@pyreon/reactivity 0.18.0 → 0.20.0

package/src/reactive-devtools.ts

@@ -0,0 +1,281 @@
+/**
+ * Reactive devtools bridge — an OPT-IN, leak-free introspection layer
+ * over the live signal / computed / effect graph.
+ *
+ * Powers the `@pyreon/devtools` Signals / Graph / Effects / Console
+ * surfaces. Design constraints (mirroring `reactive-trace.ts`):
+ *
+ *   - **Zero cost until attached.** Every instrumentation entry point
+ *     early-returns on `!_active`. The registry is empty and no work
+ *     happens until a devtools client calls `activateReactiveDevtools()`.
+ *     The single call site per creation/track sits inside the existing
+ *     `process.env.NODE_ENV !== 'production'` gate (tree-shaken in prod)
+ *     and is structurally identical to the perf-harness counter calls
+ *     and `_recordSignalWrite` already on those paths.
+ *   - **No retention / no leak.** Nodes are held via `WeakRef` and
+ *     pruned by a `FinalizationRegistry`. The registry never pins a
+ *     signal/computed/effect alive. Edges + the fire ring buffer hold
+ *     only numeric ids and primitives, never node references or values.
+ *   - **Snapshot on demand.** `getReactiveGraph()` recomputes the edge
+ *     set fresh from the live subscriber Sets — no incremental
+ *     bookkeeping to drift out of sync with `cleanupEffect`.
+ *
+ * Names: signals carry `.label` (set explicitly or by the vite plugin's
+ * dev auto-naming). Computeds/effects have no name in the framework, so
+ * they get a stable synthetic label (`derived#12` / `effect#7`).
+ */
+
+export type ReactiveNodeKind = 'signal' | 'derived' | 'effect'
+
+export interface ReactiveNode {
+  id: number
+  kind: ReactiveNodeKind
+  /** Explicit `.label` for signals; synthetic (`derived#id`) otherwise. */
+  name: string
+  /** Bounded string preview of the current value (signals/derived only). */
+  value: string
+  /** Live downstream subscriber count. */
+  subscribers: number
+  /** Total times this node has fired/recomputed since activation. */
+  fires: number
+  /** `performance.now()` of the most recent fire, or null. */
+  lastFire: number | null
+}
+
+export interface ReactiveEdge {
+  /** Source node id (the reactive value being read). */
+  from: number
+  /** Subscriber node id (the computed/effect that read it). */
+  to: number
+}
+
+export interface ReactiveGraph {
+  nodes: ReactiveNode[]
+  edges: ReactiveEdge[]
+}
+
+export interface ReactiveFire {
+  id: number
+  /** `performance.now()` at fire time. */
+  ts: number
+}
+
+// ── Internal node record ─────────────────────────────────────────────────
+
+interface NodeRec {
+  id: number
+  kind: ReactiveNodeKind
+  name: string
+  /** Weak handle to the read fn (signal/computed) — never pins the node. */
+  ref: WeakRef<object>
+  /** Weak handle to the subscriber-set host (signal read fn / computed host). */
+  hostRef: WeakRef<{ _s: Set<() => void> | null }> | null
+  fires: number
+  lastFire: number | null
+}
+
+let _active = false
+let _nextId = 1
+// id → record. Records are pruned by the FinalizationRegistry the moment
+// the underlying node is GC'd, so this Map never retains a dead node.
+const _byId = new Map<number, NodeRec>()
+// Subscriber-callback identity → node id. Lets `getReactiveGraph()`
+// resolve `_s` Set membership (anonymous `recompute`/`run` closures)
