fix(ts/fusion): kernel2 invalidation-path robustness (K4/K17/K12/K10/K9)

Port the C# Computed invalidation contracts into the TS kernel:

- K4+K17: Computed.invalidate() never throws. Own onInvalidated handlers
  fire first (each isolated via EventHandlerSet.triggerSafe + error log),
  then dependants propagate unconditionally (per-dependant try/catch),
  then unregister — all in a finally so the cascade always completes. This
  also keeps a ComputedState update loop alive when a handler throws.
- K12: replace the public onInvalidated EventHandlerSet field with an
  onInvalidated(handler) method that invokes the handler immediately when
  the computed is already invalidated (C# add-accessor parity); the handler
  set is now private. Updated call sites in fusion-rpc/fusion-hub.ts and the
  fusion tests.
- K10: whenInvalidated(abortSignal) stores the abort listener so both sides
  clean each other up (invalidation removes the abort listener; abort
  removes the invalidation handler); pre-checks abortSignal.aborted and
  rejects immediately with signal.reason ?? new Error('Operation cancelled.').
- K9: Computed.update() runs the renewer with the compute context cleared
  (computeContextKey = undefined), the TS analog of C# BeginIsolation, so
  update()/state.update()/recompute() never records a dependency edge.

Adds kernel2-invalidation.test.ts covering all five items.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SDiBQM5rnhyBG1asuP1kDi

Author: alexyakunin

docs/plans/ts-port-audit.md

@@ -78,6 +78,8 @@ Confidence: confirmed (mechanism fully traced; a by-design JS limitation, but si
 
 ### K4. `invalidate()` can throw and aborts the invalidation cascade midway
 
+Status: **closed** — fixed 2026-07-15 (batch kernel2).
+
 Confidence: confirmed.
 
 - TS: `computed.ts:184-193` — dependant propagation and `onInvalidated.trigger()` run with no try/catch (`events.ts:19-21` doesn't isolate handlers either). A throwing handler propagates up: remaining dependants are never invalidated, `_unregister` is skipped (an Invalidated computed stays registered), and the exception surfaces to whoever called `invalidate()` — e.g. out of `MutableState.set()`, or inside `ComputedState._updateCycle`, whose outer catch (`computed-state.ts:150-154`) logs "UpdateCycle failed and stopped" and **exits the loop permanently**.
@@ -132,6 +134,8 @@ Confidence: confirmed.
 
 ### K9. `update()` is not isolated — renewal registers a dependency in the ambient compute context
 
+Status: **closed** — fixed 2026-07-15 (batch kernel2).
+
 Confidence: confirmed.
 
 - TS: `Computed.update()` → `_renewer()` (`computed.ts:106-114`) → `ComputeFunction.invoke`, which falls back to `AsyncContext.current` (`compute-function.ts:55-58`) and captures the produced computed into that ambient context (`compute-function.ts:116`).
@@ -142,6 +146,8 @@ Confidence: confirmed.
 
 ### K10. `whenInvalidated(abortSignal)` leaks one abort listener per call on long-lived signals; never settles on an already-aborted signal
 
+Status: **closed** — fixed 2026-07-15 (batch kernel2).
+
 Confidence: confirmed.
 
 - TS: `computed.ts:196-216` — the `'abort'` listener (added `{ once: true }`) is never removed when the promise resolves via invalidation. `ComputedState._updateCycle` passes the same `disposeSignal` every iteration (`computed-state.ts:139`), so listeners accumulate one per update. Also: when the signal is *already aborted*, the listener is skipped and the returned promise may never settle (feeds S5); and `ps.reject(abortSignal.reason)` can reject with `undefined`.
@@ -162,6 +168,8 @@ Confidence: confirmed.
 
 ### K12. `onInvalidated` is a public raw handler set — a handler added after invalidation never fires (C#: fires immediately)
 
+Status: **closed** — fixed 2026-07-15 (batch kernel2; `onInvalidated(handler)` is now a method with immediate fire on already-invalidated computeds).
+
 Confidence: confirmed.
 
