@kudzujs/core 0.8.30 → 0.8.32

package/MIGRATION_ROADMAP.md

@@ -2,7 +2,7 @@
 
 This document is the source of truth for Kudzu's product direction, architecture invariants, and future development order. Read it before extending React-shaped syntax or browser capabilities.
 
-The executable post-`0.8.30` compiler and large-application sequence is maintained in [`docs/next-architecture/large-application-ai-native-roadmap.md`](./docs/next-architecture/large-application-ai-native-roadmap.md). Follow its PR dependencies for implementation work; this document remains authoritative when selecting or accepting a migration capability.
+The executable post-`0.8.32` compiler and large-application sequence is maintained in [`docs/next-architecture/large-application-ai-native-roadmap.md`](./docs/next-architecture/large-application-ai-native-roadmap.md). Follow its PR dependencies for implementation work; this document remains authoritative when selecting or accepting a migration capability.
 
 [`GOAL_A.md`](./GOAL_A.md) and [`GOAL_B.md`](./GOAL_B.md) are completed capability-validation records. Their commerce and realtime dashboard fixtures prove general lifecycle, navigation, async-workflow, and Worker capabilities; they are not separate product verticals or future priority lists.
 
@@ -28,6 +28,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - Interactive routes ship only the capabilities they use.
 - Prefer build-time execution whenever all inputs are available during the build.
 - State setters update logical state immediately and batch direct DOM writes at synchronous-turn boundaries.
+- Async handler state writes, queued commits, and captured ref resolution end when its mounted DOM owner is released; application promises and ordinary reads may finish without reviving that ownership.
 - Preserve familiar function components, props, children, JSX, hooks, conditions, collections, and event handlers where Kudzu can compile them safely.
 - Prefer compiler specialization over asking migrated applications to replace ordinary declarative React UI with imperative DOM code.
 - Unknown browser-only data receives a static shell plus only the ESM needed to obtain and patch it.
@@ -288,6 +289,19 @@ This queue orders the next investigations by general migration value. Start only
 - Ordinary dynamic `import()` fails during graph discovery rather than surviving into generated `.kudzu` modules; relative, package, template, and computed forms share one source-located boundary.
 - Ordinary and Worker graph ownership remain separate, while type-only and unreachable source stay excluded. Export-name validation, ProjectSession, runtime behavior, and public APIs remain unchanged.
 
+### Completed In 0.8.31
+
+- Pending async native handlers lose state-write, queued-commit, and captured-ref authority when enhanced navigation, keyed removal, conditional removal, or document disposal releases their mounted DOM owner.
+- Direct and captured setters cannot recreate released state, queued commits clear without touching replacement DOM, and captured object refs resolve to `null` after release.
+- Chrome coverage removes and recreates the same route and keyed row before old work resolves, proving replacement ownership stays fresh without cancelling application promises or adding a scheduler.
+- The focused 5,000-event Chrome dispatch median remains 6.4 ms; the native fixture retains its emitted paths with a measured 209 B raw / 94 B aggregate gzip correctness cost.
+
+### Completed In 0.8.32
+
+- Production artifacts complete in staging; public/generated collisions and late `afterBuild()` failure preserve the previous successful `dist`.
+- Same-root builds use an exclusive PID lock, stale locks fail closed, interrupted promotion backups recover on the next admitted build after lock removal, and successful replacement removes stale output.
+- Route HTML writes use bounded batches, keyed reverse/remove paths avoid repeated map reconstruction, and binding/condition commits share one dispatch without adding a runtime or public API.
+
 ## Cross-Cutting Performance Gates
 
 Every migration feature must preserve:

