executable acceptance, uses React 19.2.8 in all
+five task classes, and records Kudzu 11/25 attributable successes (44%) against
+React + Vite 24/25 (96%). One React realtime adapter exceeded 300 seconds without
+a trace and correctly remains incomplete; it was not selectively replaced.
+
+The gate fails: Kudzu has no successful task result for content or commerce, so
+its aggregate task-token median is unavailable. React's incomplete realtime
+attempt also leaves its aggregate failure-inclusive cost unavailable. Kudzu keeps lower accepted browser artifacts and zero-JavaScript static
+siblings, but does not meet the required success-rate or cost criteria. The raw
+invalid and corrected attempts are published as
+`kudzu-ai-delivery-0.21.4-gpt-5.6-sol.tar.gz`, SHA-256
+`4e37d15b4c4b0cf88720a3a7743996794b2e0172dbc43d40514f944fb01bd0f8`.
+The next evidence-selected work must address reactive collection normalization
+and count reuse, then reactive text inside selected conditional branches.
+`1.0.0` remains unauthorized. This packet adds no semantic primitive, compiler
+pass, runtime concept, public API, dependency, generated behavior, or browser
+byte.
+
 ## `1.0.0`: Stable Application Model
 
 `1.0.0` is authorized only after every required `0.21.x` gate passes. It means:
@@ -2273,4 +2299,4 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.21.1` | Released as `0.16.16` | Preserve 100/1,000/10,000-route phase, RSS, output, digest, incremental-equivalence, recovery, and bounded canonical-AST retention evidence. | Full 10,000-route report has one complete measured run after two measured-stage diagnostics; no projection used |
 | `0.21.2` | Closed by existing semantics | Preserve initial/session/lazy bytes, keyed/range/navigation median alarms, and bounded endurance ownership evidence. | Same-revision absolute gates; structural artifact bytes are not compressed network transfer |
 | `0.21.3` | Released as `0.16.17` | Preserve exact package, browser, benchmark, registry, and fresh-install evidence. | One initial navigation benchmark invocation stalled at the outer timeout; its clean seven-profile rerun passed all alarms |
-| `0.21.4` | Active; attribution prerequisite released as `0.16.18` | Freeze paired production starters and complete acceptance for the five required task classes, then run at least five interleaved attempts per framework and task. | No local complete React + Vite starter set; derive four pairs from maintained complete fixtures and pin the public commerce pair |
+| `0.21.4` | Measured gate failed; npm recovery released as `0.16.21` | Preserve both raw batches, the corrected revision-2 protocols, and the failed success/cost decision; keep `1.0.0` blocked. | Kudzu 11/25 versus React + Vite 24/25; next evidence work is reactive collection normalization/count reuse and conditional-branch reactive text |

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.16.18` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.21.4`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.16.21` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The `0.21.4` AI delivery gate is measured and blocked; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.21.4`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The [`application-capability-release-plan.md`](./application-capability-release-plan.md) records the measured and blocked `0.21.4` AI delivery gate. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
-[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.21.4`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
+[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for the measured `0.21.4` result and the next evidence-selected work; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
 
 ## Product Outcome
 
@@ -483,4 +483,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-All listed foundation and `0.9` slices are complete. Current work continues at `0.21.4` AI delivery proof under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.
+All listed foundation and `0.9` slices are complete. The `0.21.4` AI delivery proof failed its success-and-cost gate; select subsequent work only from its measured content, CRUD, and commerce failures under the [`application-capability-release-plan.md`](./application-capability-release-plan.md). Keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.21.4`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
+This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md); its `0.21.4` AI delivery gate is measured and blocked. That plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.143` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.18`.
+`create-kudzu@0.1.146` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.21`.
 
 ## Release Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.16.18",
+  "version": "0.16.21",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",
@@ -66,6 +66,7 @@
     "benchmark:project-state": "node test/project-state-performance.mjs",
     "benchmark:source-scale": "node test/source-scale-performance.mjs",
     "benchmark:ai-delivery": "node test/ai-delivery-runner.mjs",
+    "benchmark:ai-delivery-production": "node test/ai-delivery-production-suite.mjs",
     "prepublishOnly": "npm run check && npm test",
     "deploy": "wrangler deploy",
     "preview": "wrangler dev"