@kudzujs/core 0.8.31 → 0.8.32

package/MIGRATION_ROADMAP.md

@@ -2,7 +2,7 @@
 
 This document is the source of truth for Kudzu's product direction, architecture invariants, and future development order. Read it before extending React-shaped syntax or browser capabilities.
 
-The executable post-`0.8.31` compiler and large-application sequence is maintained in [`docs/next-architecture/large-application-ai-native-roadmap.md`](./docs/next-architecture/large-application-ai-native-roadmap.md). Follow its PR dependencies for implementation work; this document remains authoritative when selecting or accepting a migration capability.
+The executable post-`0.8.32` compiler and large-application sequence is maintained in [`docs/next-architecture/large-application-ai-native-roadmap.md`](./docs/next-architecture/large-application-ai-native-roadmap.md). Follow its PR dependencies for implementation work; this document remains authoritative when selecting or accepting a migration capability.
 
 [`GOAL_A.md`](./GOAL_A.md) and [`GOAL_B.md`](./GOAL_B.md) are completed capability-validation records. Their commerce and realtime dashboard fixtures prove general lifecycle, navigation, async-workflow, and Worker capabilities; they are not separate product verticals or future priority lists.
 
@@ -296,6 +296,12 @@ This queue orders the next investigations by general migration value. Start only
 - Chrome coverage removes and recreates the same route and keyed row before old work resolves, proving replacement ownership stays fresh without cancelling application promises or adding a scheduler.
 - The focused 5,000-event Chrome dispatch median remains 6.4 ms; the native fixture retains its emitted paths with a measured 209 B raw / 94 B aggregate gzip correctness cost.
 
+### Completed In 0.8.32
+
+- Production artifacts complete in staging; public/generated collisions and late `afterBuild()` failure preserve the previous successful `dist`.
+- Same-root builds use an exclusive PID lock, stale locks fail closed, interrupted promotion backups recover on the next admitted build after lock removal, and successful replacement removes stale output.
+- Route HTML writes use bounded batches, keyed reverse/remove paths avoid repeated map reconstruction, and binding/condition commits share one dispatch without adding a runtime or public API.
+
 ## Cross-Cutting Performance Gates
 
 Every migration feature must preserve:

package/PERFORMANCE.md

@@ -2,6 +2,82 @@
 
 Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, and `npm run benchmark:native` are maintained in this repository; `npm run benchmark:commerce` is a maintained paired runner over the public external storefront; older excluded-workspace sections are historical provenance only and are not current framework rankings.
 
