From 2003ac620c3a6a79e39a37cf1cb0c7e21897f245 Mon Sep 17 00:00:00 2001
From: Mohamed Mansour <mmansour@microsoft.com>
Date: Wed, 19 Aug 2026 22:56:16 -0700
Subject: [PATCH 1/5] feat: support component-local streaming boundaries

Replace fixed entry boundaries with runtime occurrences, resumable rendering, span-aware hydration, and start/resume/update APIs across all hosts.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .gitattributes                                |    1 +
 .github/workflows/pr.yml                      |  856 +++---
 DESIGN.md                                     | 1322 ++++-----
 crates/webui-cli/README.md                    |   18 +-
 crates/webui-cli/src/commands/inspect.rs      |    1 +
 crates/webui-cli/src/commands/serve.rs        |   10 +
 .../src/commands/serve/streaming_api.rs       |  843 ++++--
 crates/webui-ffi/README.md                    |   18 +
 crates/webui-ffi/benches/protocol_bench.rs    |    2 +
 crates/webui-ffi/include/webui_ffi.h          |  278 +-
 crates/webui-ffi/src/lib.rs                   |  785 ++++--
 crates/webui-ffi/tests/ffi_test.rs            |  639 +++--
 crates/webui-handler/README.md                |   25 +
 .../benches/bootstrap_state_bench.rs          |    8 +
 crates/webui-handler/benches/handler_bench.rs |   12 +
 .../benches/streaming_hydration_bench.rs      |   86 +-
 crates/webui-handler/src/css_module.rs        |   44 +
 crates/webui-handler/src/lib.rs               | 2458 +++--------------
 crates/webui-handler/src/plugin/fast_v3.rs    |   30 +
 crates/webui-handler/src/plugin/webui.rs      |    3 +
 crates/webui-handler/src/route_handler.rs     |  281 +-
 crates/webui-handler/src/route_matcher.rs     |    1 +
 .../webui-handler/src/streaming/checkpoint.rs |  452 +--
 crates/webui-handler/src/streaming/error.rs   |  244 +-
 crates/webui-handler/src/streaming/mod.rs     |  370 ++-
 crates/webui-handler/src/streaming/owned.rs   |  312 +--
 crates/webui-handler/src/streaming/plan.rs    |  181 --
 crates/webui-handler/src/streaming/root.rs    |   52 +-
 crates/webui-handler/src/streaming/session.rs |  816 +++---
 crates/webui-handler/src/streaming/state.rs   |  259 +-
 crates/webui-handler/src/streaming/vm.rs      | 1487 ++++++++++
 crates/webui-handler/tests/streaming_v2.rs    |  781 ++++++
 crates/webui-node/README.md                   |   22 +
 crates/webui-node/src/lib.rs                  |  253 +-
 crates/webui-parser/src/diagnostic.rs         |   23 +-
 crates/webui-parser/src/lib.rs                | 1261 +++++++--
 crates/webui-parser/src/plugin/webui.rs       |   49 +-
 crates/webui-parser/src/route_parser.rs       |    1 +
 .../webui-protocol/benches/protocol_bench.rs  |   19 +
 crates/webui-protocol/proto/webui.proto       |   57 +-
 crates/webui-protocol/src/gen_webui.rs        |   93 +-
 crates/webui-protocol/src/lib.rs              |  314 ++-
 crates/webui-python/README.md                 |   29 +-
 .../benchmarks/benchmark_renderer.py          |   47 +-
 .../python/microsoft_webui/__init__.py        |   12 +-
 .../python/microsoft_webui/_api.py            |   94 +-
 .../python/microsoft_webui/_native.pyi        |   30 +-
 crates/webui-python/src/lib.rs                |  131 +-
 crates/webui-python/tests/compare_fixture.py  |   20 +-
 crates/webui-python/tests/conftest.py         |   16 +
 .../webui-python/tests/fixtures/protocol.bin  |  Bin 1017 -> 923 bytes
 .../tests/fixtures/streaming-app/index.html   |   22 +
 .../tests/fixtures/streaming_protocol.bin     |   74 +
 .../tests/test_compare_fixture.py             |   49 +
 crates/webui-python/tests/test_package.py     |    6 +
 crates/webui-python/tests/test_streaming.py   |  236 +-
 crates/webui-test-utils/src/lib.rs            |   62 +
 crates/webui-wasm/README.md                   |   23 +-
 crates/webui-wasm/src/handler.rs              |  260 +-
 .../webui/benches/component_assets_bench.rs   |    4 +
 crates/webui/src/lib.rs                       |   54 +-
 crates/webui/src/server.rs                    |    6 +
 docs/.webui-press/config.json                 |    6 +-
 docs/ai/SKILL.md                              |  104 +-
 docs/guide/cli/index.md                       |   36 +-
 docs/guide/concepts/directives/boundary.md    |  250 +-
 docs/guide/concepts/directives/index.md       |    2 +-
 docs/guide/concepts/hydration.md              |  170 +-
 docs/guide/concepts/interactivity.md          |    6 +-
 docs/guide/concepts/performance.md            |   41 +-
 docs/guide/installation.md                    |    3 +
 docs/guide/integrations/dotnet.md             |   90 +
 docs/guide/integrations/ffi.md                |  102 +-