+// back to graph nodes for edge extraction. A WeakMap so a disposed
+// effect's closure doesn't keep its id mapping alive.
+const _subId = new WeakMap<object, number>()
+
+/** @internal — finalizer callback; prunes the record when a node is GC'd. */
+export function _rdPrune(id: number): void {
+  _byId.delete(id)
+}
+
+// FinalizationRegistry is baseline since Node 14.6 / all modern browsers
+// / Bun — the same universal-availability assumption the codebase already
+// makes for WeakRef. No env guard (avoids an uncoverable dead branch).
+const _finalizer = new FinalizationRegistry<number>(_rdPrune)
+
+// Bounded fire ring buffer (Effects timeline). Same shape/rationale as
+// reactive-trace.ts — fixed cap, primitives only, never grows.
+const FIRE_CAP = 512
+let _fireBuf: ReactiveFire[] | null = null
+let _fireCount = 0
+
+const PREVIEW_MAX = 60
+
+function preview(v: unknown): string {
+  let s: string
+  try {
+    if (v === null) return 'null'
+    if (v === undefined) return 'undefined'
+    const t = typeof v
+    if (t === 'string') s = JSON.stringify(v) as string
+    else if (t === 'number' || t === 'boolean' || t === 'bigint') s = String(v)
+    else if (t === 'function')
+      s = `[Function ${(v as { name?: string }).name || 'anonymous'}]`
+    else if (t === 'symbol') s = (v as symbol).toString()
+    else if (Array.isArray(v)) s = `Array(${(v as unknown[]).length})`
+    else {
+      const ctor = (v as { constructor?: { name?: string } }).constructor?.name
+      let keys: string[] = []
+      try {
+        keys = Object.keys(v as object).slice(0, 3)
+      } catch {
+        keys = []
+      }
+      s = `${ctor && ctor !== 'Object' ? `${ctor} ` : ''}{${keys.join(', ')}${keys.length === 3 ? ', …' : ''}}`
+    }
+  } catch {
+    s = '[unstringifiable]'
+  }
+  return s.length > PREVIEW_MAX ? `${s.slice(0, PREVIEW_MAX)}…` : s
+}
+
+/** Activate the bridge. Idempotent. Called when a devtools client attaches. */
+export function activateReactiveDevtools(): void {
+  _active = true
+}
+
+/**
+ * Deactivate + drop all retained state. Called when the devtools client
+ * disconnects so a closed panel leaves zero residue.
+ */
+export function deactivateReactiveDevtools(): void {
+  _active = false
+  _byId.clear()
+  _fireBuf = null
+  _fireCount = 0
+}
+
+export function isReactiveDevtoolsActive(): boolean {
+  return _active
+}
+
+// ── Instrumentation entry points (called from the hot paths, but only
+//    after the existing prod gate; each is a no-op until activated) ──────
+
+/**
+ * Register a signal/computed/effect node. `host` is the object carrying
+ * the `_s` subscriber Set (the signal read fn itself, or a computed's
+ * internal host). `sub` is the notify closure (`recompute`/`run`) whose
+ * identity appears in upstream `_s` Sets — used to resolve edges.
+ *
+ * @internal
+ */
+export function _rdRegister(
+  node: object,
+  kind: ReactiveNodeKind,
+  host: { _s: Set<() => void> | null } | null,
+  sub: object | null,
+  label: string | undefined,
+): number | undefined {
+  if (!_active) return undefined
+  const id = _nextId++
+  _byId.set(id, {
+    id,
+    kind,
+    name: label ?? `${kind === 'signal' ? 'signal' : kind}#${id}`,
+    ref: new WeakRef(node),
+    hostRef: host ? new WeakRef(host) : null,
+    fires: 0,
+    lastFire: null,