+## 2026-08-11 React, Vue, And Svelte Check
+
+This is a current local check, not a maintained framework ranking. The external `/home/kft/Documents/etc/demo/benchmarks` workspace is not Git-provenanced, but its matched fixtures, validators, dependencies, and raw result files were present and reused without source changes. The Kudzu target used this P0.5 candidate with `0.8.31` package metadata; controls were React 19.2.7, Vue 3.5.40, Svelte 5.56.6, and Vite 7.3.6 on Node 24.14.0, Linux x64, and Chrome 142.0.7444.175.
+
+Each fixture received one warm-up and seven rotating clean production builds. Seven fresh headless Chrome profiles per target validated exact row count/order/text, retained and released DOM identity, fresh state on re-entry, and effect lifecycle counts before recording MutationObserver completion. React, Vue, and Svelte are CSR controls with no initial rows in HTML; Kudzu emits all initial rows, so total deploy size is reported but is not architecture-equivalent.
+
+| Fixture | Framework | Build median | Initial JS gzip | Total deploy raw |
+|---|---|---:|---:|---:|
+| 1,000 keyed rows with local state | Kudzu | 1,212 ms | 10.2 KB | 576.0 KB |
+| | Svelte | 1,745 ms | 13.1 KB | 33.8 KB |
+| | Vue | 1,584 ms | 24.4 KB | 61.6 KB |
+| | React | 1,939 ms | 59.4 KB | 189.5 KB |
+| 1,000 keyed effects | Kudzu | 735 ms | 9.8 KB | 226.0 KB |
+| | Svelte | 1,554 ms | 12.5 KB | 32.4 KB |
+| | Vue | 1,444 ms | 24.5 KB | 61.9 KB |
+| | React | 1,741 ms | 59.5 KB | 189.7 KB |
+| 100 parents x 10 keyed children | Kudzu | 732 ms | 8.2 KB | 354.6 KB |
+| | Svelte | 1,613 ms | 13.1 KB | 33.8 KB |
+| | Vue | 1,437 ms | 24.6 KB | 62.1 KB |
+| | React | 1,718 ms | 59.5 KB | 190.0 KB |
+
+Kudzu's build medians were 23% to 58% lower and its initial JavaScript gzip was 21% to 86% lower than the three CSR controls. A separate seven-run GNU `time` check on the keyed-row fixture measured median build peak RSS of 157.4 MiB for Kudzu, 209.2 MiB for Svelte, 208.0 MiB for Vue, and 281.3 MiB for React.
+
+| Fixture operation | Kudzu | Svelte | Vue | React |
+|---|---:|---:|---:|---:|
+| Row edit | 5.6 ms | 4.9 ms | 5.7 ms | 11.9 ms |
+| Reverse 1,000 rows | 28.2 ms | 94.3 ms | 23.2 ms | 51.8 ms |
+| Remove row | 5.0 ms | 8.7 ms | 7.6 ms | 15.6 ms |
+| Re-add row | 7.7 ms | 16.8 ms | 8.1 ms | 18.5 ms |
+| Effect dependency update | 4.8 ms | 9.8 ms | 10.0 ms | 14.9 ms |
+| Effect-unrelated update | 2.8 ms | 7.3 ms | 2.7 ms | 10.1 ms |
+| Reverse effect rows | 11.7 ms | 71.5 ms | 13.4 ms | 29.5 ms |
+| Nested child update | 2.7 ms | 3.4 ms | 6.5 ms | 12.0 ms |
+| Reverse 10 children | 0.7 ms | 1.1 ms | 3.1 ms | 9.0 ms |
+| Reverse 100 parents | 6.8 ms | 7.7 ms | 7.3 ms | 11.1 ms |
+| Remove parent | 1.1 ms | 1.5 ms | 3.4 ms | 6.7 ms |
+
+These initial browser runs were grouped by target and some seven-sample ranges were wide, so they were treated as directional rather than a framework ranking. The candidate then removed repeated keyed-root lookups and redundant removal-map reconstruction across the generic, nested, and reducer list paths, and merged binding/condition state dispatch into one committer. The keyed-row JavaScript graph decreased from 26,962 B raw / 10,508 B gzip to 26,768 B raw / 10,485 B gzip.
+
+A 31-round rotating follow-up ran fresh Chrome profiles in alternating and periodically reversed framework order. Its full-list completion predicate retained the exact 1,000-row content and identity checks inside timing:
+
+| Framework | Edit | Reverse | Remove | Re-add |
+|---|---:|---:|---:|---:|
+| Kudzu | 5.9 ms | 23.4 ms | 5.6 ms | 8.0 ms |
+| Svelte | 5.5 ms | 97.0 ms | 9.2 ms | 14.7 ms |
+| Vue | 6.8 ms | 26.6 ms | 9.6 ms | 10.0 ms |
+| React | 14.7 ms | 51.0 ms | 20.2 ms | 14.3 ms |
+
+Paired sign tests established Kudzu's reverse, remove, and re-add advantage over Vue at 6.0 ms (`p=0.00143`), 4.1 ms (`p=0.000192`), and 2.1 ms (`p=0.0107`) median differences. Kudzu also beat Svelte for those operations in 31/31, 28/31, and 27/31 rounds. The full-list edit result remained dominated by the validator: Kudzu versus Svelte had a 0.8 ms directional loss with `p=0.281`, while Kudzu versus Vue had a 0.4 ms directional gain with `p=0.720`.
+
+A final edit-only protocol kept complete 1,000-row correctness validation after each measurement but used only the edited row's class/input identity as the completion signal. Over 31 rotating rounds, Kudzu measured 0.7 ms versus Svelte 1.4 ms and Vue 1.8 ms. Paired differences favored Kudzu by 0.7 ms in 30/31 rounds (`p=2.98e-8`) versus Svelte and by 0.9 ms in 31/31 rounds (`p=9.31e-10`) versus Vue. Complete seven-run suite samples remain in the external workspace's `benchmarks/results/*-current.{json,md}` files; rotating raw samples are temporary measurement artifacts and this section remains a current local check rather than a maintained general ranking.
+
+## 0.8.32 Staged Output Emission
+
+Measured UTC 2026-08-11 on an Intel Core i5-9500 with 6 cores, Linux 6.17.0-19-generic, Node 24.14.0, and npm 11.9.0. The baseline was clean tag `v0.8.31` at `06b436e`; baseline and the pre-release P0.5 candidate used the same installed dependencies and the public 1,000-product storefront fixture at `f2d5be1a516c539e30f7125f6870d42b1dd02ecd`. The later same-root lock and interrupted-backup recovery hardening was correctness-tested but not included in this timing array.
+
+One warm-up followed by 21 alternating replacement builds preserved the preceding output so the candidate exercised staging, promotion, and prior-tree removal on every run. Generated `.kudzu` scratch was cleaned outside timing. The candidate folds collision validation into one public copy traversal and writes the already-rendered route HTML in bounded batches of 64.
+
+| Target | Build median | Output |
+|---|---:|---:|
+| `v0.8.31` | 20,392.7 ms | 3,056 files / 11,137,074 B |
+| P0.5 candidate | 19,229.1 ms | 3,056 files / 11,137,074 B |
+
+The candidate median is 5.71% lower. Every relative artifact path and SHA-256 hash matched, so deploy raw and gzip sizes are unchanged and no browser bytes are added.
+
+```text
+v0.8.31: [20868.5,19436.9,22023.6,21433.5,20634.0,20410.1,20392.7,21408.8,20252.0,19858.3,20489.9,20835.2,20450.2,18727.3,17239.1,17578.2,17672.1,17465.1,21087.0,18892.8,18727.9]
+candidate: [20481.6,18692.6,21060.7,19881.9,19510.8,20844.1,20348.6,19229.1,20304.8,19852.9,18929.3,20472.5,17384.9,18628.6,17890.2,18841.0,19755.6,17805.9,18282.5,17770.5,17370.3]
+```
+
+```bash
+APP_ROOT=/tmp/opencode/kudzu-based-bench/apps/shop-kudzu \
+BASELINE_ROOT=/tmp/opencode/kudzu-p05-profile \
+PRESERVE_OUTPUT=1 RUNS=21 npm run benchmark:commerce
+```
+
 ## 0.8.31 Async Native Handler Ownership
 
 Measured UTC 2026-08-10 on Apple M3, 8 logical CPUs, 8 GiB RAM, macOS 26.5.2 / Darwin 25.5.0, Node 25.6.1, npm 11.18.0, and Chrome 151.0.7922.76. The baseline was clean tag `v0.8.30` at `9bb5ce8`; baseline and candidate used the same installed dependencies.