package/PERFORMANCE.md

@@ -1,6 +1,117 @@
 # Performance Records
 
-Reproducibility classes: `npm run benchmark` and `npm run benchmark:keyed` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
+Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, and `npm run benchmark:native` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
+
+## 2026-08-11 React, Vue, And Svelte Check
+
+This is a current local check, not a maintained framework ranking. The external `/home/kft/Documents/etc/demo/benchmarks` workspace is not Git-provenanced, but its matched fixtures, validators, dependencies, and raw result files were present and reused without source changes. The Kudzu target used this P0.5 candidate with `0.8.31` package metadata; controls were React 19.2.7, Vue 3.5.40, Svelte 5.56.6, and Vite 7.3.6 on Node 24.14.0, Linux x64, and Chrome 142.0.7444.175.
+
+Each fixture received one warm-up and seven rotating clean production builds. Seven fresh headless Chrome profiles per target validated exact row count/order/text, retained and released DOM identity, fresh state on re-entry, and effect lifecycle counts before recording MutationObserver completion. React, Vue, and Svelte are CSR controls with no initial rows in HTML; Kudzu emits all initial rows, so total deploy size is reported but is not architecture-equivalent.
+
+| Fixture | Framework | Build median | Initial JS gzip | Total deploy raw |
+|---|---|---:|---:|---:|
+| 1,000 keyed rows with local state | Kudzu | 1,212 ms | 10.2 KB | 576.0 KB |
+| | Svelte | 1,745 ms | 13.1 KB | 33.8 KB |
+| | Vue | 1,584 ms | 24.4 KB | 61.6 KB |
+| | React | 1,939 ms | 59.4 KB | 189.5 KB |
+| 1,000 keyed effects | Kudzu | 735 ms | 9.8 KB | 226.0 KB |
+| | Svelte | 1,554 ms | 12.5 KB | 32.4 KB |
+| | Vue | 1,444 ms | 24.5 KB | 61.9 KB |
+| | React | 1,741 ms | 59.5 KB | 189.7 KB |
+| 100 parents x 10 keyed children | Kudzu | 732 ms | 8.2 KB | 354.6 KB |
+| | Svelte | 1,613 ms | 13.1 KB | 33.8 KB |
+| | Vue | 1,437 ms | 24.6 KB | 62.1 KB |
+| | React | 1,718 ms | 59.5 KB | 190.0 KB |
+
+Kudzu's build medians were 23% to 58% lower and its initial JavaScript gzip was 21% to 86% lower than the three CSR controls. A separate seven-run GNU `time` check on the keyed-row fixture measured median build peak RSS of 157.4 MiB for Kudzu, 209.2 MiB for Svelte, 208.0 MiB for Vue, and 281.3 MiB for React.
+
+| Fixture operation | Kudzu | Svelte | Vue | React |
+|---|---:|---:|---:|---:|
+| Row edit | 5.6 ms | 4.9 ms | 5.7 ms | 11.9 ms |
+| Reverse 1,000 rows | 28.2 ms | 94.3 ms | 23.2 ms | 51.8 ms |
+| Remove row | 5.0 ms | 8.7 ms | 7.6 ms | 15.6 ms |
+| Re-add row | 7.7 ms | 16.8 ms | 8.1 ms | 18.5 ms |
+| Effect dependency update | 4.8 ms | 9.8 ms | 10.0 ms | 14.9 ms |
+| Effect-unrelated update | 2.8 ms | 7.3 ms | 2.7 ms | 10.1 ms |
+| Reverse effect rows | 11.7 ms | 71.5 ms | 13.4 ms | 29.5 ms |
+| Nested child update | 2.7 ms | 3.4 ms | 6.5 ms | 12.0 ms |
+| Reverse 10 children | 0.7 ms | 1.1 ms | 3.1 ms | 9.0 ms |
+| Reverse 100 parents | 6.8 ms | 7.7 ms | 7.3 ms | 11.1 ms |
+| Remove parent | 1.1 ms | 1.5 ms | 3.4 ms | 6.7 ms |
+
+These initial browser runs were grouped by target and some seven-sample ranges were wide, so they were treated as directional rather than a framework ranking. The candidate then removed repeated keyed-root lookups and redundant removal-map reconstruction across the generic, nested, and reducer list paths, and merged binding/condition state dispatch into one committer. The keyed-row JavaScript graph decreased from 26,962 B raw / 10,508 B gzip to 26,768 B raw / 10,485 B gzip.
+
+A 31-round rotating follow-up ran fresh Chrome profiles in alternating and periodically reversed framework order. Its full-list completion predicate retained the exact 1,000-row content and identity checks inside timing:
+
+| Framework | Edit | Reverse | Remove | Re-add |
+|---|---:|---:|---:|---:|
+| Kudzu | 5.9 ms | 23.4 ms | 5.6 ms | 8.0 ms |
+| Svelte | 5.5 ms | 97.0 ms | 9.2 ms | 14.7 ms |
+| Vue | 6.8 ms | 26.6 ms | 9.6 ms | 10.0 ms |
+| React | 14.7 ms | 51.0 ms | 20.2 ms | 14.3 ms |
+
+Paired sign tests established Kudzu's reverse, remove, and re-add advantage over Vue at 6.0 ms (`p=0.00143`), 4.1 ms (`p=0.000192`), and 2.1 ms (`p=0.0107`) median differences. Kudzu also beat Svelte for those operations in 31/31, 28/31, and 27/31 rounds. The full-list edit result remained dominated by the validator: Kudzu versus Svelte had a 0.8 ms directional loss with `p=0.281`, while Kudzu versus Vue had a 0.4 ms directional gain with `p=0.720`.
+
+A final edit-only protocol kept complete 1,000-row correctness validation after each measurement but used only the edited row's class/input identity as the completion signal. Over 31 rotating rounds, Kudzu measured 0.7 ms versus Svelte 1.4 ms and Vue 1.8 ms. Paired differences favored Kudzu by 0.7 ms in 30/31 rounds (`p=2.98e-8`) versus Svelte and by 0.9 ms in 31/31 rounds (`p=9.31e-10`) versus Vue. Complete seven-run suite samples remain in the external workspace's `benchmarks/results/*-current.{json,md}` files; rotating raw samples are temporary measurement artifacts and this section remains a current local check rather than a maintained general ranking.
+
+## 0.8.32 Staged Output Emission
+
+Measured UTC 2026-08-11 on an Intel Core i5-9500 with 6 cores, Linux 6.17.0-19-generic, Node 24.14.0, and npm 11.9.0. The baseline was clean tag `v0.8.31` at `06b436e`; baseline and the pre-release P0.5 candidate used the same installed dependencies and the public 1,000-product storefront fixture at `f2d5be1a516c539e30f7125f6870d42b1dd02ecd`. The later same-root lock and interrupted-backup recovery hardening was correctness-tested but not included in this timing array.
+
+One warm-up followed by 21 alternating replacement builds preserved the preceding output so the candidate exercised staging, promotion, and prior-tree removal on every run. Generated `.kudzu` scratch was cleaned outside timing. The candidate folds collision validation into one public copy traversal and writes the already-rendered route HTML in bounded batches of 64.
+
+| Target | Build median | Output |
+|---|---:|---:|
+| `v0.8.31` | 20,392.7 ms | 3,056 files / 11,137,074 B |
+| P0.5 candidate | 19,229.1 ms | 3,056 files / 11,137,074 B |
+
+The candidate median is 5.71% lower. Every relative artifact path and SHA-256 hash matched, so deploy raw and gzip sizes are unchanged and no browser bytes are added.
+
+```text
+v0.8.31: [20868.5,19436.9,22023.6,21433.5,20634.0,20410.1,20392.7,21408.8,20252.0,19858.3,20489.9,20835.2,20450.2,18727.3,17239.1,17578.2,17672.1,17465.1,21087.0,18892.8,18727.9]
+candidate: [20481.6,18692.6,21060.7,19881.9,19510.8,20844.1,20348.6,19229.1,20304.8,19852.9,18929.3,20472.5,17384.9,18628.6,17890.2,18841.0,19755.6,17805.9,18282.5,17770.5,17370.3]
+```
+
+```bash
+APP_ROOT=/tmp/opencode/kudzu-based-bench/apps/shop-kudzu \
+BASELINE_ROOT=/tmp/opencode/kudzu-p05-profile \
+PRESERVE_OUTPUT=1 RUNS=21 npm run benchmark:commerce
+```
+
+## 0.8.31 Async Native Handler Ownership
+
+Measured UTC 2026-08-10 on Apple M3, 8 logical CPUs, 8 GiB RAM, macOS 26.5.2 / Darwin 25.5.0, Node 25.6.1, npm 11.18.0, and Chrome 151.0.7922.76. The baseline was clean tag `v0.8.30` at `9bb5ce8`; baseline and candidate used the same installed dependencies.
+
+The implementation and maintained-check patch over `v0.8.30` had SHA-256 `c67956b67b558052885dd48a9dbe35f238b8ce042876537952355aa05b8cdc10`, produced by:
+
+```bash
+git diff --binary v0.8.30 -- framework/native-runtime.js framework/serialization.js test/fixtures/navigation/src/Shell.tsx test/fixtures/navigation/src/pages/product.tsx test/fixtures/navigation/public/browser-test.js test/framework.test.mjs test/native-performance.mjs package.json | shasum -a 256
+```
+
+The maintained browser runner built the same `test/fixtures/native-bubbling` source with each framework root. After one warm-up, 21 alternating headless Chrome processes dispatched 5,000 synchronous clicks through the real DOM listener, handler-module lookup, generated handler, state context, and queued-flush scheduling path. Both medians were 6.4 ms; the 6.1-6.8 ms baseline and 6.2-6.7 ms candidate ranges overlap, so no dispatch regression is established.
+
+```bash
+git worktree add --detach /tmp/kudzu-v0.8.30 v0.8.30
+ln -s "$PWD/node_modules" /tmp/kudzu-v0.8.30/node_modules
+BASELINE_ROOT=/tmp/kudzu-v0.8.30 RUNS=21 ITERATIONS=5000 \
+CHROME_BIN="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+npm run benchmark:native
+```
+
+```text
+0.8.30: [6.6,6.3,6.4,6.3,6.3,6.8,6.3,6.6,6.3,6.4,6.5,6.4,6.5,6.5,6.4,6.1,6.3,6.2,6.5,6.4,6.4]
+0.8.31: [6.4,6.7,6.2,6.4,6.6,6.6,6.5,6.4,6.5,6.4,6.4,6.4,6.6,6.5,6.4,6.3,6.4,6.4,6.6,6.2,6.4]
+```
+
+The maintained `native-bubbling` fixture retained the same eight JavaScript paths. The browser runner hashes every file and permits only the ownership-bearing native and capture-deserialization runtimes to change:
+
+| Artifact | 0.8.30 raw / gzip | 0.8.31 raw / gzip | Delta raw / gzip |
+|---|---:|---:|---:|
+| `assets/kudzu-native.js` | 1,528 B / 842 B | 1,715 B / 925 B | +187 B / +83 B |
+| `assets/kudzu-serialization.js` | 675 B / 381 B | 697 B / 392 B | +22 B / +11 B |
+| Complete native fixture JavaScript | 13,629 B / 6,177 B | 13,838 B / 6,271 B | +209 B / +94 B |
+
+The timing is a focused synchronous event-dispatch measurement, not a general interaction or asynchronous task benchmark. The runtime does not cancel application promises or arbitrary browser API work; it invalidates Kudzu state writes, queued commits, and captured ref resolution after the listener's DOM ownership is released.
 
