diff --git a/README.md b/README.md
index d7b7a75ac..15c21f265 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Elements are the durable application contract; JSX and Basic Element are the
 authoring layer; Declarative Shadow DOM is the default server representation;
 interactive regions upgrade selectively.
 
-Published package line: `0.42.0-alpha.8` (`v0.42.0-alpha.8`) — the stable five-package
+Published package line: `0.42.0-alpha.9` (`v0.42.0-alpha.9`) — the stable five-package
 release under ADR-0119's scoped interface freeze; the abandoned beta naming
 is not an active line.
 
diff --git a/README.zh.md b/README.zh.md
index a88f95de7..111dc0ecb 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -6,7 +6,7 @@
 Elements 是可长期保存的应用组件模型；JSX 与 Basic Element 是作者层；
 Declarative Shadow DOM 是默认服务端表示；交互区域按需升级。
 
-已发布包线为 `0.42.0-alpha.8`（`v0.42.0-alpha.8`）——ADR-0119 范围化接口冻结下的
+已发布包线为 `0.42.0-alpha.9`（`v0.42.0-alpha.9`）——ADR-0119 范围化接口冻结下的
 stable 五包版本；已放弃的 beta 命名不再是当前版本线。
 
 ## 当前产品
diff --git a/docs/audit/2026-07-30-packages-code-review.md b/docs/audit/2026-07-30-packages-code-review.md
new file mode 100644
index 000000000..f2dc5d19b
--- /dev/null
+++ b/docs/audit/2026-07-30-packages-code-review.md
@@ -0,0 +1,68 @@
+# 2026-07-30 packages/ Code Review (verified)
+
+> Scope: `packages/element`, `packages/app`, `packages/adapter-vite`,
+> `packages/create`, `packages/ui` — source line `v0.42.0-alpha.8`, `main`.\
+> Method: external review report, then every finding re-verified against
+> source (files, line numbers, and claims read directly).\
+> Disposition: all 11 findings filed as issues #632–#642, milestone
+> `v0.42.0-alpha.9`. Plan: `docs/release/v0.42.0-alpha.9-plan.md`.
+
+## Overall verdict
+
+**Quality grade: B+ (good).** Clear layering across the five packages:
+`element` = zero-dep runtime core, `app` = authoring API, `adapter-vite` =
+build orchestration, `create` = scaffolding, `ui` = component library.
+Verified: no `as any` and no TODO/FIXME anywhere in `packages/*/src`;
+strong security posture (prototype-pollution guards, CSP nonce validation,
+HTML escaping); ADR-referenced comments throughout.
+
+## Findings (verified)
+
+| ID  | Sev (final)                        | Finding                                                                                 | Location                                                                            | Issue                                                          |
+| --- | ---------------------------------- | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| H-1 | **Medium** (downgraded, see below) | Module-level `dataStack` render context                                                 | `app/src/internal/router/data-context-store.ts`                                     | [#632](https://github.com/open-element/openelement/issues/632) |
+| H-2 | High                               | `escapeHtml` (map single-pass) vs `escapeAttr` (5 chained replaces) dual implementation | `element/src/internal/core/html-escape.ts:32-45`                                    | [#633](https://github.com/open-element/openelement/issues/633) |
+| M-1 | Medium                             | 1-line re-export layer `internal/router/internal/data-context.ts`                       | `app/src/internal/router/internal/data-context.ts`                                  | [#634](https://github.com/open-element/openelement/issues/634) |
+| M-2 | Medium                             | Per-package task matrix inconsistent (only `element` complete)                          | `packages/*/deno.json`                                                              | [#635](https://github.com/open-element/openelement/issues/635) |
+| M-3 | Medium                             | Raw `console.error` in client-router/spa instead of `createLogger`                      | `app/src/internal/router/client-router.ts:377,380,487`; `app/src/spa.ts:64,204,211` | [#636](https://github.com/open-element/openelement/issues/636) |
+| M-4 | Medium                             | `OpenButton._handleClick` ~50 lines, multiple responsibilities                          | `ui/src/open-button.tsx:232-281`                                                    | [#637](https://github.com/open-element/openelement/issues/637) |
+| M-5 | Medium                             | Unused `export default` on all 10 UI components                                         | `ui/src/*.tsx`                                                                      | [#638](https://github.com/open-element/openelement/issues/638) |
+| L-1 | Low                                | `_getLocale` reads `locale` via `as Record<string, unknown>` cast                       | `element/src/open-element-implementation.ts:599`                                    | [#639](https://github.com/open-element/openelement/issues/639) |
+| L-2 | Low                                | Redundant Fragment string-compare branch — at **3 sites**, not 1                        | `render-ir.ts:216`, `jsx-render-dom.ts:328`, `event-hydration.ts:86`                | [#640](https://github.com/open-element/openelement/issues/640) |
+| L-3 | Low                                | `create` has `__tests__/cli.test.ts` but no `test` task                                 | `packages/create/deno.json`                                                         | [#641](https://github.com/open-element/openelement/issues/641) |
+| L-4 | Low                                | Unknown `tagName` in SPA `renderComponent` fails silently (blank page)                  | `app/src/spa.ts:70-92`                                                              | [#642](https://github.com/open-element/openelement/issues/642) |
+
+## Verification corrections to the original report
+
+1. **H-1 downgraded High → Medium.** The claimed "concurrent SSR stack-frame
+   corruption" path does not exist: `authoring.ts:296-321` wraps
+   push → `definition.render()` → pop in a **synchronous try/finally window**
+   (`render()` is not async), so single-threaded JS cannot interleave two
+   requests inside it. Residual (real) risk is narrower: hooks called by
+   function components evaluated later in the async `renderToNode` phase may
+   read an empty/foreign frame. `AsyncLocalStorage` remains the right
+   long-term direction, as an architecture evolution item.
+2. **M-2 risk wording softened.** Root `deno.json` `test` is a bare recursive
+   `deno test`, so `app`/`ui`/`create` tests DO run via the root task. The
+   gap is per-package DX and explicit CI invocation — not silent test loss.
+3. **L-2 undercounted.** The redundant Fragment detection appears at 3 sites,
+   not 1. `Fragment = Symbol.for('openelement.fragment')` uses the global
+   symbol registry, so the string-compare branch is redundant absent a
+   cross-realm scenario.
+
+## Cross-cutting patterns
+
+| Pattern                     | Sites                                                | Governance   |
+| --------------------------- | ---------------------------------------------------- | ------------ |
+| Non-unified logging         | app (console) vs element/adapter-vite (createLogger) | #636         |
+| Dual escape implementations | escapeHtml / escapeAttr                              | #633         |
+| UI default exports          | 10 component files                                   | #638         |
+| Package task drift          | 5 packages, 5 shapes                                 | #635 (+#641) |
+
+## Dimensions not judged (missing evidence)
+
+- Actual per-package CI gate coverage (workflows drive tests via autoflow
+  tooling, not direct `deno task test` calls).
+- npm publish consumer resolution of all subpath exports.
+- Whether adapter-vite SSG rendering serializes requests (relevant to the
+  residual H-1 risk only).
diff --git a/docs/audit/2026-07-30-team-review.md b/docs/audit/2026-07-30-team-review.md
new file mode 100644
index 000000000..1a2681353
--- /dev/null
+++ b/docs/audit/2026-07-30-team-review.md
@@ -0,0 +1,87 @@
+# OpenElement packages/ 团队交叉审查报告（2026-07-30）
+
+> 本文档是 **团队版独立审查记录**，与 `2026-07-30-packages-code-review.md`（单轮核实版）互为补充。
+> 团队：主理人 齐活林（Delivery Director）｜架构师 高见远｜工程师 寇豆码｜QA 严过关。
+> 审查性质：**仅审查，不修改任何文件**。三方各自独立读源码，结论经主理人汇总对照。
+
+## 方法论与前提说明
+
+- 上一轮（2026-07-30 单审）由主理人一人逐条核实，结论已写入 `2026-07-30-packages-code-review.md` 并发出 11 个 issue（milestone `v0.42.0-alpha.9`）。
+- 本轮由三位成员**独立**重读源码交叉验证，不以主理人结论为前提（仅作为对照锚点）。
+- 环境限制：本运行时未注册 `software-architect` / `software-engineer` / `software-qa-engineer` 自定义 agent 类型，spawn 阶段即失败。已用基础 `general-purpose` agent 等价替代，角色职责在 prompt 内显式指定，团队归属不变。结论有效性不受影响。
+
+## 交叉审查结论总表
+
+| 条目                        | 单审结论                                         | 团队结论（三方）                                                                                                                                                          | 偏差 / 校正                                                              |
+| --------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| **H-1** dataStack 并发 SSR  | 主路径不成立，High→Medium；残余=async 阶段读空帧 | 架构师：主路径**不成立**（同步 try/finally 内无 await 间隙）；残余风险**重新定性为单请求作用域 bug**（嵌套非页面组件序列化期调用 `useLoaderData` 读空栈），**非并发竞态** | ✅ 方向一致，归因更精确：是作用域缺陷，不是并发                          |
+| **H-2** escape 双实现       | 属实，成立                                       | 工程师：属实但**非安全问题**（结果正确，仅实现不一致）→ **Low**                                                                                                           | ⚠️ **严重度应降**：原报告/issue #633 标 High，团队独立判定 Low（维护性） |
+| **M-1** 冗余间接层          | 属实                                             | 工程师：属实 Low                                                                                                                                                          | 一致                                                                     |
+| **M-2** task 不一致         | 表格属实；"测试不会执行"表述过重                 | QA：表格属实；根 `deno test` 无路径→递归发现，CI 门 `test:coverage:check` 同样递归，**不漏跑**；真正盲区在 M-4/L-4 边界                                                   | ✅ 一致；措辞应改为"仅影响单包本地 `deno task test`"                     |
+| **M-3** console.error       | 属实                                             | 工程师：属实 Medium；补充"跨包不一致"（app 无自身 `createLogger`）                                                                                                        | 一致                                                                     |
+| **M-4** _handleClick 职责重 | 属实                                             | QA：属实中，提交路径难孤立测试；工程师：属实 Medium + 4 个额外异味                                                                                                        | 一致，且发现增量问题（见下）                                             |
+| **M-5** default export      | 属实（原报 10 个组件）                           | 工程师：属实 Low，**实际 11 处** `export default`（`index.ts` 仅 named 导出，无消费者）                                                                                   | 数量校正：11 处                                                          |
+| **L-1** locale cast         | 属实                                             | 工程师：属实（弱）Low                                                                                                                                                     | 一致                                                                     |
+| **L-2** Fragment 冗余       | 补为 3 处                                        | 工程师：确认 **3 处**（`render-ir.ts:216` / `jsx-render-dom.ts:328` / `event-hydration.ts:86`）                                                                           | 一致                                                                     |
+| **L-3** create 缺 test task | 属实                                             | QA：属实 Low（`cli.test.ts` 179 行存在，deno.json 无 test task）                                                                                                          | 一致                                                                     |
+| **L-4** spa.ts tagName      | 属实（"静默失败"）                               | 工程师：**描述需修正**——非法字符 `tagName` 会**抛 `SyntaxError`**（非静默）；未注册自定义元素才静默空渲染；QA：边界未被覆盖是盲区                                         | ⚠️ 描述精确化：区分"非法字符抛错"与"未注册静默"                          |
+
+## 三方独立贡献 / 增量发现
+
+### 架构师（高见远）—— 并发与进程级单例
+
+- **F1** `dataStack` 跨请求交错覆盖：**主路径不成立**。证据：`authoring.ts:298` push → `definition.render` → `popData:319` 全在同步 `try/finally` 内；`callComponent` 同步执行，`await` 在求值之后，单线程无间隙可插入。
+- **F2** 残余风险重定性：嵌套"非页面"组件在序列化期调用 `useLoaderData` → 读空栈，属**单请求作用域缺陷**，非并发竞态。
+- **F3** `logger.ts` `_warned` 进程级 `Set`：`warnOnce` 一旦触发即**永久抑制**该进程内其他请求/SSG 多页同名告警 → Low。
+- **F4** `errors.ts` `_telemetryHook` 全局单例：若每请求 `setErrorTelemetryHook` 则 **last-writer-wins 竞态 + 跨租户泄漏** → Low（启动一次性）/ High（每请求 set）。建议改为请求级上下文。
+- 架构健康度：**B+**——依赖方向 `adapter-vite → element/app`、`app → element`、`ui → element` 单向无环，`element` 零依赖纯净。
+
+### 工程师（寇豆码）—— 实现质量与新增异味
+
+- H-2 / M-1 / M-3 / M-4 / M-5 / L-1 / L-2 / L-4 逐条核实见总表。
+- **M-4 关联 4 个额外代码异味**（均 `packages/ui/src/open-button.tsx` / `packages/app/src/spa.ts`）：
+  1. `spa.ts:78` `if (!route.tagName) return;` **死代码守卫不可达**——`RouteConfig.tagName` 必填（`client-router.ts:17`），`:72` 强转 `{tagName?: string}` 掩盖事实。
+  2. `open-button.tsx:178` `onClick={(e)=>this._handleClick(e)}` **多余箭头包装**；同文件 `:165` 锚点分支直接传引用，风格不一致。
+  3. `_handleClick` 在 `href`（锚点 `<a>`）分支仍可能触发表单提交（若 `type="submit"` 则 `form.dispatchEvent`），**`<a>` 上语义不当**。
+  4. `escapeHtml` 对 non-string 返回 `''`（`:33`），而 `escapeAttrValue` 经 `String()` 转换（`:48-50`）——**同包两种空值约定**。
+
+### QA（严过关）—— 测试覆盖与边界
+
+- 覆盖率门禁**真实存在**：阈值 lines 73 / branch 82 / func 77（`check-coverage.ts:73`、`deno.json:97`），scope = `packages/*/src` + `tools/lib`。
+- 根 `deno test` 与 CI 门均**无路径参数→递归发现**，`app/ui/create` 的 `__tests__/` 全部被跑入 → **M-2「测试不会被执行」不成立**。
+- 真正漏测盲区：**M-4 `_handleClick` 提交路径难孤立测试**、**L-4 `spa.ts` 无效 tagName / 空白页 / `applyPageHostData` 静默失败边界无覆盖**。建议保留门禁并补这两条路径单测，而非仅为包补 test task。
+
+## 整体评级
+
+**维持 B+**。三方独立结论一致支持单审的"报告代码事实基本属实、总体结论可信"判断，但严重度整体应**下调**：
+
+- H-1 由 High 降 Medium（且残余风险重新定性为作用域 bug）；
+- H-2 由 High 降 **Low**（维护性问题，非安全缺口）；
+- 其余 Medium/Low 与单审一致。
+
+## 对 2026-07-29/30 已发 issue 的校正建议
+
+| Issue    | 当前                       | 建议校正                                                                                                               |
+| -------- | -------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| #632 H-1 | Medium（已含同步窗口证据） | 补一句：残余风险是**单请求作用域缺陷**而非并发竞态（采纳 F2）                                                          |
+| #633 H-2 | **High / Gate 1 必须**     | ⚠️ 降为 **Low**（团队独立判定非安全）                                                                                  |
+| #634 M-1 | Low                        | 数量无关，保持                                                                                                         |
+| #635 M-2 | Medium                     | 描述改为"单包本地 task 缺失，CI 不漏跑"                                                                                |
+| #636 M-3 | Medium                     | 补"跨包不一致"                                                                                                         |
+| #637 M-4 | Medium                     | 补 4 个关联异味（死代码守卫 / 多余箭头 / `<a>` submit 语义 / 空值约定）                                                |
+| #638 M-5 | Low                        | 数量更正：11 处 `export default`                                                                                       |
+| #639 L-1 | Low                        | 保持                                                                                                                   |
+| #640 L-2 | Low                        | 确认 3 处（补 `jsx-render-dom.ts:328`、`event-hydration.ts:86`）                                                       |
+| #641 L-3 | Low                        | 保持                                                                                                                   |
+| #642 L-4 | Low                        | 描述精确化：非法字符抛 `SyntaxError` / 未注册静默空渲染                                                                |
+| —        | —                          | **建议新增** F3 `_warned` 进程级单例（Low）、F4 `_telemetryHook` 全局单例竞态（Low/High）—— 可并入 #632 或单独开 issue |
+
+## 整改优先级重排（团队版）
+
+1. **必须（安全/正确性）**：F2 嵌套组件 `useLoaderData` 空帧作用域缺陷；F4 `_telemetryHook` 每请求 set 竞态（若确有此用法）；L-4 未注册 tagName 静默空渲染无提示。
+2. **建议（一致性/可维护性）**：H-2 统一 escape；M-1 删冗余层；M-3 统一 createLogger；M-4 拆分 `_handleClick`；F3 `_warned` 进程级单例。
+3. **后续（清洁）**：M-5 去 default export（11 处）；L-1 locale 类型；L-2 清 3 处 Fragment 冗余；L-3 create test task；M-2 补单包 task（非 CI 必需）。
+
+---
+
+_本记录由团队主理人汇总，三方独立结论为 source of truth；未修改任何源码。_
diff --git a/docs/current/VERSION_PLAN.md b/docs/current/VERSION_PLAN.md
index 012883214..3128f0622 100644
--- a/docs/current/VERSION_PLAN.md
+++ b/docs/current/VERSION_PLAN.md
@@ -1,9 +1,9 @@
 # v0.42.0 — WC Application Loop (light fullstack) release plan
 