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.8.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.8.31 - Async native-handler ownership.** Pending async handlers lose state-write, queued-commit, and captured-ref authority when enhanced navigation or keyed/conditional removal releases their DOM owner. The focused synchronous native event-dispatch benchmark shows no material regression. Read the [release notes](./RELEASES.md#0831---async-native-handler-ownership), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.8.31), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.8.32 - Staged and collision-safe output.** Builds complete in an isolated staging tree, reject public/generated collisions, preserve the previous `dist` on ordinary build and hook failures, recover interrupted promotion backups after a stale lock is cleared, and reject overlapping same-root builds. Read the [release notes](./RELEASES.md#0832---staged-and-collision-safe-output), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.8.32), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,36 @@
 # Kudzu Releases
 
+## 0.8.32 - Staged and collision-safe output
+
+Kudzu 0.8.32 completes P0.5 by building production artifacts away from the active deploy tree, rejecting public/generated collisions, and replacing `dist` only after generation and trusted `afterBuild()` work succeed.
+
+### Changed in 0.8.32
+
+- Route HTML, runtime, handler, chunk, Worker, source CSS, and configured CSS artifacts complete in a project-local staging tree before promotion.
+- Public files merge only into unowned paths. A public file cannot replace a generated file or directory, and duplicate configured stylesheet outputs fail before publication.
+- Ordinary compiler, bundler, public-copy, and `afterBuild()` failures leave the previous successful `dist` unchanged.
+- Same-root builds use an exclusive PID lock. Active overlap and dead/invalid lock files fail closed; after an operator removes a stale lock, the next admitted build recovers a backup left by interrupted promotion. Promotion is a guarded rollback/recovery sequence rather than a lock-free atomic directory exchange.
+- Successful replacement removes stale output and staging/backup artifacts. Development rebuild errors retain the previous on-disk HTML while the existing error overlay reports the source failure.
+- Route HTML writes use bounded batches. Keyed reverse/remove paths avoid repeated root-map work, and binding plus condition updates share one state commit dispatch.
+
+### Performance
+
+- Before final lock/recovery hardening, twenty-one alternating local replacement builds of the 1,011-page commerce fixture observed a 20,392.7 ms to 19,229.1 ms median change, 5.71% lower, while all 3,056 paths and 11,137,074 deploy bytes retained identical SHA-256 hashes.
+- The optimized 1,000-row browser graph decreased by 194 B raw / 23 B gzip. External exploratory browser comparisons and their non-publication limitations are documented in `PERFORMANCE.md`; they are not a release gate or maintained general ranking.
+
+### Validation
+
+- `npm run check`, `npm test`, `npm run test:package`, and all 190 tests pass.
+- Focused integration coverage verifies seven public/generated namespaces, configured-style collisions, late hook failure, successful stale-file removal, same-root overlap rejection, stale-lock diagnosis, interrupted-backup recovery after lock removal, and no staging/backup remnants.
+- Existing keyed identity/state, nested lists, reducer rows, SVG, effects, Workers, navigation, async ownership, and static zero-JavaScript behavior remain covered.
+- P0.6 ProjectSession and explicit root is next.
+
+### Upgrade
+
+```bash
+npm install @kudzujs/core@^0.8.32
+```
+
 ## 0.8.31 - Async native-handler ownership
 
 Kudzu 0.8.31 completes P0.4 by tying every mounted native-handler context to its DOM registration lifetime. Async work may finish after route, keyed, or conditional removal, but it cannot write through ownership that no longer exists.

package/docs/next-architecture/README.md

@@ -11,7 +11,7 @@ The top-level [`GOAL_A.md`](../../GOAL_A.md) and [`GOAL_B.md`](../../GOAL_B.md)
 | C: state/resource model | Research only | Reduced fixtures expose a limitation |
 | D: routing compatibility | Current behavior preserved | Revisit only with migration evidence and invariant review |
 
-The active post-`0.8.31` implementation sequence is [`large-application-ai-native-roadmap.md`](./large-application-ai-native-roadmap.md). P0.4 native-handler ownership is complete; P0.5 atomic and collision-safe output is next. The plan orders compiler semantic generalization, large-application foundations, compatibility boundaries, AI tooling, and production validation without changing the invariants below.
+The active post-`0.8.32` implementation sequence is [`large-application-ai-native-roadmap.md`](./large-application-ai-native-roadmap.md). P0.5 staged and collision-safe output is complete; P0.6 ProjectSession and explicit root is next. The plan orders compiler semantic generalization, large-application foundations, compatibility boundaries, AI tooling, and production validation without changing the invariants below.
 