+  })
+  if (sub) _subId.set(sub, id)
+  _finalizer.register(node, id)
+  // Stash the id on the node so fire events correlate in O(1). Every node
+  // we register is a framework-created function/closure (signal/computed
+  // `read`, effect `run`) — always extensible, so defineProperty cannot
+  // throw here; no defensive try/catch (it would be an uncoverable dead
+  // branch).
+  Object.defineProperty(node, '__pxRdId', {
+    value: id,
+    enumerable: false,
+    configurable: true,
+  })
+  return id
+}
+
+/**
+ * Record that a node fired (signal write / computed recompute / effect
+ * run). Bumps counters + appends to the bounded fire buffer.
+ *
+ * @internal
+ */
+export function _rdRecordFire(node: object): void {
+  if (!_active) return
+  const id = (node as { __pxRdId?: number }).__pxRdId
+  if (id === undefined) return
+  const rec = _byId.get(id)
+  const ts =
+    typeof performance !== 'undefined' && typeof performance.now === 'function'
+      ? performance.now()
+      : Date.now()
+  if (rec) {
+    rec.fires++
+    rec.lastFire = ts
+  }
+  if (_fireBuf === null) _fireBuf = new Array<ReactiveFire>(FIRE_CAP)
+  _fireBuf[_fireCount % FIRE_CAP] = { id, ts }
+  _fireCount++
+}
+
+// ── Snapshot API (consumed by the devtools hook) ─────────────────────────
+
+function resolveSubId(sub: () => void): number | undefined {
+  const direct = (sub as { __pxRdId?: number }).__pxRdId
+  if (direct !== undefined) return direct
+  return _subId.get(sub)
+}
+
+/**
+ * Fresh snapshot of the live reactive graph. Edges are recomputed from
+ * each live node's current subscriber Set — always consistent with the
+ * framework's real subscription state, no incremental drift.
+ */
+export function getReactiveGraph(): ReactiveGraph {
+  const nodes: ReactiveNode[] = []
+  const edges: ReactiveEdge[] = []
+  for (const rec of _byId.values()) {
+    const node = rec.ref.deref()
+    if (!node) continue
+    const host = rec.hostRef?.deref() ?? null
+    const subs = host?._s ?? null
+    // `preview()` is total (its own try/catch returns '[unstringifiable]'),
+    // and `_v` on our registered nodes is a plain property (signal) or a
+    // getter that never throws (computed's getter routes errors through
+    // `_errorHandler` and returns the stale value). No defensive wrapper
+    // here — it would be an uncoverable dead branch.
+    const valueStr =
+      rec.kind === 'effect' ? '' : preview((node as { _v?: unknown })._v)
+    nodes.push({
+      id: rec.id,
+      kind: rec.kind,
+      name: rec.name,
+      value: valueStr,
+      subscribers: subs?.size ?? 0,
+      fires: rec.fires,
+      lastFire: rec.lastFire,
+    })
+    if (subs) {
+      for (const cb of subs) {
+        const to = resolveSubId(cb)
+        if (to !== undefined) edges.push({ from: rec.id, to })
+      }
+    }
+  }
+  return { nodes, edges }
+}
+
+/** Bounded recent-fire timeline (oldest → newest). Fresh copy. */
+export function getReactiveFires(): ReactiveFire[] {
+  if (_fireBuf === null || _fireCount === 0) return []
+  if (_fireCount <= FIRE_CAP) return _fireBuf.slice(0, _fireCount)
+  const start = _fireCount % FIRE_CAP
+  const out: ReactiveFire[] = []
+  for (let i = 0; i < FIRE_CAP; i++) {
+    const e = _fireBuf[(start + i) % FIRE_CAP]
+    if (e) out.push(e)
+  }
+  return out
+}
+