 ## 0.8.26 Goal B Benchmark Hardening
 

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.8.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.8.30 - Graph failure diagnostics.** Reachable ordinary modules now validate relative runtime imports and re-exports and reject dynamic `import()` at the original importer location before generated module loading. Worker ownership, type-only edges, and unreachable source remain distinct. Read the [release notes](./RELEASES.md#0830---graph-failure-diagnostics), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.8.30), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.8.32 - Staged and collision-safe output.** Builds complete in an isolated staging tree, reject public/generated collisions, preserve the previous `dist` on ordinary build and hook failures, recover interrupted promotion backups after a stale lock is cleared, and reject overlapping same-root builds. Read the [release notes](./RELEASES.md#0832---staged-and-collision-safe-output), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.8.32), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,67 @@
 # Kudzu Releases
 
+## 0.8.32 - Staged and collision-safe output
+
+Kudzu 0.8.32 completes P0.5 by building production artifacts away from the active deploy tree, rejecting public/generated collisions, and replacing `dist` only after generation and trusted `afterBuild()` work succeed.
+
+### Changed in 0.8.32
+
+- Route HTML, runtime, handler, chunk, Worker, source CSS, and configured CSS artifacts complete in a project-local staging tree before promotion.
+- Public files merge only into unowned paths. A public file cannot replace a generated file or directory, and duplicate configured stylesheet outputs fail before publication.
+- Ordinary compiler, bundler, public-copy, and `afterBuild()` failures leave the previous successful `dist` unchanged.
+- Same-root builds use an exclusive PID lock. Active overlap and dead/invalid lock files fail closed; after an operator removes a stale lock, the next admitted build recovers a backup left by interrupted promotion. Promotion is a guarded rollback/recovery sequence rather than a lock-free atomic directory exchange.
+- Successful replacement removes stale output and staging/backup artifacts. Development rebuild errors retain the previous on-disk HTML while the existing error overlay reports the source failure.
+- Route HTML writes use bounded batches. Keyed reverse/remove paths avoid repeated root-map work, and binding plus condition updates share one state commit dispatch.
+
+### Performance
+
+- Before final lock/recovery hardening, twenty-one alternating local replacement builds of the 1,011-page commerce fixture observed a 20,392.7 ms to 19,229.1 ms median change, 5.71% lower, while all 3,056 paths and 11,137,074 deploy bytes retained identical SHA-256 hashes.
+- The optimized 1,000-row browser graph decreased by 194 B raw / 23 B gzip. External exploratory browser comparisons and their non-publication limitations are documented in `PERFORMANCE.md`; they are not a release gate or maintained general ranking.
+
+### Validation
+
+- `npm run check`, `npm test`, `npm run test:package`, and all 190 tests pass.
+- Focused integration coverage verifies seven public/generated namespaces, configured-style collisions, late hook failure, successful stale-file removal, same-root overlap rejection, stale-lock diagnosis, interrupted-backup recovery after lock removal, and no staging/backup remnants.
+- Existing keyed identity/state, nested lists, reducer rows, SVG, effects, Workers, navigation, async ownership, and static zero-JavaScript behavior remain covered.
+- P0.6 ProjectSession and explicit root is next.
+
+### Upgrade
+
+```bash
+npm install @kudzujs/core@^0.8.32
+```
+
+## 0.8.31 - Async native-handler ownership
+
+Kudzu 0.8.31 completes P0.4 by tying every mounted native-handler context to its DOM registration lifetime. Async work may finish after route, keyed, or conditional removal, but it cannot write through ownership that no longer exists.
+
+### Changed in 0.8.31
+
+- Native registrations expose one active lifetime to direct setters, captured setters, queued commits, and captured object refs.
+- `unmountNative()` invalidates the registration before removing its listener. Enhanced navigation, keyed removal, and conditional removal use the shared unmount hook; non-persisted `pagehide` directly releases document registrations.
+- Late state writes become no-ops instead of recreating released state IDs; already queued commits clear without touching replacement DOM.
+- Captured object refs resolve to `null` after release, so a late handler cannot find a replacement node that reused the same compiler-owned ref ID.
+- Application promises are not cancelled, and no scheduler, task registry, component runtime, or public API is added.
+
+### Performance
+
+- Twenty-one alternating headless Chrome processes measured 5,000 synchronous native event dispatches at a 6.4 ms median for both `0.8.30` and `0.8.31`; the recorded ranges overlap.
+- The maintained `native-bubbling` fixture keeps the same eight JavaScript paths. `kudzu-native.js` and `kudzu-serialization.js` add 209 B raw / 94 B aggregate gzip; the runner rejects any other artifact change.
+- Environment, raw arrays, artifact bytes, methodology, and limitations are recorded in `PERFORMANCE.md`.
+
+### Validation
+
+- `npm run check`, `npm test`, `npm run test:package`, and all 189 tests pass.
+- Chrome starts async route and keyed-row handlers, releases and recreates their owners, and proves late state writes and refs cannot mutate replacement ownership. A persistent layout handler also proves non-persisted document disposal invalidates pending work.
+- Focused context checks cover queued direct commits and captured setters. The browser suite retains normal synchronous native event semantics; unaffected static routes remain zero JavaScript.
+- P0.5 atomic and collision-safe output is next.
+
+### Upgrade
+
+```bash
+npm install @kudzujs/core@^0.8.31
+```
+
 ## 0.8.30 - Graph failure diagnostics
 
 Kudzu 0.8.30 completes P0.3 by making ordinary source-graph failures stop at the original importer before compilation, generated module loading, or `.kudzu` paths can obscure the source error.

package/docs/next-architecture/README.md

@@ -11,7 +11,7 @@ The top-level [`GOAL_A.md`](../../GOAL_A.md) and [`GOAL_B.md`](../../GOAL_B.md)
 | C: state/resource model | Research only | Reduced fixtures expose a limitation |
 | D: routing compatibility | Current behavior preserved | Revisit only with migration evidence and invariant review |
 
-The active post-`0.8.30` implementation sequence is [`large-application-ai-native-roadmap.md`](./large-application-ai-native-roadmap.md). It orders compiler semantic generalization, large-application foundations, compatibility boundaries, AI tooling, and production validation without changing the invariants below.
+The active post-`0.8.32` implementation sequence is [`large-application-ai-native-roadmap.md`](./large-application-ai-native-roadmap.md). P0.5 staged and collision-safe output is complete; P0.6 ProjectSession and explicit root is next. The plan orders compiler semantic generalization, large-application foundations, compatibility boundaries, AI tooling, and production validation without changing the invariants below.
 