 ## Required Invariants
 

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.8.31` architecture built on the completed `0.8.23` Goal A compiler foundation. File and function names are the stable references; line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.8.32` architecture built on the completed `0.8.23` Goal A compiler foundation. File and function names are the stable references; line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 
@@ -28,10 +28,10 @@ This maps the current `0.8.31` architecture built on the completed `0.8.23` Goal
 | Route capability projection | [`framework/compiler/route-capability-planner.mjs`](../../framework/compiler/route-capability-planner.mjs), `planRouteCapabilities()` | Validates RouteIR v1 and purely folds rendered plans and route facts into CapabilityIR v1. |
 | Effect entry generation | [`framework/compiler/effect-codegen.mjs`](../../framework/compiler/effect-codegen.mjs) | Generates ordinary, dependency, owned, and navigable effect entries from rendered descriptors. |
 | Runtime generation | [`framework/compiler/runtime-codegen.mjs`](../../framework/compiler/runtime-codegen.mjs), [`framework/compiler/list-runtime-codegen.mjs`](../../framework/compiler/list-runtime-codegen.mjs), [`framework/compiler/param-codegen.mjs`](../../framework/compiler/param-codegen.mjs) | Consumes versioned contracts, specializes authored capability sources with fail-closed anchors, and returns source/define results without filesystem ownership. |
-| Artifact emission | `framework/build.mjs` | Selects required files from CapabilityIR and writes or bundles generated sources with esbuild. Byte-identical native, parameter, and effect route entries reuse one exact-source transform result within the current build only. |
+| Artifact emission | `framework/build.mjs` | Selects required files from CapabilityIR, writes route HTML in bounded batches, writes and bundles the complete generation in a project-local staging sibling, copies public subtrees without replacing generated paths, runs `afterBuild`, then promotes with rollback so failed builds preserve the prior `dist`. Byte-identical native, parameter, and effect route entries reuse one exact-source transform result within the current build only. |
 | Browser capabilities | [`framework/*.js`](../../framework/) | Small optional modules for commands, bindings, lists, effects, native handlers, serialization, parameters, and navigation; native contexts invalidate writes and refs at DOM ownership release, with no component runtime. |
 | Opt-in navigation | [`framework/navigation-runtime.js`](../../framework/navigation-runtime.js) plus `framework/build.mjs` navigation configuration/emission | Fetches and validates complete same-origin documents, replaces only the marked route range, manages route/layout disposal, history, focus, finite prefetch retention, and native fallback. |
-| Development serving | [`framework/dev-server.mjs`](../../framework/dev-server.mjs) and [`framework/dev-state.js`](../../framework/dev-state.js) | Rebuild/watch/SSE and response-only short-lived state restoration; never changes production `dist/`. |
+| Development serving | [`framework/dev-server.mjs`](../../framework/dev-server.mjs) and [`framework/dev-state.js`](../../framework/dev-state.js) | Rebuild/watch/SSE and response-only short-lived state restoration; failed rebuilds show the existing error overlay while preserving the previous on-disk output. |
 