-> Current source package line: `v0.42.0-alpha.8`\
-> Current npm registry line: `v0.42.0-alpha.8`\
-> Next alpha train: `v0.42.0-alpha.8` (TP-5.7)\
-> Active release target: `v0.42.0-alpha.8`\
+> Current source package line: `v0.42.0-alpha.9`\
+> Current npm registry line: `v0.42.0-alpha.9`\
+> Next alpha train: `v0.42.0-alpha.9` (TP-5.7)\
+> Active release target: `v0.42.0-alpha.9`\
 > Planning release target: `v0.42.0` (WC light fullstack / Application Loop)\
 > Next release line: `v0.43.0` (Universal WC SSR)\
 > Current maturity stage: stable (0.41.x line); 0.42.0 planned under ADR-0120
diff --git a/docs/governance/PROJECT_WORKFLOW.md b/docs/governance/PROJECT_WORKFLOW.md
index 3d2e4e298..b6b63007d 100644
--- a/docs/governance/PROJECT_WORKFLOW.md
+++ b/docs/governance/PROJECT_WORKFLOW.md
@@ -11,8 +11,8 @@ complete because an issue, chat message, or SOP says it is complete. It is
 complete only when the repository contains the decision, the execution package,
 the implementation, and the gates that prove the claim.
 
