@abide/abide 0.48.0 → 0.50.0

package/src/lib/ui/router.ts

@@ -1,7 +1,6 @@
-import { hydratingSlot } from '../shared/hydratingSlot.ts'
+import { hydrationWindow } from '../shared/hydrationWindow.ts'
 import { layoutChainForRoute } from '../shared/layoutChainForRoute.ts'
 import { matchRoute } from '../shared/matchRoute.ts'
-import { wakeHydrationPeeks } from '../shared/wakeHydrationPeeks.ts'
 import { fillBoundary } from './dom/fillBoundary.ts'
 import { outlet } from './dom/outlet.ts'
 import { effect } from './effect.ts'
@@ -20,6 +19,7 @@ import type { Route } from './runtime/types/Route.ts'
 import type { RouteLoader } from './runtime/types/RouteLoader.ts'
 import type { UiProps } from './runtime/types/UiProps.ts'
 import { untrack } from './runtime/untrack.ts'
+import { withPath } from './runtime/withPath.ts'
 
 /* An outlet boundary — the `<!--abide:outlet-->`…`<!--/abide:outlet-->` marker pair a
    layer's content lives between (a layout's `<slot/>`, or the router's root boundary in
@@ -200,17 +200,19 @@ export function router(
             /* Route params as reactive thunks: reading `clientPage.value.params` inside the
                thunk tracks the page signal, so an in-place same-route hop (params change, the
                page stays mounted) re-runs each `props()` derive. The key set is stable across
-               same-route hops, so the bag need not rebuild. A layout also gets `$children`
+               same-route hops, so the bag need not rebuild. A layout also gets `children`
                set to `CHILD_PRESENT` when a child layer exists below it, read by
                `{#if children}` (a layout's `{children()}` lowers to its `outlet()` boundary,
-               so it ignores this value). */
+               so it ignores this value). Every bag entry is a thunk — `props()` destructure
+               lowers to `$props["key"]?.()` — so the sentinel must be wrapped too, or calling
+               it would invoke `CHILD_PRESENT` and yield `undefined` instead of the sentinel. */
             const propsBag = (hasChild: boolean): UiProps => {
                 const bag: UiProps = {}
                 for (const key of Object.keys(params)) {
                     bag[key] = () => clientPage.value.params[key]
                 }
                 if (hasChild) {
-                    bag.$children = CHILD_PRESENT
+                    bag.children = () => CHILD_PRESENT
                 }
                 return bag
             }
@@ -218,15 +220,17 @@ export function router(
             for (let depth = index; depth < layoutViews.length; depth += 1) {
                 const view = layoutViews[depth] as Route
                 PENDING_OUTLET.current = undefined
-                const { dispose } = fillBoundary(
-                    boundary.open,
-                    boundary.close,
-                    view.build,
-                    /* A layout always has a child below: a deeper layout, or the page. */
-                    propsBag(depth < layoutViews.length - 1 || pageView !== undefined),
-                    /* The layout's route key names its scope in the inspector's Reactive tab
-                       (no host element to read a tag from — see `scopeLabel`). */
-                    chainKeys[depth],
+                /* Root this layer's render-path at its route key (the directory URL — stable
+                   across reloads and globally unique), so every scope/cell it builds gets a
+                   serialization-stable id under it (`withPath`). */
+                const { dispose } = withPath(chainKeys[depth] as string, () =>
+                    fillBoundary(
+                        boundary.open,
+                        boundary.close,
+                        view.build,
+                        /* A layout always has a child below: a deeper layout, or the page. */
+                        propsBag(depth < layoutViews.length - 1 || pageView !== undefined),
+                    ),
                 )
                 const slot = PENDING_OUTLET.current
                 if (slot === undefined) {
@@ -239,34 +243,32 @@ export function router(
                 mountedPageKey = undefined
                 return
             }
-            disposePage = fillBoundary(
-                boundary.open,
-                boundary.close,
-                pageView.build,
-                /* A page is a leaf — no child layer. */
-                propsBag(false),
-                /* The page's route key names its scope in the inspector (see above). */
-                pageKey,
+            /* Root the page's render-path at its route key (stable, unique) — see the layout
+               layer above. */
+            disposePage = withPath(pageKey, () =>
+                fillBoundary(
+                    boundary.open,
+                    boundary.close,
+                    pageView.build,
+                    /* A page is a leaf — no child layer. */
+                    propsBag(false),
+                ),
             ).dispose
             mountedPageKey = pageKey
         }
         if (hydrating) {
             const previous = RENDER.hydration
-            const previousHydrating = hydratingSlot.active
             RENDER.hydration = { next: new Map() }
-            hydratingSlot.active = true
+            hydrationWindow.enter()
             enterRenderPass()
             try {
                 run()
             } finally {
                 exitRenderPass()
                 RENDER.hydration = previous
-                hydratingSlot.active = previousHydrating
-                /* Wake the peeks this pass withheld for SSR congruence, now that the pass is
-                   over and the warm value is congruent to show. Only on the outermost unwind. */
-                if (!previousHydrating) {
-                    wakeHydrationPeeks()
-                }
+                /* Outermost exit clears the window and wakes the peeks this pass withheld
+                   for SSR congruence, now that the warm value is congruent to show. */
+                hydrationWindow.exit()
             }
             return
         }
@@ -379,6 +381,15 @@ export function router(
            would re-run the router and re-mount the page, dropping local state. */
         const path = runtimePath.value
         untrack(() => {
+            /* Capture whether THIS run is the first paint, then flip the shared flag
+               synchronously. Previously `first` was only cleared inside the async `.then`,
+               so a second navigation that began before the boot resolve settled (a
+               double-tapped back button, two quick `navigate()` calls) still read
+               `first === true` and skipped its auth/redirect probe. Each run's `.then`
+               closes over its own `isFirstRun`, so hydration still keys off the real first
+               paint. */
+            const isFirstRun = first
+            first = false
             /* The route matches on the pathname only; the query/hash ride along for