 ## Current Data Flow
 
@@ -54,8 +54,10 @@ src/pages entries + config
        -> CapabilityIR v1
   -> specialize and emit only selected runtime/capability ESM
        -> reuse exact generated route-entry transforms within this build
-  -> write route index.html, CSS/assets, Worker graphs, rewrites, and .kudzu/kudzu-plan.json
-  -> optional afterBuild()
+  -> write route index.html, CSS/assets, Worker graphs, and rewrites into staging
+  -> copy public paths only where they do not replace generated artifacts
+  -> optional afterBuild() against staging
+  -> rollback-safe promotion to dist; recover an interrupted backup on the next admitted build after stale-lock removal
 ```
 
 The browser consumes static HTML first. State seeds and descriptors in that HTML connect only to emitted command, binding, list, native-handler, effect, parameter, or navigation modules. Browser execution patches owned DOM directly; it does not invoke component functions or reconstruct a component tree.

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Active execution plan after `0.8.31`. This document turns the current compiler audit into an ordered implementation program. It does not mark any planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Active execution plan after `0.8.32`. This document turns the current compiler audit into an ordered implementation program. It does not mark any planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
 [`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains authoritative for product invariants and fixture-driven feature selection. This plan is authoritative for the order and completion evidence of compiler generalization, large-application foundations, compatibility boundaries, AI tooling, and scale validation. If implementation evidence changes a boundary, update this document before broadening a patch.
 
@@ -112,7 +112,7 @@ This is an incremental evolution of the current repository:
 - Resource-specific ownership passes into a package-neutral ResourceIR when evidence permits.
 - Serialized handler URL searches into explicit artifact references.
 - Site-wide capability unions into route capability signatures.
-- Full destructive development builds into project-session invalidation and atomic output.
+- Full destructive development builds into project-session invalidation and rollback-safe output.
 - String-only diagnostics into structured diagnostics suitable for machines and AI agents.
 
 ### Avoid
@@ -133,7 +133,8 @@ This is an incremental evolution of the current repository:
 - [x] P0.2 Symbol-aware descriptor discovery is complete in `0.8.29`. Native handler, effect, remaining binding, list evaluator, optimized-command, and effect-resource discovery/lowering use the source-local binding index when it owns the complete AST; synthesized trees retain the existing fail-safe path. Focused lexical-shadow, JSON-safe IR, resource-ownership checks, all 187 tests, and packed-package smoke pass.
 - [x] P0.3 Graph diagnostics is complete in `0.8.30`. Reachable ordinary modules validate relative runtime imports/re-exports and reject every dynamic `import()` at the importer source location before compilation or generated module loading. Ordinary and Worker traversal retain separate ownership, type-only and unreachable edges remain excluded, focused page/helper/re-export/dynamic fixtures pass with all 189 tests and packed-package smoke, and no export-symbol graph, ProjectSession, runtime, or public API is added.
 - [x] P0.4 Async native handler ownership is complete in `0.8.31`. Mounted native registrations invalidate direct/captured setters, queued commits, and captured refs before listener removal. Chrome route, keyed-row, document-disposal, and synchronous event-dispatch checks, all 189 tests, and packed-package smoke pass without cancelling application promises or adding a scheduler.
-- [ ] P0.5 Atomic and collision-safe output is next. Failed builds must preserve prior output and public content must not overwrite generated artifacts.
+- [x] P0.5 Staged and collision-safe output is complete in `0.8.32`. Production output completes in one project-local staging tree, public files are compared against generated route/runtime/handler/chunk/Worker/CSS paths while copying, `afterBuild` runs before rollback-safe promotion, and ordinary failures preserve the prior `dist`. Same-root overlap and stale locks fail closed; after stale-lock removal, an interrupted promotion backup recovers on the next admitted build. Focused collision/replacement/dev checks pass with equivalent `v0.8.31` commerce deploy output; `.kudzu` remains compiler scratch for P0.6.
+- [ ] P0.6 Explicit ProjectSession is next. Root and caches must become build-scoped so independent projects can compile safely in one process.
 
 ### P0: Semantic Correctness And Compiler Foundation
 
@@ -145,7 +146,7 @@ P0 creates the semantic base required by every later large-application capabilit
 | P0.2 | Descriptor consumers use SymbolRef | P0.1 | Handler/effect/binding capture and import discovery no longer depends only on text names |
 | P0.3 | Graph diagnostics | P0.1 | Relative dynamic imports and unresolved runtime edges fail at the source location |
 | P0.4 | Async native handler ownership | None | Pending handlers cannot write after route or DOM ownership is released |
-| P0.5 | Atomic collision-safe build | None | Failed builds preserve prior output and public files cannot overwrite generated artifacts |
+| P0.5 | Staged collision-safe build | None | Failed builds preserve prior output and public files cannot overwrite generated artifacts |
 | P0.6 | Explicit ProjectSession | P0.1 | Root and caches are build-scoped; two projects can compile safely in one process |
 | P0.7 | Parsed module/export cache | P0.6 | Shared modules are parsed and summarized once per build |
 | P0.8 | Stable ModuleSymbol and SiteId | P0.6-P0.7 | Imports, re-exports, aliases, owners, and call sites use stable identities outside a pass |
@@ -275,7 +276,7 @@ Every result carries a stable source-local binding slot, debug name, declaration
 
 **Completed in `0.8.31`:** the existing native registration lifetime now guards state mutation, queued commits, and captured ref lookup. Route and keyed-row browser checks recreate the same ownership IDs before old work resolves, and document disposal invalidates a pending layout handler. Replacement state and DOM remain fresh. Both 5,000-event Chrome dispatch medians are 6.4 ms, and the 209 B raw / 94 B aggregate gzip runtime cost is recorded in `PERFORMANCE.md`.
 
-### PR 5: Atomic And Collision-Safe Output
