@timber-js/app 0.2.0-alpha.170 → 0.2.0-alpha.172

package/src/server/prebuilt/slots.ts

@@ -5,8 +5,8 @@
  * as a shell with a stable <SlotOutlet slot={name} /> client-reference
  * hole per declared slot prop; live slot content composes in per instance
  * at request time via SlotsProvider/SlotContext. This generalizes the
- * TIM-1181 layout mechanism (ChildSegmentOutlet) to explicitly declared,
- * named slots on any cached component.
+ * TIM-1181 layout mechanism to explicitly declared, named slots on any
+ * cached component. Layouts use the same mechanism with a `children` slot.
  *
  * Both the production wrapper (cache path) and the dev wrapper (no cache,
  * same tree shape for dev/prod parity) build their render from these
@@ -16,27 +16,50 @@
 import { createElement } from 'react';
 
 import type { SlotValues } from '../../client/slot-context.js';
-import { ChildSegmentOutlet } from '../../client/child-segment-outlet.js';
 import { SlotOutlet } from '../../client/slot-outlet.js';
 import { SlotsProvider } from '../../client/slot-provider.js';
 import { splitSlotProps } from './cache-key.js';
 import type { PrebuiltComponentOptions } from '../prebuilt-runtime.js';
 
 /**
- * Is this value the framework-injected `<ChildSegmentOutlet />` element?
- * Total: the `in` probe and `.type` read run against a user-controlled
- * value, and a Proxy trap can throw — that must classify as "not the
- * outlet" (the canonicalizer then rejects the value as unkeyable → live
- * render), not abort the request (codex P2 on PR #890).
+ * Framework-internal slot name for layout children. Uses a prefix that
+ * cannot collide with user-declared slot names (which are React prop
+ * names). Layout children flow through SlotsProvider/SlotOutlet with
+ * this key instead of the bare "children" key, so a cached component
+ * with `slots: ['children']` inside a layout never shadows the layout's
+ * own children delivery.
+ *
+ * Defined here (a server module) rather than in `client/slot-context.ts`
+ * (`'use client'`) because RSC's client-reference proxying would replace
+ * the string value with a proxy object in the server environment. The
+ * client-side SlotOutlet receives this value via props, so it doesn't
+ * need the constant. See TIM-1191.
  */
-export function isChildSegmentOutletElement(value: unknown): boolean {
+export const LAYOUT_CHILDREN_SLOT = '\0timber:children';
+
+/**
+ * Is this value the framework-injected layout children slot outlet
+ * (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
+ * receive this as their `children` prop — a stable client reference
+ * whose cache key is stripped so layout `cache.component` hits work
+ * (design/45 §Layout Propagation).
+ *
+ * Uses a framework-reserved slot name (LAYOUT_CHILDREN_SLOT) that
+ * cannot collide with user-declared slot names, preventing context
+ * shadowing when a cached component with its own SlotsProvider is
+ * nested inside a layout. See TIM-1191.
+ *
+ * Total: the probes run against a user-controlled value, and a Proxy
+ * trap can throw — that must classify as "not the outlet" (the
+ * canonicalizer then rejects the value as unkeyable → live render), not
+ * abort the request (codex P2 on PR #890).
+ */
+export function isChildrenSlotOutletElement(value: unknown): boolean {
   try {
-    return (
-      value != null &&
-      typeof value === 'object' &&
-      'type' in value &&
-      (value as { type: unknown }).type === ChildSegmentOutlet
-    );
+    if (value == null || typeof value !== 'object') return false;
+    if (!('type' in value)) return false;
+    const el = value as { type: unknown; props?: { slot?: unknown } };
+    return el.type === SlotOutlet && el.props?.slot === LAYOUT_CHILDREN_SLOT;
   } catch {
     return false;
   }
@@ -161,7 +184,7 @@ export function wrapInSlotsProvider(
 ): React.ReactElement {
   // children passed as a prop, not a JSX child — the shell is `unknown`
   // to the type system. Same pattern as route-element-builder's `h` alias
-  // for ChildSegmentProvider.
+  // for SlotsProvider.
   const h = createElement as (...args: unknown[]) => React.ReactElement;
   return h(SlotsProvider, { values: slotValues as SlotValues, children: shell });
 }