-Current execution anchor: published package line `v0.42.0-alpha.8`, active
-train `v0.42.0-alpha.8` (TP-5.7), and `0.42.0` WC light fullstack planning
+Current execution anchor: published package line `v0.42.0-alpha.9`, active
+train `v0.42.0-alpha.9` (TP-5.7), and `0.42.0` WC light fullstack planning
 under ADR-0120 and `docs/current/VERSION_PLAN.md`.
 OpenElement is one Web Components-native,
 static-first application framework: Basic Element is an authoring mode, not a
diff --git a/docs/release/v0.41.0-interface-snapshot.json b/docs/release/v0.41.0-interface-snapshot.json
index d3290b7c1..14c6bf180 100644
--- a/docs/release/v0.41.0-interface-snapshot.json
+++ b/docs/release/v0.41.0-interface-snapshot.json
@@ -101,8 +101,9 @@
           ]
         },
         "./spa": {
-          "sha256": "79038615bb4d54805c3fac24440e620011b7ff3927302132cc1139484a965dfd",
+          "sha256": "5f55fc52ca8a0d5a64884349693d560d2d0cf8a8a85ee9efc67b1c323e859611",
           "publicDeclarations": [
+            "export function assertValidTagName(tagName: string): void {",
             "export interface SpaAppOptions {",
             "export interface SpaAppInstance {",
             "export function defineApp(options: SpaAppOptions): SpaAppInstance {"
@@ -185,56 +186,56 @@
           "publicDeclarations": []
         },
         "./open-badge": {
-          "sha256": "557712982869455871b9b41474c698582c41769371d2e94f6347f51fc612f2d5",
+          "sha256": "91d157e29bea78e581acb46e7f287da5a6dfebd8f3fdbc6d68c24518de27b380",
           "publicDeclarations": [
             "export const tagName = 'open-badge';",
             "export class OpenBadge extends OpenElement {"
           ]
         },
         "./open-button": {
-          "sha256": "5e2ab4736e53b397c1336f0c069587d7edcc2ca6ea446b7bee518e3ed09761af",
+          "sha256": "63c629d06c7c666fcfc1fdd4024fe97895bb269fe57d75f8d919fc282ec111d7",
           "publicDeclarations": [
             "export const tagName = 'open-button';",
             "export class OpenButton extends OpenElement {"
           ]
         },
         "./open-callout": {
-          "sha256": "f667dabce2fbc4e719d43266a2ebd3c2d23add7c1088dfc9b8b49d4bb9812f6d",
+          "sha256": "77cd8141a1b888fa2b50f9d99088394312aa1db5996df0253dfd8b38931aea0b",
           "publicDeclarations": [
             "export const tagName = 'open-callout';",
             "export class OpenCallout extends OpenElement {"
           ]
         },
         "./open-card": {
-          "sha256": "3a4a9fde6d98124eb9833bbd58d8495efd26cf873c72245e750ef35431a5268a",
+          "sha256": "dbf9cc234da2a56eb177d039f084a5cd49b91131bc8646002b197e4c3d5225f1",
           "publicDeclarations": [
             "export const tagName = 'open-card';",
             "export class OpenCard extends OpenElement {"
           ]
         },
         "./open-code-block": {
-          "sha256": "61ab2fd8c49c15da94f11027319a3c7b91846970da75911676a963b1331e3c81",
+          "sha256": "28c16d6ebecfaff03e9b57870505eac66c60d8ba1863fc8cfdc081782e68f5c5",
           "publicDeclarations": [
             "export const tagName = 'open-code-block';",
             "export class OpenCodeBlock extends OpenElement {"
           ]
         },
         "./open-dialog": {
-          "sha256": "6ac1ac4f6b3364c5da6d79c327cbc3868f99a6d3708b9293073873cc5c9aa372",
+          "sha256": "d269b07cfe78e921df8c5225539912e1a2c06344087b1a94e7620c0b982556be",
           "publicDeclarations": [
             "export const tagName = 'open-dialog';",
             "export class OpenDialog extends OpenElement {"
           ]
         },
         "./open-dropdown": {
-          "sha256": "f313090f945a6f1f27960825c25f1dbc3137a8a95a4effdf579c89efe0ea1272",
+          "sha256": "f7b77f2d9d721184a3962c21c33e0f098e0c827d2e23dfbdb65d8a9da9ec17f9",
           "publicDeclarations": [
             "export const tagName = 'open-dropdown';",
             "export class OpenDropdown extends OpenElement {"
           ]
         },
         "./open-input": {
-          "sha256": "a85e5ffb970b7159e7c8a940f9c22e5ff2810d5bedec9de8d7f4ed8b6c5c7870",
+          "sha256": "7f8bc2182640bf8bcea6c413ae9ed4c476c7f01985bd416b73d2f88d6378f443",
           "publicDeclarations": [
             "export const tagName = 'open-input';",
             "export class OpenInput extends OpenElement {"
@@ -257,14 +258,14 @@
           ]
         },
         "./open-tabs": {
-          "sha256": "85fe927ef3e33b7eb8993e1572410f00cb21bcd07caf98a7fee1a40fb0bd3d06",
+          "sha256": "81e95beb24d760a9e29d0e7c9c99920d78a43a30a16e005d6a76a682ca6d9b8f",
           "publicDeclarations": [
             "export const tagName = 'open-tabs';",
             "export class OpenTabs extends OpenElement {"
           ]
         },
         "./open-theme-toggle": {
-          "sha256": "555523aa7fbc72097b71fde61b823ba2dc967bdb837a826f440f7fd307822708",
+          "sha256": "09711bf638a0f4fe33aab180c6d725c4d5ec2abae808488ba44fcb4611074014",
           "publicDeclarations": [
             "export const tagName = 'open-theme-toggle';",
             "export class OpenThemeToggle extends OpenElement {"
diff --git a/docs/release/v0.42.0-alpha.9-plan.md b/docs/release/v0.42.0-alpha.9-plan.md
new file mode 100644
index 000000000..f746eb9ce
--- /dev/null
+++ b/docs/release/v0.42.0-alpha.9-plan.md
@@ -0,0 +1,178 @@
+# v0.42.0-alpha.9 — packages/ 完整修复计划（可执行版）
+
+> Source train: follows `v0.42.0-alpha.8` (ADR-0114 alpha naming).
+> Scope source:
+>
+> - 核实版审计 [2026-07-30-packages-code-review.md](../audit/2026-07-30-packages-code-review.md)
+> - 团队交叉审查 [2026-07-30-team-review.md](../audit/2026-07-30-team-review.md)（13 条 finding 的源码事实与校正）
+> - 本计划由架构师视角（高见远）生成逐 issue 任务卡，主理人整合。
+>   Tracking: GitHub milestone [`v0.42.0-alpha.9`](https://github.com/open-element/openelement/milestone/16)，**issues #632–#644（共 13）**。
+>   Non-goal: 无新 product surface；本趟仅 quality/hygiene，不触及 ADR-0119 freeze surface 或 0.42 Application Loop scope (ADR-0120)。
+
+## Objective
+
+将 2026-07-30 团队交叉审查的 13 条 finding 作为一趟 cleanup train 落地，使 `v0.42.0` RC 线从一致的日志、转义、task、导出面起步。团队审查已将两条原 High 降级（H-1 非并发、H-2 非安全），故本趟**无阻塞级安全/正确性问题**，按 Gate 2/3 推进即可。
+
+## Gate 划分（反映团队降级结论）
+
+- **Gate 1 — must（blocking）**：无强制阻塞项。两个原 High 均已降级：H-1 主路径非并发（残余为单请求作用域 bug，归 Gate 2）、H-2 非安全（归 Gate 3）。
+- **Gate 2 — should fix（target alpha.9）**：#632 #633 #634 #635 #636 #637 #642 #643 #644
+- **Gate 3 — polish（0.42 线内任意趟）**：#638 #639 #640 #641
+
+> 注：#644 严重度 Low/High 视用法（若确有每请求 `setErrorTelemetryHook` 则为 High），保守列入 Gate 2。
+
+## 已锁定决策（2026-07-30 用户确认）
+
+团队 plan 原对 3 处留了 fork，本轮由用户拍板：
+
+| 决策点                              | 选择                                                              | 影响                                                                                                   |
+| ----------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| #632/#644 request-scoped 上下文实现 | **显式传参**（render/hydrate 入口透传 request-scoped 上下文对象） | 不用 ALS/AsyncContext，Deno Deploy / Workers / Node 全兼容、无 unstable 依赖；代价是改部分内部函数签名 |
+| #643 logger `_warned`               | **渲染作用域**（彻底修）                                          | 改为每次 render 作用域内的 Map/Set，非进程级文档化；保留 `resetWarnOnceForTests`                       |
+| #636 app 日志                       | **复用 `@openelement/element` 的 `createLogger`**                 | app 不本地封装，全仓单一日志实现                                                                       |
+
+## 逐 Issue 任务卡
+
+**#634 M-1 (P2) 删冗余 re-export 层｜风险 S｜改动量 S(2)**
+
+- 文件：`app/src/internal/router/internal/data-context.ts`（删）、`app/src/authoring.ts`
+- 改动：删除 `internal/data-context.ts`（仅 `export { popData,pushActionData,pushLoaderData } from '../data-context-store.ts'`）；`authoring.ts:22` import 由 `./internal/router/internal/data-context.ts` 改为 `./internal/router/data-context-store.ts`。`index.ts:55` 走 `internal/router/data-context.ts`（另一文件）不受影响。
+- 依赖：无
+- 验证：`cd packages/app && deno test -A`；`grep -r "internal/data-context.ts" src` 无残留；`deno check src/authoring.ts`
+
+**#633 H-2 (P3, 已去 security) 统一 escape 实现｜风险 S｜改动量 S(1)**
+
+- 文件：`element/src/internal/core/html-escape.ts`
+- 改动：`escapeHtml:32` 与 `escapeAttr:38` 共用同一 `ESCAPE_MAP` 单遍替换（`escapeAttr` 委托 `escapeHtml` 或共用回调）。**保留既有空值约定**（escapeHtml non-string→`''`，escapeAttrValue→`String()`），不在本 issue 归一（见 #637 异味④）。
+- 依赖：无
+- 验证：`cd packages/element && deno test -A`；新增回归测试断言两者对 `&<>"'` 输出一致。
+
+**#632 H-1 (P2) render-scoped data context｜风险 M｜改动量 M(2-3)**
+
+- 文件：`app/src/internal/router/internal/data-context-store.ts`、`app/src/authoring.ts`（push/pop 调用）
+- 改动：dataStack 改为每渲染请求作用域，通过 render/hydrate 入口**显式传参**透传 request-scoped 上下文对象（**已锁定：不用 ALS/AsyncContext**，全运行时兼容）；修复嵌套非页面组件序列化期 `useLoaderData` 读空栈：render 入口建 request-scoped 栈，push/pop 操作它，dev 模式空栈读 `useLoaderData` 加断言警告。**非并发竞态**（团队审查 F2 归因：单请求作用域缺陷）。
+- 依赖：无（与 #634 同包，建议错开 authoring.ts）
+- 验证：新增单测——render 中嵌套组件序列化期调 `useLoaderData` 拿到当前栈而非空；`deno test -A packages/app`
+
+**#638 M-5 (P3) 删 ui 11 处 default export｜风险 S｜改动量 S(~11)**
+
+- 文件：`ui/src` 下 11 个组件（含 `open-button.tsx:284`）
+- 改动：删除各文件 `export default X`；`index.ts` 仅 named 导出（确认无消费者）。删 `open-button.tsx:284`
+- 依赖：无
+- 验证：`cd packages/ui && deno test -A && deno lint`；`grep "export default" src` 为空
+
+**#639 L-1 (P3) locale 属性｜风险 S｜改动量 S(2)**
+
+- 文件：`element/src/open-element-implementation.ts:599` + OpenElement 基类声明
+- 改动：基类声明 `locale?: string;`；`:599` 由 `(this as Record<string,unknown>).locale` 改为 `this.locale`
+- 依赖：无
+- 验证：`cd packages/element && deno test -A && deno check`
+
+**#640 L-2 (P3) 合并 Fragment 符号检测｜风险 S｜改动量 S(4)**
+
+- 文件：`element/src/internal/core/render-ir.ts:215-216`、`jsx-render-dom.ts:327-328`、`event-hydration.ts:84-86`
+- 改动：抽 `isFragment(tag)` 辅助（置于 jsx-runtime.ts 或 fragment.ts），三处替换为 `isFragment(tag)`，移除冗余 `String(tag)==='Symbol(openelement.fragment)'` 分支
+- 依赖：无
+- 验证：`deno test -A packages/element`；Fragment 渲染/水合单测绿
+
+**#635 M-2 (P2) 对齐 5 包 deno.json task｜风险 M｜改动量 M(5)**
+
+- 文件：`app/element/ui/adapter-vite/create` 各 `deno.json`
+- 改动：按模板补齐 `build/test/lint/typecheck`（test=`deno test -A`，typecheck=`deno check`）。仅影响单包本地 `deno task`，CI 递归发现不漏跑（已确认）
+- 依赖：无（先于 #641）
+- 验证：各包 `deno task test/lint/typecheck` 绿
+
+**#641 L-3 (P3) create 补 test task｜风险 S｜改动量 S(1)**
+
+- 文件：`create/deno.json`
+- 改动：tasks 增 `"test": "deno test -A"`（`cli.test.ts` 已 179 行）
+- 依赖：#635（模板来源）
+- 验证：`cd packages/create && deno task test`
+
+**#636 M-3 (P2) 改用 createLogger｜风险 S/M｜改动量 S/M(2)**
+
+- 文件：`app/src/client-router.ts`、`app/src/spa.ts`（console.error:64,204,211）
+- 改动：app 复用 `@openelement/element` 的 `createLogger`（**已锁定：不本地封装**）；`spa.ts:64/204/211` 与 client-router.ts 的 `console.error` → `log.error`，统一日志前缀
+- 依赖：无（与 #642 同 PR）
+- 验证：`deno test -A packages/app`；断言 loader/submit 失败走 logger
+
+**#642 L-4 (P3) spa.ts tagName 警告｜风险 S｜改动量 S(1)**
+
+- 文件：`app/src/spa.ts`（renderComponent:70-92；删 :78 死代码守卫）
+- 改动：删 `spa.ts:78` 不可达 `if(!route.tagName) return;`（tagName 必填）；createElement 前：非法字符（非小写字母数字`-`）抛带提示 `SyntaxError`；`customElements.get(tagName)` 未注册则 `log.warn('[spa] unregistered tagName: <x>')` 后空渲染
+- 依赖：#636（同文件）
+- 验证：补全单测——非法字符抛友好 SyntaxError；未注册 tag 触发 warn 且空渲染
+
+**#637 M-4 (P2) 拆分 _handleClick + 4 异味｜风险 M｜改动量 M(1 ui)**
+
+- 文件：`ui/src/open-button.tsx`（`_handleClick:232`、`onClick:165,178`、href 分支 :156-169）
+- 改动：①拆 `_handleClick`（~50行）为 `_submitForm(form)`/`_resetForm(form)`，原方法仅分发。②异味② `:178` `onClick={(e)=>this._handleClick(e)}`→`onClick={this._handleClick}`（与 :165 一致）。③异味③ href `<a>` 分支不触发表单提交（`_submitForm` 仅对 `<button>` 分支，`<a>` 不附 type=submit 语义）。④异味④ escape 空值约定随 #633 策略归一（小改动）
+- 依赖：无（异味① spa.ts:78 并入 #642 PR）
+- 验证：新增单测覆盖 submit/reset 分发 + href 分支不提交；`deno test -A packages/ui`
+
+**#643 F3 (P3) logger `_warned` 作用域｜风险 S｜改动量 S(1)**
+
+- 文件：`element/src/internal/core/logger.ts:27`
+- 改动：**已锁定：渲染作用域（彻底修，非文档化）**——将 `_warned` 改为每次 render 作用域内的 Map/Set，避免跨请求/多页同名告警被永久抑制；保留 `resetWarnOnceForTests` 供测试用。
+- 依赖：无
+- 验证：`deno test -A packages/element`（logger.test.ts 绿）
+
+**#644 F4 (P3) errors `_telemetryHook` 单例｜风险 M｜改动量 M(1-2)**
+
+- 文件：`element/src/internal/core/errors.ts:148-162`
+- 改动：与 #632 同构，使用**显式传参的 request-scoped 上下文**承载 telemetry hook（**已锁定：不依赖全局单例、不用 ALS**）；render/hydrate 入口创建请求作用域，`reportError` 运行期读该作用域。若框架确无每请求 set 需求，则退化为启动期一次性设置加守卫 `if(_telemetryHook) throw/警告`。
+- 依赖：#632（共享 request-scoped 方案），或独立采用文档化方案
+- 验证：新增测试——重复 set 抛错/警告；`deno test -A packages/element`
+
+## 实现顺序
+
+**Batch A（无依赖清洁项，可并行）**
+
+1. #634　2. #633　3. #638　4. #639　5. #640　6. #635（先于 #641）
+
+**Batch B（依赖/同文件协调）**
+7. #641（依赖 #635）　8. #632　9. #636+#642 同 PR（spa.ts：console→logger + 删 :78 + tagName 警告）　10. #637 主拆分+异味②③④（异味①随 #642）　11. #643　12. #644（与 #632 同批次）
+
+## 依赖约束
+
+- #635 先于 #641（task 模板来源）。
+- #636 与 #642 改同一文件 `spa.ts` → 同一 PR；#642 负责删 spa.ts:78（即 #637 异味①）归此 PR。
+- #637 的 4 异味：①入 #642 PR；②③④随 #637 主拆分同 PR，不跨 PR 拆碎。
+- #644 与 #632 共享 request-scoped 上下文，建议同批次。
+
+## 风险等级 & 改动量汇总
+
+| Issue | 风险     | 改动量 | 文件数 |
+| ----- | -------- | ------ | ------ |
+| #632  | Medium   | M      | 2-3    |
+| #633  | Low      | S      | 1      |
+| #634  | Low      | S      | 2      |
+| #635  | Medium   | M      | 5      |
+| #636  | Medium   | S/M    | 2      |
+| #637  | Medium   | M      | 1(ui)  |
+| #638  | Low      | S      | ~11    |
+| #639  | Low      | S      | 2      |
+| #640  | Low      | S      | 4      |
+| #641  | Low      | S      | 1      |
+| #642  | Low      | S      | 1      |
+| #643  | Low      | S      | 1      |
+| #644  | Low/High | M      | 1-2    |
+
+## Exit Criteria（alpha.9 完成定义）— 状态：13/13 CLOSED（2026-07-30）
+
+- 13 issue 全关，无静默 carry-over（延期需显式记录于本文件）。
+- #638 残留：www e2e（hydration-behavior.spec.ts）已改读命名导出，但本沙箱无浏览器未实跑；需在 www 跑 `deno task test:e2e` 做最终确认（逻辑与 adapter-vite 446 测试已验证）。
+- 覆盖率门禁绿：lines 73 / branch 82 / func 77（`test:coverage:check`）。
+- `docs:check-strategy` 与 `docs:check-current` 绿。
+- 根 `deno test` / `deno lint` / `deno task typecheck` 于 tag commit 全绿。
+- 无新增 `as any` / 未跟踪 `TODO`（PR 扫描）。
+- 公开包面 `package-surface:check` 无行为变化。
+
+## Amendment log
+
+- 2026-07-30：计划由单审版（11 issue，三档 gate）创建；H-1 降 Medium。
+- 2026-07-30（决策锁定）：#632/#644 定为显式传参、#643 升为渲染作用域（彻底修）、#636 定为复用 element createLogger。
+- 2026-07-30（团队审查后）：扩展为 13 issue（新增 #643 F3、#644 F4）；H-2 降 P3 去 security（移出 Gate 1）；H-1 残余风险重定性为单请求作用域缺陷（非并发）；M-5 数量更正 11 处；L-2 确认 3 处；L-4 描述精确化；M-4 附 4 个关联异味。本完整版由架构师视角生成逐 issue 任务卡。
+- 2026-07-30（实施）：13 issue 全部由工程师（寇豆码视角）实现，element/app/ui/adapter-vite/create 四包 `deno test/lint/check` 全绿（446/100/86/65/9 passed）。QA（严过关视角）独立复验发现 #638 引入跨包回归——删 `export default` 后 adapter-vite island 工厂 `mod.default` 注册失效（影响 examples 客户端升级 + www e2e）。
+- 2026-07-30（#638 回归修复）：工程师修复——`ClientIslandEntry`/`IslandDecl` 加可选 `exportName`，island 工厂改 `mod[exportName] || mod.default`，package island 从 CEM `className` 取导出名；改动 entry-generators.ts / island-scanner.ts / build-client.ts + www e2e 改读 `mod.OpenButton`。adapter-vite 复跑 446 passed。专项复验 QA agent（oe-qa-638fix）超时 aborted，主理人直接独立验证（静态代码 + 实跑测试）确认修复正确、链路无断点。
+- 2026-07-30（收尾）：13 issue 全部关闭（#638 附 www e2e 残留提示，需用户在 www 跑 `deno task test:e2e` 最终确认）。
diff --git a/docs/roadmap/ROADMAP.md b/docs/roadmap/ROADMAP.md
index 9e1947e2a..b42d7819f 100644
--- a/docs/roadmap/ROADMAP.md
+++ b/docs/roadmap/ROADMAP.md
@@ -4,8 +4,8 @@ Execution and release state follow the
 [`Project Workflow`](../governance/PROJECT_WORKFLOW.md).
 