+### PR 5: Staged And Collision-Safe Output
 
 **Objective:** make production builds safe before scaling the build graph.
 
@@ -283,7 +284,9 @@ Every result carries a stable source-local binding slot, debug name, declaration
 
 **Tests:** public collisions with route HTML, core runtime, handler entry, chunk, Worker namespace, source CSS, and configured CSS; failed build preserves prior `dist`.
 
-**Done condition:** output is staged, validated, and atomically promoted; public content cannot silently replace generated artifacts.
+**Done condition:** output is staged, validated, and promoted with rollback/recovery; public content cannot silently replace generated artifacts.
+
+**Completed in `0.8.32`:** Kudzu emits into a locked project-local staging sibling, validates public files during one collision-safe copy traversal, runs trusted `afterBuild` mutation there, and promotes with backup rollback. Active overlap and stale locks fail closed; after stale-lock removal, the next admitted build restores an interrupted promotion backup. This is a guarded two-rename replacement, not a lock-free atomic directory exchange. Route HTML is written in bounded batches. Route HTML, core runtime, handler entry, actual esbuild chunk, Worker namespace, source CSS, and configured CSS collisions preserve the complete prior manifest; late hook failure also preserves it and successful replacement removes stale files. Before final lock/recovery hardening, twenty-one alternating 1,011-page replacement builds observed a 5.71% lower median with identical 3,056-file / 11,137,074-byte commerce deploy output.
 
 ### PR 6: ProjectSession And Explicit Root
 
@@ -430,7 +433,7 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 ## Production Gates Before 1.0
 
 - Async native and effect work cannot write after ownership release.
-- Build output is atomic and collision-safe.
+- Build output is staged, collision-safe, and rollback/recovery guarded.
 - Source maps connect generated route code to TS/TSX diagnostics.
 - Chrome, Firefox, and WebKit pass required journeys.
 - Accessibility automation and keyboard checks cover forms, navigation, dialogs, menus, charts, and errors.
@@ -457,4 +460,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-PR 1 through PR 4 are complete. The next PR is **PR 5: Atomic And Collision-Safe Output**. Do not skip directly to a store, resource, router, virtualization, or ecosystem package feature.
+PR 1 through PR 5 are complete. The next PR is **PR 6: ProjectSession And Explicit Root**. Do not skip directly to a store, resource, router, virtualization, or ecosystem package feature.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.31` are completed scopes represented by package/release records.
+This is an execution sequence, not release history. `0.8.16` through `0.8.32` are completed scopes represented by package/release records.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -22,6 +22,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 | `0.8.29` | Move native handler, effect, remaining binding, list evaluator, optimized-command, and effect-resource discovery/lowering onto source-local lexical identity. | Shadowed imports/globals/state/resources remain distinct, HandlerIR/BindingIR round trips pass, synthesized trees retain the fallback, and no runtime or public API is added. |
 | `0.8.30` | Validate ordinary runtime graph edges before code generation and reject dynamic imports at the importer source. | Page/helper/re-export/dynamic fixtures report original file/range/specifier without `.kudzu` paths; Worker, type-only, unreachable, output, and runtime behavior remain unchanged. |
 | `0.8.31` | Invalidate pending native-handler contexts when their route, keyed, conditional, or document DOM owner is released. | Late setters, queued commits, and captured refs cannot mutate replacement ownership; synchronous dispatch remains within the performance gate and runtime bytes are recorded. |
+| `0.8.32` | Stage and validate production output before rollback-safe promotion, reject same-root overlap, and tighten keyed browser paths. | Build/hook failures preserve the prior output, stale locks fail closed, interrupted backups recover on the next admitted build after lock removal, public/generated collisions fail, and deploy output remains equivalent. |
 
 ## Sequence Rules
 

package/framework/binding-runtime.js

@@ -41,14 +41,12 @@ export function patchBinding(node, target, value) {
 
 function commitBindings(id) {
   const bindings = bindingTargets.get(id)
-  if (!bindings) return
-  for (const binding of bindings) {
-    if (!binding.node.isConnected) bindings.delete(binding)
-    else patchBinding(binding.node, binding.target, binding.read())
+  if (bindings) {
+    for (const binding of bindings) {
+      if (!binding.node.isConnected) bindings.delete(binding)
+      else patchBinding(binding.node, binding.target, binding.read())
+    }
   }
-}
-
-function commitConditions(id) {
   const conditions = conditionTargets.get(id)
   if (!conditions) return
   for (const condition of conditions) {
@@ -58,7 +56,6 @@ function commitConditions(id) {
 }
 
 registerCommitter(commitBindings)
-registerCommitter(commitConditions)
 registerMountHook(mountBindings)
 registerMountHook(mountConditions)
 registerUnmountHook(unmountBindings)

package/framework/build.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto"
-import { cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises"
+import { cp, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises"
 import { dirname, join, relative, resolve, sep } from "node:path"
 import { pathToFileURL } from "node:url"
 import { build as bundle, transform } from "esbuild"
@@ -35,6 +35,31 @@ async function loadConfig() {
 }
 
 export async function build({ quiet = false, minify = true } = {}) {
+  const stagedOutput = join(root, ".kudzu-dist-staging")
+  const backupOutput = join(root, ".kudzu-dist-backup")
+  const lockPath = join(root, ".kudzu-build.lock")
+  const lock = await acquireBuildLock(lockPath)
+  try {
+    await recoverOutput(outputDirectory, backupOutput)
+    await rm(stagedOutput, { recursive: true, force: true })
+    const { result, pageCount, behaviorCount } = await buildInto(stagedOutput, { minify })
+    await promoteOutput(stagedOutput, outputDirectory, backupOutput)
+    if (!quiet) console.log(`Built ${pageCount} page(s), ${behaviorCount} interactive page(s) into dist/`)