 - TS: `computed.ts:51, 190-191` — after `trigger()` the set is cleared; `EventHandlerSet.add` on an already-invalidated computed stores a handler that can never fire. Only `whenInvalidated` has the state pre-check.
@@ -208,6 +216,8 @@ Confidence: confirmed. `computed-registry.ts:25-29` vs C# `ComputedRegistry.cs:1
 
 ### K17. Invalidation ordering differs (low)
 
+Status: **closed** — fixed 2026-07-15 (batch kernel2, folded into the K4 rework as planned).
+
 Confidence: confirmed. TS notifies dependants before the computed's own `onInvalidated` handlers (`computed.ts:184-191`); C# fires own handlers first, dependants in `finally` (`Computed.cs:303-318`). Observable to handlers that inspect dependants' state.
 
 - **Recommended:** fold into the K4 rework (its recommended shape already fires own handlers first, dependants after, both exception-isolated).

ts/packages/core/src/events.ts

@@ -25,6 +25,17 @@ export class EventHandlerSet<T> {
             handler(arg);
     }
 
+    // Fires every handler once, isolating each so one that throws can't stop the rest.
+    triggerSafe(arg: T, onError: (error: unknown) => void): void {
+        for (const handler of [...this._handlers]) {
+            try {
+                handler(arg);
+            } catch (error) {
+                onError(error);
+            }
+        }
+    }
+
     clear(): void {
         this._handlers.clear();
     }

ts/packages/fusion-rpc/src/fusion-hub.ts

@@ -183,7 +183,7 @@ export class FusionHub extends RpcHub {
 
             // Wire invalidation → send $sys-c.Invalidate to the client
             if (context !== undefined) {
-                computed.onInvalidated.add(() => {
+                computed.onInvalidated(() => {
                     const msg = serializeMessage({
                         Method: FUSION_INVALIDATE_METHOD,
                         RelatedId: context.callId,

ts/packages/fusion/src/computed.ts

@@ -9,8 +9,11 @@ import {
 import type { ComputedInput } from './computed-input.js';
 import { ComputedRegistry } from './computed-registry.js';
 import { ComputeContext, computeContextKey } from './compute-context.js';
+import { getLogs } from './logging.js';
 import type { State } from './state.js';
 
+const { errorLog } = getLogs('Computed');
+
 let _nextVersion = 0;
 
 export const enum ConsistencyState {
@@ -48,7 +51,7 @@ export class Computed<T> implements IResult<T> {
     private _invalidatePending = false;
     private _dependencies = new Set<Computed<unknown>>();
     private _dependants = new Map<number, WeakRef<Computed<unknown>>>();
-    readonly onInvalidated = new EventHandlerSet<void>();
+    private _onInvalidated = new EventHandlerSet<void>();
     readonly _renewer: (() => Computed<T> | Promise<Computed<T>>) | undefined;
 
     constructor(
@@ -107,7 +110,17 @@ export class Computed<T> implements IResult<T> {
         if (this._state === ConsistencyState.Consistent) return this;
         const latest = this._latest();
         if (latest?.isConsistent) return latest;
-        if (this._renewer !== undefined) return this._renewer();
+        if (this._renewer !== undefined) {
+            const renewer = this._renewer;
+            // Run the renewer with the compute context cleared so renewal never
+            // records a dependency edge in the ambient computation — TS analog of
+            // C# Computed.UpdateUntyped's BeginIsolation.
+            const isolated = (AsyncContext.current ?? AsyncContext.empty).with(
+                computeContextKey,
+                undefined
+            );
+            return isolated.run(renewer);
+        }
         throw new Error(
             'Cannot recompute: Computed is invalidated and has no renewer.'
         );
@@ -166,6 +179,8 @@ export class Computed<T> implements IResult<T> {
         ComputedRegistry.unregister(this as Computed<unknown>);
     }
 