package/src/server/prebuilt-builder.ts

@@ -46,7 +46,7 @@ import { createElement } from 'react';
 
 import { requestContextAls } from './als-registry.js';
 import { ParamCoercionError } from './route-element-builder.js';
-import { ChildSegmentOutlet } from '../client/child-segment-outlet.js';
+import { SlotOutlet } from '../client/slot-outlet.js';
 import { coerceSegmentParams } from './param-coercion.js';
 import { DenySignal, RedirectSignal } from './primitives.js';
 import {
@@ -56,6 +56,7 @@ import {
   type NestedWrapperRender,
 } from './prebuilt/capture-state.js';
 import { computeComponentCacheKey } from './prebuilt/cache-key.js';
+import { LAYOUT_CHILDREN_SLOT } from './prebuilt/slots.js';
 import { BuildTimeContextError, createBuildTimeStore } from './prebuilt/synthetic-store.js';
 import {
   getPrebuiltRegistration,
@@ -155,7 +156,7 @@ interface CandidateRoute {
   layoutsToLoad: ManifestFile[];
   /** Component IDs attributed to this route's page + layout chain. */
   componentIds: string[];
-  /** Component IDs from layout files (receive ChildSegmentOutlet as children). */
+  /** Component IDs from layout files (receive SlotOutlet as children). */
   layoutComponentIds: Set<string>;
 }
 
@@ -356,11 +357,11 @@ async function renderEntry(
     // synthetic store (segmentParams.get() inside the component).
     // Tag resolution also runs inside this scope so function-form tags
     // that read segment params see the synthetic store (codex P2 on PR #858).
-    // Layout captures get <ChildSegmentOutlet /> as children so the
-    // cached payload has a context-driven hole (design/45, TIM-1181).
+    // Layout captures get <SlotOutlet slot="children" /> as children so
+    // the cached payload has a context-driven hole (design/45, TIM-1181).
     const renderProps =
       isLayout && !('children' in props)
-        ? { ...props, children: createElement(ChildSegmentOutlet as React.FC) }
+        ? { ...props, children: createElement(SlotOutlet, { slot: LAYOUT_CHILDREN_SLOT }) }
         : props;
     bytes = await requestContextAls.run(store, async () => {
       const stream = renderToReadableStream(

package/src/server/prebuilt-runtime.ts

@@ -38,7 +38,7 @@ import { createElement } from 'react';
 import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { computeComponentCacheKey, splitSlotProps, tryCanonicalize } from './prebuilt/cache-key.js';
 import {
-  isChildSegmentOutletElement,
+  isChildrenSlotOutletElement,
   resolveSlotNames,
   prepareSlotRender,
   wrapInSlotsProvider,
@@ -196,7 +196,7 @@ function resolveKeyParams(store: {
  * exactly when production would serve the cache path rather than the
  * live fallback (dev/prod parity, codex P2 on PR #890): requires an ALS
  * store, keyable params (slot-param divergence unkeys), and keyable data
- * props (after the ChildSegmentOutlet strip).
+ * props (after the children slot outlet strip).
  */
 function isSlotRenderKeyable(dataProps: Record<string, unknown>): boolean {
   const store = requestContextAls.getStore();
@@ -204,7 +204,7 @@ function isSlotRenderKeyable(dataProps: Record<string, unknown>): boolean {
   const keyParams = resolveKeyParams(store);
   if (keyParams === null) return false;
   let keyProps = dataProps;
-  if (isChildSegmentOutletElement(keyProps.children)) {
+  if (isChildrenSlotOutletElement(keyProps.children)) {
     const { children: _children, ...rest } = keyProps;
     keyProps = rest;
   }
@@ -547,23 +547,23 @@ async function tryRevivePayload(
   if (keyParams === null) return null;
 