 docs/guide/integrations/index.md              |    2 +-
 docs/guide/integrations/node.md               |   77 +-
 docs/guide/integrations/python.md             |   78 +-
 docs/guide/integrations/rust.md               |  118 +-
 docs/guide/integrations/wasm.md               |   46 +-
 dotnet/src/Microsoft.WebUI/NativeBindings.cs  |  183 +-
 .../src/Microsoft.WebUI/StreamingSession.cs   |  424 ++-
 .../Microsoft.WebUI.Tests.csproj              |    9 +-
 .../StreamingSessionTests.cs                  |  228 +-
 .../fixtures/streaming-app/index.html         |   14 +-
 examples/README.md                            |    2 +-
 examples/app/service-worker/README.md         |   20 +-
 .../service-worker/public/api/metrics.json    |    2 +-
 .../service-worker/scripts/check-render.ts    |   70 +-
 examples/app/service-worker/src/index.html    |   27 +-
 .../app/service-worker/src/service-worker.ts  |  108 +-
 .../src/wasm/handler/webui_wasm_handler.d.ts  |   33 +-
 .../tests/service-worker.spec.ts              |   12 +-
 examples/app/streaming/README.md              |   46 +-
 examples/app/streaming/server/src/index.ts    |    1 +
 .../app/streaming/server/src/pacing.test.ts   |   87 +-
 examples/app/streaming/server/src/pacing.ts   |   37 +-
 .../streaming/server/src/stream-protocol.ts   |   60 +-
 examples/app/streaming/src/index.html         |   77 +-
 examples/app/streaming/src/index.ts           |    7 +-
 .../src/streaming-page/streaming-page.css     |   25 +
 .../src/streaming-page/streaming-page.html    |   46 +
 .../app/streaming/tests/streaming.spec.ts     |   46 +-
 examples/integration/node/README.md           |   38 +-
 examples/integration/node/streaming-server.js |   63 +-
 examples/integration/rust/README.md           |   14 +
 examples/integration/rust/src/main.rs         |   58 +-
 .../streaming-browser-bench/README.md         |   37 +-
 .../tests/hydration_matrix.spec.ts            |   71 +-
 .../tests/lib/lazy-fixtures.ts                |   12 +-
 .../tests/lib/scenarios.ts                    |   50 +-
 packages/webui-framework/README.md            |   30 +-
 .../src/streaming-activation.ts               |    9 +-
 .../src/streaming-bootstrap.ts                |   14 +-
 .../webui-framework/src/streaming-cleanup.ts  |   73 +-
 .../src/streaming-coordinator.ts              |  199 +-
 .../webui-framework/src/streaming-deferred.ts |  208 +-
 packages/webui-framework/src/streaming-dom.ts |  113 +-
 .../webui-framework/src/streaming-mode.ts     |   16 +-
 .../src/streaming-pipeline.test.ts            |  994 ++++++-
 .../webui-framework/src/streaming-protocol.ts |   44 +-
 .../webui-framework/src/streaming-spans.ts    |  294 ++
 .../webui-framework/src/streaming.test.ts     |   45 +-
 .../src/template-element.test.ts              |  134 +
 .../webui-framework/src/template-element.ts   |   55 +-
 packages/webui/README.md                      |   53 +-
 packages/webui/src/index.ts                   |  143 +-
 packages/webui/test/integration.test.ts       |  247 +-
 126 files changed, 13949 insertions(+), 7702 deletions(-)
 delete mode 100644 crates/webui-handler/src/streaming/plan.rs
 create mode 100644 crates/webui-handler/src/streaming/vm.rs
 create mode 100644 crates/webui-handler/tests/streaming_v2.rs
 create mode 100644 crates/webui-python/tests/fixtures/streaming-app/index.html
 create mode 100644 crates/webui-python/tests/fixtures/streaming_protocol.bin
 create mode 100644 crates/webui-python/tests/test_compare_fixture.py
 create mode 100644 docs/guide/integrations/dotnet.md
 create mode 100644 examples/app/streaming/src/streaming-page/streaming-page.css
 create mode 100644 examples/app/streaming/src/streaming-page/streaming-page.html
 create mode 100644 packages/webui-framework/src/streaming-spans.ts

diff --git a/.gitattributes b/.gitattributes
index 2d7ff98c4..896e62e13 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -17,6 +17,7 @@
 *.pdf binary
 *.zip binary
 *.gz binary
+*.bin binary
 *.wasm binary
 *.woff binary
 *.woff2 binary
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 8d53b1a7c..1283865fa 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,420 +1,436 @@
-name: PR Checks
-
-on:
-  pull_request:
-    branches: [ main ]
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  # ── Phase 1: Lint (fast, fail-fast) ────────────────────────────────
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          skip-build: 'true'
-          rust-components: clippy, rustfmt
-
-      - name: License headers
-        run: cargo xtask license-headers
-
-      - name: Format
-        run: cargo fmt --all --check
-
-      - name: Clippy