+    // Never throws — mirrors .NET Computed.Invalidate: own handlers fire first
+    // (each isolated), then dependants propagate unconditionally, then unregister.
     invalidate(): void {
         if (this._state === ConsistencyState.Invalidated)
             return;
@@ -176,42 +191,65 @@ export class Computed<T> implements IResult<T> {
             return;
         }
         this._state = ConsistencyState.Invalidated;
-
-        // Unlink from each dependency's dependants map, then clear forward references
-        for (const dependency of this._dependencies)
-            dependency._dependants.delete(this._version);
-        this._dependencies.clear();
-
-        // Notify dependants via WeakRef backward references
-        for (const [, ref] of this._dependants) {
-            const dependant = ref.deref();
-            if (dependant != null) dependant.invalidate();
+        try {
+            this._onInvalidated.triggerSafe(undefined, e =>
+                errorLog?.log('onInvalidated handler failed', e)
+            );
+            this._onInvalidated.clear();
+        } finally {
+            for (const dependency of this._dependencies)
+                dependency._dependants.delete(this._version);
+            this._dependencies.clear();
+
+            for (const [, ref] of this._dependants) {
+                const dependant = ref.deref();
+                if (dependant != null) {
+                    try {
+                        dependant.invalidate();
+                    } catch (e) {
+                        errorLog?.log('Error while invalidating dependant', e);
+                    }
+                }
+            }
+            this._dependants.clear();
+
+            this._unregister();
         }
-        this._dependants.clear();
-
-        this.onInvalidated.trigger();
-        this.onInvalidated.clear();
+    }
 
-        this._unregister();
+    onInvalidated(handler: () => void): void {
+        if (this._state === ConsistencyState.Invalidated) {
+            handler();
+            return;
+        }
+        this._onInvalidated.add(handler);
     }
 
     whenInvalidated(abortSignal?: AbortSignal): Promise<void> {
         if (this._state === ConsistencyState.Invalidated)
             return Promise.resolve();
+        if (abortSignal?.aborted)
+            // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors -- reason falls back to an Error; abortSignal.reason mirrors throwIfAborted()
+            return Promise.reject(
+                abortSignal.reason ?? new Error('Operation cancelled.')
+            );
 
         const ps = new PromiseSource<void>();
-        const handler = () => ps.resolve(undefined);
-        this.onInvalidated.add(handler);
-
-        if (abortSignal !== undefined && !abortSignal.aborted) {
-            abortSignal.addEventListener(
-                'abort',
-                () => {
-                    this.onInvalidated.remove(handler);
-                    ps.reject(abortSignal.reason);
-                },
-                { once: true }
-            );
+        let onAbort: (() => void) | undefined;
+        const onInvalidated = () => {
+            if (onAbort !== undefined)
+                abortSignal!.removeEventListener('abort', onAbort);
+            ps.resolve(undefined);
+        };
+        this._onInvalidated.add(onInvalidated);
+        if (abortSignal !== undefined) {
+            onAbort = () => {
+                this._onInvalidated.remove(onInvalidated);
+                ps.reject(
+                    abortSignal.reason ?? new Error('Operation cancelled.')
+                );
+            };
+            abortSignal.addEventListener('abort', onAbort, { once: true });
         }
 
         return ps;

ts/packages/fusion/tests/computed.test.ts

@@ -60,7 +60,7 @@ describe('Computed', () => {
         const c = new Computed<number>(makeKey('get', 1));
         c.setOutput(42);
         let count = 0;
-        c.onInvalidated.add(() => count++);
+        c.onInvalidated(() => count++);
         c.invalidate();
         c.invalidate();
         expect(count).toBe(1);
@@ -71,7 +71,7 @@ describe('Computed', () => {
         expect(c.state).toBe(ConsistencyState.Computing);
 
         let invalidatedCount = 0;
-        c.onInvalidated.add(() => invalidatedCount++);
+        c.onInvalidated(() => invalidatedCount++);
 
         // Invalidate while still Computing — should defer, not throw, not transition yet.
         c.invalidate();
@@ -88,7 +88,7 @@ describe('Computed', () => {
     it('should not double-invalidate when pending plus a later invalidate', () => {
         const c = new Computed<number>(makeKey('get', 1));
         let invalidatedCount = 0;
-        c.onInvalidated.add(() => invalidatedCount++);
+        c.onInvalidated(() => invalidatedCount++);
         c.invalidate(); // deferred
         c.setOutput(42); // applies pending invalidate
         c.invalidate(); // already invalidated — no-op
@@ -100,7 +100,7 @@ describe('Computed', () => {
         const c = new Computed<number>(makeKey('get', 1));
         c.setOutput(42);
         let fired = false;
-        c.onInvalidated.add(() => {
+        c.onInvalidated(() => {
             fired = true;
         });
         c.invalidate();