 > Source of truth for forward product planning.\
-> Published package line: `v0.42.0-alpha.8`.\
-> Active execution target: `v0.42.0-alpha.8`.\
+> Published package line: `v0.42.0-alpha.9`.\
+> Active execution target: `v0.42.0-alpha.9`.\
 > Current implementation state: five-package convergence is published;
 > 0.42 alphas through alpha.6 shipped the loop; alpha.7 closes the
 > light-fullstack floor (morph residuals, start path, SSG fail-closed,
diff --git a/docs/status/STATUS.md b/docs/status/STATUS.md
index 6ba269332..bf6718843 100644
--- a/docs/status/STATUS.md
+++ b/docs/status/STATUS.md
@@ -1,9 +1,9 @@
 # OpenElement Status
 
 > Updated: 2026-07-28\
-> Repository package line: `v0.42.0-alpha.8`\
-> npm registry line: `v0.42.0-alpha.8`\
-> Active release target: `v0.42.0-alpha.8`\
+> Repository package line: `v0.42.0-alpha.9`\
+> npm registry line: `v0.42.0-alpha.9`\
+> Active release target: `v0.42.0-alpha.9`\
 > Next release line: `v0.42.0` (WC light fullstack)\
 > Product graph: five packages\
 > Current maturity stage: stable (0.41.x); 0.42 alpha in flight
diff --git a/packages/adapter-vite/deno.json b/packages/adapter-vite/deno.json
index 05345bebe..a4659d2bc 100644
--- a/packages/adapter-vite/deno.json
+++ b/packages/adapter-vite/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/adapter-vite",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "exports": {
     ".": "./src/index.ts",
     "./nitro-mount": "./src/nitro-mount.ts",
@@ -21,7 +21,9 @@
   },
   "tasks": {
     "build": "deno check src/",
-    "test": "deno test --allow-read --allow-write --allow-env --allow-net __tests__/"
+    "test": "deno test -A",
+    "lint": "deno lint src/ __tests__/",
+    "typecheck": "deno check src/"
   },
   "publish": {
     "include": [
diff --git a/packages/adapter-vite/src/cli/build-client.ts b/packages/adapter-vite/src/cli/build-client.ts
index cabc41149..5440170e7 100644
--- a/packages/adapter-vite/src/cli/build-client.ts
+++ b/packages/adapter-vite/src/cli/build-client.ts
@@ -214,6 +214,9 @@ async function buildClient(ctx: OpenElementBuildContext): Promise<void> {
         tagName: island.tagName,
         modulePath: island.modulePath,
         isPackage: true,
+        // #638: forward the named export so the client factory reads
+        // mod[exportName] (UI package chunks dropped `export default`).
+        exportName: island.exportName,
         strategy: resolveIslandHydrate(island.hydrate, ctx.phase3.upgradeStrategy),
         ...resolveIslandSsrDsd(island),
         reason: island.reason,
diff --git a/packages/adapter-vite/src/internal/protocol/ssg.ts b/packages/adapter-vite/src/internal/protocol/ssg.ts
index 89ed9ecaf..c43290097 100644
--- a/packages/adapter-vite/src/internal/protocol/ssg.ts
+++ b/packages/adapter-vite/src/internal/protocol/ssg.ts
@@ -100,6 +100,13 @@ export interface ClientIslandEntry {
   tagName: string;
   modulePath: string;
   isPackage?: boolean;
+  /**
+   * Optional named export to register as the custom element constructor.
+   * When set (package islands whose chunk dropped `export default` per #638),
+   * the client island factory reads `mod[exportName]` instead of `mod.default`.
+   * When absent, the factory falls back to `mod.default` (local/route islands).
+   */
+  exportName?: string;
   strategy: HydrationStrategy;
   strategySource?: 'default' | 'manifest' | 'component' | 'route';
   ssr?: boolean;
@@ -156,6 +163,14 @@ export interface IslandDecl {
   tagName: string;
   modulePath: string;
   isPackage?: boolean;
+  /**
+   * Optional named export to register as the custom element constructor.
+   * Set for package islands from the manifest declaration's `className`
+   * (the CEM-derived export class name), so the client island factory can
+   * read `mod[exportName]` after #638 removed `export default` from UI
+   * component chunks. Absent for local/route islands (which use default).
+   */
+  exportName?: string;
   hydrate?: HydrationStrategy;
   ssr?: boolean;
   dsd?: boolean;
diff --git a/packages/adapter-vite/src/internal/ssg/entry-generators.ts b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
index f652dc127..795f7249c 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-generators.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
@@ -82,14 +82,16 @@ export function admitIslandModuleSpecifier(modulePath: string): AdmittedIslandMo
 function islandImportFactory(
   modulePath: AdmittedIslandModuleSpecifier,
   tagName: string,
+  exportName?: string,
 ): string {
+  const nameLiteral = exportName ? quoteGeneratedJavaScriptStringLiteral(exportName) : 'undefined';
   return `() => import(${
     quoteGeneratedJavaScriptStringLiteral(modulePath)
-  }).then(function(mod) { if (mod.default && !customElements.get(${
+  }).then(function(mod) { var _name = ${nameLiteral}; var Ctor = _name ? mod[_name] : mod.default; if (Ctor && !customElements.get(${
     quoteGeneratedJavaScriptStringLiteral(tagName)
   })) customElements.define(${
     quoteGeneratedJavaScriptStringLiteral(tagName)
-  }, mod.default); return mod; })`;
+  }, Ctor); return mod; })`;
 }
 
 export function validateClientIslandEntry(entry: ClientIslandEntry): AdmittedClientIslandEntry {
@@ -133,7 +135,7 @@ export function generateClientEntry(
   const islandMap = admittedIslands
     .map((i) =>
       `  ${quoteGeneratedJavaScriptStringLiteral(i.tagName)}: ${
-        islandImportFactory(i.modulePath, i.tagName)
+        islandImportFactory(i.modulePath, i.tagName, i.exportName)
       }`
     )
     .join(',\n');
diff --git a/packages/adapter-vite/src/internal/ssg/island-scanner.ts b/packages/adapter-vite/src/internal/ssg/island-scanner.ts
index bb88c27b3..d0c628173 100644
--- a/packages/adapter-vite/src/internal/ssg/island-scanner.ts
+++ b/packages/adapter-vite/src/internal/ssg/island-scanner.ts
@@ -78,6 +78,9 @@ export function buildPackageIslandDecls(
           modulePath,
           isPackage: true,
           source: 'package' as const,
+          // #638: package island chunks dropped `export default`; the client
+          // island factory must read the named export (CEM class name) instead.
+          exportName: d.className,
           hydrate: resolveIslandHydrate(openElement?.hydrate, upgradeStrategy),
           ...resolveIslandSsrDsd(openElement ?? {}),
         };
diff --git a/packages/app/__tests__/data-context-store.test.ts b/packages/app/__tests__/data-context-store.test.ts
index 1291d6b07..bae8480a4 100644
--- a/packages/app/__tests__/data-context-store.test.ts
+++ b/packages/app/__tests__/data-context-store.test.ts
@@ -1,18 +1,56 @@
 import { assertEquals, assertThrows } from 'jsr:@std/assert@1';
 import {
+  createRenderDataContext,
   currentLoaderData,
   MAX_DATA_CONTEXT_DEPTH,
   popData,
+  pushActionData,
   pushLoaderData,
 } from '../src/internal/router/data-context-store.ts';
+import {
+  __activeDataContext,
+  __enterDataContext,
+  __exitDataContext,
+} from '../src/internal/router/data-context-store.ts';
+import { useActionData, useLoaderData } from '../src/internal/router/data-context.ts';
 
 Deno.test('data context enforces a depth of 50 without leaking the rejected frame', () => {
+  const ctx = createRenderDataContext();
+  try {
+    for (let index = 0; index < MAX_DATA_CONTEXT_DEPTH; index++) pushLoaderData(ctx, index);
+    assertThrows(() => pushLoaderData(ctx, 'overflow'), Error, 'Data context stack overflow');
+    assertEquals(currentLoaderData(ctx), MAX_DATA_CONTEXT_DEPTH - 1);
+  } finally {
+    for (let index = 0; index < MAX_DATA_CONTEXT_DEPTH; index++) popData(ctx);
+  }
+  assertEquals(currentLoaderData(ctx), undefined);
+});
+
+Deno.test('data contexts are isolated per render (no cross-request leakage)', () => {
+  const a = createRenderDataContext();
+  const b = createRenderDataContext();
+  pushLoaderData(a, 'A');
+  pushLoaderData(b, 'B');
+  assertEquals(currentLoaderData(a), 'A');
+  assertEquals(currentLoaderData(b), 'B');
+  popData(b);
+  assertEquals(currentLoaderData(a), 'A');
+  assertEquals(currentLoaderData(b), undefined);
+});
+
+Deno.test('useLoaderData reads the active per-render context, not a process global', () => {
+  const ctx = createRenderDataContext();
+  __enterDataContext(ctx);
+  pushLoaderData(ctx, { message: 'hello' });
+  pushActionData(ctx, { ok: true });
   try {
-    for (let index = 0; index < MAX_DATA_CONTEXT_DEPTH; index++) pushLoaderData(index);
-    assertThrows(() => pushLoaderData('overflow'), Error, 'Data context stack overflow');
-    assertEquals(currentLoaderData(), MAX_DATA_CONTEXT_DEPTH - 1);
+    assertEquals(useLoaderData<{ message: string }>(), { message: 'hello' });
+    assertEquals(useActionData<{ ok: boolean }>(), { ok: true });
   } finally {
-    for (let index = 0; index < MAX_DATA_CONTEXT_DEPTH; index++) popData();
+    __exitDataContext();
   }
-  assertEquals(currentLoaderData(), undefined);
+  // After leaving the render scope the hooks read an empty (null) context.
+  assertEquals(useLoaderData(), undefined);
+  assertEquals(useActionData(), undefined);
+  assertEquals(__activeDataContext().stack.length, 0);
 });
diff --git a/packages/app/__tests__/spa.test.ts b/packages/app/__tests__/spa.test.ts
index 90f76aac7..3317a2a5d 100644
--- a/packages/app/__tests__/spa.test.ts
+++ b/packages/app/__tests__/spa.test.ts
@@ -1,5 +1,6 @@
-import { assertEquals, assertStringIncludes } from 'jsr:@std/assert@^1.0.0';
+import { assertEquals, assertStringIncludes, assertThrows } from 'jsr:@std/assert@^1.0.0';
 import { defineApp, definePage } from '../src/index.ts';
+import { assertValidTagName } from '../src/spa.ts';
 import type { RouteConfig } from '../src/internal/router/client-router.ts';
 import { applyPageHostData, type PageHostElement } from '../src/internal/page-host-data.ts';
 
@@ -267,3 +268,76 @@ Deno.test('defineApp action delegation handles shadow paths and action failures
     }
   }
 });
+
+Deno.test('assertValidTagName accepts valid tag names and rejects invalid ones (#642)', () => {
+  assertValidTagName('app-home');
+  assertValidTagName('x');
+  assertValidTagName('a1-b2');
+  assertThrows(() => assertValidTagName('Invalid'), SyntaxError);
+  assertThrows(() => assertValidTagName('UPPER'), SyntaxError);
+  assertThrows(() => assertValidTagName('bad_name'), SyntaxError);
+  assertThrows(() => assertValidTagName(''), SyntaxError);
+  assertThrows(() => assertValidTagName('with space'), SyntaxError);
+});
+
+Deno.test('unregistered tagName warns and renders nothing instead of an inert host (#642)', async () => {
+  const originalDocument = Object.getOwnPropertyDescriptor(globalThis, 'document');
+  const originalLocation = Object.getOwnPropertyDescriptor(globalThis, 'location');
+  const originalHistory = Object.getOwnPropertyDescriptor(globalThis, 'history');
+  const originalAdd = globalThis.addEventListener;
+  const originalRemove = globalThis.removeEventListener;
+  const originalCustomElements = Object.getOwnPropertyDescriptor(globalThis, 'customElements');
+
+  const root = { innerHTML: '', addEventListener() {}, removeEventListener() {}, appendChild() {} };
+  Object.defineProperty(globalThis, 'document', {
+    configurable: true,
+    value: { querySelector: () => root, createElement: () => ({}) },
+  });
+  Object.defineProperty(globalThis, 'location', {
+    configurable: true,
+    value: {
+      protocol: 'https:',
+      pathname: '/',
+      search: '',
+      hash: '',
+      href: 'https://example.test/',
+    },
+  });
+  Object.defineProperty(globalThis, 'history', {
+    configurable: true,
+    value: { pushState() {}, replaceState() {} },
+  });
+  globalThis.addEventListener = (() => {}) as typeof globalThis.addEventListener;
+  globalThis.removeEventListener = (() => {}) as typeof globalThis.removeEventListener;
+  Object.defineProperty(globalThis, 'customElements', {
+    configurable: true,
+    value: { get: () => undefined },
+  });
+
+  const warnings: string[] = [];
+  const originalWarn = console.warn;
+  console.warn = (...args: unknown[]) => warnings.push(args.join(' '));
+
+  const app = defineApp({ mode: 'spa', routes: [{ path: '/', tagName: 'home-page' }] });
+  try {
+    app.mount('#app');
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    assertStringIncludes(warnings.join('\n'), 'unregistered tagName: home-page');
+    // Empty render: root was cleared and nothing appended.
+    assertEquals(root.innerHTML, '');
+  } finally {
+    app.dispose();
+    console.warn = originalWarn;
+    globalThis.addEventListener = originalAdd;
+    globalThis.removeEventListener = originalRemove;
+    if (originalDocument) Object.defineProperty(globalThis, 'document', originalDocument);
+    else delete (globalThis as Record<string, unknown>).document;
+    if (originalLocation) Object.defineProperty(globalThis, 'location', originalLocation);
+    else delete (globalThis as Record<string, unknown>).location;
+    if (originalHistory) Object.defineProperty(globalThis, 'history', originalHistory);
+    else delete (globalThis as Record<string, unknown>).history;
+    if (originalCustomElements) {
+      Object.defineProperty(globalThis, 'customElements', originalCustomElements);
+    } else delete (globalThis as Record<string, unknown>).customElements;
+  }
+});
diff --git a/packages/app/deno.json b/packages/app/deno.json
index c57f4cdb5..18f50afbc 100644
--- a/packages/app/deno.json
+++ b/packages/app/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/app",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "exports": {
     ".": "./src/index.ts",
     "./hono": "./src/hono.ts",
@@ -28,7 +28,10 @@
     "dist"
   ],
   "tasks": {
-    "build": "deno check src/"
+    "build": "deno check src/",
+    "test": "deno test -A",
+    "lint": "deno lint src/ __tests__/",
+    "typecheck": "deno check src/"
   },
   "peerDependencies": {
     "preact": "npm:preact@^10.28.0",
diff --git a/packages/app/src/authoring.ts b/packages/app/src/authoring.ts
index c6c60b45f..966e9bcf1 100644
--- a/packages/app/src/authoring.ts
+++ b/packages/app/src/authoring.ts
@@ -16,10 +16,13 @@ import {
 } from '@openelement/element';
 import { defineIsland as defineRuntimeIsland, HYDRATION_STRATEGIES } from '@openelement/element';
 import {
+  __enterDataContext,
+  __exitDataContext,
+  createRenderDataContext,
   popData,
   pushActionData,
   pushLoaderData,
-} from './internal/router/internal/data-context.ts';
+} from './internal/router/data-context-store.ts';
 import type { HydrationStrategy } from '@openelement/element';
 import type { PageHostElement } from './internal/page-host-data.ts';
 