 ## Required Invariants
 

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.8.30` architecture built on the completed `0.8.23` Goal A compiler foundation. File and function names are the stable references; line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.8.32` architecture built on the completed `0.8.23` Goal A compiler foundation. File and function names are the stable references; line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 
@@ -28,10 +28,10 @@ This maps the current `0.8.30` architecture built on the completed `0.8.23` Goal
 | Route capability projection | [`framework/compiler/route-capability-planner.mjs`](../../framework/compiler/route-capability-planner.mjs), `planRouteCapabilities()` | Validates RouteIR v1 and purely folds rendered plans and route facts into CapabilityIR v1. |
 | Effect entry generation | [`framework/compiler/effect-codegen.mjs`](../../framework/compiler/effect-codegen.mjs) | Generates ordinary, dependency, owned, and navigable effect entries from rendered descriptors. |
 | Runtime generation | [`framework/compiler/runtime-codegen.mjs`](../../framework/compiler/runtime-codegen.mjs), [`framework/compiler/list-runtime-codegen.mjs`](../../framework/compiler/list-runtime-codegen.mjs), [`framework/compiler/param-codegen.mjs`](../../framework/compiler/param-codegen.mjs) | Consumes versioned contracts, specializes authored capability sources with fail-closed anchors, and returns source/define results without filesystem ownership. |
-| Artifact emission | `framework/build.mjs` | Selects required files from CapabilityIR and writes or bundles generated sources with esbuild. Byte-identical native, parameter, and effect route entries reuse one exact-source transform result within the current build only. |
-| Browser capabilities | [`framework/*.js`](../../framework/) | Small optional modules for commands, bindings, lists, effects, native handlers, serialization, parameters, and navigation; no component runtime. |
+| Artifact emission | `framework/build.mjs` | Selects required files from CapabilityIR, writes route HTML in bounded batches, writes and bundles the complete generation in a project-local staging sibling, copies public subtrees without replacing generated paths, runs `afterBuild`, then promotes with rollback so failed builds preserve the prior `dist`. Byte-identical native, parameter, and effect route entries reuse one exact-source transform result within the current build only. |
+| Browser capabilities | [`framework/*.js`](../../framework/) | Small optional modules for commands, bindings, lists, effects, native handlers, serialization, parameters, and navigation; native contexts invalidate writes and refs at DOM ownership release, with no component runtime. |
 | Opt-in navigation | [`framework/navigation-runtime.js`](../../framework/navigation-runtime.js) plus `framework/build.mjs` navigation configuration/emission | Fetches and validates complete same-origin documents, replaces only the marked route range, manages route/layout disposal, history, focus, finite prefetch retention, and native fallback. |
-| Development serving | [`framework/dev-server.mjs`](../../framework/dev-server.mjs) and [`framework/dev-state.js`](../../framework/dev-state.js) | Rebuild/watch/SSE and response-only short-lived state restoration; never changes production `dist/`. |
+| Development serving | [`framework/dev-server.mjs`](../../framework/dev-server.mjs) and [`framework/dev-state.js`](../../framework/dev-state.js) | Rebuild/watch/SSE and response-only short-lived state restoration; failed rebuilds show the existing error overlay while preserving the previous on-disk output. |
 