                the probe (so server gating sees them) and for clientPage.url. */
             const pathname = path.split(/[?#]/)[0] ?? path
@@ -390,7 +401,7 @@ export function router(
             const targetUrl = resolveUrl(path)
             const mountedUrl = clientPage.value.url
             if (
-                !first &&
+                !isFirstRun &&
                 mountedUrl.pathname === targetUrl.pathname &&
                 mountedUrl.search === targetUrl.search &&
                 mountedUrl.hash !== targetUrl.hash
@@ -422,13 +433,13 @@ export function router(
                Skipped on first paint — there is no page to leave. An instant SPA hop
                (chunk cached, no probe) flips it back within the same microtask, so the
                browser never paints the intermediate state — no flash. */
-            if (!first && !clientPage.value.navigating) {
+            if (!isFirstRun && !clientPage.value.navigating) {
                 clientPage.value = { ...clientPage.value, navigating: true }
             }
             /* First paint adopts a document the server already ran handle() on;
                only later navigations re-run it through the probe. */
             const verdict: Promise<NavVerdict> =
-                first || probe === undefined ? Promise.resolve({ kind: 'mount' }) : probe(path)
+                isFirstRun || probe === undefined ? Promise.resolve({ kind: 'mount' }) : probe(path)
             /* Resolve the page chunk, its layout chunks, and the gate in parallel,
                keeping the current chain mounted until all land — no blank frame while
                imports are in flight or the probe is in the air. */
@@ -439,14 +450,10 @@ export function router(
             ])
                 .then(([pageView, resolvedLayouts, decision]) => {
                     if (token !== sequence || disposed) {
-                        /* Consume the first-paint flag even when superseded: the boot SSR DOM
-                           is valid only for THIS boot navigation. Leaving `first` true would
-                           let a navigation that started before this settled (to a different
-                           page) skip its auth probe and hydrate the boot URL's SSR DOM as its
-                           own — claimExpected then throws and commit swallows it, stranding a
-                           broken page. Cleared here → the superseding nav builds create-mode
-                           (clearing the stale SSR DOM) and runs its probe. */
-                        first = false
+                        /* Superseded (or disposed) — drop this build. The first-paint flag was
+                           already consumed synchronously at run start (`first = false`), so a
+                           navigation that started after this one already saw `first === false`,
+                           ran its probe, and builds in create mode over the stale SSR DOM. */
                         return
                     }
                     /* handle() redirected: go where it pointed, replacing the blocked
@@ -474,9 +481,8 @@ export function router(
                     ) {
                         divergence += 1
                     }
-                    const firstPaint = first
-                    const hydrating = first && pageView?.hydratable === true
-                    first = false
+                    const firstPaint = isFirstRun
+                    const hydrating = isFirstRun && pageView?.hydratable === true
                     /* Same page, same layout chain — only params/url differ (e.g. stepping
                        between episodes on one detail page). The whole structure survives, so
                        publish the new snapshot on the reactive `page` proxy and let the mounted
@@ -526,15 +532,42 @@ export function router(
                         disposeFrom(divergence)
                         const url = resolveUrl(path)
                         clientPage.value = { route: chainRoute, params, url, navigating: false }
-                        buildFrom(
-                            divergence,
-                            chainKeys,
-                            layoutViews,
-                            pageView,
-                            key,
-                            params,
-                            hydrating,
-                        )
+                        try {
+                            buildFrom(
+                                divergence,
+                                chainKeys,
+                                layoutViews,
+                                pageView,
+                                key,
+                                params,
+                                hydrating,
+                            )
+                        } catch (error) {
+                            /* A cold mount owns no claim cursor, so the SSR-vs-client claim asserts
+                               (`assertClaimedText`, `claimExpected`) can't fire there — a throw from
+                               it is a genuine codegen/user-render defect. Rethrow to `commit`, which
+                               surfaces it and stops (a reload would re-run the same failure). */
+                            if (!hydrating) {
+                                throw error
+                            }
+                            /* A HYDRATING first paint threw — a server↔client markup divergence (a
+                               blocking cell whose resolved value the server couldn't serialize into
+                               `__SSR__.cells`, so the client reads pending where SSR baked a value;
+                               or any other SSR/client mismatch). A reload re-runs the same SSR, so
+                               recover CLIENT-side: discard the server markup and mount the page fresh
+                               (cold — pending reads render their empty state and fill in on settle,
+                               congruent because nothing is being adopted). Reset to the pristine
+                               pre-mount state so `run` re-establishes the root boundary and clears the
+                               host, then rebuild the whole chain cold. */
+                            console.warn(
+                                `[abide] hydration mismatch at ${path} — discarding server markup and rendering on the client:`,
+                                error,
+                            )
+                            disposeFrom(0)
+                            rootBoundary = undefined
+                            mountedPageKey = undefined
+                            buildFrom(0, chainKeys, layoutViews, pageView, key, params, false)
+                        }
                         /* Reapply the destination entry's scroll once its DOM exists — a
                        back/forward restores its offset, a fresh nav scrolls to the `#hash`
                        anchor (now built) or the top. SKIPPED on a hydrating first paint:

