@kudzujs/core 0.16.9 → 0.16.10

package/MIGRATION_ROADMAP.md

@@ -18,7 +18,7 @@ Apache Answer's `useTranslation()` cannot be folded safely because its language
 
 Apache Answer's SWR/axios/qs question reads now have an executable migration path through one native fetch effect with application-owned loading/error/data state. Derived `page` and `order` query dependencies restart the effect, stale responses lose setter authority, recommendation endpoints and HTTP recovery remain explicit, nested keyed tags retain list ownership, and a static sibling remains JavaScript-free. No cache, Provider, retry scheduler, SWR, axios, or query runtime is added.
 
-Apache Answer authentication now has a reduced layout-owned session path: native login form submission persists a token, a mount effect restores and validates it, shared header/settings consumers read one package-neutral state record, and a 401 clears storage/state before native replacement navigation. The public sibling remains JavaScript-free. Full browser acceptance and the broader server-fed settings stores remain subsequent gates.
+Apache Answer authentication now has a browser-proven layout-owned session path: native login form submission persists a token, a mount effect restores and validates it, shared header/settings consumers read one package-neutral state record, and a 401 clears storage/state before native replacement navigation. A deterministic server verifies anonymous, invalid login, valid login, reload restoration, shared consumers, and expiry while the public sibling remains JavaScript-free. Broader server-fed settings stores remain a subsequent gate.
 
 Apache Answer's first route-shell gate replaces `RouterProvider` and nested `Outlet` ownership with seven directly addressable Kudzu file routes, one ordinary shared shell, native anchors, and runtime question/tag parameters. Questions, tags, admin dashboard, and unwrapped legal output build without a browser router; the two bracket routes emit only pathname capability and rewrite metadata.
 
@@ -51,7 +51,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - stronger JavaScript failure resilience;
 - no remaining material large-route build-scaling weakness.
 
-The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.19.1` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
+The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.19.2` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
 
 ### 0.10.0 Through 0.21.x: Application Capability Release Train
 

package/PERFORMANCE.md

@@ -2,6 +2,19 @@
 
 Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm run benchmark:native`, `npm run benchmark:module-cache`, `npm run benchmark:project-navigation`, `npm run benchmark:project-state`, and `npm run benchmark:source-scale` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
 
+## 0.16.10 Apache Answer Authentication Journey
+
+Measured 2026-08-31 on Linux x64 with Node 24.14.0 and required Chrome. The
+existing authentication fixture remains 17 deploy files and 36,441 raw / 15,598
+aggregate gzip B. The login route owns 25,684 raw / 11,372 gzip B, settings owns
+26,818 raw / 11,319 gzip B, and the public sibling owns zero JavaScript. Required
+Chrome verifies anonymous, invalid and valid login, token restore, shared
+header/settings state, 401 clearing, and replacement navigation against a
+deterministic server. No production source or deploy artifact changed. The
+maintained Worker graph remains 907 raw / 477 gzip B and the window graph remains
+14,456 raw / 6,160 gzip B. Seven clean builds record a 674.7 ms median on this
+loaded host; timing is not compared.
+
 ## 0.16.9 Compatibility Boundary And Inventory
 
 Measured 2026-08-31 on Linux x64 with Node 24.14.0 and required Chrome. The

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.16.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.16.9 - Compatibility boundary and inventory.** Reachable authored package sites now receive deterministic compatibility classes and source ranges in a compiler-only report without entering semantic IR or browser output. Read the [release notes](./RELEASES.md#0169---compatibility-boundary-and-inventory), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.9), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.16.10 - Apache Answer authentication journey.** The existing layout-owned session reduction now passes anonymous, invalid and valid login, reload restoration, shared settings, and 401 replacement navigation against a deterministic server without compiler or browser-output changes. Read the [release notes](./RELEASES.md#01610---apache-answer-authentication-journey), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.10), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,31 @@
 # Kudzu Releases
 
+## 0.16.10 - Apache Answer Authentication Journey
+
+Kudzu 0.16.10 promotes the existing Apache Answer authentication reduction from
+build-only evidence to a complete deterministic browser journey.
+
+### Changed in 0.16.10
+
+- Proves anonymous startup, invalid login, valid login, token persistence, and
+  token restoration after a full document reload.
+- Proves one layout-owned package-neutral session record updates the shared
+  header and settings route without a browser component tree.
+- Proves a server 401 clears storage and shared state before native replacement
+  navigation returns to the anonymous login document.
+- Runs the journey against a deterministic native test server while preserving
+  the public sibling as complete HTML with zero JavaScript.
+- Adds no compiler behavior, semantic primitive, IR kind, runtime concept,
+  package adapter, public API, or browser bytes.
+- Updates `create-kudzu@0.1.135` to generate projects on
+  `@kudzujs/core@^0.16.10`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.10
+```
+
 ## 0.16.9 - Compatibility Boundary And Inventory
 
