From e68c43522b8d665c0add9e20ce44f55547b2b2c0 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 09:54:28 +0300
Subject: [PATCH 1/8] Update Jint to 4.15.3

---
 src/JsxCore/JsxCore.csproj | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/JsxCore/JsxCore.csproj b/src/JsxCore/JsxCore.csproj
index 479461a..3c3a2a5 100644
--- a/src/JsxCore/JsxCore.csproj
+++ b/src/JsxCore/JsxCore.csproj
@@ -64,7 +64,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Jint" Version="4.15.1" />
+    <PackageReference Include="Jint" Version="4.15.3" />
   </ItemGroup>
 
   <!--

From a664e4e14de24936233bccbd49c292056b752880 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 09:57:11 +0300
Subject: [PATCH 2/8] Parse each module once per build, not once per pooled
 engine

---
 src/JsxCore/Rendering/JsxModuleLoader.cs   | 47 ++++++++++++++++++----
 src/JsxCore/Rendering/JsxServerRenderer.cs | 19 ++++++---
 src/JsxCore/Rendering/ServerModuleCache.cs | 26 ++++++++++++
 3 files changed, 80 insertions(+), 12 deletions(-)
 create mode 100644 src/JsxCore/Rendering/ServerModuleCache.cs

diff --git a/src/JsxCore/Rendering/JsxModuleLoader.cs b/src/JsxCore/Rendering/JsxModuleLoader.cs
index b9ee05d..dd3467f 100644
--- a/src/JsxCore/Rendering/JsxModuleLoader.cs
+++ b/src/JsxCore/Rendering/JsxModuleLoader.cs
@@ -32,11 +32,22 @@ public sealed class JsxModuleLoader : IModuleLoader
     private readonly JsxRuntimeLayout _runtime;
     private readonly string? _runtimeAssetDirectory;
     private readonly NodeModuleResolver? _npm;
+    private readonly ServerModuleCache? _modules;
 
     public JsxModuleLoader(CompilationLayout layout, JsxRuntimeLayout runtime, NodeModuleResolver? npm = null)
+        : this(layout, runtime, npm, modules: null)
+    {
+    }
+
+    internal JsxModuleLoader(
+        CompilationLayout layout,
+        JsxRuntimeLayout runtime,
+        NodeModuleResolver? npm,
+        ServerModuleCache? modules)
     {
         ArgumentNullException.ThrowIfNull(layout);
         _npm = npm;
+        _modules = modules;
         _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
         _outputDirectory = Path.GetFullPath(layout.OutputDirectory);
         _runtimeDirectory = Path.GetFullPath(layout.RuntimeDirectory);
@@ -142,8 +153,18 @@ public Module LoadModule(Engine engine, ResolvedSpecifier resolved)
             return LoadPackageModule(engine, resolved);
         }
 
-        var source = ReadSource(resolved.Key);
-        return ModuleFactory.BuildSourceTextModule(engine, resolved, source, new ModuleParsingOptions());
+        if (_modules is null)
+        {
+            var source = ReadSource(resolved.Key);
+            return ModuleFactory.BuildSourceTextModule(engine, resolved, source, new ModuleParsingOptions());
+        }
+
+        // The name the engine gives back as the referencing location when this module's own
+        // relative imports are resolved, so it has to be the one the engine would have derived
+        // from the resolved specifier itself.
+        var location = resolved.Uri?.LocalPath ?? resolved.Key;
+        var prepared = _modules.GetOrParse(location, () => ReadSource(resolved.Key));
+        return ModuleFactory.BuildSourceTextModule(engine, in prepared);
     }
 
     private string ReadSource(string path)
@@ -188,8 +209,8 @@ private Module LoadPackageModule(Engine engine, ResolvedSpecifier resolved)
             throw new JsxCoreException($"JsxCore could not read the package module '{path}'.");
         }
 
-        var source = File.ReadAllText(path);
-        var kind = _npm!.KindOf(path);
+        var npm = _npm!;
+        var kind = npm.KindOf(path);
 
         // JSON keeps the engine's own module type rather than being re-expressed as
         // "export default <json>". The two are not equivalent, and not in a harmless direction:
@@ -199,11 +220,23 @@ private Module LoadPackageModule(Engine engine, ResolvedSpecifier resolved)
         // which is why the two hosts differ here, and only here.
         if (kind == NodeModuleKind.Json)
         {
-            return ModuleFactory.BuildJsonModule(engine, resolved, source);
+            return ModuleFactory.BuildJsonModule(engine, resolved, File.ReadAllText(path));
         }
 
-        var shaped = ModuleTransform.Apply(path, kind, source, new EngineSpecifierRewriter(_npm));
-        return ModuleFactory.BuildSourceTextModule(engine, resolved, shaped.Source, new ModuleParsingOptions());
+        if (_modules is null)
+        {
+            var shaped = ModuleTransform.Apply(path, kind, File.ReadAllText(path), new EngineSpecifierRewriter(npm));
+            return ModuleFactory.BuildSourceTextModule(engine, resolved, shaped.Source, new ModuleParsingOptions());
+        }
+
+        // What is cached is the module as the engine sees it, after the CommonJS wrapping, so a
+        // second engine pays for neither the read nor the transform.
+        var location = resolved.Uri?.LocalPath ?? resolved.Key;
+        var prepared = _modules.GetOrParse(
+            location,
+            () => ModuleTransform.Apply(path, kind, File.ReadAllText(path), new EngineSpecifierRewriter(npm)).Source);
+
+        return ModuleFactory.BuildSourceTextModule(engine, in prepared);
     }
 