   // Strip `children` from the cache key ONLY when it is the framework-
-  // injected ChildSegmentOutlet. Layout components receive
-  // <ChildSegmentOutlet /> as children — a deterministic client reference
-  // that is the same on every request, so it should not vary the key.
-  // User-provided React element children (e.g., <Cached><A /></Cached>)
-  // are NOT stripped — they remain unkeyable so the component renders
-  // live, which is correct: the cache cannot distinguish <A> from <B>.
+  // injected children slot outlet (<SlotOutlet slot="children" />).
+  // Layout components receive this as children — a deterministic client
+  // reference that is the same on every request, so it should not vary
+  // the key. User-provided React element children are NOT stripped —
+  // they remain unkeyable so the component renders live, which is
+  // correct: the cache cannot distinguish <A> from <B>.
   // See design/45-cache-lifetimes.md §Layout Propagation, TIM-1181.
   // keyPropsOverride = slot component (TIM-1173): the wrapper already
   // split out slot props; only data props participate in the key. The
-  // ChildSegmentOutlet strip applies to EITHER source — a cached layout
+  // children outlet strip applies to EITHER source — a cached layout
   // declaring only named slots (slots: ['modal']) still receives the
   // framework-injected children outlet in its data props, and it must not
   // unkey the render there any more than on the non-slot path (codex P2
   // on PR #890).
   const allProps = (props ?? {}) as Record<string, unknown>;
   let keyProps = keyPropsOverride ?? allProps;
-  if (isChildSegmentOutletElement(keyProps.children)) {
+  if (isChildrenSlotOutletElement(keyProps.children)) {
     const { children: _children, ...rest } = keyProps;
     keyProps = rest;
   }

package/src/server/request-context.ts

@@ -14,7 +14,13 @@
  * and design/11-platform.md §"AsyncLocalStorage".
  */
 
-import { requestContextAls, type RequestContextStore } from './als-registry.js';
+import {
+  requestContextAls,
+  taintScopeAls,
+  markAccessorTouched,
+  type RequestContextStore,
+  type TaintScope,
+} from './als-registry.js';
 import { _setGetSearchParamsFn } from '../search-params/define.js';
 import { _setGetSegmentParamsFn } from '../segment-params/define.js';
 import { consumeSeededCookies } from './cookie-context.js';
@@ -39,6 +45,7 @@ export function getHeaders(): ReadonlyHeaders {
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
+  markAccessorTouched();
   return store.headers;
 }
 
@@ -51,6 +58,7 @@ export function getHeaders(): ReadonlyHeaders {
  * @internal — not part of the public API. Use `getHeaders().get(name)` instead.
  */
 export function getHeader(name: string): string | undefined {
+  // getHeaders() already calls markAccessorTouched()
   const headers = getHeaders();
   return headers.get(name) ?? undefined;
 }
@@ -68,6 +76,7 @@ export function getSearchParams(): URLSearchParams {
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
+  markAccessorTouched();
   return store.searchParams;
 }
 
@@ -217,6 +226,43 @@ export function getRequestSearchString(): string {
   return store?.searchString ?? '';
 }
 