package/src/reactive-trace.ts

@@ -0,0 +1,142 @@
+/**
+ * Reactive trace — a bounded, dev-only ring buffer of recent signal
+ * writes. When a signal-based UI throws, the single most useful
+ * debugging question is "what reactive state changed in the run-up to
+ * the crash" — a point-in-time snapshot of every signal value can't
+ * answer that (it shows the end state, not the causal sequence). The
+ * ring buffer records the last N writes so an error report can attach
+ * the sequence that led into the bad state.
+ *
+ * Design constraints:
+ *
+ *   - **Bounded memory.** Fixed-size circular buffer (`CAP` entries).
+ *     Never grows. Old entries overwrite oldest-first.
+ *   - **No value retention.** Stores a TRUNCATED STRING preview of
+ *     prev / next, never the raw value. Holding raw references would
+ *     retain large arrays / detached DOM / closures in the buffer and
+ *     leak them for the buffer's lifetime. The preview is also what
+ *     makes the trace safely serializable into an error report.
+ *   - **Cheap.** No stack capture (that's the expensive part of the
+ *     `onSignalUpdate` debug path — this is deliberately lighter so it
+ *     can record every write in dev without a perf cost). One object
+ *     literal + one array slot write per signal write.
+ *   - **Zero production cost.** The single call site in `signal.ts`
+ *     is inside the existing `process.env.NODE_ENV !== 'production'`
+ *     gate, so the whole module tree-shakes out of prod bundles.
+ */
+
+export interface ReactiveTraceEntry {
+  /** Signal `label` (set via `signal(v, { name })` or the vite plugin's dev auto-naming). `undefined` for anonymous signals. */
+  name: string | undefined
+  /** Bounded string preview of the value before the write. */
+  prev: string
+  /** Bounded string preview of the value after the write. */
+  next: string
+  /** `performance.now()` at write time (monotonic; survives clock changes). */
+  timestamp: number
+}
+
+/**
+ * Ring-buffer capacity. 50 entries is enough to see the causal chain
+ * for a crash (the writes in the few ticks before the throw) without
+ * the buffer itself becoming a memory concern — each entry is a small
+ * object with two short strings.
+ */
+const CAP = 50
+
+// Lazily allocated — apps that never write a signal in dev (rare) pay
+// nothing until the first write. `_count` is the monotonic total write
+// count; `_count % CAP` is the next slot. Reading reconstructs
+// chronological order from the wrapped buffer.
+let _buf: (ReactiveTraceEntry | undefined)[] | null = null
+let _count = 0
+
+/** Max characters of a value preview before truncation. Keeps the buffer + serialized report small. */
+const PREVIEW_MAX = 80
+
+/**
+ * Safe, bounded stringification. Never throws (a getter or `toJSON`
+ * that throws must not break the trace recorder), never returns more
+ * than `PREVIEW_MAX` chars + an ellipsis marker.
+ */
+function preview(v: unknown): string {
+  let s: string
+  try {
+    if (v === null) return 'null'
+    if (v === undefined) return 'undefined'
+    const t = typeof v
+    if (t === 'string') s = JSON.stringify(v) as string
+    else if (t === 'number' || t === 'boolean' || t === 'bigint') s = String(v)
+    else if (t === 'function') s = `[Function ${(v as { name?: string }).name || 'anonymous'}]`
+    else if (t === 'symbol') s = (v as symbol).toString()
+    else if (Array.isArray(v)) s = `Array(${(v as unknown[]).length})`
+    else {
+      // Plain-ish object: show the constructor name + a shallow key
+      // hint. Avoid full JSON.stringify — it can be huge or throw on
+      // cycles / BigInt / getters.
+      const ctor = (v as { constructor?: { name?: string } }).constructor?.name
+      const keys = (() => {
+        try {
+          return Object.keys(v as object).slice(0, 4)
+        } catch {
+          return []
+        }
+      })()
+      s = `${ctor && ctor !== 'Object' ? ctor + ' ' : ''}{${keys.join(', ')}${keys.length === 4 ? ', …' : ''}}`
+    }
+  } catch {
+    s = '[unstringifiable]'
+  }
+  return s.length > PREVIEW_MAX ? s.slice(0, PREVIEW_MAX) + '…' : s
+}
+
+/**
+ * Record one signal write. Called from `signal.ts` `_set`, already
+ * inside the prod-gate, so this never runs in production builds.
+ *
+ * @internal
+ */
+export function _recordSignalWrite(name: string | undefined, prev: unknown, next: unknown): void {
+  if (_buf === null) _buf = new Array(CAP)
+  _buf[_count % CAP] = {
+    name,
+    prev: preview(prev),
+    next: preview(next),
+    timestamp:
+      typeof performance !== 'undefined' && typeof performance.now === 'function'
+        ? performance.now()
+        : Date.now(),
+  }
+  _count++
+}
+
+/**
+ * Returns the recorded writes in chronological order (oldest → newest),
+ * at most `CAP` entries. Empty array when nothing has been recorded.
+ * The returned array is a fresh copy — safe to retain / serialize
+ * without pinning the ring buffer.
+ *
+ * Consumed by `@pyreon/core`'s `reportError` to attach `reactiveTrace`
+ * to the error context.
+ */
+export function getReactiveTrace(): ReactiveTraceEntry[] {
+  if (_buf === null || _count === 0) return []
+  if (_count <= CAP) {
+    // Buffer not yet wrapped — entries 0.._count-1 are in order.
+    return _buf.slice(0, _count) as ReactiveTraceEntry[]
+  }
+  // Wrapped: oldest entry is at `_count % CAP`, walk forward CAP slots.
+  const start = _count % CAP
+  const out: ReactiveTraceEntry[] = []
+  for (let i = 0; i < CAP; i++) {
+    const e = _buf[(start + i) % CAP]
+    if (e) out.push(e)
+  }
+  return out
+}
+
+/** Clears the buffer. For test isolation; not part of the app-facing API. */
+export function clearReactiveTrace(): void {
+  _buf = null
+  _count = 0
+}

package/src/reconcile.ts

@@ -23,6 +23,16 @@ import { isStore } from './store'
 