package/src/lib/ui/runtime/AsyncCellError.ts

@@ -0,0 +1,20 @@
+import type { AsyncComputed } from '../../shared/types/AsyncComputed.ts'
+
+/*
+The throw a compiled async-cell read (`$$readCell`) raises when the cell is in error
+with no retained value — routed to the nearest reactive `{#try}`. It carries the
+originating cell so the boundary can subscribe to that cell's lifecycle and re-arm
+the guarded content when the cell recovers (error→value via a `refresh()` or a
+dependency change) — "keep watching what threw" (ADR-0019 D3.3). A plain `peek()` in
+JS never throws; the throw is a template-lowering behaviour only, so the cause is
+carried through unchanged for an author's `{:catch err}` binding.
+*/
+export class AsyncCellError extends Error {
+    readonly cell: AsyncComputed<unknown>
+
+    constructor(cell: AsyncComputed<unknown>, cause: unknown) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause })
+        this.name = 'AsyncCellError'
+        this.cell = cell
+    }
+}

package/src/lib/ui/runtime/CELL_SEED.ts

@@ -0,0 +1,14 @@
+/* The async-cell warm-seed manifest: an SSR-resolved cell value, keyed by the cell's
+   serialization-stable render-path id (`${scope.id}:${index}`), as a ref-json-encoded STRING
+   (decoded lazily at the read site in `createAsyncCell`, so an in-process graph with cycles /
+   shared back-references survives where JSON would drop it — the same codec `RESUME` uses).
+   `startClient` drains `__SSR__.cells` into here before mount; a hydrating cell reads its key to
+   seed its value warm instead of re-running the seed (no refetch, no pending flash).
+
+   Backed by `globalThis.__abideCells` so an inline pre-bundle script and the framework share one
+   store — whoever runs first creates it, the other adopts the same reference (mirrors RESUME). */
+const globalScope = globalThis as { __abideCells?: Record<string, string> }
+globalScope.__abideCells ??= {}
+
+// @documentation plumbing
+export const CELL_SEED: Record<string, string> = globalScope.__abideCells