+// ─── Request Accessor Taint Tracking ─────────────────────────────────────
+// Used by segment/slot skip decisions to determine whether a component
+// actually reads per-request data, replacing the AsyncFunction heuristic.
+
+/**
+ * Run a callback inside a taint tracking scope. Returns whether any
+ * request accessor (getHeaders, getSearchParams, cookies) was called
+ * during the callback's execution.
+ *
+ * Uses a dedicated ALS so concurrent async components (Flight renders
+ * siblings in parallel) each get their own isolated scope. The shared
+ * push/pop stack model was unsound under concurrency.
+ *
+ * Results are stored in the request context's taintResults map, keyed
+ * by segment/slot ID, for buildSegmentInfo() to consume.
+ *
+ * @internal — framework use only (route-element-builder.ts, slot-resolver.ts)
+ */
+export async function runInTaintScope<T>(segmentKey: string, fn: () => T | Promise<T>): Promise<T> {
+  const store = requestContextAls.getStore();
+  const scope: TaintScope = { touched: false };
+  try {
+    const result = await taintScopeAls.run(scope, fn);
+    if (store) {
+      if (!store.taintResults) store.taintResults = new Map();
+      store.taintResults.set(segmentKey, scope.touched);
+    }
+    return result;
+  } catch (error) {
+    if (store) {
+      if (!store.taintResults) store.taintResults = new Map();
+      store.taintResults.set(segmentKey, true);
+    }
+    throw error;
+  }
+}
+
 // ─── Types ────────────────────────────────────────────────────────────────
 
 /**

package/src/server/route-element-builder.ts

@@ -16,26 +16,13 @@
  */
 
 import { createElement, Fragment } from 'react';
-import { randomUUID } from 'node:crypto';
 
 import { withSpan } from './tracing.js';
 import type { RouteMatch } from './pipeline.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
 import { resolveMetadata, renderMetadataToElements } from './metadata.js';
 import type { Metadata } from './types.js';
-import {
-  METADATA_ROUTE_CONVENTIONS,
-  getMetadataRouteAutoLink,
-  resolveServePathForFile,
-} from './metadata-routes.js';
-
-// In dev mode, use a per-startup nonce for metadata route cache busting
-// instead of per-file content hashes (avoids rehashing on every request).
-let _devNonce: string | undefined;
-function getDevNonce(): string {
-  _devNonce ??= randomUUID().slice(0, 8);
-  return _devNonce;
-}
+import { collectMetadataRouteHeadElements } from './metadata-routes.js';
 import { DenySignal, RedirectSignal } from './primitives.js';
 import { AccessGate } from './access-gate.js';
 import { requestContextAls } from './als-registry.js';
@@ -46,37 +33,18 @@ import {
   setDenyStatus,
 } from './deny-boundary.js';
 import type { DenyPageEntry } from './deny-boundary.js';
-import { resolveSlotElement } from './slot-resolver.js';
+import { LAYOUT_CHILDREN_SLOT } from './prebuilt/slots.js';
+import { resolveSlotProps, type SlotSkipEntry } from './slot-resolver.js';
 import { SegmentProvider } from '../client/segment-context.js';
 import { SegmentOutlet } from '../client/segment-outlet.js';
-import { ChildSegmentOutlet } from '../client/child-segment-outlet.js';
-import { ChildSegmentProvider } from '../client/child-segment-provider.js';
+import { SlotOutlet } from '../client/slot-outlet.js';
+import { SlotsProvider } from '../client/slot-provider.js';
 
 import { wrapSegmentWithErrorBoundaries } from './error-boundary-wrapper.js';
 import type { InterceptionContext } from './pipeline.js';
-import { shouldSkipSegment, computeSegmentKeys } from './state-tree-diff.js';
-import type { HeadElement } from './metadata.js';
-
-/**
- * Convert HeadElement descriptors to React elements for Float hoisting.
- *
- * React 19 Float hoists <title>, <meta>, and <link> rendered anywhere in
- * the tree into <head> during SSR, and manages them in document.head
- * during client-side rendering. This replaces the X-Timber-Head header
- * side-channel and the imperative client DOM applier.
- */
-export function headElementsToReact(elements: HeadElement[]): React.ReactElement {
-  const children: React.ReactElement[] = [];
-  for (let i = 0; i < elements.length; i++) {
-    const el = elements[i];
-    if (el.tag === 'title' && el.content !== undefined) {
-      children.push(createElement('title', { key: `t${i}` }, el.content));
-    } else if (el.attrs) {
-      children.push(createElement(el.tag, { key: `h${i}`, ...el.attrs }));
-    }
-  }
-  return createElement(Fragment, null, ...children);
-}
+import { shouldSkipSegment, computeSegmentKeys, type ClientStateTree } from './state-tree-diff.js';
+import { runInTaintScope } from './request-context.js';
+import { headElementsToReact } from './metadata.js';
 import { loadModule } from './safe-load.js';
 