+    return result
+  } finally {
+    try {
+      await rm(stagedOutput, { recursive: true, force: true })
+    } finally {
+      try {
+        await lock.close()
+      } finally {
+        await rm(lockPath, { force: true })
+      }
+    }
+  }
+}
+
+async function buildInto(outputDirectory, { minify }) {
   const config = await loadConfig()
   const base = normalizeBase(config.base)
   const configuredStyles = normalizeStyles(config.styles, base)
@@ -52,7 +77,6 @@ export async function build({ quiet = false, minify = true } = {}) {
     group.hasParams = false
   }
   await rm(workDirectory, { recursive: true, force: true })
-  await rm(outputDirectory, { recursive: true, force: true })
   await mkdir(workDirectory, { recursive: true })
   await mkdir(outputDirectory, { recursive: true })
 
@@ -227,11 +251,13 @@ export async function build({ quiet = false, minify = true } = {}) {
     runtime: { shared: hasSharedRuntime, dependency: hasDependencyRuntime }
   } = capabilityIR
   const runtimeName = usesDependencyRuntime => usesDependencyRuntime ? "kudzu-deps.js" : "kudzu.js"
-  for (const entry of pageEntries) {
-    const routeDirectory = join(outputDirectory, entry.route)
-    await mkdir(routeDirectory, { recursive: true })
-    const html = preloadModules(entry.html.replace(runtimePlaceholder, escapeAttribute(assetPath(base, `assets/${runtimeName(entry.usesDependencyRuntime)}`))))
-    await writeFile(join(routeDirectory, "index.html"), html)
+  for (let offset = 0; offset < pageEntries.length; offset += 64) {
+    await Promise.all(pageEntries.slice(offset, offset + 64).map(async entry => {
+      const routeDirectory = join(outputDirectory, entry.route)
+      await mkdir(routeDirectory, { recursive: true })
+      const html = preloadModules(entry.html.replace(runtimePlaceholder, escapeAttribute(assetPath(base, `assets/${runtimeName(entry.usesDependencyRuntime)}`))))
+      await writeFile(join(routeDirectory, "index.html"), html)
+    }))
   }
   if (navigationRoutes.length || behaviorCount && (hasSharedRuntime || regularBehaviorCount)) {
     const runtimeFile = hasSharedRuntime ? "./shared-runtime.js" : "./runtime.js"
@@ -316,10 +342,6 @@ export async function build({ quiet = false, minify = true } = {}) {
   }
   const sortedRewrites = rewrites.sort((left, right) => runtimeSpecificity(right) - runtimeSpecificity(left) || left.pattern.localeCompare(right.pattern))
   await writeFile(join(workDirectory, "kudzu-plan.json"), JSON.stringify({ routes: plans, rewrites: sortedRewrites }, null, 2))
-  for (const file of new Set([...cssFiles, ...importedAssets])) {
-    const collision = join(publicDirectory, "assets", relative(sourceDirectory, file))
-    if (await exists(collision)) throw new Error(`${relative(root, collision)} collides with emitted source asset ${relative(root, file)}`)
-  }
   for (const file of cssFiles) {
     const output = join(assetsDirectory, relative(sourceDirectory, file))
     await mkdir(dirname(output), { recursive: true })
@@ -339,17 +361,95 @@ export async function build({ quiet = false, minify = true } = {}) {
       if (typeof css !== "string") throw new Error(`${style.label}.transform must return CSS text or an object with a css string`)
     }
     const output = join(outputDirectory, style.output.slice(1))
+    if (await exists(output)) throw new Error(`${style.label}.output ${JSON.stringify(style.output)} collides with a generated artifact`)
     await mkdir(dirname(output), { recursive: true })
     await writeFile(output, css)
   }
-  if (await exists(publicDirectory)) await cp(publicDirectory, outputDirectory, { recursive: true })
+  if (await exists(publicDirectory)) {
+    await copyPublic(publicDirectory, outputDirectory)
+  }
   if (config.afterBuild !== undefined) {
     if (typeof config.afterBuild !== "function") throw new Error("kudzu.config afterBuild must be a function")
     await config.afterBuild({ root, outDir: outputDirectory, sourceDir: sourceDirectory, base, routes: plans.map(plan => plan.route), plans, rewrites: sortedRewrites })
   }
 
-  if (!quiet) console.log(`Built ${plans.length} page(s), ${behaviorCount} interactive page(s) into dist/`)
-  return { sourceResults }
+  return { result: { sourceResults }, pageCount: plans.length, behaviorCount }
+}
+
+async function acquireBuildLock(lockPath) {
+  let lock
+  try {
+    lock = await open(lockPath, "wx")
+  } catch (error) {
+    if (error?.code !== "EEXIST") throw error
+  }
+  if (lock) {
+    try {
+      await lock.writeFile(String(process.pid))
+      return lock
+    } catch (error) {
+      await lock.close()
+      await rm(lockPath, { force: true })
+      throw error
+    }
+  }
+  const owner = Number(await readFile(lockPath, "utf8").catch(() => ""))
+  if (Number.isInteger(owner) && owner > 0) {
+    let active = true
+    try {
+      process.kill(owner, 0)
+    } catch (error) {
+      if (error?.code === "ESRCH") active = false
+      else throw error
+    }
+    if (active) throw new Error(`Another Kudzu build is already running for ${root} (PID ${owner})`)
+    throw new Error(`A stale Kudzu build lock for PID ${owner} exists at ${lockPath}; remove it before building`)
+  }
+  throw new Error(`An invalid Kudzu build lock exists at ${lockPath}; remove it before building`)
+}
+
+async function recoverOutput(finalOutput, backupOutput) {
+  if (!await exists(backupOutput)) return
+  if (await exists(finalOutput)) await rm(backupOutput, { recursive: true, force: true })
+  else await rename(backupOutput, finalOutput)
+}
+
+async function promoteOutput(stagedOutput, finalOutput, backup) {
+  const previous = await exists(finalOutput)
+  if (previous) await rename(finalOutput, backup)
+  try {
+    await rename(stagedOutput, finalOutput)
+  } catch (error) {
+    if (previous) {
+      try {
+        await rename(backup, finalOutput)
+      } catch (rollbackError) {
+        throw new AggregateError([error, rollbackError], "Kudzu output promotion and rollback both failed")
+      }
+    }
+    throw error
+  }
+  if (previous) await rm(backup, { recursive: true, force: true }).catch(error => console.warn(`Built output was promoted, but ${backup} could not be removed and will be retried on the next build: ${error.message}`))
+}
+
+async function copyPublic(sourceDirectory, destinationDirectory, destinationRoot = destinationDirectory) {
+  for (const entry of await readdir(sourceDirectory, { withFileTypes: true })) {
+    const source = join(sourceDirectory, entry.name)