 ## Current Data Flow
 
@@ -54,8 +54,10 @@ src/pages entries + config
        -> CapabilityIR v1
   -> specialize and emit only selected runtime/capability ESM
        -> reuse exact generated route-entry transforms within this build
-  -> write route index.html, CSS/assets, Worker graphs, rewrites, and .kudzu/kudzu-plan.json
-  -> optional afterBuild()
+  -> write route index.html, CSS/assets, Worker graphs, and rewrites into staging
+  -> copy public paths only where they do not replace generated artifacts
+  -> optional afterBuild() against staging
+  -> rollback-safe promotion to dist; recover an interrupted backup on the next admitted build after stale-lock removal
 ```
 
 The browser consumes static HTML first. State seeds and descriptors in that HTML connect only to emitted command, binding, list, native-handler, effect, parameter, or navigation modules. Browser execution patches owned DOM directly; it does not invoke component functions or reconstruct a component tree.
@@ -67,7 +69,7 @@ The browser consumes static HTML first. State seeds and descriptors in that HTML
 - `build()` still owns explicit artifact selection and filesystem writes after generator results are produced.
 - Runtime generators intentionally specialize readable authored sources through exact anchors; every required anchor fails closed, but a future generator format may remove this transitional dependency.
 - Source reachability and source compilation share one module because both consume the same normalization and import graph contracts.
-- Native handler, effect, state/setter, list, Router, React, and Zustand discovery still contains name-based analysis. The binding index is intentionally adopted one consumer family at a time; P0.2 moves the next descriptor consumers without changing cross-module semantics.
+- Imported, specialized, and compiler-synthesized trees still use conservative name/scope fallback where the source-local binding index does not own the complete AST; cross-module semantics remain deferred to stable ModuleSymbol and SiteId work.
 
 These are future simplification opportunities, not incomplete Goal A contracts. Goal A changed no source support, browser output semantics, or browser architecture.
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Active execution plan after `0.8.30`. This document turns the current compiler audit into an ordered implementation program. It does not mark any planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Active execution plan after `0.8.32`. This document turns the current compiler audit into an ordered implementation program. It does not mark any planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
 [`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains authoritative for product invariants and fixture-driven feature selection. This plan is authoritative for the order and completion evidence of compiler generalization, large-application foundations, compatibility boundaries, AI tooling, and scale validation. If implementation evidence changes a boundary, update this document before broadening a patch.
 
@@ -43,7 +43,7 @@ The current limiting architecture is observable in these files:
 | ModuleIR | `compiler/ir/module-ir.mjs` | Numeric slots, names, export strings, and formatted owner strings coexist; several sections are descriptive rather than authoritative inputs |
 | RouteIR/CapabilityIR | `route-capability-planner.mjs` | Validation is shallow and capability selection is site-wide across interactive routes |
 | Build/codegen | `framework/build.mjs`, runtime generators | Full destructive builds, serialized-string handler reachability, source-text runtime surgery, no route chunk/CSS closure report |
-| Browser lifetime | `native-runtime.js`, `effect-runtime.js`, `navigation-runtime.js` | Effects invalidate stale work, but pending native handlers can write after route unmount |
+| Browser lifetime | `native-runtime.js`, `effect-runtime.js`, `navigation-runtime.js` | Effects and native handlers invalidate stale writes at their existing effect or DOM ownership boundary |
 | Compatibility | React/Router/Zustand passes plus core branches | Package-specific knowledge is not contained behind one adapter boundary |
 | AI interface | CLI and string diagnostics | No stable diagnostic codes, semantic index, explain, fix, or migration analysis output |
 
@@ -112,7 +112,7 @@ This is an incremental evolution of the current repository:
 - Resource-specific ownership passes into a package-neutral ResourceIR when evidence permits.
 - Serialized handler URL searches into explicit artifact references.
 - Site-wide capability unions into route capability signatures.
-- Full destructive development builds into project-session invalidation and atomic output.
+- Full destructive development builds into project-session invalidation and rollback-safe output.
 - String-only diagnostics into structured diagnostics suitable for machines and AI agents.
 
 ### Avoid
@@ -132,7 +132,9 @@ This is an incremental evolution of the current repository:
 - [x] P0.1 Source-local binding index is complete in `0.8.28`. Reactive binding capture/import discovery and lowering use the index only when the complete expression is indexed; synthesized keyed expressions retain the existing fail-safe path. Focused scope tests, a 1,000-reference guard, browser integration, all 185 tests, and packed-package smoke pass.
 - [x] P0.2 Symbol-aware descriptor discovery is complete in `0.8.29`. Native handler, effect, remaining binding, list evaluator, optimized-command, and effect-resource discovery/lowering use the source-local binding index when it owns the complete AST; synthesized trees retain the existing fail-safe path. Focused lexical-shadow, JSON-safe IR, resource-ownership checks, all 187 tests, and packed-package smoke pass.
 - [x] P0.3 Graph diagnostics is complete in `0.8.30`. Reachable ordinary modules validate relative runtime imports/re-exports and reject every dynamic `import()` at the importer source location before compilation or generated module loading. Ordinary and Worker traversal retain separate ownership, type-only and unreachable edges remain excluded, focused page/helper/re-export/dynamic fixtures pass with all 189 tests and packed-package smoke, and no export-symbol graph, ProjectSession, runtime, or public API is added.
-- [ ] P0.4 Async native handler ownership is next. Pending handlers must not write after route or DOM ownership is released.
+- [x] P0.4 Async native handler ownership is complete in `0.8.31`. Mounted native registrations invalidate direct/captured setters, queued commits, and captured refs before listener removal. Chrome route, keyed-row, document-disposal, and synchronous event-dispatch checks, all 189 tests, and packed-package smoke pass without cancelling application promises or adding a scheduler.
+- [x] P0.5 Staged and collision-safe output is complete in `0.8.32`. Production output completes in one project-local staging tree, public files are compared against generated route/runtime/handler/chunk/Worker/CSS paths while copying, `afterBuild` runs before rollback-safe promotion, and ordinary failures preserve the prior `dist`. Same-root overlap and stale locks fail closed; after stale-lock removal, an interrupted promotion backup recovers on the next admitted build. Focused collision/replacement/dev checks pass with equivalent `v0.8.31` commerce deploy output; `.kudzu` remains compiler scratch for P0.6.
+- [ ] P0.6 Explicit ProjectSession is next. Root and caches must become build-scoped so independent projects can compile safely in one process.
 
 ### P0: Semantic Correctness And Compiler Foundation
 
@@ -144,7 +146,7 @@ P0 creates the semantic base required by every later large-application capabilit
 | P0.2 | Descriptor consumers use SymbolRef | P0.1 | Handler/effect/binding capture and import discovery no longer depends only on text names |
 | P0.3 | Graph diagnostics | P0.1 | Relative dynamic imports and unresolved runtime edges fail at the source location |
 | P0.4 | Async native handler ownership | None | Pending handlers cannot write after route or DOM ownership is released |
-| P0.5 | Atomic collision-safe build | None | Failed builds preserve prior output and public files cannot overwrite generated artifacts |
+| P0.5 | Staged collision-safe build | None | Failed builds preserve prior output and public files cannot overwrite generated artifacts |
 | P0.6 | Explicit ProjectSession | P0.1 | Root and caches are build-scoped; two projects can compile safely in one process |
 | P0.7 | Parsed module/export cache | P0.6 | Shared modules are parsed and summarized once per build |
 | P0.8 | Stable ModuleSymbol and SiteId | P0.6-P0.7 | Imports, re-exports, aliases, owners, and call sites use stable identities outside a pass |
@@ -272,7 +274,9 @@ Every result carries a stable source-local binding slot, debug name, declaration
 
 **Done condition:** a handler resolving after enhanced navigation or row removal cannot recreate or mutate released state, refs, or DOM.
 
-### PR 5: Atomic And Collision-Safe Output
+**Completed in `0.8.31`:** the existing native registration lifetime now guards state mutation, queued commits, and captured ref lookup. Route and keyed-row browser checks recreate the same ownership IDs before old work resolves, and document disposal invalidates a pending layout handler. Replacement state and DOM remain fresh. Both 5,000-event Chrome dispatch medians are 6.4 ms, and the 209 B raw / 94 B aggregate gzip runtime cost is recorded in `PERFORMANCE.md`.
+
+### PR 5: Staged And Collision-Safe Output
 
 **Objective:** make production builds safe before scaling the build graph.
 
@@ -280,7 +284,9 @@ Every result carries a stable source-local binding slot, debug name, declaration
 