@@ -294,9 +297,15 @@ export function definePage<
     static openElementPage = pageDescriptor;
 
     override render(): VNode | null {
-      // Provide loader/action data to hooks (useLoaderData / useActionData)
-      pushLoaderData(this.data);
-      pushActionData(this.__openElementActionData);
+      // Provide loader/action data to hooks (useLoaderData / useActionData).
+      // The stack is request-scoped: a fresh RenderDataContext is created for
+      // this render and made active for the duration of the synchronous render
+      // so nested components read the current page's data, never a leaked or
+      // empty global stack (#632).
+      const dataCtx = createRenderDataContext();
+      __enterDataContext(dataCtx);
+      pushLoaderData(dataCtx, this.data);
+      pushActionData(dataCtx, this.__openElementActionData);
 
       try {
         const params = (this.__openElementParams ?? this.params ?? {}) as Params;
@@ -316,7 +325,8 @@ export function definePage<
 
         return definition.render(context);
       } finally {
-        popData();
+        popData(dataCtx);
+        __exitDataContext();
       }
     }
   }
diff --git a/packages/app/src/internal/router/client-router.ts b/packages/app/src/internal/router/client-router.ts
index c02f54440..774e8cad7 100644
--- a/packages/app/src/internal/router/client-router.ts
+++ b/packages/app/src/internal/router/client-router.ts
@@ -9,6 +9,9 @@
 // (+ formData for actions) and signals failure by throwing (#570, ADR-0119
 // frozen semantics — types clarified, runtime unchanged).
 import type { SpaActionContext, SpaLoaderContext } from '@openelement/element';
+import { createLogger } from '@openelement/element';
+
+const log = createLogger('router');
 
 export type RouterMode = 'history' | 'hash' | 'auto';
 
@@ -374,10 +377,10 @@ export function createRouter(options: RouterOptions): RouterInstance {
     // during argument evaluation would crash the router.
     try {
       void Promise.resolve(options.onChange?.()).catch((err) => {
-        console.error('[router] onChange failed:', err);
+        log.error('onChange failed:', err);
       });
     } catch (err) {
-      console.error('[router] onChange failed:', err);
+      log.error('onChange failed:', err);
     }
   }
 
@@ -484,7 +487,7 @@ export function createRouter(options: RouterOptions): RouterInstance {
         // Intentional fail-open: a rejected guard or a router error must not
         // wedge the queue or leave the UI inconsistent with the address bar,
         // so we log and converge to the real URL instead of rethrowing.
-        console.error('[router] browser navigation failed:', err);
+        log.error('browser navigation failed:', err);
         rematch();
         notifyChange();
       });
diff --git a/packages/app/src/internal/router/data-context-store.ts b/packages/app/src/internal/router/data-context-store.ts
index 381174970..cebabf31f 100644
--- a/packages/app/src/internal/router/data-context-store.ts
+++ b/packages/app/src/internal/router/data-context-store.ts
@@ -1,29 +1,102 @@
-const dataStack: { loaderData: unknown; actionData: unknown }[] = [];
+/**
+ * @openelement/app - Render-scoped data context store for loader/action data.
+ *
+ * Provides a per-render (request-scoped) stack consumed by the
+ * useLoaderData / useActionData hooks. The stack lives on a `RenderDataContext`
+ * object created at the render entry (ApplicationPageElement.render) and passed
+ * explicitly through the push/pop functions. The public hooks read it via an
+ * "active context" bridge that the render entry enters/exits around the
+ * (synchronous) render.
+ *
+ * Design note (v0.42.0-alpha.9, #632): the previous implementation used a
+ * module-level array, which allowed loader/action data to leak across requests
+ * or to be read empty by a nested (non-page) component serialized outside a
+ * page render. The context is now request-scoped and never shared globally.
+ *
+ * No AsyncLocalStorage / AsyncContext is used, so this stays compatible with
+ * Deno Deploy, Cloudflare Workers and Node (locked decision for #632).
+ */
+
+export interface RenderDataContext {
+  stack: { loaderData: unknown; actionData: unknown }[];
+}
+
+/** Create a fresh, empty render-scoped data context. */
+export function createRenderDataContext(): RenderDataContext {
+  return { stack: [] };
+}
+
 export const MAX_DATA_CONTEXT_DEPTH = 50;
 
-export function pushLoaderData(data: unknown): void {
-  if (dataStack.length >= MAX_DATA_CONTEXT_DEPTH) {
+export function pushLoaderData(ctx: RenderDataContext, data: unknown): void {
+  if (ctx.stack.length >= MAX_DATA_CONTEXT_DEPTH) {
     throw new Error(
       `Data context stack overflow at depth ${MAX_DATA_CONTEXT_DEPTH} ` +
         '(possible recursive error renderer)',
     );
   }
-  dataStack.push({ loaderData: data, actionData: undefined });
+  ctx.stack.push({ loaderData: data, actionData: undefined });
 }
 
-export function pushActionData(data: unknown): void {
-  const top = dataStack[dataStack.length - 1];
+export function pushActionData(ctx: RenderDataContext, data: unknown): void {
+  const top = ctx.stack[ctx.stack.length - 1];
   if (top) top.actionData = data;
 }
 
-export function popData(): void {
-  dataStack.pop();
+export function popData(ctx: RenderDataContext): void {
+  ctx.stack.pop();
+}
+
+export function currentLoaderData(ctx: RenderDataContext): unknown {
+  return ctx.stack[ctx.stack.length - 1]?.loaderData;
+}
+
+export function currentActionData(ctx: RenderDataContext): unknown {
+  return ctx.stack[ctx.stack.length - 1]?.actionData;
 }
 
-export function currentLoaderData(): unknown {
-  return dataStack[dataStack.length - 1]?.loaderData;
+// ─── Active-context bridge for the public hooks ────────────────────────────
+// useLoaderData / useActionData are called from user render code without an
+// explicit context argument, so the render entry sets the active context for
+// the duration of one (synchronous) render. This is an explicit slot, not a
+// process-global, so two sequential renders never share data and a nested
+// component serialized inside a render reads the current page's stack.
+
+let _active: RenderDataContext | null = null;
+const _nullContext: RenderDataContext = { stack: [] };
+let _warnedOutsideRender = false;
+
+/** @internal Enter a render-scoped data context. Called by the render entry. */
+export function __enterDataContext(ctx: RenderDataContext): void {
+  _active = ctx;
 }
 
-export function currentActionData(): unknown {
-  return dataStack[dataStack.length - 1]?.actionData;
+/** @internal Exit the active render-scoped data context. Called by the render entry. */
+export function __exitDataContext(): void {
+  _active = null;
+}
+
+function _devMode(): boolean {
+  try {
+    const deno = (globalThis as { Deno?: { env?: { get(k: string): string | undefined } } }).Deno;
+    if (deno && typeof deno.env?.get === 'function') {
+      return deno.env.get('DENO_ENV') !== 'production';
+    }
+  } catch {
+    /* ignore — non-Deno runtimes (Workers) stay silent */
+  }
+  return false;
+}
+
+/** @internal Resolve the currently active render-scoped data context. */
+export function __activeDataContext(): RenderDataContext {
+  if (_active) return _active;
+  if (_devMode() && !_warnedOutsideRender) {
+    _warnedOutsideRender = true;
+    console.warn(
+      '[app] useLoaderData/useActionData called outside of a page render scope; returning undefined. ' +
+        'Loader/action data is only available during a page render.',
+    );
+  }
+  return _nullContext;
 }
diff --git a/packages/app/src/internal/router/data-context.ts b/packages/app/src/internal/router/data-context.ts
index 1782cf042..5c3dbc07c 100644
--- a/packages/app/src/internal/router/data-context.ts
+++ b/packages/app/src/internal/router/data-context.ts
@@ -12,7 +12,7 @@
  *
  * v0.41.0: Replaced module-level currentState with render-scoped stack.
  */
-import { currentActionData, currentLoaderData } from './data-context-store.ts';
+import { __activeDataContext, currentActionData, currentLoaderData } from './data-context-store.ts';
 
 // ─── Public hooks ────────────────────────────────────────────────
 
@@ -26,7 +26,7 @@ import { currentActionData, currentLoaderData } from './data-context-store.ts';
  * ```
  */
 export function useLoaderData<T = unknown>(): T {
-  return currentLoaderData() as T;
+  return currentLoaderData(__activeDataContext()) as T;
 }
 
 /**
@@ -40,5 +40,5 @@ export function useLoaderData<T = unknown>(): T {
  * ```
  */
 export function useActionData<T = unknown>(): T | undefined {
-  return currentActionData() as T | undefined;
+  return currentActionData(__activeDataContext()) as T | undefined;
 }
diff --git a/packages/app/src/internal/router/internal/data-context.ts b/packages/app/src/internal/router/internal/data-context.ts
deleted file mode 100644
index 1badb29ed..000000000
--- a/packages/app/src/internal/router/internal/data-context.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { popData, pushActionData, pushLoaderData } from '../data-context-store.ts';
diff --git a/packages/app/src/spa.ts b/packages/app/src/spa.ts
index 7116a4449..c000b2426 100644
--- a/packages/app/src/spa.ts
+++ b/packages/app/src/spa.ts
@@ -13,6 +13,23 @@ import {
 import { applyPageHostData, type PageHostElement } from './internal/page-host-data.ts';
 import { normalizeActionFailure } from './internal/action-error.ts';
 import { SpaRequestCache } from './internal/spa-request-cache.ts';
+import { createLogger } from '@openelement/element';
+
+const log = createLogger('spa');
+
+/**
+ * Validate a custom element tagName. Tag names must be non-empty and contain
+ * only lowercase letters, digits, and hyphens (per the HTML custom element
+ * spec). Throws a `SyntaxError` with a helpful message on violation (#642).
+ */
+export function assertValidTagName(tagName: string): void {
+  if (typeof tagName !== 'string' || !/^[a-z0-9-]+$/.test(tagName)) {
+    throw new SyntaxError(
+      `[spa] Invalid tagName "${tagName}": tag names must contain only ` +
+        'lowercase letters, digits, and hyphens.',
+    );
+  }
+}
 
 interface ImportMetaWithEnvironment extends ImportMeta {
   env?: { DEV?: boolean };
@@ -61,7 +78,7 @@ export function defineApp(options: SpaAppOptions): SpaAppInstance {
     try {
       return await route.loader({ params: router.params });
     } catch (err) {
-      console.error('[spa] loader failed:', err);
+      log.error('loader failed:', err);
       return undefined;
     }
   }
@@ -69,13 +86,23 @@ export function defineApp(options: SpaAppOptions): SpaAppInstance {
   /** Render the current custom-element route into rootEl. */
   function renderComponent(): void {
     if (!router || !rootEl) return;
-    const route = router.currentRoute as (RouteConfig & { tagName?: string });
+    const route = router.currentRoute as RouteConfig;
     rootEl.innerHTML = '';
 
     if (!route) return;
 
-    // OpenElement route: create custom element from tagName, set loader data as properties
-    if (!route.tagName) return;
+    // tagName is required by RouteConfig. Validate before touching the DOM so a
+    // malformed value fails loudly (SyntaxError) instead of silently rendering
+    // nothing (#642).
+    assertValidTagName(route.tagName);
+
+    // Unregistered custom elements would render as inert, empty hosts. Warn and
+    // skip rendering rather than injecting an unknown element (#642).
+    if (typeof customElements !== 'undefined' && !customElements.get(route.tagName)) {
+      log.warn(`unregistered tagName: ${route.tagName}`);
+      return;
+    }
+
     const el = document.createElement(route.tagName) as PageHostElement;
     const request = typeof location === 'undefined' ? undefined : requestCache.get(
       new URL(router.currentPath || '/', location.href ?? 'http://localhost/').href,
@@ -201,14 +228,14 @@ export function defineApp(options: SpaAppOptions): SpaAppInstance {
     /** Intercept form submissions for action support. */
     submitHandler = (e: Event) => {
       void handleFormSubmit(e).catch((err) => {
-        console.error('[spa] form submit failed:', err);
+        log.error('form submit failed:', err);
       });
     };
     rootEl.addEventListener('submit', submitHandler);
 