 }
diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index ff2db23..caa6ec4 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -18,8 +18,9 @@ namespace JsxCore.Rendering;
 /// <remarks>
 /// <para>
 /// Engines are not thread-safe, so they are pooled and rented for the duration of a render. A
-/// pooled engine keeps its parsed module graph, which is what makes repeat renders cheap; engines
-/// built against a superseded compilation are discarded rather than reused.
+/// pooled engine keeps its module graph, which is what makes repeat renders cheap, and the parsed
+/// modules behind it are shared by the whole pool, so growing the pool costs no extra parsing.
+/// Engines built against a superseded compilation are discarded rather than reused.
 /// </para>
 /// <para>
 /// General CLR access is deliberately never enabled. The only .NET reachable from a view is what
@@ -38,6 +39,7 @@ public sealed class JsxServerRenderer(
     private readonly JsxRuntimeLayout _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
     private readonly NodeModuleResolver? _npm = npm;
     private readonly ConcurrentBag<PooledEngine> _pool = [];
+    private readonly BuildScopedCache<ServerModuleCache> _moduleCache = new();
     private readonly SemaphoreSlim _slots = new(Math.Max(1, options.ServerRendering.MaxPooledEngines));
     private bool _disposed;
 
@@ -195,7 +197,7 @@ private PooledEngine Rent(string buildId)
             Discard(candidate);
         }
 
-        return new PooledEngine(CreateEngine(), buildId);
+        return new PooledEngine(CreateEngine(buildId), buildId);
     }
 
     private void Return(PooledEngine engine)
@@ -230,9 +232,14 @@ private static void Discard(PooledEngine engine)
         }
     }
 
-    private Engine CreateEngine()
+    private Engine CreateEngine(string buildId)
     {
-        var loader = new JsxModuleLoader(_compilation.Layout, _runtime, _options.AllowNodeModules ? _npm : null);
+        var loader = new JsxModuleLoader(
+            _compilation.Layout,
+            _runtime,
+            _options.AllowNodeModules ? _npm : null,
+            _moduleCache.Get(buildId, static () => new ServerModuleCache()));
+
         var settings = _options.ServerRendering;
 
         var engine = new Engine(options =>
@@ -282,6 +289,8 @@ public void Reset()
         {
             Discard(engine);
         }
+
+        _moduleCache.Clear();
     }
 
     public void Dispose()
diff --git a/src/JsxCore/Rendering/ServerModuleCache.cs b/src/JsxCore/Rendering/ServerModuleCache.cs
new file mode 100644
index 0000000..745e8fd
--- /dev/null
+++ b/src/JsxCore/Rendering/ServerModuleCache.cs
@@ -0,0 +1,26 @@
+using System.Collections.Concurrent;
+using Jint;
+using AstModule = Acornima.Ast.Module;
+
+namespace JsxCore.Rendering;
+
+/// <summary>
+/// Modules parsed once and shared by every pooled engine rendering one compilation. A pooled
+/// engine keeps its own module graph; this keeps the parsing from being repeated when the pool
+/// grows, or refills after a rebuild.
+/// </summary>
+/// <remarks>
+/// A pool fills under a burst of requests, and the engines it builds walk the same modules in the
+/// same order — so the natural race is every engine parsing every module and all but one result
+/// being thrown away. The <see cref="Lazy{T}"/> holds that door: whoever asks first parses, and
+/// the rest wait for that result instead of duplicating it.
+/// </remarks>
+internal sealed class ServerModuleCache
+{
+    private readonly ConcurrentDictionary<string, Lazy<Prepared<AstModule>>> _modules = new(StringComparer.Ordinal);
+
+    public Prepared<AstModule> GetOrParse(string location, Func<string> readSource) =>
+        _modules.GetOrAdd(
+            location,
+            l => new Lazy<Prepared<AstModule>>(() => Engine.PrepareModule(readSource(), l))).Value;
+}

From 82e12d7f141a4f0dbaf48a68814e05e675358088 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:01:47 +0300
Subject: [PATCH 3/8] Stop re-parsing the host shims and per-render scaffolding

---
 src/JsxCore/Rendering/JsxServerRenderer.cs | 41 +++++++++++++++-------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index caa6ec4..1f9e700 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -1,13 +1,14 @@
 using System.Collections.Concurrent;
 using System.Text.Json;
+using Acornima.Ast;
 using Jint;
 using Jint.Native;
-using Jint.Native.Object;
 using Jint.Runtime;
 using Jint.Runtime.Interop;
 using JsxCore.Compilation;
 using JsxCore.Compilation.Assets;
 using JsxCore.Compilation.Modules;
+using JsonParser = Jint.Native.Json.JsonParser;
 
 namespace JsxCore.Rendering;
 
@@ -127,9 +128,7 @@ private ServerRenderResult Render(
         {
             InstallGlobals(engine, services);
 
-            engine.SetValue("__jsxcore_payload", payload);
-            var props = engine.Evaluate("JSON.parse(__jsxcore_payload)").AsObject();
-            engine.SetValue("__jsxcore_payload", JsValue.Undefined);
+            var props = new JsonParser(engine).Parse(payload).AsObject();
 
             var server = engine.Modules.Import(_runtime.ServerEntrySpecifier);
             var module = engine.Modules.Import("./" + view.ModuleRelativePath);
@@ -175,7 +174,7 @@ private void InstallGlobals(Engine engine, IServiceProvider services)
             return;
         }
 
-        var globals = engine.Evaluate("({})").AsObject();
+        var globals = new JsObject(engine);
         foreach (var (name, registration) in registrations)
         {
             globals.Set(name, JsValue.FromObject(engine, registration.Factory(services)));
@@ -232,6 +231,29 @@ private static void Discard(PooledEngine engine)
         }
     }
 