 type AnyObject = Record<PropertyKey, unknown>
 
+// Keys that, written through the bracket-assignment paths below, would
+// mutate Object.prototype (or a constructor's prototype) instead of the
+// store. `reconcile` is explicitly documented for applying API responses
+// directly (`reconcile(JSON.parse(body), store)`), and
+// `JSON.parse('{"__proto__":{…}}')` yields an OWN enumerable `__proto__`
+// key that `Object.keys` returns — the canonical prototype-pollution
+// merge vector. Skip these unconditionally on both the write and the
+// stale-key-removal pass.
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
+
 export function reconcile<T extends object>(source: T, target: T): void {
   _reconcileInner(source, target, new WeakSet())
 }
@@ -80,6 +90,7 @@ function _reconcileObject(source: AnyObject, target: AnyObject, seen: WeakSet<ob
   const targetKeys = new Set(Object.keys(target))
 
   for (const key of sourceKeys) {
+    if (DANGEROUS_KEYS.has(key)) continue
     const sv = source[key]
     const tv = target[key]
 
@@ -101,6 +112,7 @@ function _reconcileObject(source: AnyObject, target: AnyObject, seen: WeakSet<ob
 
   // Remove keys that no longer exist in source
   for (const key of targetKeys) {
+    if (DANGEROUS_KEYS.has(key)) continue
     delete target[key]
   }
 }

package/src/signal.ts

@@ -1,5 +1,7 @@
 import { batch, enqueuePendingNotification, isBatching } from './batch'
 import { _notifyTraceListeners, isTracing } from './debug'
+import { _rdRecordFire, _rdRegister } from './reactive-devtools'
+import { _recordSignalWrite } from './reactive-trace'
 import { notifySubscribers, trackSubscriber } from './tracking'
 
 // Dev-time counter sink — see packages/internals/perf-harness for contract.
@@ -35,9 +37,9 @@ export interface Signal<T> {
   subscribe(listener: () => void): () => void
   /**
    * Register a direct updater — even lighter than subscribe().
-   * Uses a flat array instead of Set. Disposal nulls the slot (no Set.delete).
    * Intended for compiler-emitted DOM bindings (_bindText, _bindDirect).
-   * Returns a disposer that nulls the slot.
+   * Returns a disposer that removes the updater (O(1)); the live set
+   * stays bounded under register/dispose churn.
    */
   direct(updater: () => void): () => void
   /**
@@ -63,13 +65,13 @@ interface SignalFn<T> {
   _v: T
   /** @internal subscriber set (lazily allocated by trackSubscriber) */
   _s: Set<() => void> | null
-  /** @internal direct updaters array — compiler-emitted DOM updaters (lazily allocated) */
-  _d: ((() => void) | null)[] | null
+  /** @internal direct updater set — compiler-emitted DOM updaters (lazily allocated) */
+  _d: Set<() => void> | null
   peek(): T
   set(value: T): void
   update(fn: (current: T) => T): void
   subscribe(listener: () => void): () => void
-  /** Register a direct updater — lighter than subscribe, uses array index disposal. */
+  /** Register a direct updater — lighter than subscribe; O(1) set-based disposal. */
   direct(updater: () => void): () => void
   label: string | undefined
   debug(): SignalDebugInfo<T>
@@ -87,6 +89,17 @@ function _set(this: SignalFn<unknown>, newValue: unknown) {
     _countSink.__pyreon_count__?.('reactivity.signalWrite')
   const prev = this._v
   this._v = newValue
+  // Dev-only bounded ring buffer of recent writes — attached to error
+  // reports so a crash carries the causal sequence of signal changes,
+  // not just the thrown value. Tree-shaken in prod via the gate.
+  // Deliberately separate from the `isTracing()` path below: that one
+  // is opt-in (requires an onSignalUpdate listener) and captures a
+  // stack (expensive); this is always-on in dev and intentionally
+  // cheap (string preview, no stack).
+  if (process.env.NODE_ENV !== 'production') {
+    _recordSignalWrite(this.label, prev, newValue)
+    _rdRecordFire(this)
+  }
   if (isTracing()) {
     // Trace listeners are user-supplied debug code that fires on every
     // signal write. A throwing listener here would leave `_v` updated but
@@ -144,33 +157,36 @@ function _subscribe(this: SignalFn<unknown>, listener: () => void): () => void {
 