package/src/lib/ui/runtime/CHILD_PRESENT.ts

@@ -1,7 +1,7 @@
 /*
 A no-op truthiness marker the router (client) and `renderChain` (SSR) set as a layout's
-`$props.$children` when a child layer (a nested layout or the page) exists below it. Read
-only by `{#if children}` (→ `$props?.$children`); a layout's `{children()}` lowers to the
+`$props.children` when a child layer (a nested layout or the page) exists below it. Read
+only by `{#if children}` (→ `$props?.children`); a layout's `{children()}` lowers to the
 `outlet()` boundary the router fills, so this value is never invoked — it exists purely so
 `{#if children}` reads a uniform presence signal on both the client and the server.
 */

package/src/lib/ui/runtime/CURRENT_BOUNDARY.ts

@@ -0,0 +1,11 @@
+import type { Boundary } from './types/Boundary.ts'
+
+/*
+The ambient reactive error boundary — the `{#try}` mirror of `CURRENT_SCOPE`. A `tryBlock`
+sets `current` to its boundary around the guarded build so every effect created inside
+associates with it (`boundaryFor`), then restores the previous value (boundaries nest, the
+innermost wins). Undefined outside any `{#try}`; a plain mutable holder is enough — the
+value is only read on the cold path where an effect is created inside a boundary, never on
+the reactive hot path.
+*/
+export const CURRENT_BOUNDARY: { current: Boundary | undefined } = { current: undefined }

package/src/lib/ui/runtime/CURRENT_PATH.ts

@@ -0,0 +1,29 @@
+import { ambientPathBacking } from './ambientPathBacking.ts'
+
+/*
+The ambient RENDER-PATH — a serialization-stable lexical id for "where in the render tree
+am I", composed top-down as the tree builds. Each nesting site pushes a segment for the
+duration of its subtree (route → layout layer → slot → `{#each}` row key → `{#if}`/`{#switch}`
+branch → child-component ordinal), and a lexical scope (`createScope`) snapshots the current
+value as its id (replacing the old process-local `scope-${n}` counter, which restarted every
+run and drifted on any SSR/client divergence). Because the path is built from compiler-stamped
+positions and runtime data keys — NOT a creation-order counter — it is order-independent
+(streaming can't shift it), and it self-handles SSR/client branch divergence: different branches
+compose different paths, so a value keyed by one never mis-adopts under the other.
+
+Segments are joined with `/` and each is `escapeKey`-escaped (RFC 6901), so a segment holding
+a `/` (a URL-shaped row key) stays one segment. `current` is `''` outside any render (a detached
+`scope()` then falls back to the counter for in-run uniqueness).
+
+`current` reads through a SWAPPABLE backing (`ambientPathBacking`) rather than a raw field, and is
+READ-ONLY: a segment is established only by `withPath`/`withPathFrom` calling the backing's `run`
+(ADR-0033 D1), never by assigning `current`. The default backing is a module variable (correct on
+the client, one render tree), but the server installs an AsyncLocalStorage-backed `run` so the
+composed path survives the inline `await`s an SSR render suspends on (the cell barrier, child
+renders) and stays isolated across concurrent requests. Mirrors `CURRENT_SCOPE`/`ambientScopeBacking`.
+*/
+export const CURRENT_PATH: { readonly current: string } = {
+    get current(): string {
+        return ambientPathBacking.active.get()
+    },
+}

package/src/lib/ui/runtime/RENDER.ts

@@ -5,11 +5,14 @@ the next server-rendered child node to claim — a node pointer (not an index) s
 survives nodes a block inserts (anchors) mid-hydration. Helpers claim in build
 order, which matches the SSR order, advancing the pointer to the next sibling.
 
-`blockId`/`depth` drive the render-pass block-id counter: every `await`/`try` block
-draws an id from `blockId` in document order, shared across a component and the
-child components it inlines, so ids are globally unique within one render pass (the
-SSR stream and client hydration agree on them — `RESUME` is keyed by id). `depth`
-tracks nesting so the OUTERMOST render/mount resets the counter and a child render/
+`blockCounters`/`depth` drive the render-pass block-id counters: every `await`/`try`
+block draws a path-namespaced id via `nextBlockId` (ADR-0037) — `blockCounters` maps
+each render-path to its own 0,1,2… sequence, counted in document order within that
+path. Namespacing by path (not one flat counter shared across a component and the
+children it inlines) is what keeps ids congruent SSR↔client even when sibling child
+renders run concurrently on the server; the client mounts each child synchronously
+under the same path, so both sides compose the same ids (`RESUME` is keyed by them).
+`depth` tracks nesting so the OUTERMOST render/mount clears the map and a child render/
 mount continues it. See `enterRenderPass`/`nextBlockId`.
 