+    /// <summary>
+    /// The host shims, parsed once for the process rather than once per engine.
+    /// </summary>
+    /// <remarks>
+    /// Every engine runs exactly this text, so parsing it again for each of them bought nothing.
+    /// The text itself is decoded out of the assembly on each read, which this saves as well.
+    /// </remarks>
+    private static readonly Lazy<Prepared<Script>> HostShims =
+        new(static () => Engine.PrepareScript(RuntimeAssets.HostShims, source: "host-shims.js"));
+
+    /// <summary>
+    /// Exposes both the exact .NET name and a camelCase alias, so a C# <c>Greet</c> method can be
+    /// called as either <c>Greet()</c> or <c>greet()</c> without the caller having to know.
+    /// </summary>
+    /// <remarks>
+    /// One resolver for all of them: it remembers the members it has already looked up, and every
+    /// engine built here is configured the same way, so there is nothing to keep apart.
+    /// </remarks>
+    private static readonly TypeResolver CamelCaseResolver = new()
+    {
+        MemberNameCreator = MemberNames
+    };
+
     private Engine CreateEngine(string buildId)
     {
         var loader = new JsxModuleLoader(
@@ -250,18 +272,13 @@ private Engine CreateEngine(string buildId)
 
             if (settings.ExposeCamelCaseMembers)
             {
-                // Expose both the exact .NET name and a camelCase alias, so a C# `Greet` method can
-                // be called as either `Greet()` or `greet()` without the caller having to know.
-                options.Interop.TypeResolver = new TypeResolver
-                {
-                    MemberNameCreator = MemberNames
-                };
+                options.Interop.TypeResolver = CamelCaseResolver;
             }
         });
 
         // Before anything is imported: a package that expects a browser or Node global reads it
         // while its own module body runs, so there is no later point at which this would work.
-        engine.Execute(RuntimeAssets.HostShims);
+        engine.Execute(HostShims.Value);
 
         // Which pass is running, stated on its own rather than inferred from whether any .NET
         // objects were registered. An application that registers none is still server rendering,

From 73ebcfc557bd94a0b6b95b27548ca5c423f2c9f2 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:07:19 +0300
Subject: [PATCH 4/8] Serialize the model and context once per response

---
 src/JsxCore/Rendering/JsxServerRenderer.cs | 52 +++++++++++++++++-----
 src/JsxCore/Rendering/JsxViewRenderer.cs   | 26 ++++++-----
 2 files changed, 57 insertions(+), 21 deletions(-)

diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index 1f9e700..7659c58 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -56,7 +56,7 @@ public Task<ServerRenderResult> RenderAsync(
         IReadOnlyDictionary<string, object?> context,
         IServiceProvider services,
         CancellationToken cancellationToken = default) =>
-        ExecuteAsync(view, model, context, services, "renderView", cancellationToken);
+        ExecuteAsync(view, Serialize(model), Serialize(context), services, "renderView", cancellationToken);
 
     /// <summary>
     /// Evaluates only a view's <c>head</c> export, without running the component.
@@ -72,12 +72,42 @@ public Task<ServerRenderResult> ReadHeadAsync(
         IReadOnlyDictionary<string, object?> context,
         IServiceProvider services,
         CancellationToken cancellationToken = default) =>
-        ExecuteAsync(view, model, context, services, "readHead", cancellationToken);
+        ExecuteAsync(view, Serialize(model), Serialize(context), services, "readHead", cancellationToken);
+
+    /// <summary>
+    /// Executes a view whose model and context have already been serialised.
+    /// </summary>
+    /// <remarks>
+    /// The document around a view carries the same model and context, so a response that writes
+    /// both would otherwise serialise each of them twice. The renderer that builds the document
+    /// does it once and hands the results here.
+    /// </remarks>
+    internal Task<ServerRenderResult> RenderSerializedAsync(
+        LocatedView view,
+        string modelJson,
+        string contextJson,
+        IServiceProvider services,
+        CancellationToken cancellationToken = default) =>
+        ExecuteAsync(view, modelJson, contextJson, services, "renderView", cancellationToken);
+
+    /// <summary>
+    /// Reads a view's <c>head</c> export from an already serialised model and context.
+    /// </summary>
+    internal Task<ServerRenderResult> ReadHeadSerializedAsync(
+        LocatedView view,
+        string modelJson,
+        string contextJson,
+        IServiceProvider services,
+        CancellationToken cancellationToken = default) =>
+        ExecuteAsync(view, modelJson, contextJson, services, "readHead", cancellationToken);
+
+    private string Serialize(object? value) =>
+        JsonSerializer.Serialize(value, _options.JsonSerializerOptions);
 
     private async Task<ServerRenderResult> ExecuteAsync(
         LocatedView view,
-        object? model,
-        IReadOnlyDictionary<string, object?> context,
+        string modelJson,
+        string contextJson,
         IServiceProvider services,
         string entryPoint,
         CancellationToken cancellationToken = default)
@@ -93,10 +123,6 @@ private async Task<ServerRenderResult> ExecuteAsync(
                 new FileNotFoundException(view.ModuleRelativePath));
         }
 
-        var payload = JsonSerializer.Serialize(
-            new { model, context },
-            _options.JsonSerializerOptions);
-
         await _slots.WaitAsync(cancellationToken).ConfigureAwait(false);
         try
         {
@@ -104,7 +130,7 @@ private async Task<ServerRenderResult> ExecuteAsync(
             var pooled = Rent(buildId);
             try
             {
-                return Render(pooled.Engine, view, payload, services, entryPoint);
+                return Render(pooled.Engine, view, modelJson, contextJson, services, entryPoint);
             }
             finally
             {
@@ -120,7 +146,8 @@ private async Task<ServerRenderResult> ExecuteAsync(
     private ServerRenderResult Render(
         Engine engine,
         LocatedView view,
-        string payload,
+        string modelJson,
+        string contextJson,
         IServiceProvider services,
         string entryPoint)
     {
@@ -128,7 +155,10 @@ private ServerRenderResult Render(
         {
             InstallGlobals(engine, services);
 
-            var props = new JsonParser(engine).Parse(payload).AsObject();
+            var parser = new JsonParser(engine);
+            var props = new JsObject(engine);
+            props.Set("model", parser.Parse(modelJson));
+            props.Set("context", parser.Parse(contextJson));
 
             var server = engine.Modules.Import(_runtime.ServerEntrySpecifier);
             var module = engine.Modules.Import("./" + view.ModuleRelativePath);
diff --git a/src/JsxCore/Rendering/JsxViewRenderer.cs b/src/JsxCore/Rendering/JsxViewRenderer.cs
index e403962..f65b85d 100644
--- a/src/JsxCore/Rendering/JsxViewRenderer.cs
+++ b/src/JsxCore/Rendering/JsxViewRenderer.cs
@@ -46,19 +46,24 @@ public async Task<string> RenderAsync(JsxRenderRequest request, HttpContext http
         var context = BuildContextValues(httpContext);
         var renderMode = ResolveRenderMode(request);
 