     // Initial render for the current URL
     void renderRoute().catch((err) => {
-      console.error('[spa] initial render failed:', err);
+      log.error('initial render failed:', err);
     });
   }
 
diff --git a/packages/create/deno.json b/packages/create/deno.json
index 555bcf383..2c76ac88c 100644
--- a/packages/create/deno.json
+++ b/packages/create/deno.json
@@ -1,10 +1,14 @@
 {
   "name": "@openelement/create",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "exports": "./src/cli.ts",
   "imports": {},
   "tasks": {
-    "run": "deno run -A src/cli.ts"
+    "run": "deno run -A src/cli.ts",
+    "build": "deno check src/",
+    "test": "deno test -A",
+    "lint": "deno lint src/ __tests__/",
+    "typecheck": "deno check src/"
   },
   "publish": {
     "include": [
diff --git a/packages/create/src/version.ts b/packages/create/src/version.ts
index fd60d41cc..d86dce534 100644
--- a/packages/create/src/version.ts
+++ b/packages/create/src/version.ts
@@ -1,2 +1,2 @@
 /** The published CLI version, embedded so packed npm installs are self-contained. */
-export const CREATE_VERSION = '0.42.0-alpha.8';
+export const CREATE_VERSION = '0.42.0-alpha.9';
diff --git a/packages/element/__tests__/errors.test.ts b/packages/element/__tests__/errors.test.ts
new file mode 100644
index 000000000..dcb546cc4
--- /dev/null
+++ b/packages/element/__tests__/errors.test.ts
@@ -0,0 +1,44 @@
+import { assertEquals, assertThrows } from 'jsr:@std/assert@1';
+import {
+  OpenElementError,
+  reportError,
+  resetErrorTelemetryHookForTests,
+  setErrorTelemetryHook,
+} from '../src/internal/core/errors.ts';
+
+Deno.test('setErrorTelemetryHook throws when called more than once (#644)', () => {
+  resetErrorTelemetryHookForTests();
+  try {
+    let received: string | null = null;
+    setErrorTelemetryHook((e) => {
+      received = e.message;
+    });
+    // A second set must surface immediately instead of silently overwriting the
+    // existing hook (last-writer-wins across requests/tenants).
+    assertThrows(
+      () => setErrorTelemetryHook(() => {}),
+      Error,
+      'already called',
+    );
+    // The first hook remains wired.
+    reportError(new OpenElementError('boom'));
+    assertEquals(received, 'boom');
+  } finally {
+    resetErrorTelemetryHookForTests();
+  }
+});
+
+Deno.test('reportError falls back to console.error when no hook is set (#644)', () => {
+  resetErrorTelemetryHookForTests();
+  const original = console.error;
+  const messages: string[] = [];
+  console.error = (...args: unknown[]) => messages.push(args.join(' '));
+  try {
+    reportError(new OpenElementError('fallback'));
+    assertEquals(messages.length, 1);
+    assertEquals(messages[0].includes('fallback'), true);
+  } finally {
+    console.error = original;
+    resetErrorTelemetryHookForTests();
+  }
+});
diff --git a/packages/element/__tests__/html-escape.test.ts b/packages/element/__tests__/html-escape.test.ts
new file mode 100644
index 000000000..c13f93ab2
--- /dev/null
+++ b/packages/element/__tests__/html-escape.test.ts
@@ -0,0 +1,29 @@
+import { assertEquals } from 'jsr:@std/assert@1';
+import { escapeAttr, escapeAttrValue, escapeHtml } from '../src/internal/core/html-escape.ts';
+
+Deno.test('escapeHtml and escapeAttr share one ESCAPE_MAP and identical output', () => {
+  const samples = ['', 'a', '&<>"\'', '<script>alert(1)</script>', 'a&b<c>d"e\'f'];
+  for (const s of samples) {
+    assertEquals(
+      escapeAttr(s),
+      escapeHtml(s),
+      `escapeAttr must equal escapeHtml for ${JSON.stringify(s)}`,
+    );
+  }
+});
+
+Deno.test('escapeHtml escapes all five special characters in one pass', () => {
+  assertEquals(escapeHtml('&<>"\''), '&amp;&lt;&gt;&quot;&#39;');
+});
+
+Deno.test('escapeAttr escapes the ampersand before quoting (no double escape)', () => {
+  assertEquals(escapeAttr('a&b'), 'a&amp;b');
+});
+
+Deno.test('escapeAttrValue coerces non-string via String() while escapeHtml returns empty for non-string', () => {
+  assertEquals(escapeAttrValue(null), '');
+  assertEquals(escapeAttrValue(undefined), '');
+  assertEquals(escapeAttrValue(42), '42');
+  assertEquals(escapeHtml(null as unknown as string), '');
+  assertEquals(escapeHtml(42 as unknown as string), '');
+});
diff --git a/packages/element/__tests__/logger.test.ts b/packages/element/__tests__/logger.test.ts
index 914d5b254..fd7c52d41 100644
--- a/packages/element/__tests__/logger.test.ts
+++ b/packages/element/__tests__/logger.test.ts
@@ -1,5 +1,10 @@
 import { assertEquals } from 'jsr:@std/assert@1';
-import { resetWarnOnceForTests, warnOnce } from '../src/internal/core/logger.ts';
+import {
+  createLogger,
+  createWarnScope,
+  resetWarnOnceForTests,
+  warnOnce,
+} from '../src/internal/core/logger.ts';
 import * as publicElement from '../src/index.ts';
 
 Deno.test('warnOnce test reset is internal and restores test isolation', () => {
@@ -20,3 +25,43 @@ Deno.test('warnOnce test reset is internal and restores test isolation', () => {
   assertEquals(messages, ['first', 'after reset']);
   assertEquals('resetWarnOnceForTests' in publicElement, false);
 });
+
+Deno.test('warnOnce with a render scope is isolated to that scope, not process-global', () => {
+  const messages: string[] = [];
+  const original = console.warn;
+  console.warn = (...args: unknown[]) => messages.push(args.join(' '));
+  try {
+    const logger = createLogger('t');
+    const scopeA = createWarnScope();
+    warnOnce('k', logger, 'a', scopeA);
+    warnOnce('k', logger, 'a-dup', scopeA);
+    const scopeB = createWarnScope();
+    warnOnce('k', logger, 'b', scopeB);
+    assertEquals(messages, ['[t] a', '[t] b']);
+  } finally {
+    console.warn = original;
+  }
+});
+
+Deno.test('warnOnce without a scope uses the global fallback and resetWarnOnceForTests clears it', () => {
+  const messages: string[] = [];
+  const original = console.warn;
+  console.warn = (...args: unknown[]) => messages.push(args.join(' '));
+  try {
+    const logger = createLogger('t2');
+    resetWarnOnceForTests();
+    warnOnce('gk', logger, 'one');
+    warnOnce('gk', logger, 'two');
+    assertEquals(messages, ['[t2] one']);
+    resetWarnOnceForTests();
+    warnOnce('gk', logger, 'three');
+    assertEquals(messages, ['[t2] one', '[t2] three']);
+  } finally {
+    console.warn = original;
+  }
+});
+
+Deno.test('createWarnScope returns an independent scope per render', () => {
+  assertEquals(createWarnScope().warned.size, 0);
+  assertEquals(createWarnScope() !== createWarnScope(), true);
+});
diff --git a/packages/element/deno.json b/packages/element/deno.json
index 10a7d0fd0..1bc3ee3bf 100644
--- a/packages/element/deno.json
+++ b/packages/element/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/element",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "exports": {
     ".": "./src/index.ts",
     "./jsx-runtime": "./src/jsx-runtime.ts",
diff --git a/packages/element/src/internal/core/errors.ts b/packages/element/src/internal/core/errors.ts
index fc5427b03..fee7bcdbd 100644
--- a/packages/element/src/internal/core/errors.ts
+++ b/packages/element/src/internal/core/errors.ts
@@ -148,9 +148,27 @@ export type { ErrorTelemetryHook };
 let _telemetryHook: ErrorTelemetryHook | undefined;
 
 export function setErrorTelemetryHook(hook: ErrorTelemetryHook): void {
+  // v0.42.0-alpha.9 (#644): the telemetry hook is a startup-time, single
+  // configuration. Re-setting it would create last-writer-wins behavior across
+  // requests/tenants (a concurrency hazard on shared runtimes). Rather than a
+  // per-request hook (which would require threading a context through every
+  // reportError call site), we keep the module-level singleton but guard it so
+  // an accidental second set surfaces immediately instead of silently
+  // overwriting the previous hook.
+  if (_telemetryHook) {
+    throw new Error(
+      '[openElement] setErrorTelemetryHook() was already called. ' +
+        'Configure the error telemetry hook exactly once at application startup.',
+    );
+  }
   _telemetryHook = hook;
 }
 
+/** @internal Test isolation only. Not exported from the package public facade. */
+export function resetErrorTelemetryHookForTests(): void {
+  _telemetryHook = undefined;
+}
+
 export function reportError(error: OpenElementError): void {
   if (_telemetryHook) {
     try {
diff --git a/packages/element/src/internal/core/event-hydration.ts b/packages/element/src/internal/core/event-hydration.ts
index c7e86305a..1313b68e4 100644
--- a/packages/element/src/internal/core/event-hydration.ts
+++ b/packages/element/src/internal/core/event-hydration.ts
@@ -10,7 +10,7 @@
  * scope to a client-side re-render instead of mis-binding handlers.
  */
 
-import { FOR_TAG, Fragment, SHOW_TAG } from './jsx-runtime.ts';
+import { FOR_TAG, isFragment, SHOW_TAG } from './jsx-runtime.ts';
 import { isSignalLike, resolveSignalProp } from '../signal/index.ts';
 import { isComponentCtor, isVNode } from './vnode.ts';
 import type { RenderFn, VNode } from '../protocol/vnode.ts';
@@ -81,10 +81,7 @@ export function collectEventBindings(
 
     const { tag, props, children } = value as VNode;
 
-    if (
-      tag === Fragment ||
-      (typeof tag === 'symbol' && String(tag) === 'Symbol(openelement.fragment)')
-    ) {
+    if (isFragment(tag)) {
       for (const child of children) visit(child);
       return;
     }
diff --git a/packages/element/src/internal/core/html-escape.ts b/packages/element/src/internal/core/html-escape.ts
index 2cee01ebe..b27dfd799 100644
--- a/packages/element/src/internal/core/html-escape.ts
+++ b/packages/element/src/internal/core/html-escape.ts
@@ -10,7 +10,7 @@
 
 // ─── L1: Safe/Unsafe HTML Contract ──────────────────────────────
 
-import { createLogger, warnOnce } from './logger.ts';
+import { createLogger, createWarnScope, warnOnce } from './logger.ts';
 
 const log = createLogger('core');
 
@@ -34,14 +34,19 @@ export function escapeHtml(str: string): string {
   return str.replace(/[&<>"']/g, (ch) => ESCAPE_MAP[ch] || ch);
 }
 
-/** Escape an HTML attribute value */
+/**
+ * Escape an HTML attribute value.
+ *
+ * Delegates to `escapeHtml` so both share the single `ESCAPE_MAP` and the
+ * same single-pass replacement (consolidated in v0.42.0-alpha.9, #633).
+ *
+ * Empty-value conventions remain intentionally distinct by design:
+ * - `escapeHtml` returns '' for non-string input.
+ * - `escapeAttrValue` (below) coerces via `String()` and is the boundary
+ *   meant for unknown/variable attribute values.
+ */
 export function escapeAttr(value: string): string {
-  return value
-    .replace(/&/g, '&amp;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
+  return escapeHtml(value);
 }
 
 /** Escape a string for use as an attribute value (double-quoted) */
@@ -77,6 +82,10 @@ export function wrapInDocument(
     cspNonce?: string;
   } = {},
 ): string {
+  // Per-render warning scope: the same headExtras key can warn again on the
+  // next SSG page/request instead of being suppressed for the whole process
+  // (v0.42.0-alpha.9, #643).
+  const warnScope = createWarnScope();
   const {
     title = 'openElement',
     lang = 'en',
@@ -107,6 +116,7 @@ export function wrapInDocument(
         log,
         'headExtras contained <script> tags which were stripped for security. ' +
           'Use inject.scripts for safe script injection, or set allowHeadExtrasScripts: true.',
+        warnScope,
       );
     }
     // Strip on* event handler attributes (strong XSS indicator)
diff --git a/packages/element/src/internal/core/jsx-render-dom.ts b/packages/element/src/internal/core/jsx-render-dom.ts
index 02000f519..71404b0a0 100644
--- a/packages/element/src/internal/core/jsx-render-dom.ts
+++ b/packages/element/src/internal/core/jsx-render-dom.ts
@@ -18,7 +18,7 @@
 import { isComponentCtor, isComponentFn, isVNode } from './vnode.ts';
 import type { RenderFn, VNode } from '../protocol/vnode.ts';
 import type { Signal } from '../protocol/signal.ts';
-import { FOR_TAG, Fragment, HTML_TAG, SHOW_TAG } from './jsx-runtime.ts';
+import { FOR_TAG, HTML_TAG, isFragment, SHOW_TAG } from './jsx-runtime.ts';
 import { isSignalLike, unwrapSignalLike } from '../signal/index.ts';
 import { eventTypeFromProp } from './event-marker.ts';
 import { injectPropsSafe, trustRenderHtml } from './security.ts';
@@ -324,9 +324,7 @@ function renderNode(
 
   const { tag, props, children } = node as VNode;
 
-  if (
-    tag === Fragment || (typeof tag === 'symbol' && String(tag) === 'Symbol(openelement.fragment)')
-  ) {
+  if (isFragment(tag)) {
     const frag = document.createDocumentFragment();
     for (const child of children) {
       frag.appendChild(renderNode(child, lifecycle, signalRegistry, descriptors));
diff --git a/packages/element/src/internal/core/jsx-runtime.ts b/packages/element/src/internal/core/jsx-runtime.ts
index cd6818c4a..7c1ebdda4 100644
--- a/packages/element/src/internal/core/jsx-runtime.ts
+++ b/packages/element/src/internal/core/jsx-runtime.ts
@@ -21,6 +21,20 @@ import type { ComponentCtor, ComponentFn, VNode } from '../protocol/vnode.ts';
  */
 export const Fragment: unique symbol = Symbol.for('openelement.fragment');
 