 `namespace` is the ambient foreign-content namespace (SVG/MathML) a control-flow block
@@ -19,12 +22,12 @@ undefined outside foreign content. See `enterNamespace`/`effectiveChildNamespace
 */
 export const RENDER: {
     hydration: { next: Map<Node, Node | null> } | undefined
-    blockId: number
+    blockCounters: Map<string, number>
     depth: number
     namespace: string | undefined
 } = {
     hydration: undefined,
-    blockId: 0,
+    blockCounters: new Map(),
     depth: 0,
     namespace: undefined,
 }

package/src/lib/ui/runtime/RESUME.ts

@@ -1,7 +1,7 @@
 /* The await-resume manifest: the resolved value (or error) of each streamed
    `await` block, keyed by its boundary id. The SSR stream serializes each entry
-   alongside its fragment; the client registers it (via `applyResolved` or the
-   inline swap script), and hydration reads it so an `await` block adopts the
+   alongside its fragment; the client registers it (via the inline swap script),
+   and hydration reads it so an `await` block adopts the
    resolved branch with the real value instead of re-running the promise.
 
    Each value is the ref-json-encoded ResumeEntry STRING, not the decoded object:
@@ -16,8 +16,8 @@
    same reference. */
 export type ResumeEntry = { ok: true; value: unknown } | { ok: false; error: unknown }
 
-const globalScope = globalThis as { __abideResume?: Record<number, string> }
+const globalScope = globalThis as { __abideResume?: Record<string, string> }
 globalScope.__abideResume ??= {}
 
 // @documentation plumbing
-export const RESUME: Record<number, string> = globalScope.__abideResume
+export const RESUME: Record<string, string> = globalScope.__abideResume

package/src/lib/ui/runtime/STREAMED_CELLS.ts

@@ -0,0 +1,57 @@
+/*
+Post-mount sink for STREAMING-cell resolutions (ADR-0035). Unlike `CELL_SEED` — the pre-mount
+warm-seed a blocking cell reads at construction — a streaming cell ships pending and its value
+arrives LATER (streamed after the shell, `__abideResolve({ cellKey, value })` →
+`seedStreamedResolution`). So a mounted streaming cell registers an `apply` fn keyed by its
+render-path id, and the streamed value is routed to it — the render-path analogue of the cache
+path's `markLifecycle` wake. A value that arrives before its cell registers is buffered and applied
+on registration (the two orderings race as the shell hydrates while chunks stream in).
+
+Backed by `globalThis.__abideStreamedCells` so an inline pre-bundle script and the framework share
+one store, mirroring `CELL_SEED`/`RESUME`.
+*/
+const globalScope = globalThis as {
+    __abideStreamedCells?: {
+        apply: Map<string, (value: unknown) => void>
+        buffer: Map<string, unknown>
+    }
+}
+globalScope.__abideStreamedCells ??= { apply: new Map(), buffer: new Map() }
+
+const store = globalScope.__abideStreamedCells
+
+/* Apply a streamed value to its cell as a POST-hydration reactive update. Deferred to a microtask
+   so it can NEVER run inside the synchronous hydration mount: the streamed `__abideResolve` chunk
+   parses (buffering the value) BEFORE the client mounts, so a synchronous apply at registration
+   would set the cell to the resolved value while the SSR DOM still shows the pending text — an
+   `assertClaimedText` desync (ADR-0033). The microtask runs after the whole synchronous mount
+   tree unwinds, so hydration claims the pending markup first and the value lands as a plain
+   reactive update (pending → resolved), congruent with a fresh mount. */
+function deferApply(apply: (value: unknown) => void, value: unknown): void {
+    queueMicrotask(() => apply(value))
+}
+
+/* A mounted streaming cell offers where to deliver its streamed value. If the value already
+   arrived (buffered), schedule it; otherwise hold the apply fn for when it streams in. */
+export function registerStreamedCell(key: string, apply: (value: unknown) => void): void {
+    if (store.buffer.has(key)) {
+        const value = store.buffer.get(key)
+        store.buffer.delete(key)
+        deferApply(apply, value)
+        return
+    }
+    store.apply.set(key, apply)
+}
+
+/* A streamed value landed for `key`. Deliver it to the registered cell (scheduled post-mount), or
+   buffer it until the cell registers. One-shot: the apply fn is consumed (a cell adopts a streamed
+   value once; later reactivity is its own reseed). */
+export function receiveStreamedCell(key: string, value: unknown): void {
+    const apply = store.apply.get(key)
+    if (apply !== undefined) {
+        store.apply.delete(key)
+        deferApply(apply, value)
+        return
+    }
+    store.buffer.set(key, value)
+}