+        // The view and the document around it are handed the same model and the same context, so
+        // both are written out once here and the two consumers share them.
+        var modelJson = JsonSerializer.Serialize(request.Model, _options.JsonSerializerOptions);
+        var contextJson = JsonSerializer.Serialize(context, _options.JsonSerializerOptions);
+
         ServerRenderResult? serverResult;
         if (renderMode is RenderMode.Server or RenderMode.ServerAndClient)
         {
-            serverResult = await _serverRenderer.RenderAsync(
+            serverResult = await _serverRenderer.RenderSerializedAsync(
                 request.View,
-                request.Model,
-                context,
+                modelJson,
+                contextJson,
                 httpContext.RequestServices,
                 httpContext.RequestAborted).ConfigureAwait(false);
         }
         else
         {
-            serverResult = await TryReadHeadAsync(request, context, httpContext).ConfigureAwait(false);
+            serverResult = await TryReadHeadAsync(request, modelJson, contextJson, httpContext).ConfigureAwait(false);
         }
 
         var assetBase = $"{_options.RequestPath}/v{buildId}";
@@ -69,8 +74,8 @@ public async Task<string> RenderAsync(JsxRenderRequest request, HttpContext http
             RenderMode = renderMode,
             ServerHtml = serverResult?.Html,
             Head = serverResult?.Head,
-            ModelJson = JsonSerializer.Serialize(request.Model, _options.JsonSerializerOptions),
-            ContextJson = JsonSerializer.Serialize(context, _options.JsonSerializerOptions),
+            ModelJson = modelJson,
+            ContextJson = contextJson,
             ModuleUrl = $"{assetBase}/views/{request.View.ModuleRelativePath}",
             StyleSheets = StyleSheetsFor(request.View, assetBase, buildId),
             Document = request.Document ?? _options.Document,
@@ -114,15 +119,16 @@ public RenderMode ResolveRenderMode(JsxRenderRequest request)
     /// </summary>
     private async Task<ServerRenderResult?> TryReadHeadAsync(
         JsxRenderRequest request,
-        IReadOnlyDictionary<string, object?> context,
+        string modelJson,
+        string contextJson,
         HttpContext httpContext)
     {
         try
         {
-            return await _serverRenderer.ReadHeadAsync(
+            return await _serverRenderer.ReadHeadSerializedAsync(
                 request.View,
-                request.Model,
-                context,
+                modelJson,
+                contextJson,
                 httpContext.RequestServices,
                 httpContext.RequestAborted).ConfigureAwait(false);
         }

From f8a77f246be31c3e7c6587bf3d2e33e96a72a19f Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:09:22 +0300
Subject: [PATCH 5/8] Return server markup directly instead of through JSON

---
 src/JsxCore/Assets/preact/server.js        |  2 +-
 src/JsxCore/Assets/react/server.js         |  2 +-
 src/JsxCore/Assets/shared/view-host.js     | 19 ++++++++++++-------
 src/JsxCore/Rendering/JsxServerRenderer.cs | 13 ++++++++++---
 4 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/src/JsxCore/Assets/preact/server.js b/src/JsxCore/Assets/preact/server.js
index c523065..278844f 100644
--- a/src/JsxCore/Assets/preact/server.js
+++ b/src/JsxCore/Assets/preact/server.js
@@ -1,5 +1,5 @@
 // Server entry for Preact. Loaded by the .NET host, which calls renderView/readHead and reads the
-// JSON they return; nothing above this layer knows how a view is rendered.
+// markup and head they return; nothing above this layer knows how a view is rendered.
 
 import { createElement } from "preact";
 import { render } from "preact-render-to-string";
diff --git a/src/JsxCore/Assets/react/server.js b/src/JsxCore/Assets/react/server.js
index 9bbdee1..65d8d62 100644
--- a/src/JsxCore/Assets/react/server.js
+++ b/src/JsxCore/Assets/react/server.js
@@ -1,5 +1,5 @@
 // Server entry for React. Loaded by the .NET host, which calls renderView/readHead and reads the
-// JSON they return; the contract is identical to every other framework's entry.
+// markup and head they return; the contract is identical to every other framework's entry.
 
 import React from "react";
 import ReactDomServer from "react-dom/server.browser";
diff --git a/src/JsxCore/Assets/shared/view-host.js b/src/JsxCore/Assets/shared/view-host.js
index 5a8f3e2..254987d 100644
--- a/src/JsxCore/Assets/shared/view-host.js
+++ b/src/JsxCore/Assets/shared/view-host.js
@@ -143,8 +143,13 @@ function synchronous(Component) {
 }
 
 /**
- * Builds a framework's server entry: renderView and readHead, which the .NET host calls and whose
- * JSON it reads. The contract is identical for every framework, which is the point.
+ * Builds a framework's server entry: renderView and readHead, which the .NET host calls and reads
+ * the result of. The contract is identical for every framework, which is the point.
+ *
+ * Both return { html, head }: the markup as the string it already is, and the head descriptor as
+ * JSON, or null when the view contributed no head at all. A whole page of markup is by far the
+ * larger of the two and gains nothing from being escaped and unescaped on the way out; the head
+ * descriptor is a handful of tags with a shape the host already knows how to read.
  */
 export function createServerEntry(createElement, renderToString) {
     return {
@@ -158,17 +163,17 @@ export function createServerEntry(createElement, renderToString) {
                 synchronous(Component), { model: props.model, context: props.context });
 
             const rendered = renderCollectingHead(() => renderToString(element));
+            const head = mergeHead(resolveHead(viewModule, props), rendered.contributed);
 