 /**
@@ -191,6 +159,12 @@ export interface RouteElementResult {
    * See TIM-1045 (pages), TIM-1208 (layouts).
    */
   shellSettled?: Promise<void>;
+  /**
+   * Slot metadata for the X-Timber-Segments header. Contains info about
+   * all parallel route slots encountered during element tree construction,
+   * enabling the client to populate its segment cache with slot entries.
+   */
+  slotSkipInfo: SlotSkipEntry[];
 }
 
 // ─── Module Processing Helpers ─────────────────────────────────────────────
@@ -273,7 +247,7 @@ export async function buildRouteElement(
   req: Request,
   match: RouteMatch,
   interception?: InterceptionContext,
-  clientStateTree?: Set<string> | null,
+  clientStateTree?: ClientStateTree | null,
   metadataRouteHashes?: Record<string, string>
 ): Promise<RouteElementResult> {
   const segments = match.segments;
@@ -408,79 +382,15 @@ export async function buildRouteElement(
   const headElements = renderMetadataToElements(resolvedMetadata);
 
   // Auto-link metadata route files (icon, apple-icon, manifest, opengraph-image).
-  // opengraph-image emits both og:image and twitter:image (no separate twitter-image convention).
-  // Skip OG auto-linking when the user already declared images in metadata.
   // See design/16-metadata.md §"Auto-Linking"
-  const hasUserOgImage = Boolean(resolvedMetadata.openGraph?.images);
-  const hasUserTwitterImage = Boolean(resolvedMetadata.twitter?.images);
-  const requestUrl = new URL(req.url);
-  const requestPathname = requestUrl.pathname;
-  // In dev mode, use the request origin so OG URLs resolve to localhost.
-  // In production, use metadataBase (the canonical domain).
-  const ogBase =
-    process.env.NODE_ENV !== 'production'
-      ? new URL(requestUrl.origin)
-      : resolvedMetadata.metadataBase;
-
-  for (let si = 0; si < segments.length; si++) {
-    const segment = segments[si];
-    if (!segment.metadataRoutes) continue;
-    // Skip auto-linking for denied segments — same gate as metadata().
-    if (si >= firstDeniedIndex) continue;
-    for (const baseName of Object.keys(segment.metadataRoutes)) {
-      const convention = METADATA_ROUTE_CONVENTIONS[baseName];
-      if (!convention) continue;
-      // Non-nestable routes only auto-link from root
-      if (!convention.nestable && segment.urlPath !== '/') continue;
-      // Skip auto-linking entirely if user declared openGraph.images (covers both og + twitter)
-      if (convention.type === 'opengraph-image' && hasUserOgImage) continue;
-      // Build the href using the actual request path (not the pattern with [param]).
-      // For nestable routes, the metadata route sits under the same resolved path
-      // as the page. For root-only routes, use '/'.
-      const resolvedPrefix = convention.nestable
-        ? requestPathname === '/'
-          ? ''
-          : requestPathname
-        : '';
-      const metaFile = segment.metadataRoutes[baseName];
-      const fileServePath = metaFile?.filePath
-        ? resolveServePathForFile(baseName, metaFile.filePath)
-        : convention.serveExtension
-          ? `${convention.servePath}.${convention.serveExtension}`
-          : convention.servePath;
-      let href = `${resolvedPrefix}/${fileServePath}`;
-      // Append cache-bust query param for image metadata routes
-      if (convention.type === 'opengraph-image') {
-        const fileHash = metaFile?.filePath ? metadataRouteHashes?.[metaFile.filePath] : undefined;
-        const cacheBust = fileHash ?? getDevNonce();
-        href = `${href}?${cacheBust}`;
-      }
-      // Resolve to absolute URL for og:image/twitter:image (social crawlers need full URLs)
-      if (ogBase && convention.type === 'opengraph-image') {
-        href = new URL(href, ogBase).toString();
-      }
-      for (const autoLink of getMetadataRouteAutoLink(convention.type, href)) {
-        // Skip auto-linked twitter:image when user declared twitter.images
-        if (
-          hasUserTwitterImage &&
-          autoLink.tag === 'meta' &&
-          'name' in autoLink &&
-          autoLink.name === 'twitter:image'
-        )
-          continue;
-        if (autoLink.tag === 'link') {
-          const attrs: Record<string, string> = { rel: autoLink.rel, href: autoLink.href };
-          if (autoLink.type) attrs.type = autoLink.type;
-          headElements.push({ tag: 'link', attrs });
-        } else {
-          const attrs: Record<string, string> = { content: autoLink.content };
-          if (autoLink.property) attrs.property = autoLink.property;
-          if (autoLink.name) attrs.name = autoLink.name;
-          headElements.push({ tag: 'meta', attrs });
-        }
-      }
-    }
-  }
+  const autoLinkedElements = collectMetadataRouteHeadElements(
+    segments,
+    firstDeniedIndex,
+    resolvedMetadata,
+    new URL(req.url),
+    metadataRouteHashes
+  );
+  headElements.push(...autoLinkedElements);
 