+    const destination = join(destinationDirectory, entry.name)
+    let generated
+    try {
+      generated = await stat(destination)
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error
+    }
+    if (!generated) {
+      await cp(source, destination, { recursive: entry.isDirectory(), force: false, errorOnExist: true })
+    } else if (entry.isDirectory() && generated.isDirectory()) {
+      await copyPublic(source, destination, destinationRoot)
+    } else {
+      throw new Error(`${relative(root, source)} collides with generated output ${relative(destinationRoot, destination).replaceAll(sep, "/")}`)
+    }
+  }
 }
 
 function preloadModules(html) {
@@ -551,6 +651,7 @@ function normalizeStyles(value, base) {
   if (!Array.isArray(value)) throw new Error("kudzu.config styles must be an array")
   const urls = []
   const sources = []
+  const outputs = new Set()
   for (let index = 0; index < value.length; index++) {
     const style = value[index]
     const label = `kudzu.config styles[${index}]`
@@ -570,6 +671,8 @@ function normalizeStyles(value, base) {
     if (typeof style.source !== "string" || !style.source) throw new Error(`${label}.source must be a non-empty file path`)
     if (typeof style.output !== "string" || !style.output.startsWith("/") || style.output.startsWith("//") || /[%?#\\\0]/.test(style.output) || style.output.split("/").includes("..") || !style.output.endsWith(".css")) throw new Error(`${label}.output must be a root-relative .css path without query, hash, or traversal`)
     if (style.transform !== undefined && typeof style.transform !== "function") throw new Error(`${label}.transform must be a function`)
+    if (outputs.has(style.output)) throw new Error(`${label}.output duplicates another configured style output ${JSON.stringify(style.output)}`)
+    outputs.add(style.output)
     const entry = { label, source: resolve(root, style.source), output: style.output, transform: style.transform }
     sources.push(entry)
     urls.push(withBase(base, style.output))

package/framework/list-runtime.js

@@ -195,12 +195,13 @@ function updateList(list) {
     const currentTokens = [...list.roots.keys()]
     const nextTokens = entries.map(entry => entry.token)
     if (nextTokens.length === currentTokens.length && nextTokens.every((token, index) => token === currentTokens[currentTokens.length - index - 1])) {
+      const nextRoots = nextTokens.map(token => [token, list.roots.get(token)])
       const parent = list.container ?? list.start.parentNode
       const reordered = parent.ownerDocument.createDocumentFragment()
-      reordered.append(...nextTokens.map(token => list.roots.get(token)))
+      reordered.append(...nextRoots.map(([, node]) => node))
       parent.insertBefore(reordered, list.boundary)
-      list.roots = new Map(nextTokens.map(token => [token, list.roots.get(token)]))
-      if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextTokens.map(token => list.roots.get(token))
+      list.roots = new Map(nextRoots)
+      if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextRoots.map(([, node]) => node)
       list.container ??= parent
       list.items = items
       return
@@ -210,7 +211,6 @@ function updateList(list) {
       const removedIndex = currentTokens.indexOf(removed)
       if (removed && nextTokens.every((token, index) => token === currentTokens[index >= removedIndex ? index + 1 : index])) {
         removeListRoot(list, removed)
-        list.roots = new Map(nextTokens.map(token => [token, list.roots.get(token)]))
         if (__KUDZU_LIST_STABLE_FAST_PATHS__) list.orderedRoots = nextTokens.map(token => list.roots.get(token))
         list.items = items
         return
@@ -472,12 +472,12 @@ function updateNestedList(list, items) {
     return true
   }
   if (items.length === previous.length && items.every((item, index) => item === previous[previous.length - index - 1])) {
-    const tokens = [...list.roots.keys()].reverse()
+    const roots = [...list.roots].reverse()
     const parent = list.container ?? list.start.parentNode
     const reordered = parent.ownerDocument.createDocumentFragment()
-    reordered.append(...tokens.map(token => list.roots.get(token)))
+    reordered.append(...roots.map(([, node]) => node))
     parent.insertBefore(reordered, list.boundary)
-    list.roots = new Map(tokens.map(token => [token, list.roots.get(token)]))
+    list.roots = new Map(roots)
     list.items = items
     list.container ??= parent
     return true
@@ -487,10 +487,6 @@ function updateNestedList(list, items) {
     while (removed < items.length && items[removed] === previous[removed]) removed++
     if (items.every((item, index) => item === previous[index >= removed ? index + 1 : index])) {
       removeListRoot(list, keyToken(previous[removed]?.[list.descriptor.key]))
-      list.roots = new Map(items.map(item => {
-        const token = keyToken(item[list.descriptor.key])
-        return [token, list.roots.get(token)]
-      }))
       list.items = items
       return true
     }
@@ -540,12 +536,12 @@ function updateReducerList(list, items) {
     return true
   }
   if (items.length === previous.length && items.every((item, index) => item === previous[previous.length - index - 1])) {
-    const tokens = [...list.roots.keys()].reverse()
+    const roots = [...list.roots].reverse()
     const parent = list.container ?? list.start.parentNode
     const reordered = parent.ownerDocument.createDocumentFragment()
-    reordered.append(...tokens.map(token => list.roots.get(token)))
+    reordered.append(...roots.map(([, node]) => node))
     parent.insertBefore(reordered, list.boundary)
-    list.roots = new Map(tokens.map(token => [token, list.roots.get(token)]))
+    list.roots = new Map(roots)
     list.items = items
     list.container ??= parent
     return true
@@ -555,10 +551,6 @@ function updateReducerList(list, items) {
     while (removed < items.length && items[removed] === previous[removed]) removed++
     if (items.every((item, index) => item === previous[index >= removed ? index + 1 : index])) {
       removeListRoot(list, keyToken(previous[removed]?.[list.descriptor.key]))
-      list.roots = new Map(items.map(item => {
-        const token = keyToken(item[list.descriptor.key])
-        return [token, list.roots.get(token)]
-      }))
       list.items = items
       return true
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.8.31",
+  "version": "0.8.32",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",