-            return JSON.stringify({
-                html: rendered.html,
-                head: mergeHead(resolveHead(viewModule, props), rendered.contributed)
-            });
+            return { html: rendered.html, head: head ? JSON.stringify(head) : null };
         },
 
         // Only the head export, because the component is not run in this pass. A <Head> inside a
         // client-rendered view is applied by the browser after it mounts.
         readHead(viewModule, props) {
-            return JSON.stringify({ html: "", head: resolveHead(viewModule, props) });
+            const head = resolveHead(viewModule, props);
+
+            return { html: "", head: head ? JSON.stringify(head) : null };
         }
     };
 }
diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index 7659c58..f69e245 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -163,10 +163,17 @@ private ServerRenderResult Render(
             var server = engine.Modules.Import(_runtime.ServerEntrySpecifier);
             var module = engine.Modules.Import("./" + view.ModuleRelativePath);
 
-            var json = engine.Invoke(server.Get(entryPoint), module, props).AsString();
+            var result = engine.Invoke(server.Get(entryPoint), module, props).AsObject();
 
-            return JsonSerializer.Deserialize<ServerRenderResult>(json, SerializerOptions)
-                ?? new ServerRenderResult(string.Empty, null);
+            // The markup is taken as the string it already is. Only the head descriptor, which is a
+            // handful of tags rather than a whole page, is worth reading back out of JSON.
+            var html = result.Get("html").AsString();
+            var headValue = result.Get("head");
+            var head = headValue.IsString()
+                ? JsonSerializer.Deserialize<HeadDescriptor>(headValue.AsString(), SerializerOptions)
+                : null;
+
+            return new ServerRenderResult(html, head);
         }
         catch (JavaScriptException ex)
         {

From e76771a0878927ec61313e7dc8e80b4e6fe40c5c Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:16:01 +0300
Subject: [PATCH 6/8] Restore a clean global surface when an engine returns to
 the pool

---
 src/JsxCore/Rendering/JsxServerRenderer.cs    | 38 +++++++++++++++----
 .../Rendering/ServerRenderingTests.cs         | 28 ++++++++++++++
 2 files changed, 58 insertions(+), 8 deletions(-)

diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index f69e245..17d48be 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -233,7 +233,7 @@ private PooledEngine Rent(string buildId)
             Discard(candidate);
         }
 
-        return new PooledEngine(CreateEngine(buildId), buildId);
+        return CreateEngine(buildId);
     }
 
     private void Return(PooledEngine engine)
@@ -244,10 +244,21 @@ private void Return(PooledEngine engine)
             return;
         }
 
-        // The globals were resolved from the request's own scope, and that scope is about to end.
-        // Left in place they stay reachable for as long as the engine sits in the pool, which for
-        // a quiet application is indefinitely.
-        engine.Engine.SetValue(GlobalsName, JsValue.Undefined);
+        // The engine goes back with the globals it was built with: the request's .NET bridge, which
+        // was resolved from a scope that is about to end, and anything a view left on globalThis are
+        // both gone, while the modules it has already parsed stay. Left in place, either would
+        // remain for as long as the engine sits in the pool, which for a quiet application is
+        // indefinitely.
+        try
+        {
+            engine.Engine.Advanced.RestoreGlobalSnapshot(engine.CleanGlobals);
+        }
+        catch (InvalidOperationException)
+        {
+            // An engine whose global surface cannot be restored is not worth pooling.
+            Discard(engine);
+            return;
+        }
 
         _pool.Add(engine);
     }
@@ -291,7 +302,7 @@ private static void Discard(PooledEngine engine)
         MemberNameCreator = MemberNames
     };
 
-    private Engine CreateEngine(string buildId)
+    private PooledEngine CreateEngine(string buildId)
     {
         var loader = new JsxModuleLoader(
             _compilation.Layout,
@@ -322,7 +333,12 @@ private Engine CreateEngine(string buildId)
         // and isServerRender() used to answer that wrongly.
         engine.SetValue(ServerFlag, true);
 
-        return engine;
+        // Taken last, so that everything above it is part of what the engine is built with: a render
+        // returning the engine to the pool restores this surface, and the shims and the flag have to
+        // survive that rather than be swept away with the render's own leavings.
+        var cleanGlobals = engine.Advanced.CaptureGlobalSnapshot();
+
+        return new PooledEngine(engine, buildId, cleanGlobals);
     }
 
     private static IEnumerable<string> MemberNames(System.Reflection.MemberInfo member)
@@ -358,5 +374,11 @@ public void Dispose()
         _slots.Dispose();
     }
 
-    private sealed record PooledEngine(Engine Engine, string BuildId);
+    /// <summary>
+    /// A pooled engine, together with the global surface it was built with.
+    /// </summary>
+    /// <param name="CleanGlobals">
+    /// The engine's globals as construction left them, restored every time it returns to the pool.
+    /// </param>
+    private sealed record PooledEngine(Engine Engine, string BuildId, GlobalSnapshot CleanGlobals);
 }
diff --git a/test/JsxCore.Tests/Component/Rendering/ServerRenderingTests.cs b/test/JsxCore.Tests/Component/Rendering/ServerRenderingTests.cs
index 7e05e12..ba1629b 100644
--- a/test/JsxCore.Tests/Component/Rendering/ServerRenderingTests.cs
+++ b/test/JsxCore.Tests/Component/Rendering/ServerRenderingTests.cs
@@ -275,6 +275,34 @@ public async Task Render_CalledRepeatedly_ReusesPooledEnginesCorrectly()
         results.ShouldBe(Enumerable.Range(0, 25).Select(n => $"<p>{n}</p>"), ignoreOrder: true);
     }
 