 **Tests:** public collisions with route HTML, core runtime, handler entry, chunk, Worker namespace, source CSS, and configured CSS; failed build preserves prior `dist`.
 
-**Done condition:** output is staged, validated, and atomically promoted; public content cannot silently replace generated artifacts.
+**Done condition:** output is staged, validated, and promoted with rollback/recovery; public content cannot silently replace generated artifacts.
+
+**Completed in `0.8.32`:** Kudzu emits into a locked project-local staging sibling, validates public files during one collision-safe copy traversal, runs trusted `afterBuild` mutation there, and promotes with backup rollback. Active overlap and stale locks fail closed; after stale-lock removal, the next admitted build restores an interrupted promotion backup. This is a guarded two-rename replacement, not a lock-free atomic directory exchange. Route HTML is written in bounded batches. Route HTML, core runtime, handler entry, actual esbuild chunk, Worker namespace, source CSS, and configured CSS collisions preserve the complete prior manifest; late hook failure also preserves it and successful replacement removes stale files. Before final lock/recovery hardening, twenty-one alternating 1,011-page replacement builds observed a 5.71% lower median with identical 3,056-file / 11,137,074-byte commerce deploy output.
 
 ### PR 6: ProjectSession And Explicit Root
 
@@ -427,7 +433,7 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 ## Production Gates Before 1.0
 
 - Async native and effect work cannot write after ownership release.
-- Build output is atomic and collision-safe.
+- Build output is staged, collision-safe, and rollback/recovery guarded.
 - Source maps connect generated route code to TS/TSX diagnostics.
 - Chrome, Firefox, and WebKit pass required journeys.
 - Accessibility automation and keyboard checks cover forms, navigation, dialogs, menus, charts, and errors.
@@ -454,6 +460,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-The first implementation PR is **PR 1: Source-Local Binding Index**. It is compile-time only, adds no browser bytes or public API, fixes an existing correctness class, and creates the stable semantic foundation required by component graphs, state operations, cross-module analysis, compatibility adapters, structured diagnostics, and AI explanation tooling.
-
-The next PR is **PR 4: Async Native Handler Invalidation**. Do not skip directly to a store, resource, router, virtualization, or ecosystem package feature.
+PR 1 through PR 5 are complete. The next PR is **PR 6: ProjectSession And Explicit Root**. Do not skip directly to a store, resource, router, virtualization, or ecosystem package feature.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.30` are completed scopes represented by package/release records.
+This is an execution sequence, not release history. `0.8.16` through `0.8.32` are completed scopes represented by package/release records.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -21,6 +21,8 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 | `0.8.28` | Add the source-local binding index and adopt it for reactive binding capture/import discovery and lowering. | Lexical shadowing is identity-based for complete indexed bindings, synthesized keyed expressions retain their fallback, the 1,000-reference guard passes, and no browser bytes or public API are added. |
 | `0.8.29` | Move native handler, effect, remaining binding, list evaluator, optimized-command, and effect-resource discovery/lowering onto source-local lexical identity. | Shadowed imports/globals/state/resources remain distinct, HandlerIR/BindingIR round trips pass, synthesized trees retain the fallback, and no runtime or public API is added. |
 | `0.8.30` | Validate ordinary runtime graph edges before code generation and reject dynamic imports at the importer source. | Page/helper/re-export/dynamic fixtures report original file/range/specifier without `.kudzu` paths; Worker, type-only, unreachable, output, and runtime behavior remain unchanged. |
+| `0.8.31` | Invalidate pending native-handler contexts when their route, keyed, conditional, or document DOM owner is released. | Late setters, queued commits, and captured refs cannot mutate replacement ownership; synchronous dispatch remains within the performance gate and runtime bytes are recorded. |
+| `0.8.32` | Stage and validate production output before rollback-safe promotion, reject same-root overlap, and tighten keyed browser paths. | Build/hook failures preserve the prior output, stale locks fail closed, interrupted backups recover on the next admitted build after lock removal, public/generated collisions fail, and deploy output remains equivalent. |
 
 ## Sequence Rules
 

package/framework/README.md

@@ -63,7 +63,7 @@ Reduced Zustand migration stores lower to one ordinary layout-lifetime state slo
 - `list-runtime.js`: optional keyed list validation, external item-expression evaluation, item-local conditional ranges, dynamic styles, item handler/effect scopes, moves, and cleanup.
 - `serialization.js`: capture deserialization shared by binding and native handlers.
 - `effect-runtime.js`: optional state and capture context for route-specific mount-effect entries.
-- `native-runtime.js`: optional runtime for normal synchronous and asynchronous ESM handlers.
+- `native-runtime.js`: optional runtime for normal synchronous and asynchronous ESM handlers; DOM unmount invalidates late state writes, queued commits, and captured refs.
 - `navigation-runtime.js`: optional emitted-route complete-document prefetch, runtime segment matching, validation, finite memory caching, route-range replacement, history, focus, and native fallback, specialized once per configured shared-layout group.
 - `dev-state.js`: dev-only, short-lived logical-state snapshot validation and restoration.
 - `*.d.ts`: public TypeScript and JSX declarations.
@@ -90,4 +90,4 @@ A direct setter may cross one same-file or relative-imported component boundary
 
 `kudzu.config` may opt one emitted shared-layout group into same-document navigation with legacy `navigation: { routes: ["/product", "/items/[id]"] }`, or multiple groups with `navigation: { groups: [{ routes: [...] }, { routes: [...] }] }`. The forms are mutually exclusive. Identities are globally unique emitted exact paths or `runtimeParams` patterns; each group uses one page-exported layout function identity. Runtime records securely match concrete pathnames under `base`, and their cache-safe parameter initializer runs before route DOM/effects mount on every transition. Each group receives a deterministic route-hashed asset specialized to only its records, pattern decoder, and effect/parameter lifecycle needs. Cross-group and ungrouped anchors remain native and are not prefetched; overlapping path domains across groups fail the build. Route effect entries export cache-safe layout and route mount functions: layout effects, including conditional/keyed DOM-owned effects, persist for the group session; route effects receive a fresh owner registry after each route insertion; and non-persisted page disposal cleans route before layout. Direct primitive state, runtime parameter, and keyed-item property dependencies and cleanup are supported. Fragment payloads and coordinated View Transitions are not implemented.
 
-Cross-framework performance tables are historical snapshots from excluded workspaces and are not current rankings. `npm run benchmark` tracks the Worker build/graph fixture; `RUNS=21 npm run benchmark:keyed` tracks large keyed restoration with fresh Chrome profiles. Current methodology, raw arrays, external-fixture limits, and artifact deltas live in `PERFORMANCE.md` and the web docs.
+Cross-framework performance tables are historical snapshots from excluded workspaces and are not current rankings. `npm run benchmark` tracks the Worker build/graph fixture; `RUNS=21 npm run benchmark:keyed` tracks large keyed restoration; `BASELINE_ROOT=... npm run benchmark:native` tracks native dispatch and exact artifact changes. Current methodology, raw arrays, external-fixture limits, and artifact deltas live in `PERFORMANCE.md` and the web docs.

package/framework/binding-runtime.js

@@ -41,14 +41,12 @@ export function patchBinding(node, target, value) {
 
 function commitBindings(id) {
   const bindings = bindingTargets.get(id)
-  if (!bindings) return
-  for (const binding of bindings) {
-    if (!binding.node.isConnected) bindings.delete(binding)
-    else patchBinding(binding.node, binding.target, binding.read())
+  if (bindings) {
+    for (const binding of bindings) {
+      if (!binding.node.isConnected) bindings.delete(binding)
+      else patchBinding(binding.node, binding.target, binding.read())
+    }
   }
-}
-
-function commitConditions(id) {
   const conditions = conditionTargets.get(id)
   if (!conditions) return
   for (const condition of conditions) {
@@ -58,7 +56,6 @@ function commitConditions(id) {
 }
 
 registerCommitter(commitBindings)
-registerCommitter(commitConditions)
 registerMountHook(mountBindings)
 registerMountHook(mountConditions)
 registerUnmountHook(unmountBindings)

package/framework/build.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto"
-import { cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises"
+import { cp, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises"
 import { dirname, join, relative, resolve, sep } from "node:path"
 import { pathToFileURL } from "node:url"
 import { build as bundle, transform } from "esbuild"
@@ -35,6 +35,31 @@ async function loadConfig() {
 }
 
 export async function build({ quiet = false, minify = true } = {}) {
+  const stagedOutput = join(root, ".kudzu-dist-staging")
+  const backupOutput = join(root, ".kudzu-dist-backup")
+  const lockPath = join(root, ".kudzu-build.lock")
+  const lock = await acquireBuildLock(lockPath)
+  try {
+    await recoverOutput(outputDirectory, backupOutput)
+    await rm(stagedOutput, { recursive: true, force: true })
