Data-bound chart components 5/8: the chart factories - #465

The user-facing half of the tier: reflex_xy.scatter_chart(data=Dash.cloud,
x="x", y="y", color="mag") and the composed reflex_xy.chart(*nodes,
data=...) for multi-mark charts.

A factory call at page evaluation builds a plan, so the chart's structure
is validated at `reflex run` rather than at hydrate. What that buys, in the
order a user hits it: a hallucinated factory name fails at import (the xy
node re-exports are an explicit curated map, not getattr passthrough); an
unknown kwarg fails with a did-you-mean; a bad colormap, enum, or axis ref
fails in the zero-row probe; an unknown column name fails against the data
var's TypedDict without executing the data method; and the wrong var or a
raw string in data= fails on the typed prop.

The kwarg partition — mark options vs chrome vs component props vs event
handlers — is derived from inspect.signature at import rather than
hand-listed, because a hand-listed partition silently drifts from xy's
signatures and Reflex absorbs unknown non-event kwargs into `style` where
a typo would vanish rather than raise (the hazard Phase 0 pinned).
Collisions get generated aliases, pinned by test.

Two mounts from one surface: a Var data source becomes the plan/data props
the wrapper composes into a composite subscription, while a concrete
mapping binds immediately and routes to the static payload-asset path —
same validation, works under `reflex export`.

Aggregating kinds (box, violin, hexbin, contour, heatmap, stairs, ecdf) and
the data-taking composites (pie, radar, wind_rose, sankey) are excluded
from the plan tier and refused by name with the two working routes: their
validators need real values, and a synthetic-row probe would validate
against made-up data — a silent decimation of the compile guarantee.

Page-plan registration lands here too, with the factories that populate the
map: backend-only workers import the app without evaluating pages, so the
startup lifespan evaluates them once, making "the plan map is populated in
every worker" true by construction instead of an assumption about Reflex.

Spec: reflex-integration.md §3.6 (factories, static symmetry, kind
coverage, page-plan registration), file map.

`_ensure_page_plans` was fail-closed in name only. Reflex starts a
coroutine lifespan task with `asyncio.create_task(task())` and then
yields, so a raise inside an `async def` lifespan body landed in a
background task on an already-serving worker — the load-balancer-dependent
blank charts the check exists to prevent. The registered task is now a
plain function that runs the page pass synchronously and returns the sweep
coroutine, so the raise happens in the `task()` call Reflex makes inline,
before create_task and before the lifespan yields.

Alongside it, four narrower corrections:

- The signature-derived kwarg partition excluded only `data`, so xy's
  private adapter knobs (`_artist_alpha`, `_marker_path`, …) were accepted
  as flat kwargs and offered as did-you-mean candidates. Underscore-prefixed
  params are now filtered out of both.
- Every public `reflex_xy` export is restated under `TYPE_CHECKING` — the
  twelve chart factories and the curated xy node re-exports, which typed as
  missing/`Any` behind `__getattr__`. A new test pins `__all__` against the
  static declarations in both directions.
- Demo-fence namespace snapshots key on (page, source, occurrence) instead
  of (page, source). A page repeating an identical fence would otherwise
  restore the first occurrence's namespace, discarding what the fences
  between them defined — not the shared renderer's accumulation semantics.
  One occurrence counter is threaded through the body and FAQ transformers.
- The republish benchmark sweeps data size (10k → 5M, straddling the 200k
  density threshold) and reports ms per million points. "State deltas
  independent of data size" is a scaling claim; one datum at one N is
  consistent with any growth curve. Table in §6 replaced with the sweep.

Also: the repeated-render docs guard now detects annotated, augmented,
unpacked, and def/class rebinding, not just plain assignment (12 → 13
pages covered), and the fourfold `app_cwd` fixture is hoisted into
`tests/reflex_adapter/conftest.py`.

…blish sweep

Three follow-ups from review of af9f99c.

Occurrence-keyed fence snapshots made a snapshot's identity positional, but
`_FENCE_NAMESPACES` was never invalidated. Editing a page that repeats a
fence renumbers every surviving copy, so a fence could restore a namespace
captured when it sat elsewhere in the sequence — one predating the bindings
now ahead of it. The dev server re-renders in-process on reload, so that is
the live path. Snapshots are now versioned by a digest of the page source and
a page's entries are dropped as soon as its content changes, which also
bounds the cache: superseded page versions are evicted instead of holding a
full namespace snapshot alive for the life of the process.

The rebound-name detector only walked a fence's top-level statements, so
bindings inside `for`/`with`/`if`/`try`/`match` bodies were invisible while
the docstring claimed every form. It now recurses through compound statements
(stopping at `def`/`class` bodies, which are a separate scope) and handles
for/with/except/match targets, imports, and walrus. Imports are the
substantive gain: counting them takes the guarded page set from 13 to 41 of
74, for 5.7s.

The §6 republish prose claimed the normalized column "stays flat" while its
own table showed 5M above the 1M floor. The table was at fault, not the
prose: at one trial per size, run-to-run variance exceeds the gap between
neighbouring sizes, and the 4.7 ms/1M reading was noise (three trials at that
size give 3.40 / 2.74 / 3.02). The sweep now runs `REPUBLISH_TRIALS` trials
per size and reports the observed range beside the median, and adds a 2M row
at the direct soft ceiling. Re-recorded: 2.95 / 2.86 / 2.77 ms per 1M at
1M/2M/5M with overlapping ranges. The stated regression signal is the top of
the sweep rising clear of that band, not any increase between adjacent rows.