-        run: cargo clippy --workspace -- -D warnings
-
-      - name: Deny (licenses & advisories)
-        run: |
-          cargo install --locked cargo-deny || true
-          cargo deny check
-
-  # ── Phase 2: Test (Ubuntu) ─────────────────────────────────────────
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    needs: lint
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          skip-build: 'true'
-
-      - name: Test
-        run: cargo test --workspace
-
-  # ── Phase 2: Build (Linux + macOS + Windows) ────────────────────────
-  build-linux:
-    name: Build (Linux)
-    runs-on: ubuntu-latest
-    needs: lint
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          shared-cache-key: ubuntu-build
-
-  build-macos:
-    name: Build (macOS)
-    runs-on: macos-latest-large
-    needs: lint
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-
-  build-windows:
-    name: Build (Windows)
-    runs-on: windows-latest
-    needs: lint
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-
-  # ── Phase 3: E2E (Ubuntu, after Linux build) ───────────────────────
-  e2e:
-    name: E2E (Ubuntu)
-    runs-on: ubuntu-latest
-    needs: build-linux
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          shared-cache-key: ubuntu-build
-          cache-on-failure: 'true'
-
-      - name: Install Playwright browsers
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Run E2E tests
-        run: cargo xtask e2e
-
-      - name: Regenerate baselines (on failure)
-        if: failure()
-        run: cargo xtask e2e --update-snapshots
-
-      - name: Upload updated baselines (on failure)
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-updated-baselines
-          path: |
-            examples/app/*/tests/*.spec.ts-snapshots/
-            packages/*/tests/*.spec.ts-snapshots/
-          retention-days: 7
-
-      - name: Upload test results (on failure)
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-test-results
-          path: |
-            examples/app/*/test-results/
-            packages/*/test-results/
-          retention-days: 7
-
-  # ── Phase 2: WASM (Ubuntu) ─────────────────────────────────────────
-  wasm:
-    name: WASM
-    runs-on: ubuntu-latest
-    needs: lint
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/setup-wasm
-
-  # ── Phase 2: Docs ─────────────────────────────────────────────────
-  docs:
-    name: Docs
-    runs-on: ubuntu-latest
-    needs: build-linux
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          shared-cache-key: ubuntu-build
-
-      - name: Build docs
-        run: pnpm --filter @webui/docs... build
-
-  # ── Phase 3: FFI bindings (after Linux build) ──────────────────────
-  # Exercises the C ABI from Python, Go, and C#. Depends on build-linux and
-  # shares its cache key: these are the same debug workspace crates that job
-  # already compiled, so the cargo steps below are a cache hit rather than a
-  # second full build.
-  ffi:
-    name: FFI
-    runs-on: ubuntu-latest
-    needs: build-linux
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          skip-build: 'true'
-          shared-cache-key: ubuntu-build
-          dotnet: '8.0.x'
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.12'
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: '1.21'
-
-      - name: Build FFI library and protocol fixture
-        run: |
-          cargo build -p microsoft-webui-ffi
-          cargo run -p microsoft-webui-cli -- build \
-            crates/webui-ffi/tests/fixtures/app \
-            --out crates/webui-ffi/tests/fixtures/protocol.bin
-
-      - name: Run Python FFI tests
-        run: python crates/webui-ffi/tests/python/test_webui_ffi.py -v
-        env:
-          LD_LIBRARY_PATH: target/debug
-
-      - name: Run Go FFI tests
-        working-directory: crates/webui-ffi/tests/go
-        run: go test -v
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}/target/debug
-          CGO_LDFLAGS: -L${{ github.workspace }}/target/debug -lwebui_ffi -lm -ldl -lpthread
-
-      - name: Run C# FFI tests
-        working-directory: crates/webui-ffi/tests/csharp
-        run: dotnet test -v normal
-        env:
-          LD_LIBRARY_PATH: ${{ github.workspace }}/target/debug
-
-  # ── Phase 2: Python wheels ─────────────────────────────────────────
-  # Build every wheel in the release contract. The x64 wheels feed python-test
-  # below; the ARM64 wheels are cross-compiled exactly as the release pipeline
-  # cross-compiles them, so an ARM64 build break surfaces on the PR that causes
-  # it. They are never installed here - that needs ARM64 hardware.