+    const { result, pageCount, behaviorCount } = await buildInto(stagedOutput, { minify })
+    await promoteOutput(stagedOutput, outputDirectory, backupOutput)
+    if (!quiet) console.log(`Built ${pageCount} page(s), ${behaviorCount} interactive page(s) into dist/`)
+    return result
+  } finally {
+    try {
+      await rm(stagedOutput, { recursive: true, force: true })
+    } finally {
+      try {
+        await lock.close()
+      } finally {
+        await rm(lockPath, { force: true })
+      }
+    }
+  }
+}
+
+async function buildInto(outputDirectory, { minify }) {
   const config = await loadConfig()
   const base = normalizeBase(config.base)
   const configuredStyles = normalizeStyles(config.styles, base)
@@ -52,7 +77,6 @@ export async function build({ quiet = false, minify = true } = {}) {
     group.hasParams = false
   }
   await rm(workDirectory, { recursive: true, force: true })
-  await rm(outputDirectory, { recursive: true, force: true })
   await mkdir(workDirectory, { recursive: true })
   await mkdir(outputDirectory, { recursive: true })
 
@@ -227,11 +251,13 @@ export async function build({ quiet = false, minify = true } = {}) {
     runtime: { shared: hasSharedRuntime, dependency: hasDependencyRuntime }
   } = capabilityIR
   const runtimeName = usesDependencyRuntime => usesDependencyRuntime ? "kudzu-deps.js" : "kudzu.js"
-  for (const entry of pageEntries) {
-    const routeDirectory = join(outputDirectory, entry.route)
-    await mkdir(routeDirectory, { recursive: true })
-    const html = preloadModules(entry.html.replace(runtimePlaceholder, escapeAttribute(assetPath(base, `assets/${runtimeName(entry.usesDependencyRuntime)}`))))
-    await writeFile(join(routeDirectory, "index.html"), html)
+  for (let offset = 0; offset < pageEntries.length; offset += 64) {
+    await Promise.all(pageEntries.slice(offset, offset + 64).map(async entry => {
+      const routeDirectory = join(outputDirectory, entry.route)
+      await mkdir(routeDirectory, { recursive: true })
+      const html = preloadModules(entry.html.replace(runtimePlaceholder, escapeAttribute(assetPath(base, `assets/${runtimeName(entry.usesDependencyRuntime)}`))))
+      await writeFile(join(routeDirectory, "index.html"), html)
+    }))
   }
   if (navigationRoutes.length || behaviorCount && (hasSharedRuntime || regularBehaviorCount)) {
     const runtimeFile = hasSharedRuntime ? "./shared-runtime.js" : "./runtime.js"
@@ -316,10 +342,6 @@ export async function build({ quiet = false, minify = true } = {}) {
   }
   const sortedRewrites = rewrites.sort((left, right) => runtimeSpecificity(right) - runtimeSpecificity(left) || left.pattern.localeCompare(right.pattern))
   await writeFile(join(workDirectory, "kudzu-plan.json"), JSON.stringify({ routes: plans, rewrites: sortedRewrites }, null, 2))
-  for (const file of new Set([...cssFiles, ...importedAssets])) {
-    const collision = join(publicDirectory, "assets", relative(sourceDirectory, file))
-    if (await exists(collision)) throw new Error(`${relative(root, collision)} collides with emitted source asset ${relative(root, file)}`)
-  }
   for (const file of cssFiles) {
     const output = join(assetsDirectory, relative(sourceDirectory, file))
     await mkdir(dirname(output), { recursive: true })
@@ -339,17 +361,95 @@ export async function build({ quiet = false, minify = true } = {}) {
       if (typeof css !== "string") throw new Error(`${style.label}.transform must return CSS text or an object with a css string`)
     }
     const output = join(outputDirectory, style.output.slice(1))
+    if (await exists(output)) throw new Error(`${style.label}.output ${JSON.stringify(style.output)} collides with a generated artifact`)
     await mkdir(dirname(output), { recursive: true })
     await writeFile(output, css)
   }
-  if (await exists(publicDirectory)) await cp(publicDirectory, outputDirectory, { recursive: true })
+  if (await exists(publicDirectory)) {
+    await copyPublic(publicDirectory, outputDirectory)
+  }
   if (config.afterBuild !== undefined) {
     if (typeof config.afterBuild !== "function") throw new Error("kudzu.config afterBuild must be a function")
     await config.afterBuild({ root, outDir: outputDirectory, sourceDir: sourceDirectory, base, routes: plans.map(plan => plan.route), plans, rewrites: sortedRewrites })
   }
 
-  if (!quiet) console.log(`Built ${plans.length} page(s), ${behaviorCount} interactive page(s) into dist/`)
-  return { sourceResults }
+  return { result: { sourceResults }, pageCount: plans.length, behaviorCount }
+}
+
+async function acquireBuildLock(lockPath) {
+  let lock
+  try {
+    lock = await open(lockPath, "wx")
+  } catch (error) {
+    if (error?.code !== "EEXIST") throw error
+  }
+  if (lock) {
+    try {
+      await lock.writeFile(String(process.pid))
+      return lock
+    } catch (error) {
+      await lock.close()
+      await rm(lockPath, { force: true })
+      throw error
+    }
+  }
+  const owner = Number(await readFile(lockPath, "utf8").catch(() => ""))
+  if (Number.isInteger(owner) && owner > 0) {
+    let active = true
+    try {
+      process.kill(owner, 0)
+    } catch (error) {
+      if (error?.code === "ESRCH") active = false
+      else throw error
+    }
+    if (active) throw new Error(`Another Kudzu build is already running for ${root} (PID ${owner})`)
+    throw new Error(`A stale Kudzu build lock for PID ${owner} exists at ${lockPath}; remove it before building`)
+  }
+  throw new Error(`An invalid Kudzu build lock exists at ${lockPath}; remove it before building`)
+}
+
+async function recoverOutput(finalOutput, backupOutput) {
+  if (!await exists(backupOutput)) return
+  if (await exists(finalOutput)) await rm(backupOutput, { recursive: true, force: true })
+  else await rename(backupOutput, finalOutput)
+}
+
+async function promoteOutput(stagedOutput, finalOutput, backup) {
+  const previous = await exists(finalOutput)
+  if (previous) await rename(finalOutput, backup)
+  try {
+    await rename(stagedOutput, finalOutput)
+  } catch (error) {
+    if (previous) {
+      try {
+        await rename(backup, finalOutput)
+      } catch (rollbackError) {
+        throw new AggregateError([error, rollbackError], "Kudzu output promotion and rollback both failed")
+      }
+    }
+    throw error
+  }
+  if (previous) await rm(backup, { recursive: true, force: true }).catch(error => console.warn(`Built output was promoted, but ${backup} could not be removed and will be retried on the next build: ${error.message}`))
+}
+
+async function copyPublic(sourceDirectory, destinationDirectory, destinationRoot = destinationDirectory) {
+  for (const entry of await readdir(sourceDirectory, { withFileTypes: true })) {
+    const source = join(sourceDirectory, entry.name)
+    const destination = join(destinationDirectory, entry.name)
+    let generated
+    try {
+      generated = await stat(destination)
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error
+    }
+    if (!generated) {
+      await cp(source, destination, { recursive: entry.isDirectory(), force: false, errorOnExist: true })
+    } else if (entry.isDirectory() && generated.isDirectory()) {
+      await copyPublic(source, destination, destinationRoot)
+    } else {
+      throw new Error(`${relative(root, source)} collides with generated output ${relative(destinationRoot, destination).replaceAll(sep, "/")}`)
+    }
+  }
 }
 
 function preloadModules(html) {
@@ -551,6 +651,7 @@ function normalizeStyles(value, base) {
   if (!Array.isArray(value)) throw new Error("kudzu.config styles must be an array")
   const urls = []
   const sources = []
+  const outputs = new Set()
   for (let index = 0; index < value.length; index++) {
     const style = value[index]
     const label = `kudzu.config styles[${index}]`
@@ -570,6 +671,8 @@ function normalizeStyles(value, base) {
     if (typeof style.source !== "string" || !style.source) throw new Error(`${label}.source must be a non-empty file path`)
     if (typeof style.output !== "string" || !style.output.startsWith("/") || style.output.startsWith("//") || /[%?#\\\0]/.test(style.output) || style.output.split("/").includes("..") || !style.output.endsWith(".css")) throw new Error(`${label}.output must be a root-relative .css path without query, hash, or traversal`)
     if (style.transform !== undefined && typeof style.transform !== "function") throw new Error(`${label}.transform must be a function`)
+    if (outputs.has(style.output)) throw new Error(`${label}.output duplicates another configured style output ${JSON.stringify(style.output)}`)
+    outputs.add(style.output)
     const entry = { label, source: resolve(root, style.source), output: style.output, transform: style.transform }
     sources.push(entry)
     urls.push(withBase(base, style.output))

package/framework/list-runtime.js

@@ -195,12 +195,13 @@ function updateList(list) {
     const currentTokens = [...list.roots.keys()]
     const nextTokens = entries.map(entry => entry.token)
     if (nextTokens.length === currentTokens.length && nextTokens.every((token, index) => token === currentTokens[currentTokens.length - index - 1])) {
+      const nextRoots = nextTokens.map(token => [token, list.roots.get(token)])
       const parent = list.container ?? list.start.parentNode
       const reordered = parent.ownerDocument.createDocumentFragment()
-      reordered.append(...nextTokens.map(token => list.roots.get(token)))
+      reordered.append(...nextRoots.map(([, node]) => node))
       parent.insertBefore(reordered, list.boundary)
-      list.roots = new Map(nextTokens.map(token => [token, list.roots.get(token)]))
-      if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextTokens.map(token => list.roots.get(token))
+      list.roots = new Map(nextRoots)
+      if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextRoots.map(([, node]) => node)
       list.container ??= parent
       list.items = items
       return