   // Convert HeadElement descriptors to React elements for Float hoisting.
   // Placed at the page segment level so they're always re-rendered on
@@ -491,7 +401,7 @@ export async function buildRouteElement(
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
   // Shell settlement tracking (TIM-1045 pages, TIM-1208 layouts).
-  // ChildSegmentProvider is 'use client', so React Flight eagerly
+  // SlotsProvider is 'use client', so React Flight eagerly
   // serializes both the layout and child content as independent subtrees —
   // the page can settle before an outer layout. We need all deny-capable
   // components to settle before committing the HTTP status.
@@ -637,6 +547,14 @@ export async function buildRouteElement(
 
   let outermostSegmentProvider: React.ReactElement | null = null;
 
+  // Slot caching: the departing URL (X-Timber-URL header) and the
+  // destination URL (request URL) are compared to determine which
+  // slots' content has changed. Full URLs (with search) are passed
+  // so slot pages reading getSearchParams() are correctly re-rendered.
+  const departingUrl = req.headers.get('X-Timber-URL');
+  const destinationUrl = req.url;
+  const slotSkipInfo: SlotSkipEntry[] = [];
+
   for (let i = segments.length - 1; i >= 0; i--) {
     const segment = segments[i];
     const isLeaf = i === segments.length - 1;
@@ -682,9 +600,15 @@ export async function buildRouteElement(
     // This prevents leaking layout UI (sidebars, nav) on denied pages.
     // See design/04-authorization.md §"Access Failure".
     if (layoutComponent) {
-      // Resolve parallel slots for this layout.
-      // Compute the parent tree path so slots can build their full
-      // segment path for per-slot param storage in ALS.
+      // Resolve parallel slots for this layout, wrapping each in
+      // SegmentOutlet for client-side caching. Unchanged slots get
+      // skip=true so the client keeps its cached content.
+      //
+      // Skip slot resolution for denied segments (TIM-1229): when a
+      // parent segment's AccessGate denies, the layout never renders,
+      // so slot props are never consumed. Resolving them is wasted work
+      // and could trigger side effects in slot access.ts functions.
+      const segmentId = segmentKeys[i];
       const parentTreePath =
         '/' +
         segments
@@ -692,17 +616,21 @@ export async function buildRouteElement(
           .map((s) => s.segmentName)
           .filter(Boolean)
           .join('/');
-      const slotProps: Record<string, unknown> = {};
-      const slotEntries = Object.entries(segment.slots ?? {});
-      for (const [slotName, slotNode] of slotEntries) {
-        slotProps[slotName] = await resolveSlotElement(
-          slotNode as ManifestSegmentNode,
-          match,
-          h,
-          interception,
-          parentTreePath
-        );
-      }
+      const slotProps =
+        i >= firstDeniedIndex
+          ? {}
+          : await resolveSlotProps({
+              segment,
+              segmentId,
+              match,
+              h,
+              interception,
+              parentTreePath,
+              departingUrl,
+              destinationUrl,
+              clientStateTree: clientStateTree as ClientStateTree | null,
+              slotSkipInfo,
+            });
 