-  python-wheel:
-    name: Python wheel (${{ matrix.platform.label }})
-    runs-on: ${{ matrix.platform.os }}
-    needs: lint
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - label: Linux x64
-            os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-            platform_tag: manylinux_2_17_x86_64.manylinux2014_x86_64
-            image: messense/manylinux2014-cross:x86_64@sha256:13670ccc63c35e072661938181c046243c01d7bca7976b3914177fb9b162998d
-            artifact: python-wheel-linux-x64
-          - label: macOS x64
-            os: macos-latest-large
-            target: x86_64-apple-darwin
-            platform_tag: macosx_10_12_x86_64
-            artifact: python-wheel-macos-x64
-          - label: Windows x64
-            os: windows-latest
-            target: x86_64-pc-windows-msvc
-            platform_tag: win_amd64
-            artifact: python-wheel-windows-x64
-          - label: Linux ARM64
-            os: ubuntu-latest
-            target: aarch64-unknown-linux-gnu
-            platform_tag: manylinux_2_17_aarch64.manylinux2014_aarch64
-            image: messense/manylinux2014-cross:aarch64@sha256:32c92568ebee8db53e0598c21bcd06a6dd1649d45d507646a8a49313c50325f8
-            artifact: ''
-          - label: macOS ARM64
-            os: macos-latest-large
-            target: aarch64-apple-darwin
-            platform_tag: macosx_11_0_arm64
-            artifact: ''
-          - label: Windows ARM64
-            os: windows-latest
-            target: aarch64-pc-windows-msvc
-            platform_tag: win_arm64
-            artifact: ''
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # Linux wheels build entirely inside the pinned manylinux image, so the
-      # host toolchain is only needed for the targets built natively here.
-      - uses: ./.github/actions/build
-        if: runner.os != 'Linux'
-        with:
-          skip-build: 'true'
-          rust-targets: ${{ matrix.platform.target }}
-          shared-cache-key: python-${{ matrix.platform.target }}
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.11'
-
-      # abi3 needs no target interpreter and `generate-import-lib` synthesizes
-      # the Windows ARM64 import library, so every target cross-compiles here.
-      - name: Build wheel
-        if: runner.os != 'Linux'
-        shell: bash
-        run: |
-          set -euo pipefail
-          python -m pip install --upgrade "maturin==1.14.1"
-          cargo xtask publish-build --target "${{ matrix.platform.target }}" --python-only
-
-      - name: Build manylinux wheel
-        if: runner.os == 'Linux'
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm --platform linux/amd64 \
-            -v "$GITHUB_WORKSPACE:/io" -w /io "${{ matrix.platform.image }}" \
-            bash crates/webui-python/scripts/build-manylinux-wheel.sh \
-              "${{ matrix.platform.target }}"
-
-      - name: Validate wheel name, tags, and license metadata
-        shell: bash
-        run: |
-          set -euo pipefail
-          python crates/webui-python/tests/validate_wheel.py \
-            publish/python "${{ matrix.platform.platform_tag }}"
-          python crates/webui-python/tests/validate_artifacts.py publish/python/*.whl
-
-      - name: Upload wheel
-        if: matrix.platform.artifact != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.platform.artifact }}
-          path: publish/python/*.whl
-          if-no-files-found: error
-          retention-days: 1
-
-  # ── Phase 3: Python tests (after wheels) ───────────────────────────
-  # One abi3 wheel must serve every supported interpreter, so the Linux wheel is
-  # installed on each CPython. macOS and Windows only re-verify that the wheel
-  # loads on its platform, which 3.11 already proves.