 /**
  * Register a direct updater — lighter than subscribe().
- * Uses a flat array instead of Set. Disposal nulls the slot (no Set.delete overhead).
  * Used by compiler-emitted _bindText/_bindDirect for zero-overhead DOM bindings.
+ *
+ * Backed by a `Set` (same as `_s`), NOT a flat array. The array form
+ * disposed by nulling the slot (`arr[idx] = null`) but never compacted —
+ * so a long-lived signal (theme/locale/auth, or a signal read inside
+ * `<For>` rows) bound by churning components accumulated one permanent
+ * dead slot per ever-mounted binding. That is an app-lifetime memory
+ * leak AND degrades the signal-write hot path: `notifyDirect` iterated
+ * O(total-ever-registered), not O(live). A Set bounds growth to the live
+ * set and keeps disposal + iteration O(live); the "Set.delete overhead"
+ * the array form optimised for is negligible against an unbounded array.
  */
 function _directFn(this: SignalFn<unknown>, updater: () => void): () => void {
-  if (!this._d) this._d = []
-  const arr = this._d
-  const idx = arr.length
-  arr.push(updater)
+  if (!this._d) this._d = new Set()
+  const set = this._d
+  set.add(updater)
   return () => {
-    arr[idx] = null
+    set.delete(updater)
   }
 }
 
 /**
- * Notify direct updaters — flat array iteration, batch-aware.
- * Null slots (from disposed updaters) are skipped.
+ * Notify direct updaters — set iteration, batch-aware. Disposed updaters
+ * are already absent from the set (O(1) delete on disposal).
  */
-function notifyDirect(updaters: ((() => void) | null)[]): void {
+function notifyDirect(updaters: Set<() => void>): void {
   if (isBatching()) {
-    for (let i = 0; i < updaters.length; i++) {
-      const fn = updaters[i]
-      if (fn) enqueuePendingNotification(fn)
-    }
+    for (const fn of updaters) enqueuePendingNotification(fn)
   } else {
-    for (let i = 0; i < updaters.length; i++) {
-      updaters[i]?.()
-    }
+    for (const fn of updaters) fn()
   }
 }
 
@@ -218,5 +234,8 @@ export function signal<T>(initialValue: T, options?: SignalOptions): Signal<T> {
   read.debug = _debug as () => SignalDebugInfo<T>
   read.label = options?.name
 
+  if (process.env.NODE_ENV !== 'production')
+    _rdRegister(read, 'signal', read, null, read.label)
+
   return read as unknown as Signal<T>
 }

package/src/store.ts

@@ -179,6 +179,17 @@ function wrap(raw: object, shallow: boolean): object {
         return true
       }
 
+      // Defense-in-depth against prototype pollution: a bare
+      // `target.__proto__ = obj` here would mutate the store object's
+      // prototype rather than set a property. `reconcile()` already
+      // filters these, but the proxy is the public write surface
+      // (`store.__proto__ = …`, spread of untrusted data) so guard here
+      // too. Silently ignore — assigning these through a store is never
+      // a legitimate operation.
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+        return true
+      }
+
       const prevLength = isArray ? (target as unknown[]).length : 0
       ;(target as Record<PropertyKey, unknown>)[key] = value
 

package/src/tests/computed.test.ts

@@ -198,6 +198,37 @@ describe('computed', () => {
     expect(called).toBe(2) // equals suppresses
   })
 
+  test('.direct() registrations do not accumulate under churn (bounded, like signal._d)', () => {
+    // Regression for the never-compacted-array leak: a long-lived
+    // computed whose direct updaters register+dispose repeatedly (e.g.
+    // <For> rows re-mounting) must keep its live set bounded to LIVE
+    // registrations, not grow one permanent dead slot per ever-
+    // registered binding (which also made `recompute` O(total-ever)).
+    const s = signal(0)
+    const c = computed(() => s() * 2)
+    c() // initialize
+    const internal = c as unknown as { _d: Set<() => void> | null }
+
+    for (let i = 0; i < 10_000; i++) {
+      const dispose = c.direct(() => {})
+      dispose()
+    }
+    expect(internal._d!.size).toBe(0)
+
+    // One live binding survives → notify/iterate cost is O(live), not 10k.
+    let fired = 0
+    const dispose = c.direct(() => {
+      fired++
+    })
+    expect(internal._d!.size).toBe(1)
+    s.set(1)
+    expect(fired).toBe(1)
+    dispose()
+    expect(internal._d!.size).toBe(0)
+    s.set(2)
+    expect(fired).toBe(1) // disposed updater not invoked
+  })
+
   describe('_v with equals after disposal', () => {
     test('_v returns last cached value after dispose()', () => {
       const s = signal(5)