+    [Fact]
+    public async Task Render_ViewWritesToGlobalThis_LeavesNothingForTheNextRender()
+    {
+        using var project = JsxProjectFixture.Create();
+        project.Options.TypeChecking = TypeCheckingMode.Off;
+
+        // One engine, so the second render is certain to get the first one back out of the pool.
+        project.Options.ServerRendering.MaxPooledEngines = 1;
+
+        project.AddView("Home/Litter.tsx", """
+            (globalThis as any).__leak = "left behind";
+            export default function Litter() { return <p>littered</p>; }
+            """);
+        project.AddView("Home/Probe.tsx", """
+            export default function Probe() { return <p>{typeof (globalThis as any).__leak}</p>; }
+            """);
+        await project.CompileAsync();
+
+        var renderer = project.CreateServerRenderer();
+        var services = new ServiceCollection().BuildServiceProvider();
+        var context = new Dictionary<string, object?>();
+
+        await renderer.RenderAsync(project.Locate("Home/Litter"), null, context, services);
+        var probe = await renderer.RenderAsync(project.Locate("Home/Probe"), null, context, services);
+
+        probe.Html.ShouldBe("<p>undefined</p>");
+    }
+
     private sealed class Greeter
     {
         public string Salutation { get; init; } = "Hello";

From c51cacf3cbe1f7d94e62e8026dea6e9fe2658f08 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:20:34 +0300
Subject: [PATCH 7/8] Enforce the render timeout across the whole render and
 honour aborted requests

---
 src/JsxCore/Rendering/JsxServerRenderer.cs    | 21 ++++-
 src/JsxCore/Rendering/RenderDeadline.cs       | 64 +++++++++++++++
 .../Component/Rendering/RenderTimeoutTests.cs | 82 +++++++++++++++++++
 3 files changed, 163 insertions(+), 4 deletions(-)
 create mode 100644 src/JsxCore/Rendering/RenderDeadline.cs
 create mode 100644 test/JsxCore.Tests/Component/Rendering/RenderTimeoutTests.cs

diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index 17d48be..5b4f156 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -49,7 +49,10 @@ public sealed class JsxServerRenderer(
     /// </summary>
     /// <param name="context">Ambient values exposed as the component's <c>context</c> prop.</param>
     /// <param name="services">Scope used to resolve request-scoped globals.</param>
-    /// <param name="cancellationToken">Cancels waiting for a free engine.</param>
+    /// <param name="cancellationToken">
+    /// Abandons the render: while it waits for a free engine, and afterwards while its JavaScript
+    /// runs. A request whose client has disconnected stops paying for markup nobody will read.
+    /// </param>
     public Task<ServerRenderResult> RenderAsync(
         LocatedView view,
         object? model,
@@ -128,12 +131,14 @@ private async Task<ServerRenderResult> ExecuteAsync(
         {
             var buildId = _compilation.BuildId;
             var pooled = Rent(buildId);
+            pooled.Deadline.Begin(_options.ServerRendering.Timeout, cancellationToken);
             try
             {
                 return Render(pooled.Engine, view, modelJson, contextJson, services, entryPoint);
             }
             finally
             {
+                pooled.Deadline.End();
                 Return(pooled);
             }
         }
@@ -311,11 +316,12 @@ private PooledEngine CreateEngine(string buildId)
             _moduleCache.Get(buildId, static () => new ServerModuleCache()));
 
         var settings = _options.ServerRendering;
+        var deadline = new RenderDeadline();
 
         var engine = new Engine(options =>
         {
             options.EnableModules(loader);
-            options.TimeoutInterval(settings.Timeout);
+            options.Constraint(deadline);
             options.LimitRecursion(settings.MaxRecursionDepth);
 
             if (settings.ExposeCamelCaseMembers)
@@ -338,7 +344,7 @@ private PooledEngine CreateEngine(string buildId)
         // survive that rather than be swept away with the render's own leavings.
         var cleanGlobals = engine.Advanced.CaptureGlobalSnapshot();
 
-        return new PooledEngine(engine, buildId, cleanGlobals);
+        return new PooledEngine(engine, buildId, cleanGlobals, deadline);
     }
 