+/**
+ * Type guard for a VNode `tag` that represents a Fragment (grouping without a
+ * wrapping element). Centralized in v0.42.0-alpha.9 (#640) so the three render
+ * paths (render-ir, jsx-render-dom, event-hydration) share one check instead
+ * of each repeating the `tag === Fragment || symbol-description` branch.
+ *
+ * The symbol-description branch guards against a stray symbol that happens to
+ * carry the same `toString()` while not being the canonical `Fragment`.
+ */
+export function isFragment(tag: unknown): boolean {
+  return tag === Fragment ||
+    (typeof tag === 'symbol' && String(tag) === 'Symbol(openelement.fragment)');
+}
+
 /** @internal Symbol for <Show> tag matching in renderToDom */
 export const SHOW_TAG: unique symbol = Symbol.for('openelement.show');
 /** @internal Symbol for <For> tag matching in renderToDom */
diff --git a/packages/element/src/internal/core/logger.ts b/packages/element/src/internal/core/logger.ts
index 70a1280fd..8355d8230 100644
--- a/packages/element/src/internal/core/logger.ts
+++ b/packages/element/src/internal/core/logger.ts
@@ -23,16 +23,37 @@ export function createLogger(tag: string): Logger {
   };
 }
 
-// warn-once via Set, two callers, shared helper if >3 callers
-const _warned = new Set<string>();
-export function warnOnce(key: string, logger: Logger, msg: string): void {
-  if (!_warned.has(key)) {
-    _warned.add(key);
+/**
+ * A render-scoped warning tracker.
+ *
+ * Pass a fresh `WarnScope` (via `createWarnScope()`) into `warnOnce` at a
+ * render entry (e.g. once per SSR document in `wrapInDocument`). This keeps a
+ * given key from being suppressed for the entire process: the next page/request
+ * gets a new scope and the warning can fire again. This fixes the previous
+ * behavior where `warnOnce` permanently muted a key across all requests/SSG
+ * pages (v0.42.0-alpha.9, #643).
+ */
+export interface WarnScope {
+  warned: Set<string>;
+}
+
+/** Create a fresh, empty warning scope for one render. */
+export function createWarnScope(): WarnScope {
+  return { warned: new Set() };
+}
+
+// Module-level fallback for call sites that don't pass an explicit render scope.
+const _globalWarned = new Set<string>();
+
+export function warnOnce(key: string, logger: Logger, msg: string, scope?: WarnScope): void {
+  const set = scope ? scope.warned : _globalWarned;
+  if (!set.has(key)) {
+    set.add(key);
     logger.warn(msg);
   }
 }
 
 /** @internal Test isolation only. Not exported from the package public facade. */
 export function resetWarnOnceForTests(): void {
-  _warned.clear();
+  _globalWarned.clear();
 }
diff --git a/packages/element/src/internal/core/render-ir.ts b/packages/element/src/internal/core/render-ir.ts
index b66b34033..e32627419 100644
--- a/packages/element/src/internal/core/render-ir.ts
+++ b/packages/element/src/internal/core/render-ir.ts
@@ -14,7 +14,7 @@ import {
   serializeEventMarkers,
   showBranchMarker,
 } from './event-marker.ts';
-import { FOR_TAG, Fragment, HTML_TAG, SHOW_TAG } from './jsx-runtime.ts';
+import { FOR_TAG, HTML_TAG, isFragment, SHOW_TAG } from './jsx-runtime.ts';
 import { injectPropsSafe, trustRenderHtml } from './security.ts';
 import { isSignalLike, resolveSignalProp, unwrapSignalLike } from '../signal/index.ts';
 import { isComponentCtor, isComponentFn, isVNode } from './vnode.ts';
@@ -212,9 +212,7 @@ export async function renderToNode(
   const { tag, props, children } = node;
 
   // Fragment
-  if (
-    tag === Fragment || (typeof tag === 'symbol' && String(tag) === 'Symbol(openelement.fragment)')
-  ) {
+  if (isFragment(tag)) {
     const parts: RenderNode[] = [];
     for (const child of children) parts.push(await renderToNode(child, eventContext, nestingDepth));
     return fragmentNode(parts);
diff --git a/packages/element/src/open-element-implementation.ts b/packages/element/src/open-element-implementation.ts
index 9c293fb11..bc21d6b31 100644
--- a/packages/element/src/open-element-implementation.ts
+++ b/packages/element/src/open-element-implementation.ts
@@ -162,6 +162,14 @@ export class OpenElement extends _Base {
   /** Rendering mode. Defaults to shadow/DSD; light DOM is explicit opt-in. */
   static renderMode?: 'shadow' | 'light';
 
+  /**
+   * Locale hint for the element, e.g. 'en' or 'zh-CN'.
+   * Set by SSR injectProps (camelCase JS property) or the `locale` HTML
+   * attribute; resolved by `_getLocale()`. Declared on the base class so the
+   * property is typed instead of cast through `Record<string, unknown>`.
+   */
+  locale?: string;
+
   /** v0.25.0: Page head metadata. SSG reads this to inject <title> and <meta> tags. */
   static head?: { title?: string; description?: string; ogImage?: string };
 
@@ -596,7 +604,7 @@ export class OpenElement extends _Base {
    * @param fallback - Default value when neither source has a value. Defaults to 'en'.
    */
   protected _getLocale(fallback = 'en'): string {
-    const prop = (this as Record<string, unknown>).locale;
+    const prop = this.locale;
     if (typeof prop === 'string' && prop) return prop;
     return this.getAttribute('locale') || fallback;
   }
diff --git a/packages/ui/__tests__/open-button-click.test.ts b/packages/ui/__tests__/open-button-click.test.ts
new file mode 100644
index 000000000..5e56a0d4b
--- /dev/null
+++ b/packages/ui/__tests__/open-button-click.test.ts
@@ -0,0 +1,170 @@
+/**
+ * @openelement/ui - open-button click behavior tests (#637).
+ *
+ * Self-contained minimal DOM harness so the test does not depend on the larger
+ * components.test.ts harness ordering. open-button is imported dynamically after
+ * the harness is installed so OpenElement captures the fake HTMLElement base.
+ */
+import { assertEquals } from 'jsr:@std/assert@^1.0.0';
+
+function installMinimalDom(): void {
+  if (typeof (globalThis as { HTMLElement?: unknown }).HTMLElement !== 'undefined') return;
+
+  class FakeHTMLElement {
+    #attrs = new Map<string, string>();
+    _internals: { form: FakeForm | null } | null = null;
+    shadowRoot = null;
+    constructor() {}
+    getAttribute(name: string): string | null {
+      return this.#attrs.get(name) ?? null;
+    }
+    setAttribute(name: string, value: string): void {
+      this.#attrs.set(name, value);
+    }
+    hasAttribute(name: string): boolean {
+      return this.#attrs.has(name);
+    }
+    removeAttribute(name: string): void {
+      this.#attrs.delete(name);
+    }
+    closest(_sel: string): unknown {
+      return null;
+    }
+    dispatchEvent(event: Event): boolean {
+      const type = event.type;
+      const store =
+        (this as unknown as { __listeners?: Map<string, Set<EventListener>> }).__listeners;
+      const ls = store?.get(type);
+      if (ls) { for (const l of ls) l.call(this, event); }
+      return true;
+    }
+    addEventListener(type: string, listener: EventListener): void {
+      const self = this as unknown as { __listeners?: Map<string, Set<EventListener>> };
+      if (!self.__listeners) self.__listeners = new Map();
+      let s = self.__listeners.get(type);
+      if (!s) {
+        s = new Set();
+        self.__listeners.set(type, s);
+      }
+      s.add(listener);
+    }
+    removeEventListener(): void {}
+    attachInternals(): { form: FakeForm | null } {
+      this._internals = { form: null };
+      return this._internals;
+    }
+    querySelector(): Element | null {
+      return null;
+    }
+    querySelectorAll(): NodeListOf<Element> {
+      return [] as unknown as NodeListOf<Element>;
+    }
+  }
+
+  (globalThis as { HTMLElement?: unknown }).HTMLElement = FakeHTMLElement;
+  (globalThis as { document?: unknown }).document = {
+    documentElement: { dataset: {}, getAttribute: () => null, setAttribute: () => {} },
+    createElement: () => new FakeHTMLElement(),
+    querySelector: () => null,
+    querySelectorAll: () => [],
+    body: new FakeHTMLElement(),
+    head: new FakeHTMLElement(),
+    addEventListener: () => {},
+    removeEventListener: () => {},
+    dispatchEvent: () => true,
+  };
+}
+
+interface FakeForm {
+  tagName: string;
+  dispatchEvent(event: Event): boolean;
+  reset(): void;
+  requestSubmit?: () => void;
+  submit?: () => void;
+}
+
+interface VNodeLike {
+  tag?: unknown;
+  props: Record<string, unknown>;
+  children: unknown[];
+}
+
+interface OpenButtonLike {
+  _handleClick: (e: Event) => void;
+  render: () => VNodeLike;
+  setAttribute: (n: string, v: string) => void;
+  removeAttribute: (n: string) => void;
+  _internals: { form: FakeForm | null } | null;
+  closest: (sel: string) => unknown;
+}
+
+function findByTag(node: unknown, tag: string): VNodeLike | undefined {
+  if (!node || typeof node !== 'object') return undefined;
+  const n = node as VNodeLike;
+  if (n.tag === tag) return n;
+  for (const child of n.children ?? []) {
+    const found = findByTag(child, tag);
+    if (found) return found;
+  }
+  return undefined;
+}
+
+installMinimalDom();
+
+const { OpenButton } = await import('../src/open-button.tsx');
+
+Deno.test('open-button onClick wiring uses a single handler reference for both branches (#637 异味②)', () => {
+  const btn = new (OpenButton as unknown as new () => OpenButtonLike)() as OpenButtonLike;
+
+  // Button branch (no href): onClick must be the same handler reference.
+  btn.removeAttribute('href');
+  const buttonNode = findByTag(btn.render(), 'button');
+  assertEquals(buttonNode?.props.onClick, btn._handleClick);
+
+  // Anchor branch (href present): onClick must also be the same handler reference.
+  btn.setAttribute('href', '/go');
+  const anchorNode = findByTag(btn.render(), 'a');
+  assertEquals(anchorNode?.props.onClick, btn._handleClick);
+});
+
+Deno.test('open-button submit/reset dispatch, and href branch never submits a form (#637)', () => {
+  const btn = new (OpenButton as unknown as new () => OpenButtonLike)() as OpenButtonLike;
+
+  const submits: string[] = [];
+  const resets: number[] = [];
+  const fakeForm: FakeForm = {
+    tagName: 'FORM',
+    dispatchEvent: (e: Event) => {
+      submits.push(e.type);
+      return true;
+    },
+    reset: () => {
+      resets.push(1);
+    },
+    requestSubmit: () => {},
+    submit: () => {},
+  };
+  btn._internals = { form: fakeForm };
+  btn.closest = () => null;
+
+  // submit
+  btn.removeAttribute('href');
+  btn.setAttribute('type', 'submit');
+  btn._handleClick(new Event('click'));
+  assertEquals(submits, ['submit']);
+
+  // reset
+  submits.length = 0;
+  btn.setAttribute('type', 'reset');
+  btn._handleClick(new Event('click'));
+  assertEquals(resets, [1]);
+
+  // href branch must NOT submit or reset
+  submits.length = 0;
+  resets.length = 0;
+  btn.setAttribute('href', '/go');
+  btn.setAttribute('type', 'submit');
+  btn._handleClick(new Event('click'));
+  assertEquals(submits.length, 0);
+  assertEquals(resets.length, 0);
+});
diff --git a/packages/ui/deno.json b/packages/ui/deno.json
index 74485fc6d..02050448e 100644
--- a/packages/ui/deno.json
+++ b/packages/ui/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/ui",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "exports": {
     ".": "./src/index.ts",
     "./open-button": "./src/open-button.tsx",
@@ -37,6 +37,9 @@
     "dist"
   ],
   "tasks": {
-    "build": "deno check src/index.ts"
+    "build": "deno check src/index.ts",
+    "test": "deno test -A",
+    "lint": "deno lint src/ __tests__/",
+    "typecheck": "deno check src/index.ts"
   }
 }
diff --git a/packages/ui/src/generated-manifest.json b/packages/ui/src/generated-manifest.json
index 84682681b..f2c9b3584 100644
--- a/packages/ui/src/generated-manifest.json
+++ b/packages/ui/src/generated-manifest.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "packageName": "@openelement/ui",
-  "version": "0.42.0-alpha.8",
+  "version": "0.42.0-alpha.9",
   "description": "Open Props Web Component library for openElement",
   "author": "openElement",
   "license": "MIT",
diff --git a/packages/ui/src/open-badge.tsx b/packages/ui/src/open-badge.tsx
index 059af6350..8c344aa2d 100644
--- a/packages/ui/src/open-badge.tsx
+++ b/packages/ui/src/open-badge.tsx
@@ -87,5 +87,3 @@ export class OpenBadge extends OpenElement {
     return this.getAttribute(attr) || def;
   }
 }
-
-export default OpenBadge;
diff --git a/packages/ui/src/open-button.tsx b/packages/ui/src/open-button.tsx
index ea6cd4116..e29811ce5 100644
--- a/packages/ui/src/open-button.tsx
+++ b/packages/ui/src/open-button.tsx
@@ -175,7 +175,7 @@ export class OpenButton extends OpenElement {
         part='control'
         disabled={d}
         type={type}
-        onClick={(e: Event) => this._handleClick(e)}
+        onClick={this._handleClick}
       >
         <slot></slot>
       </button>
@@ -229,56 +229,70 @@ export class OpenButton extends OpenElement {
     }
   }
 