@@ -210,7 +211,6 @@ function updateList(list) {
       const removedIndex = currentTokens.indexOf(removed)
       if (removed && nextTokens.every((token, index) => token === currentTokens[index >= removedIndex ? index + 1 : index])) {
         removeListRoot(list, removed)
-        list.roots = new Map(nextTokens.map(token => [token, list.roots.get(token)]))
         if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextTokens.map(token => list.roots.get(token))
         list.items = items
         return
@@ -472,12 +472,12 @@ function updateNestedList(list, items) {
     return true
   }
   if (items.length === previous.length && items.every((item, index) => item === previous[previous.length - index - 1])) {
-    const tokens = [...list.roots.keys()].reverse()
+    const roots = [...list.roots].reverse()
     const parent = list.container ?? list.start.parentNode
     const reordered = parent.ownerDocument.createDocumentFragment()
-    reordered.append(...tokens.map(token => list.roots.get(token)))
+    reordered.append(...roots.map(([, node]) => node))
     parent.insertBefore(reordered, list.boundary)
-    list.roots = new Map(tokens.map(token => [token, list.roots.get(token)]))
+    list.roots = new Map(roots)
     list.items = items
     list.container ??= parent
     return true
@@ -487,10 +487,6 @@ function updateNestedList(list, items) {
     while (removed < items.length && items[removed] === previous[removed]) removed++
     if (items.every((item, index) => item === previous[index >= removed ? index + 1 : index])) {
       removeListRoot(list, keyToken(previous[removed]?.[list.descriptor.key]))
-      list.roots = new Map(items.map(item => {
-        const token = keyToken(item[list.descriptor.key])
-        return [token, list.roots.get(token)]
-      }))
       list.items = items
       return true
     }
@@ -540,12 +536,12 @@ function updateReducerList(list, items) {
     return true
   }
   if (items.length === previous.length && items.every((item, index) => item === previous[previous.length - index - 1])) {
-    const tokens = [...list.roots.keys()].reverse()
+    const roots = [...list.roots].reverse()
     const parent = list.container ?? list.start.parentNode
     const reordered = parent.ownerDocument.createDocumentFragment()
-    reordered.append(...tokens.map(token => list.roots.get(token)))
+    reordered.append(...roots.map(([, node]) => node))
     parent.insertBefore(reordered, list.boundary)
-    list.roots = new Map(tokens.map(token => [token, list.roots.get(token)]))
+    list.roots = new Map(roots)
     list.items = items
     list.container ??= parent
     return true
@@ -555,10 +551,6 @@ function updateReducerList(list, items) {
     while (removed < items.length && items[removed] === previous[removed]) removed++
     if (items.every((item, index) => item === previous[index >= removed ? index + 1 : index])) {
       removeListRoot(list, keyToken(previous[removed]?.[list.descriptor.key]))
-      list.roots = new Map(items.map(item => {
-        const token = keyToken(item[list.descriptor.key])
-        return [token, list.roots.get(token)]
-      }))
       list.items = items
       return true
     }

package/framework/native-runtime.js

@@ -8,18 +8,20 @@ export function registerNativeModules(entries) {
   for (const [url, module] of entries) modules.set(url, module)
 }
 
-export function createNativeContext(state, stateIds, commit, serializedScope = {}) {
+export function createNativeContext(state, stateIds, commit, serializedScope = {}, active = () => true) {
   const changed = new Set()
   let scheduled = false
 
   const flush = () => {
     scheduled = false
+    if (!active()) return changed.clear()
     const ids = [...changed]
     changed.clear()
     for (const id of ids) commit(id, state.get(id))
   }
 
   const setId = globalThis.__KUDZU_CAPTURE_SETTER__ ? (id, value) => {
+    if (!active()) return
     const current = state.get(id)
     state.set(id, typeof value === "function" ? value(current) : value)
     changed.add(id)
@@ -29,7 +31,7 @@ export function createNativeContext(state, stateIds, commit, serializedScope = {
     }
   } : undefined
 
-  const scope = Object.fromEntries(Object.entries(serializedScope).map(([name, value]) => [name, deserialize(value, id => state.get(id), globalThis.__KUDZU_CAPTURE_SETTER__ ? setId : undefined)]))
+  const scope = Object.fromEntries(Object.entries(serializedScope).map(([name, value]) => [name, deserialize(value, id => state.get(id), globalThis.__KUDZU_CAPTURE_SETTER__ ? setId : undefined, active)]))
 
   return {
     get(name) {
@@ -43,6 +45,7 @@ export function createNativeContext(state, stateIds, commit, serializedScope = {
         setId(stateIds[name], value)
         return
       }
+      if (!active()) return
       const id = stateIds[name]
       const current = state.get(id)
       state.set(id, typeof value === "function" ? value(current) : value)
@@ -61,6 +64,9 @@ if (typeof document !== "undefined") {
   registerMountHook(mount)
   registerUnmountHook(unmountNative)
   mount(document)
+  addEventListener("pagehide", event => {
+    if (!event.persisted) unmountNative(document)
+  })
 }
 
 function mountNative(root, eventNames, modules) {
@@ -71,14 +77,16 @@ function mountNative(root, eventNames, modules) {
       let encoded = node.dataset[`kNative${capitalize(eventName)}`]
       let native = JSON.parse(encoded)
       let handler
-      let context = createNativeContext(browserState, native.states, commitDom, native.scope)
+      const registration = { active: true }
+      const active = () => registration.active
+      let context = createNativeContext(browserState, native.states, commitDom, native.scope, active)
       const listener = event => {
         try {
           const current = node.dataset[`kNative${capitalize(eventName)}`]
           if (current !== encoded) {
             native = JSON.parse(current)
             encoded = current
-            context = createNativeContext(browserState, native.states, commitDom, native.scope)
+            context = createNativeContext(browserState, native.states, commitDom, native.scope, active)
             handler = undefined
           }
           handler ??= modules.get(native.module)[native.handler]
@@ -88,8 +96,9 @@ function mountNative(root, eventNames, modules) {
           console.error(error)
         }
       }
+      registration.listener = listener
       node.addEventListener(eventName, listener)
-      listeners.set(eventName, listener)
+      listeners.set(eventName, registration)
       registrations.set(node, listeners)
     }
   }
@@ -97,7 +106,10 @@ function mountNative(root, eventNames, modules) {
 
 function unmountNative(root) {
   for (const node of matching(root, "*")) {
-    for (const [eventName, listener] of registrations.get(node) ?? []) node.removeEventListener(eventName, listener)
+    for (const [eventName, registration] of registrations.get(node) ?? []) {
+      registration.active = false
+      node.removeEventListener(eventName, registration.listener)
+    }
     registrations.delete(node)
   }
 }

package/framework/serialization.js

@@ -1,8 +1,8 @@
-export function deserialize(value, getState, setState) {
+export function deserialize(value, getState, setState, active) {
   if (!value || typeof value !== "object") return value
   if (value.type === "undefined") return undefined
   if (value.type === "number") return value.value === "NaN" ? NaN : value.value === "Infinity" ? Infinity : value.value === "-Infinity" ? -Infinity : -0
-  if (value.type === "ref") return { get current() { return typeof document === "undefined" ? null : document.querySelector(`[data-k-ref="${value.id}"]`) } }
+  if (value.type === "ref") return { get current() { return typeof document === "undefined" || active?.() === false ? null : document.querySelector(`[data-k-ref="${value.id}"]`) } }
   if (globalThis.__KUDZU_CAPTURE_STATE__ && value.type === "state") return getState?.(value.id)
   if (globalThis.__KUDZU_CAPTURE_SETTER__ && value.type === "setter") return next => {
     if (!setState) throw new Error("Captured state setter is not available in this context")
@@ -10,20 +10,20 @@ export function deserialize(value, getState, setState) {
   }
   if (value.type === "array") {
     const array = []
-    for (const [index, entry] of value.value.entries()) defineCapture(array, String(index), entry, getState, setState)
+    for (const [index, entry] of value.value.entries()) defineCapture(array, String(index), entry, getState, setState, active)
     return array
   }
   if (value.type === "object") {
     const object = value.nullPrototype ? Object.create(null) : {}
-    for (const [key, entry] of value.value) defineCapture(object, key, entry, getState, setState)
+    for (const [key, entry] of value.value) defineCapture(object, key, entry, getState, setState, active)
     return object
   }
   return value
 }
 
-function defineCapture(target, key, entry, getState, setState) {
+function defineCapture(target, key, entry, getState, setState, active) {
   const descriptor = globalThis.__KUDZU_CAPTURE_STATE__ && entry?.type === "state" && getState
     ? { get: () => getState(entry.id) }
-    : { value: deserialize(entry, getState, setState), writable: true }
+    : { value: deserialize(entry, getState, setState, active), writable: true }
   Object.defineProperty(target, key, { ...descriptor, enumerable: true, configurable: true })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.8.30",
+  "version": "0.8.32",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",
@@ -58,6 +58,7 @@
     "benchmark": "node test/performance.mjs",
     "benchmark:keyed": "node test/keyed-performance.mjs",
     "benchmark:commerce": "node test/commerce-build-performance.mjs",
+    "benchmark:native": "node test/native-performance.mjs",
     "prepublishOnly": "npm run check && npm test",
     "deploy": "wrangler deploy",
     "preview": "wrangler dev"