# Component verification record

Verified locally on 2026-10-29, Go 1.26.10, macOS arm64 / Apple M4 (10 logical
CPUs), PostgreSQL 18.4 (Homebrew). The database was a fresh temporary local cluster;
the existing test fixtures created isolated databases. No production data or GUI
was used. Migration-module work in the shared checkout was not edited or claimed.

## Commands and results

```sh
# Root module: no server or Go initialization executes during ui check.
go run ./cmd/cicadel ui check --json
go vet ./...
go build ./...

# Set CICADEL_TEST_DATABASE_URL to a dedicated test PostgreSQL administrator URL.
go run ./cmd/cicadel test --strict --require-integration \
  --report /tmp/cicadel-ui-test-results.json -- -race ./...

go test ./uic -run '^$' -fuzz '^FuzzCompile$' -fuzztime 10s
go test ./ui -run '^$' -fuzz '^FuzzTextBoundary$' -fuzztime 10s
go test ./ui -run '^$' -fuzz '^FuzzAttributes$' -fuzztime 10s

# Separate module; root ./... intentionally excludes it.
cd examples/component-library
go run github.com/fauzaanu/cicadel/cmd/cicadel ui check --json
go test -race ./...
go vet ./...
```

All commands passed. The root strict report records **130 passing named test /
subtest outcomes, zero failed or skipped named tests**, and 24 passing test
packages. Twelve additional package events say `skip` because those packages have
no test files; these are not skipped named tests. Nested consumer tests launched
by the scaffold tests are additional subprocess checks, not separate records in
this count. The independent library module passed its race-enabled HTTP/render test.

Preserved results: [root JSON report](https://github.com/fauzaanu/cicadel/blob/main/docs/component-test-results.json),
[fuzz output](https://github.com/fauzaanu/cicadel/blob/main/docs/component-fuzz.txt), [benchmark output](https://github.com/fauzaanu/cicadel/blob/main/docs/component-benchmarks.txt).
The final bounded fuzz runs performed 211,184 compiler executions, 486,064 text
boundary executions, and 1,987,512 attribute executions without a failure. Fuzz
counts vary with cache/corpus, hardware and concurrent load; this is sampled
boundary testing, not proof that every input is safe. CI includes these checks
with five-second fuzz runs and the independent module explicitly listed.

## Behavioral evidence

- [`ui/ui_test.go`](https://github.com/fauzaanu/cicadel/blob/main/ui/ui_test.go): typed composition, children/named slots,
  zero/default behavior, required values/slots, escaping, malicious URLs,
  forwarding rules, compatible/incompatible overrides, namespace conflicts,
  nil body rejection, nested failures, error attribution, recursion/output bounds,
  cancellation before/during rendering, precommit atomicity, committed write
  failure, concurrent success/failure, and separate request buffers.
- [`uic/compiler_test.go`](https://github.com/fauzaanu/cicadel/blob/main/uic/compiler_test.go): malformed nesting/context,
  script/style/event rejection (including uppercase elements), deterministic
  output, source invalidation, missing/stale/orphan outputs, Go failures for
  missing/unknown/incompatible props/components/slots, mapped machine diagnostics,
  and a panic-in-init regression proving offline check does not execute Go code.
- [`component_registry_test.go`](https://github.com/fauzaanu/cicadel/blob/main/component_registry_test.go): host integration,
  required embedded assets, missing resources and project-only override ownership.
- [`TestExternalComponentLibrary`](https://github.com/fauzaanu/cicadel/blob/main/internal/scaffold/components_test.go): a
  fresh generated project installs a unique version through the Go proxy protocol,
  explicitly registers the independent library, resolves a typed project override,
  passes required props/children/footer, verifies HTML/security/concurrent requests
  and CSS, and builds the server/test executable. The compiled HTTP tests and the
  production `check` command run from an empty directory. `TEMPL_DEV_MODE=true`
  deliberately verifies that compiled literals do not fall back to upstream disk
  discovery. The library is installed with actual `go get`, not a consumer replace;
  only the framework points to the checkout. No public module publication is claimed.
- Existing generated-project/package tests and real PostgreSQL articles/catalog
  HTTP tests passed under race detection. They retain authorization, ownership,
  validation, CSRF, session and persistence assertions after the UI conversion.
- [`examples/component-library`](https://github.com/fauzaanu/cicadel/blob/main/examples/component-library): independent module
  with explicit exports, embedded source/CSS, required assets and normal app metadata.

The source/host validation commands serve different purposes: source `ui check`
does not execute app factories, while host construction/`manage.go check` validates
actual registered components, assets, and dependency versions before serving.

## Performance measurements

```sh
go test ./ui ./uic ./templates -run '^$' \
  -bench 'Benchmark(Render|Compile|PrototypeCompile)$' -benchmem -count=3
```

Three local samples after the final implementation, using Go's adaptive benchmark
loop and no network/database. Both render benchmarks output `<h1>Hello</h1>`.
The new render includes an instrumented compiled component and the buffered
renderer; the legacy benchmark uses the existing immutable template engine.

| Operation | Observed range | Allocation observation |
| --- | --- | --- |
| Component render | 477.7–514.1 ns/op | 4,655 B/op; 15 allocs/op |
| Legacy template render | 322.6–330.6 ns/op | 352 B/op; 9 allocs/op |
| Component source-to-Go compile | 175.7–187.5 µs/op | 83.4–83.5 kB/op; 1,736 allocs/op |
| Legacy template parse/load | 1.74–2.06 µs/op | 4,728 B/op; 65 allocs/op |

The new path costs more for this small render, notably its request-owned 4 KiB
buffer and stack/context instrumentation. It deliberately avoids sharing a pool
that retains request writers. Compilation is a build-time parser/generator/AST/
formatting pipeline; the old operation parses a runtime template, so those timings
are not equivalent phases. Component compilation excludes the subsequent Go
compiler/linker. No throughput, production capacity, Django comparison, universal
speedup, or regression threshold is inferred from these microbenchmarks. Other
work on the development machine and normal scheduling may affect results.
See the [earlier performance methodology](https://cicadel.fauzaanu.com/en/dev/howto/performance/index.md) for existing baselines.

## Remaining boundaries

This completes the documented initial TPL-01/02/04/05 server component scope.
The APIs are experimental, and no independent security review is claimed. Broader
forms/admin/package batteries stay open. Streaming, hydration, client reactivity,
active script/style/foreign-content support, arbitrary trusted HTML strings,
automatic development watching/hot replacement, and sandboxing package Go code
are not implemented. Development uses explicit regeneration and server restart.
Legacy `templates` remains available for compatibility and email callers. Type
errors navigate to a source component declaration and retain their exact generated
position; they are not claimed to have expression-perfect source maps.