-  private _handleClick(_e: Event): void {
+  private _handleClick = (_e: Event): void => {
     this.dispatchEvent(new CustomEvent('open-click', { bubbles: true, composed: true }));
 
+    // An <a> (href) branch is a navigation control, not a form control — it must
+    // never submit/reset a form (异味③, #637). Only the <button> branch may
+    // trigger form submission below.
+    if (this.hasAttribute('href')) return;
+
     // Form submission: when type="submit" or type="reset" and this element is
     // associated with a <form> (via formAssociated), the inner <button> lives
     // inside the shadow DOM and its native submit/reset behavior does NOT
     // reach the outer form. We must explicitly trigger it here.
-    //
-    // Critical: the native 'submit' event is NOT composed (it does not cross
-    // shadow boundaries). open-button typically lives inside another custom
-    // element's shadow root (e.g. <reader-reading>), so a natively submitted
-    // form would never reach the SPA's root listener. We re-dispatch a
-    // composed, cancelable submit event on the form so the SPA's delegated
-    // handler (bound on #root) can intercept it; at that listener
-    // event.target is retargeted to this host, so the handler locates the
-    // form through event.composedPath() (see spa.ts handleFormSubmit).
     const type = this.getAttribute('type') || 'button';
     // formAssociated internals.form is only available when attached to DOM.
     // Fall back to closest('form') for elements without _internals (test env).
     const form = this._internals?.form ?? closestForm(this);
     if (!form) return;
     if (type === 'submit') {
-      // SubmitEvent may be unavailable in older runtimes; fall back to Event.
-      const SubmitEventCtor = (globalThis as { SubmitEvent?: typeof SubmitEvent })
-        .SubmitEvent;
-      const submitEvent: Event = SubmitEventCtor
-        ? new SubmitEventCtor('submit', {
-          bubbles: true,
-          cancelable: true,
-          composed: true,
-        })
-        : new Event('submit', { bubbles: true, cancelable: true, composed: true });
-      form.dispatchEvent(submitEvent);
-      // If the SPA prevented default, the action was handled — do NOT call
-      // requestSubmit() (which would cause native form GET navigation).
-      if (!submitEvent.defaultPrevented) {
-        const formEl = form as HTMLFormElement & {
-          requestSubmit?: () => void;
-          submit: () => void;
-        };
-        if (typeof formEl.requestSubmit === 'function') {
-          formEl.requestSubmit();
-        } else {
-          formEl.submit();
-        }
-      }
+      this._submitForm(form);
     } else if (type === 'reset') {
-      (form as HTMLFormElement).reset();
+      this._resetForm(form);
+    }
+  };
+
+  /**
+   * Submit `form` on behalf of this element (v0.42.0-alpha.9, #637).
+   *
+   * Critical: the native 'submit' event is NOT composed (it does not cross
+   * shadow boundaries). open-button typically lives inside another custom
+   * element's shadow root (e.g. <reader-reading>), so a natively submitted
+   * form would never reach the SPA's root listener. We re-dispatch a
+   * composed, cancelable submit event on the form so the SPA's delegated
+   * handler (bound on #root) can intercept it; at that listener
+   * event.target is retargeted to this host, so the handler locates the
+   * form through event.composedPath() (see spa.ts handleFormSubmit).
+   */
+  private _submitForm(form: HTMLFormElement): void {
+    // SubmitEvent may be unavailable in older runtimes; fall back to Event.
+    const SubmitEventCtor = (globalThis as { SubmitEvent?: typeof SubmitEvent }).SubmitEvent;
+    const submitEvent: Event = SubmitEventCtor
+      ? new SubmitEventCtor('submit', {
+        bubbles: true,
+        cancelable: true,
+        composed: true,
+      })
+      : new Event('submit', { bubbles: true, cancelable: true, composed: true });
+    form.dispatchEvent(submitEvent);
+    // If the SPA prevented default, the action was handled — do NOT call
+    // requestSubmit() (which would cause native form GET navigation).
+    if (!submitEvent.defaultPrevented) {
+      const formEl = form as HTMLFormElement & {
+        requestSubmit?: () => void;
+        submit: () => void;
+      };
+      if (typeof formEl.requestSubmit === 'function') {
+        formEl.requestSubmit();
+      } else {
+        formEl.submit();
+      }
     }
   }
-}
 
-export default OpenButton;
+  /** Reset `form` on behalf of this element (v0.42.0-alpha.9, #637). */
+  private _resetForm(form: HTMLFormElement): void {
+    form.reset();
+  }
+}
diff --git a/packages/ui/src/open-callout.tsx b/packages/ui/src/open-callout.tsx
index 484ba9495..0366780d3 100644
--- a/packages/ui/src/open-callout.tsx
+++ b/packages/ui/src/open-callout.tsx
@@ -90,5 +90,3 @@ export class OpenCallout extends OpenElement {
   }
   private _esc = escapeHtml;
 }
-
-export default OpenCallout;
diff --git a/packages/ui/src/open-card.tsx b/packages/ui/src/open-card.tsx
index 633dbe447..c25bdcae2 100644
--- a/packages/ui/src/open-card.tsx
+++ b/packages/ui/src/open-card.tsx
@@ -103,5 +103,3 @@ export class OpenCard extends OpenElement {
     );
   }
 }
-
-export default OpenCard;
diff --git a/packages/ui/src/open-code-block.tsx b/packages/ui/src/open-code-block.tsx
index af5bd3af6..66c10d38c 100644
--- a/packages/ui/src/open-code-block.tsx
+++ b/packages/ui/src/open-code-block.tsx
@@ -275,5 +275,3 @@ export class OpenCodeBlock extends OpenElement {
     else btn.textContent = 'Copy';
   }
 }
-
-export default OpenCodeBlock;
diff --git a/packages/ui/src/open-dialog.tsx b/packages/ui/src/open-dialog.tsx
index 3d94629d2..74727209b 100644
--- a/packages/ui/src/open-dialog.tsx
+++ b/packages/ui/src/open-dialog.tsx
@@ -217,5 +217,3 @@ export class OpenDialog extends OpenElement {
 
   private _esc = escapeHtml;
 }
-
-export default OpenDialog;
diff --git a/packages/ui/src/open-dropdown.tsx b/packages/ui/src/open-dropdown.tsx
index 5601e1ffc..aa1d28446 100644
--- a/packages/ui/src/open-dropdown.tsx
+++ b/packages/ui/src/open-dropdown.tsx
@@ -80,5 +80,3 @@ export class OpenDropdown extends OpenElement {
     );
   }
 }
-
-export default OpenDropdown;
diff --git a/packages/ui/src/open-input.tsx b/packages/ui/src/open-input.tsx
index d07e95aa4..0bc3c7e9d 100644
--- a/packages/ui/src/open-input.tsx
+++ b/packages/ui/src/open-input.tsx
@@ -259,5 +259,3 @@ export class OpenInput extends OpenElement {
 
   private _esc = escapeHtml;
 }
-
-export default OpenInput;
diff --git a/packages/ui/src/open-tabs.tsx b/packages/ui/src/open-tabs.tsx
index 99f1529f5..de464702f 100644
--- a/packages/ui/src/open-tabs.tsx
+++ b/packages/ui/src/open-tabs.tsx
@@ -45,4 +45,3 @@ export class OpenTabs extends OpenElement {
     );
   }
 }
-export default OpenTabs;
diff --git a/packages/ui/src/open-theme-toggle.tsx b/packages/ui/src/open-theme-toggle.tsx
index a76a6fcdd..4a779fb8b 100644
--- a/packages/ui/src/open-theme-toggle.tsx
+++ b/packages/ui/src/open-theme-toggle.tsx
@@ -238,5 +238,3 @@ export class OpenThemeToggle extends OpenElement {
     }
   }
 }
-
-export default OpenThemeToggle;
diff --git a/tools/project-constants.ts b/tools/project-constants.ts
index 9e004e772..36be170e2 100644
--- a/tools/project-constants.ts
+++ b/tools/project-constants.ts
@@ -1,6 +1,6 @@
-export const PACKAGE_VERSION = '0.42.0-alpha.8';
+export const PACKAGE_VERSION = '0.42.0-alpha.9';
 export const PACKAGE_VERSION_TAG = `v${PACKAGE_VERSION}`;
-export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.8';
+export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.9';
 export const RETAINED_PACKAGE_NAMES = Object.freeze([
   '@openelement/adapter-vite',
   '@openelement/app',
@@ -49,7 +49,7 @@ export const NITRO_COMPATIBILITY_DATE = '2026-06-12';
 // single source of truth for the "from" side of version-anchor replacements
 // (see buildVersionAnchorReplacements in tools/autoflow/release.ts). It is
 // kept in sync automatically by updateProjectConstants() during a bump.
-export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.7';
+export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.8';
 export const PREVIOUS_PACKAGE_VERSION_TAG = `v${PREVIOUS_PACKAGE_VERSION}`;
 
 // The theme the www roadmap current-line timeline entry carried immediately
diff --git a/www/app/data/version.ts b/www/app/data/version.ts
index a7cb282d3..0e7e4b3c5 100644
--- a/www/app/data/version.ts
+++ b/www/app/data/version.ts
@@ -1,2 +1,2 @@
 // Current published package line. Release tooling owns the next bump.
-export const OPENELEMENT_VERSION = 'v0.42.0-alpha.8';
+export const OPENELEMENT_VERSION = 'v0.42.0-alpha.9';
diff --git a/www/app/routes/roadmap.tsx b/www/app/routes/roadmap.tsx
index 3d8a9d847..d58cbd9f1 100644
--- a/www/app/routes/roadmap.tsx
+++ b/www/app/routes/roadmap.tsx
@@ -332,10 +332,10 @@ type TimelineEntry = {
 
 const entries: TimelineEntry[] = [
   {
-    version: 'v0.42.0-alpha.8',
-    theme: 'light fullstack floor',
+    version: 'v0.42.0-alpha.9',
+    theme: 'audit-to-plan execution',
     copy:
-      'The ADR-0121 action protocol hardens with throw redirect semantics, CSRF same-origin enforcement, per-form sequence tokens, and a GDS-inspired action contract. Fixes 22 items from the fullstack floor pledge.',
+      'The independent audit converts into an executable remediation plan: 13 tracked issues (#632–#644) close across the action protocol, islands hydration, and the version-truth CI gate that keeps docs, packages and build output in lockstep.',
     state: 'stable',
     stamp: 'CURRENT',
   },
@@ -427,7 +427,7 @@ export class RoadmapPage extends OpenElement {
               {entries.map((phase) => {
                 // The current-line stamp follows the bump-maintained anchor so a
                 // release bump re-marks the timeline without manual edits.
-                const stamp = phase.version === 'v0.42.0-alpha.8' ? 'CURRENT' : phase.stamp;
+                const stamp = phase.version === 'v0.42.0-alpha.9' ? 'CURRENT' : phase.stamp;
                 return (
                   <div class={`tl-row tl-${phase.state}`}>
                     <span class='tl-node' aria-hidden='true'></span>
diff --git a/www/e2e/browser-bundle.ts b/www/e2e/browser-bundle.ts
index fdce31458..2dd02181a 100644
--- a/www/e2e/browser-bundle.ts
+++ b/www/e2e/browser-bundle.ts
@@ -9,6 +9,17 @@
 
 import { build } from 'vite';
 import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+
+// The SPA/router sources import '@openelement/element' at runtime (`createLogger`,
+// and JSX via jsx-runtime). The e2e bare bundle runs with `configFile: false`, so it
+// does not inherit the workspace alias that the real www build gets from
+// adapter-vite's Vite plugin. Mirror that alias here so Rolldown can resolve the
+// package from source. See www/vite.config.ts and packages/adapter-vite workspace-alias.
+const ELEMENT_ENTRY = fileURLToPath(
+  new URL('../../packages/element/src/index.ts', import.meta.url),
+);
+const ELEMENT_DIR = fileURLToPath(new URL('../../packages/element/src', import.meta.url));
 
 const bundleCache = new Map<string, Promise<string>>();
 
@@ -21,6 +32,13 @@ export function bundleModuleForBrowser(entry: URL): Promise<string> {
       const result = await build({
         logLevel: 'silent',
         configFile: false,
+        resolve: {
+          alias: {
+            '@openelement/element': ELEMENT_ENTRY,
+            '@openelement/element/jsx-runtime': resolve(ELEMENT_DIR, 'jsx-runtime.ts'),
+          },
+        },
+        esbuild: { jsx: 'automatic', jsxImportSource: '@openelement/element' },
         build: {
           write: false,
           minify: false,
diff --git a/www/e2e/hydration-behavior.spec.ts b/www/e2e/hydration-behavior.spec.ts
index 293fe9ddd..b55d9b56d 100644
--- a/www/e2e/hydration-behavior.spec.ts
+++ b/www/e2e/hydration-behavior.spec.ts
@@ -309,8 +309,11 @@ test.describe('open-button form piercing', () => {
       // Island chunks wrapped by the runtime expose a `.t` namespace; plain
       // ui-package chunks (like open-button) export the class directly.
       const ns = mod.t as { default?: CustomElementConstructor } | undefined;
-      const ButtonCtor = ns?.default ?? (mod.default as CustomElementConstructor | undefined);
-      if (!ButtonCtor) return { error: 'open-button chunk has no default export' };
+      // #638: package island chunks dropped `export default`; the constructor
+      // is exported under the CEM class name `OpenButton`.
+      const ButtonCtor = (mod as Record<string, CustomElementConstructor | undefined>).OpenButton ??
+        ns?.default ?? (mod.default as CustomElementConstructor | undefined);
+      if (!ButtonCtor) return { error: 'open-button chunk has no OpenButton export' };
       if (!customElements.get('open-button')) {
         customElements.define('open-button', ButtonCtor);
       }