       // '/'.split('/') → ['', ''] (length 2), but root should be [''] (length 1).
       // The extra empty string makes useSelectedLayoutSegment skip the first URL segment.
@@ -710,16 +638,14 @@ export async function buildRouteElement(
       const segmentPath = rawPath.length === 2 && rawPath[1] === '' ? [''] : rawPath;
       const parallelRouteKeys = Object.keys(segment.slots ?? {});
 
-      const segmentId = segmentKeys[i];
-
       // Build the layout element.
-      // Layouts receive <ChildSegmentOutlet /> as children — a stable client
-      // reference — instead of the varying inner content. The actual child
-      // content is provided via ChildSegmentProvider above the layout.
-      // This makes layout cache.component hits possible: the cached payload
-      // contains a deterministic children reference, not varying content.
+      // Layouts receive <SlotOutlet slot={LAYOUT_CHILDREN_SLOT} /> as
+      // children — a stable client reference — instead of the varying
+      // inner content. The actual child content is provided via
+      // SlotsProvider above the layout. Uses a reserved slot name to
+      // avoid collision with user-declared cache.component slots.
       // See design/45-cache-lifetimes.md §Layout Propagation.
-      const childOutlet = h(ChildSegmentOutlet, {});
+      const childOutlet = h(SlotOutlet, { slot: LAYOUT_CHILDREN_SLOT });
       let layoutElement: React.ReactElement;
       if (isClientReference(layoutComponent)) {
         layoutElement = h(layoutComponent, {
@@ -737,10 +663,13 @@ export async function buildRouteElement(
         const layoutDenyPages = denyPageChains.get(i);
         const hasLayoutDenyChain = !!layoutDenyPages && layoutDenyPages.length > 0;
         const onLayoutSettled = hasLayoutDenyChain ? trackShellComponent() : undefined;
+        const taintKey = segmentId;
         const TracedLayout = async (props: Record<string, unknown>) => {
           try {
-            return await withSpan('timber.layout', { 'timber.segment': segmentId }, () =>
-              (layoutComponentRef as (props: Record<string, unknown>) => unknown)(props)
+            return await runInTaintScope(taintKey, () =>
+              withSpan('timber.layout', { 'timber.segment': segmentId }, () =>
+                (layoutComponentRef as (props: Record<string, unknown>) => unknown)(props)
+              )
             );
           } catch (error: unknown) {
             if (error instanceof DenySignal && layoutDenyPages) {
@@ -750,8 +679,6 @@ export async function buildRouteElement(
                 return denyElement;
               }
             }
-            // Non-deny errors (RedirectSignal, runtime errors) propagate normally
-            // to onError — signalDetected / renderError handling covers those.
             throw error;
           } finally {
             onLayoutSettled?.();
@@ -763,10 +690,10 @@ export async function buildRouteElement(
         });
       }
 
-      // Wrap the layout in ChildSegmentProvider so ChildSegmentOutlet
-      // (inside the layout's children) can read the actual child content.
-      layoutElement = h(ChildSegmentProvider, {
-        childContent: element,
+      // Wrap the layout in SlotsProvider so the SlotOutlet inside the
+      // layout's children can read the actual child content.
+      layoutElement = h(SlotsProvider, {
+        values: { [LAYOUT_CHILDREN_SLOT]: element },
         children: layoutElement,
       });
 
@@ -841,5 +768,6 @@ export async function buildRouteElement(
     deferSuspenseFor,
     skippedSegments,
     shellSettled,
+    slotSkipInfo,
   };
 }