     private static IEnumerable<string> MemberNames(System.Reflection.MemberInfo member)
@@ -380,5 +386,12 @@ public void Dispose()
     /// <param name="CleanGlobals">
     /// The engine's globals as construction left them, restored every time it returns to the pool.
     /// </param>
-    private sealed record PooledEngine(Engine Engine, string BuildId, GlobalSnapshot CleanGlobals);
+    /// <param name="Deadline">
+    /// The engine's own time budget, armed for the render currently holding it.
+    /// </param>
+    private sealed record PooledEngine(
+        Engine Engine,
+        string BuildId,
+        GlobalSnapshot CleanGlobals,
+        RenderDeadline Deadline);
 }
diff --git a/src/JsxCore/Rendering/RenderDeadline.cs b/src/JsxCore/Rendering/RenderDeadline.cs
new file mode 100644
index 0000000..bea1835
--- /dev/null
+++ b/src/JsxCore/Rendering/RenderDeadline.cs
@@ -0,0 +1,64 @@
+using System.Diagnostics;
+using Jint;
+
+namespace JsxCore.Rendering;
+
+/// <summary>
+/// The time budget for one render, and the request it belongs to.
+/// </summary>
+/// <remarks>
+/// The engine re-arms its built-in timeout at every entry from the host, and a render enters the
+/// engine several times, so a configured timeout used to bound each entry rather than the render.
+/// This holds one deadline for the whole render: armed before the engine goes to work, cleared
+/// when it returns to the pool, and deliberately untouched by the engine's own per-entry reset.
+/// It also watches the request's abort token, so a client that has gone away stops paying for
+/// JavaScript it will never receive.
+/// </remarks>
+internal sealed class RenderDeadline : Constraint
+{
+    private long _deadline;
+    private CancellationToken _aborted;
+
+    /// <summary>
+    /// Reads a clock and a token without consuming anything, so the engine may check on its
+    /// amortised cadence.
+    /// </summary>
+    public override bool IsAmortizable => true;
+
+    /// <summary>Arms the budget for one render.</summary>
+    public void Begin(TimeSpan timeout, CancellationToken aborted)
+    {
+        _aborted = aborted;
+        var deadline = Stopwatch.GetTimestamp() + (long) (timeout.TotalSeconds * Stopwatch.Frequency);
+        _deadline = deadline == 0 ? 1 : deadline;
+    }
+
+    /// <summary>Disarms the budget, so a pooled engine carries no deadline between renders.</summary>
+    public void End()
+    {
+        _deadline = 0;
+        _aborted = default;
+    }
+
+    /// <inheritdoc />
+    public override void Check()
+    {
+        if (_aborted.IsCancellationRequested)
+        {
+            throw new OperationCanceledException(_aborted);
+        }
+
+        if (_deadline != 0 && Stopwatch.GetTimestamp() >= _deadline)
+        {
+            throw new TimeoutException("The render exceeded the configured server rendering timeout.");
+        }
+    }
+
+    /// <summary>
+    /// Does nothing, deliberately. The engine resets constraints at every entry from the host, and
+    /// this budget belongs to the whole render rather than to any one entry into the engine.
+    /// </summary>
+    public override void Reset()
+    {
+    }
+}
diff --git a/test/JsxCore.Tests/Component/Rendering/RenderTimeoutTests.cs b/test/JsxCore.Tests/Component/Rendering/RenderTimeoutTests.cs
new file mode 100644
index 0000000..bceccc9
--- /dev/null
+++ b/test/JsxCore.Tests/Component/Rendering/RenderTimeoutTests.cs
@@ -0,0 +1,82 @@
+using System.Diagnostics;
+using JsxCore.Rendering;
+using JsxCore.Tests.Fixtures;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace JsxCore.Tests.Component.Rendering;
+
+/// <summary>
+/// A render that will not end on its own has to be ended for it, either by the configured budget
+/// running out or by the request it belongs to going away.
+/// </summary>
+public class RenderTimeoutTests
+{
+    /// <summary>A component that never returns, so only a constraint can stop it.</summary>
+    private const string Forever = """
+        export default function Forever() {
+            let n = 0;
+            while (true) { n = n + 1; }
+            return <p>{n}</p>;
+        }
+        """;
+
+    [Fact]
+    public async Task Render_ViewNeverReturns_IsEndedByTheConfiguredTimeout()
+    {
+        using var project = JsxProjectFixture.Create();
+        project.Options.TypeChecking = TypeCheckingMode.Off;
+        project.Options.ServerRendering.Timeout = TimeSpan.FromMilliseconds(200);
+        project.AddView("Home/Forever.tsx", Forever);
+        await project.CompileAsync();
+
+        var renderer = project.CreateServerRenderer();
+        var services = new ServiceCollection().BuildServiceProvider();
+        var elapsed = Stopwatch.StartNew();
+
+        var exception = await Record.ExceptionAsync(() => renderer.RenderAsync(
+            project.Locate("Home/Forever"), null, new Dictionary<string, object?>(), services));
+
+        elapsed.Stop();
+
+        // The message identifies which budget ran out: the render's own, rather than one of the
+        // per-entry ones a single render used to be allowed several of.
+        exception.ShouldBeOfType<JsxRenderException>()
+            .InnerException.ShouldBeOfType<TimeoutException>()
+            .Message.ShouldContain("server rendering timeout");
+
+        // Deliberately loose. The point is that the render ended rather than ran on, not how
+        // promptly a loaded machine noticed.
+        elapsed.Elapsed.ShouldBeLessThan(TimeSpan.FromSeconds(10));
+    }
+
+    [Fact]
+    public async Task Render_RequestAbortedWhileTheViewRuns_StopsRunningJavaScript()
+    {
+        using var project = JsxProjectFixture.Create();
+        project.Options.TypeChecking = TypeCheckingMode.Off;
+
+        // Far enough out that only the abort can plausibly be what ends this render.
+        project.Options.ServerRendering.Timeout = TimeSpan.FromSeconds(30);
+        project.AddView("Home/Forever.tsx", Forever);
+        await project.CompileAsync();
+
+        var renderer = project.CreateServerRenderer();
+        var services = new ServiceCollection().BuildServiceProvider();
+
+        // Cancelled after the render is under way, so the engine has to notice mid-flight. A token
+        // that was already cancelled would be caught while waiting for a pooled engine instead, and
+        // would prove nothing about the JavaScript.
+        using var aborted = new CancellationTokenSource(TimeSpan.FromMilliseconds(250));
+        var elapsed = Stopwatch.StartNew();
+
+        var exception = await Record.ExceptionAsync(() => renderer.RenderAsync(
+            project.Locate("Home/Forever"), null, new Dictionary<string, object?>(), services, aborted.Token));
+
+        elapsed.Stop();
+
+        exception.ShouldNotBeNull();
+        exception.ShouldBeAssignableTo<OperationCanceledException>();
+        elapsed.Elapsed.ShouldBeLessThan(TimeSpan.FromSeconds(15));
+    }
+}

From e50fd8073b15e056b8ba3f12f643753f8b20c373 Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 6 Aug 2026 10:24:16 +0300
Subject: [PATCH 8/8] Let a host declare immutable types crossing the globals
 bridge

---
 src/JsxCore/JsxCoreOptions.cs                 |  23 ++++
 src/JsxCore/Rendering/JsxServerRenderer.cs    |   5 +
 .../Rendering/ImmutableCrossingTests.cs       | 118 ++++++++++++++++++
 3 files changed, 146 insertions(+)
 create mode 100644 test/JsxCore.Tests/Component/Rendering/ImmutableCrossingTests.cs

diff --git a/src/JsxCore/JsxCoreOptions.cs b/src/JsxCore/JsxCoreOptions.cs
index 777dd02..ec5f317 100644
--- a/src/JsxCore/JsxCoreOptions.cs
+++ b/src/JsxCore/JsxCoreOptions.cs
@@ -431,4 +431,27 @@ public sealed class ServerRenderOptions
     /// </summary>
     public bool ExposeCamelCaseMembers { get; set; } = true;
 
