Changes
- Normal builds scan final generated route HTML after public copying and afterBuild, in batches of 64 reads. Counts distinguish script/modulepreload text markers from unreadable files, with up to five bounded sorted paths per category. Output prints only after successful promotion; quiet/JSON output and failure exits remain unchanged.
- The lexical scan is not zero-JavaScript or browser correctness proof. Comments/inert content can match, inline event attributes are not checked, and extra public HTML is outside the route inventory. Compiler semantics, runtime behavior, artifact schemas, and browser bytes remain unchanged.
- Repository-only Linux Chrome smoke/CDP tools observe rendered text and accessible names, use native input, provide bounded exact-target diagnostics, and fail on observed browser/resource errors. Release review fixes browser-test skip handling and a reproduced missing srcset favicon false pass, with CSS image coverage. These tools are not an npm API, sandbox, or acceptance oracle.
- Repository runner copy/integrity checks support equal hash-pinned public tools and invalidate changed or missing copies. Tests and private evidence remain excluded from npm; core retains 60 files and generator four.
- Updates create-kudzu to 0.1.153, generating @kudzujs/core@^0.16.28.
Evidence And Limits
Historical full-suite r8 remains Kudzu 23/25 versus React + Vite 24/25. Focused r9 records 3/5 versus 5/5; separate local summary r10 and equal-browser-tools r11 each record 4/5 versus 5/5. No rescoring, new release-time model calls, demonstrated AI-token advantage, or passing 1.0 gate is claimed. Recorded final batched build medians change +4.80% at 111 pages and -0.23% at 1,011 pages with identical deploy bytes and overlapping ranges, not an established speedup. Production build orchestration changes by +30 net lines; no semantic primitive, core pass, runtime concept, or dependency is added.
Validation
Sequential local check builds 228 pages, two interactive. Required-Chrome standalone ownership passes 1/1 plus 320/320 tests with no skips; standalone packed-package smoke and both pack dry runs pass. Four imported-search fixtures retain 32,190 raw / 12,324 aggregate gzip JavaScript bytes. Exact-commit CI passes for 04e14e3: https://github.com/kudzujs/kudzu/actions/runs/34320807470
Protected npm publication passed: https://github.com/kudzujs/kudzu/actions/runs/34321346573
Registry latest is verified as @kudzujs/core@0.16.28 and create-kudzu@0.1.153. Both downloaded tarballs match registry SHA-512/SHA-1 and local npm packs byte-for-byte (core 60 files, generator four). A fresh registry-generated app with an isolated npm cache passed npm install and npm run check, emitting two pages, one interactive, with a script-free static sibling. All release gates are complete.
Upgrade: npm install @kudzujs/core@^0.16.28