package/src/lib/ui/runtime/ambientPathBacking.ts

@@ -0,0 +1,32 @@
+/*
+The swappable backing behind `CURRENT_PATH.current` — the render-path sibling of
+`ambientScopeBacking`. The default is a module variable with a synchronous save/restore `run`
+(correct on the client, whose mount is synchronous — the whole subtree builds and restores before
+control returns, so a slot never has to survive an `await`). The server swaps in an
+AsyncLocalStorage-backed `run` at boot (`installAmbientScopeStore`, ADR-0033 D1), because SSR
+composes the path while `await`ing inline (the Tier-2 cell barrier, child renders) and the pushed
+segment must be inherited by the render's own post-await continuation — a synchronously-restored slot
+cannot follow an async continuation. `run(composed, build)` establishes the composed path for
+`build`; `get()` reads the active path (`''` outside any push). Mirrors `ambientScopeBacking`.
+*/
+type PathBacking = {
+    run: <T>(composedPath: string, build: () => T) => T
+    get: () => string
+}
+
+let modulePath = ''
+
+export const ambientPathBacking: { active: PathBacking } = {
+    active: {
+        run: <T>(composedPath: string, build: () => T): T => {
+            const previous = modulePath
+            modulePath = composedPath
+            try {
+                return build()
+            } finally {
+                modulePath = previous
+            }
+        },
+        get: () => modulePath,
+    },
+}

package/src/lib/ui/runtime/applyPatchToTree.ts

@@ -1,3 +1,4 @@
+import { setOwnProperty } from '../../shared/setOwnProperty.ts'
 import type { Patch } from './types/Patch.ts'
 
 /*
@@ -6,7 +7,7 @@ value only when the root itself is replaced). In-place is the deliberate choice:
 the patch path already names exactly what changed, so we never need copy-on-write
 to *detect* a change — and cloning the spine made every leaf write O(width) of
 the widest ancestor (a 5k-item list copied 50k times in the bench). Mutating is
-O(depth). History/undo is served by journalling patches (the change is a value),
+O(depth). Change detection is served by announcing patches (the change is a value),
 not by retaining old roots — which is cheaper anyway. The wake step in createDoc
 force-notifies ancestor readers from the path, since their container keeps its
 identity now.
@@ -21,16 +22,28 @@ export function applyPatchToTree(tree: unknown, patch: Patch, segments: string[]
     }
     let parent = tree as Record<string, unknown>
     for (const segment of segments.slice(0, -1)) {
-        parent = parent[segment] as Record<string, unknown>
+        /* Only descend into an OWN property. A segment of `__proto__`/`constructor`/
+           `prototype` is not own on a plain data object/array, so this refuses to walk
+           into a shared prototype (or the constructor function) that a later write would
+           then pollute — the real vector, since `apply` is reachable from `sync()` with
+           unvalidated peer-controlled patch paths. A legit document key that happens to be
+           named `constructor` is an own data property, so `hasOwn` still traverses it. */
+        const next = Object.hasOwn(parent, segment) ? parent[segment] : undefined
+        if (next === null || typeof next !== 'object') {
+            throw new TypeError(
+                `abide: patch path segment "${segment}" does not address a container`,
+            )
+        }
+        parent = next as Record<string, unknown>
     }
     const key = segments[segments.length - 1] as string
     if (patch.op === 'replace') {
-        parent[key] = patch.value
+        setOwnProperty(parent, key, patch.value)
     } else if (patch.op === 'add') {
         if (Array.isArray(parent)) {
             parent.splice(key === '-' ? parent.length : Number(key), 0, patch.value)
         } else {
-            parent[key] = patch.value
+            setOwnProperty(parent, key, patch.value)
         }
     } else if (Array.isArray(parent)) {
         parent.splice(Number(key), 1)