+    /// <summary>
+    /// CLR types whose instances never change while a view can see them.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Declaring a type is a promise about every instance of it that reaches a render: neither its
+    /// members nor the values behind them are mutated for as long as the render can reach it. In
+    /// exchange the engine resolves each member of such an object once instead of on every access,
+    /// which is worth having for a registered global whose methods hand back data records that a
+    /// view then walks repeatedly — <c>catalog.getProduct().pricing.currency</c> inside a loop
+    /// crosses into .NET once per object rather than once per read.
+    /// </para>
+    /// <para>
+    /// A broken promise is answered with stale reads rather than an error, so declare only types
+    /// the application controls. Assignability is the rule: declaring an interface or a base type
+    /// covers everything that implements or derives from it.
+    /// </para>
+    /// <para>
+    /// Internal while the shape of the public option is still open. Applications cannot reach this
+    /// yet, and the tests are what exercise it.
+    /// </para>
+    /// </remarks>
+    internal List<Type> ImmutableCrossingTypes { get; } = [];
 }
diff --git a/src/JsxCore/Rendering/JsxServerRenderer.cs b/src/JsxCore/Rendering/JsxServerRenderer.cs
index 5b4f156..2ada394 100644
--- a/src/JsxCore/Rendering/JsxServerRenderer.cs
+++ b/src/JsxCore/Rendering/JsxServerRenderer.cs
@@ -328,6 +328,11 @@ private PooledEngine CreateEngine(string buildId)
             {
                 options.Interop.TypeResolver = CamelCaseResolver;
             }
+
+            if (settings.ImmutableCrossingTypes.Count > 0)
+            {
+                options.AddImmutableCrossing([.. settings.ImmutableCrossingTypes]);
+            }
         });
 
         // Before anything is imported: a package that expects a browser or Node global reads it
diff --git a/test/JsxCore.Tests/Component/Rendering/ImmutableCrossingTests.cs b/test/JsxCore.Tests/Component/Rendering/ImmutableCrossingTests.cs
new file mode 100644
index 0000000..fd59ed1
--- /dev/null
+++ b/test/JsxCore.Tests/Component/Rendering/ImmutableCrossingTests.cs
@@ -0,0 +1,118 @@
+using JsxCore.Rendering;
+using JsxCore.Tests.Fixtures;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace JsxCore.Tests.Component.Rendering;
+
+/// <summary>
+/// Declaring the data types a registered global hands out as unchanging while a view can see them.
+/// The option is internal for now, so these tests configure it directly rather than through
+/// application configuration.
+/// </summary>
+public class ImmutableCrossingTests
+{
+    /// <summary>A view that reaches through two levels of .NET object and reads the deeper one twice.</summary>
+    private const string WalkingView = """
+        import { dotnet } from "dotnet:globals";
+        export default function Index() {
+            const catalog = (dotnet as any).Catalog;
+            const product = catalog.getProduct();
+            const text = product.pricing.currency + ":" + product.pricing.region;
+            return <p>{text}</p>;
+        }
+        """;
+
+    [Fact]
+    public async Task DeclaredType_WalkedByAView_ReadsTheSameValues()
+    {
+        using var project = JsxProjectFixture.Create();
+        project.Options.TypeChecking = TypeCheckingMode.Off;
+        project.Options.Globals.Register("Catalog", new Catalog());
+        project.Options.ServerRendering.ImmutableCrossingTypes.Add(typeof(Product));
+        project.AddView("Home/Catalog.tsx", WalkingView);
+        await project.CompileAsync();
+
+        var result = await project.RenderAsync("Home/Catalog");
+
+        result.Html.ShouldBe("<p>EUR:eu</p>");
+    }
+
+    [Fact]
+    public async Task DeclaredType_MemberReadTwice_ReachesDotnetOnce()
+    {
+        using var project = JsxProjectFixture.Create();
+        project.Options.TypeChecking = TypeCheckingMode.Off;
+
+        var catalog = new Catalog();
+        project.Options.Globals.Register("Catalog", catalog);
+        project.AddView("Home/Catalog.tsx", WalkingView);
+        await project.CompileAsync();
+
+        var view = project.Locate("Home/Catalog");
+        var services = new ServiceCollection().BuildServiceProvider();
+        var context = new Dictionary<string, object?>();
+
+        // Each renderer builds its engines when it first renders, so the declaration only reaches
+        // the second one.
+        var undeclared = project.CreateServerRenderer();
+        await undeclared.RenderAsync(view, null, context, services);
+        var withoutDeclaration = catalog.PricingReads;
+
+        catalog.Reset();
+        project.Options.ServerRendering.ImmutableCrossingTypes.Add(typeof(Product));
+
+        var declared = project.CreateServerRenderer();
+        await declared.RenderAsync(view, null, context, services);
+        var withDeclaration = catalog.PricingReads;
+
+        withoutDeclaration.ShouldBe(2);
+        withDeclaration.ShouldBe(1);
+    }
+
+    /// <summary>The registered global, which hands out the record a view walks.</summary>
+    public sealed class Catalog
+    {
+        private readonly Product _product = new();
+
+        public Product GetProduct() => _product;
+
+        /// <summary>How often a render has crossed back into .NET for the product's pricing.</summary>
+        public int PricingReads => _product.PricingReads;
+
+        public void Reset() => _product.Reset();
+    }
+
+    /// <summary>
+    /// A record whose pricing never changes — and which counts how often it is asked for it.
+    /// </summary>
+    /// <remarks>
+    /// The counter is the only thing here that moves, and no view can see it, so the promise a
+    /// declaration makes holds: every read resolves to the same values. Counting is what makes
+    /// "resolved once per object" observable at all, since two reads of an unchanging member are
+    /// otherwise indistinguishable from the outside.
+    /// </remarks>
+    public sealed class Product
+    {
+        private readonly Pricing _pricing = new();
+
+        public int PricingReads { get; private set; }
+
+        public Pricing Pricing
+        {
+            get
+            {
+                PricingReads++;
+                return _pricing;
+            }
+        }
+
+        public void Reset() => PricingReads = 0;
+    }
+
+    public sealed class Pricing
+    {
+        public string Currency => "EUR";
+        public string Region => "eu";
+    }
+}