 Kudzu 0.16.9 records deterministic package compatibility provenance from the

package/docs/next-architecture/1.0-large-application-compatibility-audit.md

@@ -338,8 +338,10 @@ navigation compile without Zustand, axios, React Router, or React in output; a
 public sibling remains static. One compiler correction prevents shared-state
 identifiers such as `session.token` from being misclassified as imported
 calculation results during effect dependency analysis. This adds no IR kind,
-pass, or runtime concept. Browser login/reload/401 acceptance remains required
-before this intake can be marked a completed authentication reduction.
+pass, or runtime concept. Required Chrome now proves anonymous, invalid and
+valid login, token restore after reload, shared header/settings reads, 401
+storage/state clearing, and replacement navigation against a deterministic
+server. The authentication reduction is complete without a production change.
 
 ## Route Shell Intake
 

package/docs/next-architecture/README.md

@@ -15,7 +15,7 @@ The completed `0.9.0` milestone is recorded in [`0.9-semantic-compression.md`](.
 
 [`1.0-large-application-compatibility-audit.md`](./1.0-large-application-compatibility-audit.md) records the first post-0.9 probes against Memos, Apache Answer, and Actual Budget. The audit finds that reduced slices build but whole-application source retention and behavior parity do not yet pass.
 
-[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.19.1`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
+[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.19.2`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
 
 ## Required Invariants
 

package/docs/next-architecture/application-capability-release-plan.md

@@ -1651,6 +1651,24 @@ a 532.6 ms median without a timing comparison. This packet ships as the actual
 - **Stop condition:** client UI is treated as authorization.
 - **Done condition:** the complete journey passes against a deterministic server.
 
+Complete. The existing Apache Answer reduction now runs one required-Chrome
+journey against a deterministic native server. It proves anonymous startup,
+invalid and valid native form submission, token persistence and reload restore,
+layout-owned header/settings reads, a server 401 clearing storage and shared
+state, and replacement navigation back to the anonymous login document. The
+public sibling remains complete HTML with zero JavaScript.
+
+No authored fixture, compiler, IR, runtime, or deploy artifact changed. The
+packet adds one browser harness only: zero semantic primitives, ModuleIR kinds,
+passes, normalization entries, runtime concepts, public APIs, and browser bytes.
+The authentication fixture remains 17 deploy files and 36,441 raw / 15,598 gzip
+bytes; `/` owns 25,684 raw / 11,372 gzip bytes, `/settings` owns 26,818 raw /
+11,319 gzip bytes, and `/public` owns 0 JavaScript bytes. Worker and window
+graphs remain 907 raw / 477 gzip and 14,456 raw / 6,160 gzip bytes; seven clean
+Linux x64 builds record a 674.7 ms median without a timing comparison. This
+packet ships as the actual `0.16.10` patch, with `create-kudzu@0.1.135`, to
+retain the public `0.16.x` line.
+
 ### `0.19.2`: Apache Answer Connected Authoring Journey
 
 - **Purpose:** connect query, route, detail, create/edit, validation, mutation,
@@ -1929,3 +1947,4 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.18.2` | Released as `0.16.7` | Preserve on-demand retained editor mount, bidirectional updates, failure recovery, identity, exact cleanup, cached fresh remount, and static exclusion. | Patch release retained the `0.16.x` public version line |
 | `0.18.3` | Released as `0.16.8` | Preserve shared deferred ownership, interaction-only loading, native document module-map deduplication, exact owner cleanup, binding-aware import validation, and static exclusion. | Patch release retained the `0.16.x` public version line |
 | `0.19.0` | Released as `0.16.9` | Preserve the compatibility registry, reachable source inventory, exact ranges, and package-neutral output boundary. | Patch release retained the `0.16.x` public version line |
+| `0.19.1` | Released as `0.16.10` | Preserve anonymous, invalid/valid login, token restore, layout-shared session reads, 401 clear, replacement navigation, and public zero-JavaScript output. | Patch release retained the `0.16.x` public version line |

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.16.9` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.19.1`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.16.10` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.19.2`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.19.1`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.19.2`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
-[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.19.1`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
+[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.19.2`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
 
 ## Product Outcome
 
@@ -483,4 +483,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-All listed foundation and `0.9` slices are complete. Current work continues at `0.19.1` Apache Answer Authentication Journey under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.
+All listed foundation and `0.9` slices are complete. Current work continues at `0.19.2` Apache Answer Connected Authoring Journey under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.19.1`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
+This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.19.2`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.134` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.9`.
+`create-kudzu@0.1.135` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.10`.
 
 ## Release Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.16.9",
+  "version": "0.16.10",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",