[beta.2.1] Maintain public URLPatternList fork and consume qualified releases

[SisyphusZheng]

Part of #1320. Replaces embedded/vendored production maintenance with an independently maintained public fork; upstream acceptance is not a delivery prerequisite.

Source and governance

• Fork justinfagnani/url-pattern-list into open-element/url-pattern-list; retain Git history and MIT attribution from v0.5.0 / 4911e649cc11860c7da90c9d0d9b05626c5cbb83.
• Maintain compact divergence record, independent tests/build/release and named maintenance responsibility.
• Pin an exact qualified built package version in OE and lock dependencies; remove embedded production duplicate after migration.
• Send generic fixes/tests/benchmarks upstream without blocking release. Review upstream updates selectively; returning to official dependency is optional.

Correctness and boundaries

• Same-constructor native/polyfill ordered-linear oracle agrees on full result/value identity.
• Cover static/params/catch-all/regex/optional/overlap/duplicates/encoded/case/baseURL/empty and full URL components; seed replay and reduced failures.
• Safe pruning cannot discard earlier winners; merge conservative candidates by registration sequence. Platform owns grammar/captures.
• No RouteRecord, HTTP/HEAD, loader/action, Hono or Native/Lit lifecycle inside the fork; no public parser/trie or standard-polyfill claim.

Performance acceptance

• Reproducible construction/hit/miss/MEMORY baselines, runtime/GC conditions and realistic distributions.
• Compare old OE behavior as well as linear oracle; record regressions. OE-specific harness stays outside generic library.

Construction/hit/miss/memory must be reproducibly measured against relevant baselines (old OE behavior and the ordered-linear oracle), with runtime/GC conditions and realistic distributions recorded; an unmeasured dimension never completes this issue. Defer speculative native/WASM and complex incremental mutation. Fork creation alone is not implementation qualification. Status 2026-09-09: the fork's BENCHMARKS.md now records GC-controlled memory measurement alongside construction/hit/miss (see the status comment); publication and OE consumption remain open below.

Governing plan (2026-09-08)

Maintainer-approved: ADR-0152, docs/current/VERSION_PLAN.md and #1341. Execution: https://github.com/orgs/open-element/projects/3. Acceptance checkpoints replace the three-day schedule. No automatic beta.2.4. Native/Lit are formal Framework Mode targets, not already-shipped support. Existing release records/versions remain unchanged; no closure without final-SHA evidence. examples/** stays frozen.

Accepted upstream-contribution priority — 2026-09-08

Preserve upstream history/structure and Node test conventions where practical. Generic correctness fixes, corpus and benchmarks should be contribution-ready in the upstream harness; no OE semantics or WTR requirement. Autonomous fork release remains supported regardless of upstream activity. Additional local work for maintainable upstream compatibility is acceptable; no forced switch back upstream or PR quota.

Use docs/architecture/infrastructure-reduction.md and VERSION_PLAN as scope. Prepare useful generic fixes for contribution through normal authorization; no invented bugs, cosmetic PR quota, or upstream-response release dependency. No migration is completed by this update.

[SisyphusZheng]

Fork qualification status (executor: Beta.2.1 implementation session):

Done:

• Fork open-element/url-pattern-list verified as a true fork of justinfagnani/url-pattern-list with full history; main is now 00bface02e3117222dea9c620a63792545f04c13 (4 reviewable commits on top of upstream v0.5.0 / 4911e649).
• Implementation converged to the approved semantics: canonical pathname-literal fixed index + conservative collection merged by original registration sequence; final exec decides; no RouteRecord/HTTP/Hono/lifecycle content in the fork. MIT attribution and upstream author kept; upstream Node test conventions kept (node:test + tsc + wireit).
• Tests: 109/109 pass after a clean npm ci (96 retained upstream cases + 13 new differential cases). Differential matrix: 23 patterns x 22 inputs across native and polyfill constructors, ignoreCase, seeded permutations (LCG seed 1324), TypeError boundaries, full results and value identity against the same-constructor ordered linear oracle.
• Two genuine upstream v0.5.0 bugs confirmed with minimal reproductions (first-match shadowed by same-component zero-consumption child at upstream's own TODO site; patterns pruned on empty URL components) — recipient-native reproductions and patch direction drafted in fork docs/upstream-issues.md, not yet reported upstream.
• Four benchmarks (Node 24.18.0, Apple M2, 5-sample medians, warmup, --expose-gc, retained vs transient split) recorded in fork BENCHMARKS.md, compared against upstream 0.5.0 AND the linear oracle: static-only 5000-pattern hit 0.0057ms (oracle 2.82ms, upstream 0.066ms); complex all-conservative scenario honestly degrades to linear (3.45 vs 3.27ms); retained memory trade-off recorded (per-char tree costs more at static-dense scale, equals linear when conservative).
• npm pack tarball verified in a scratch consumer: 14/14 checks pass under both constructors.

Pending (needs authorization, NOT done):

1. npm publish @open-element/url-pattern-list@0.6.0 — the executor is not authorized to publish.
2. OE-side consumption switch (dependency + lockfile) and removal of the embedded production copy packages/app/src/internal/router/url-pattern-list/ — blocked on (1); a file:/workspace link is not release qualification, so this was not faked. The embedded copy's PROVENANCE.md now records the fork as its maintenance home and the retirement condition.
3. Optional: submit the two upstream issue drafts.

This issue stays OPEN until the published version is consumed with a lockfile.

[SisyphusZheng]

Publication attempt result (2026-09-09, authorized by maintainer prompt):

PRE-PUBLISH VERIFICATION PASSED for open-element/url-pattern-list @ 00bface02e3117222dea9c620a63792545f04c13:

• clean npm ci → npm test: 109 pass / 0 fail (node:test, native + polyfill differential corpus, seeded/reduced cases)
• npm run build: exit 0; npm run benchmark: exit 0 (36 scenario records; construction/hit/miss/memory all measured)
• npm pack: open-element-url-pattern-list-0.6.0.tgz, 7 files only (index.js/.d.ts/maps + package.json/README/LICENSE), integrity sha512-6vSWC2NS3WSxi[...]PT8Yv6u116SGg==, shasum 9c4ac1be93dcaeb3bd8183076a8f8cdc29e39e03
• package identity: name @open-element/url-pattern-list, version 0.6.0, MIT, upstream author attribution retained, repository/bugs/homepage point at the fork

PUBLISH BLOCKED at the registry step — exact error:

npm publish --access public
→ npm error 404: The requested resource '@open-element/url-pattern-list@0.6.0'
  could not be found or you do not have permission to access it.

Root cause (verified): the authorized package name uses the @open-element npm scope (with dash, matching the GitHub org), but the authenticated npm account (zhizheng) has no rights to that scope — npm org read returns 403 and the package GET 404s. The account IS an owner of the existing @OpenElement npm org (no dash, where all current OE packages live).

This is a genuine package-identity error that needs a maintainer decision — I did not fake publication and did not substitute a file:/workspace/git/tarball dependency. Two concrete unblock paths:

1. Create/grant the @open-element npm org (or publish rights for this account) → I publish the authorized name @open-element/url-pattern-list@0.6.0 as-is.
2. Approve renaming the package to @openelement/url-pattern-list@0.6.0 (the npm scope OE actually owns) → I update package.json/repository fields in the fork and publish there. Zero code change; version stays 0.6.0.

Until either happens, the OE dependency switch and the embedded-copy deletion remain correctly pending. This issue stays open.