package/src/lib/ui/runtime/blockId.ts

@@ -0,0 +1,31 @@
+import { CURRENT_PATH } from './CURRENT_PATH.ts'
+
+/*
+Allocates an await/try block id NAMESPACED by the ambient render-path (ADR-0037). The id is
+`${CURRENT_PATH.current}:${n}` where `n` is a per-path counter incremented in document order —
+so blocks WITHIN one component/branch/row (one path) number 0,1,2… deterministically, while a
+child component (its own path segment) gets its own independent sequence. This replaces the old
+flat monotonic counter shared across a component and the children it inlines.
+
+Path-namespacing is what lets sibling child renders run CONCURRENTLY during SSR: their ids no
+longer depend on a globally-sequential draw order (which parallel renders would interleave), only
+on document order within each child's own path — and the server render-path is ALS-backed
+(pathStore), so each child's continuations keep their own path across awaits. The client mounts
+each child synchronously under the same path (mountChild → withPath), so both sides compose
+byte-identical ids and the resume manifest stays keyed congruently.
+
+`counters` is the per-render-pass map: the request-local `$ctx` threaded through the SSR render
+tree, or `RENDER.blockCounters` on the client (see nextBlockId). Concurrent sibling renders write
+DIFFERENT path keys, so a shared map needs no locking — each get/set is atomic and per-path.
+*/
+// @documentation plumbing
+export function blockId(counters: Map<string, number>): string {
+    const path = CURRENT_PATH.current
+    const next = counters.get(path) ?? 0
+    counters.set(path, next + 1)
+    /* Bare (pathless) render — a top-level page whose route key is `''`, or a component rendered
+       outside any route in a test — keeps the plain `0,1,2…` form; only a non-empty path qualifies
+       the id. Both sides compute the same path, so the branch is congruent, and the common bare case
+       stays identical to the pre-ADR-0037 flat counter. */
+    return path === '' ? String(next) : `${path}:${next}`
+}

package/src/lib/ui/runtime/boundaryFor.ts

@@ -0,0 +1,11 @@
+import type { Boundary } from './types/Boundary.ts'
+import type { ReactiveNode } from './types/ReactiveNode.ts'
+
+/*
+Associates an effect node with the reactive `{#try}` boundary it was created inside. Kept
+OFF the `ReactiveNode` shape — a WeakMap populated only for effects built while
+`CURRENT_BOUNDARY.current` is set — so the node stays monomorphic for signals/computeds/
+effects on the read/write hot path, and this map is consulted only on the cold throw path
+(`flushEffects.drain`'s catch), to route a guarded effect's later-run throw to its boundary.
+*/
+export const boundaryFor = new WeakMap<ReactiveNode, Boundary>()

package/src/lib/ui/runtime/cellBarrierBacking.ts

@@ -0,0 +1,30 @@
+import type { PendingAsyncCells } from '../../shared/types/PendingAsyncCells.ts'
+
+/*
+The swappable backing for the PER-RENDER async-cell barrier override (ADR-0037 Phase 2). Mirrors
+`ambientPathBacking`: the default is an inert passthrough (no override — the barrier list resolves
+through the per-request `pendingAsyncCellsSlot` as before), and the server installs an
+AsyncLocalStorage-backed variant (`renderCellBarrierStore`) so a hoisted child render can run its
+async cells under its OWN list.
+
+Why a per-render override at all: sibling child renders that run CONCURRENTLY (the parallel-SSR
+hoist) each register cells on the request-scoped pending list, and `settleAsyncCells` drains it with
+`splice(0)` — so one child's barrier would drain a sibling's cells, letting that sibling's template
+peek a still-pending value. Running each hoisted child under `isolateCellBarrier` gives it a fresh
+list (via `run`), so `activePendingCells()` returns that list for the child's registrations and its
+own barrier drain — isolated from every concurrent sibling and from the page. `current()` returns
+`undefined` outside any isolated render, so the page's own cells fall through to the request list
+unchanged. Kept out of `node:async_hooks` on the client: the default backing is pure JS, and the ALS
+variant is installed only server-side.
+*/
+export const cellBarrierBacking: {
+    active: {
+        current: () => PendingAsyncCells | undefined
+        run: <T>(list: PendingAsyncCells, render: () => T) => T
+    }
+} = {
+    active: {
+        current: () => undefined,
+        run: (_list, render) => render(),
+    },
+}