-  python-test:
-    name: Python test (${{ matrix.platform.label }} / CPython ${{ matrix.python }})
-    runs-on: ${{ matrix.platform.os }}
-    needs: python-wheel
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - label: Linux x64
-            os: ubuntu-latest
-            artifact: python-wheel-linux-x64
-        python: ['3.11', '3.12', '3.13', '3.14']
-        include:
-          - platform:
-              label: macOS x64
-              os: macos-latest-large
-              artifact: python-wheel-macos-x64
-            python: '3.11'
-          - platform:
-              label: Windows x64
-              os: windows-latest
-              artifact: python-wheel-windows-x64
-            python: '3.11'
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ matrix.python }}
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ matrix.platform.artifact }}
-          path: publish/python
-
-      - name: Install the built wheel and test it
-        shell: bash
-        run: |
-          set -euo pipefail
-          python -m pip install --upgrade "pytest>=8.3,<10"
-          python -m pip install --force-reinstall --no-deps --no-index publish/python/*.whl
-          python -m pytest crates/webui-python/tests -q
-
-      - name: Validate lint, strict typing, and stubs
-        if: runner.os == 'Linux' && matrix.python == '3.11'
-        working-directory: crates/webui-python
-        run: |
-          python -m pip install --upgrade "mypy>=1.19,<2" "ruff>=0.15,<1"
-          python -m ruff check python tests benchmarks
-          python -m mypy
-          python -m mypy.stubtest microsoft_webui
-
-  # ── Phase 3: Python fixture drift (after Linux build) ──────────────
-  # The committed protocol fixture is a build output, so rebuild it and fail if
-  # it drifted, keeping the Python tests from asserting against a stale binary.
-  python-fixture:
-    name: Python fixture
-    runs-on: ubuntu-latest
-    needs: build-linux
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ./.github/actions/build
-        with:
-          skip-build: 'true'
-          shared-cache-key: ubuntu-build
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.11'
-
-      - name: Verify the release-target contract is restated consistently
-        run: python crates/webui-python/tests/validate_release_targets.py
-
-      - name: Rebuild and compare the protocol fixture
-        run: |
-          set -euo pipefail
-          output=target/python-fixture-check
-          rm -rf "$output"
-          cargo run --quiet -p microsoft-webui-cli -- build \
-            crates/webui-python/tests/fixtures/app --plugin webui --out "$output"
-          cargo run --quiet -p microsoft-webui-cli -- inspect \
-            crates/webui-python/tests/fixtures/protocol.bin > "$output/committed.json"
-          cargo run --quiet -p microsoft-webui-cli -- inspect \
-            "$output/protocol.bin" > "$output/generated.json"
-          python crates/webui-python/tests/compare_fixture.py \
-            "$output/committed.json" "$output/generated.json"
-          cmp crates/webui-python/tests/fixtures/greeting-card.css \
-            "$output/greeting-card.css"
-
-  # ── Gate: one stable required check ────────────────────────────────
-  # Branch protection can only require per-job contexts, so requiring the jobs
-  # individually means editing that list every time one is added, renamed, or
-  # removed. Require this job instead: it is the only context that has to be
-  # protected, and it stays correct as the matrix above evolves.
-  pr-checks:
-    name: PR Checks
-    runs-on: ubuntu-latest
-    if: always()
-    needs:
-      - lint
-      - test
-      - build-linux
-      - build-macos
-      - build-windows
-      - e2e
-      - wasm
-      - docs
-      - ffi
-      - python-wheel
-      - python-test
-      - python-fixture
-    steps:
-      # `needs` collapses each matrix to a single result, so this covers every
-      # wheel and interpreter leg too. Skipped counts as failure: nothing here
-      # is conditionally skipped, so a skip only happens when a dependency
-      # failed and took its dependents with it.
-      - name: Verify every job succeeded
-        if: >-
-          contains(needs.*.result, 'failure') ||
-          contains(needs.*.result, 'cancelled') ||
-          contains(needs.*.result, 'skipped')
-        run: |
-          echo "::error::One or more PR checks did not succeed."
-          exit 1
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # ── Phase 1: Lint (fast, fail-fast) ────────────────────────────────
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          skip-build: 'true'
+          rust-components: clippy, rustfmt
+
+      - name: License headers
+        run: cargo xtask license-headers
+
+      - name: Format
+        run: cargo fmt --all --check
+
+      - name: Clippy
+        run: cargo clippy --workspace -- -D warnings
+
+      - name: Deny (licenses & advisories)
+        run: |
+          cargo install --locked cargo-deny || true
+          cargo deny check
+
+  # ── Phase 2: Test (Ubuntu) ─────────────────────────────────────────
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          skip-build: 'true'
+
+      - name: Test
+        run: cargo test --workspace
+
+  # ── Phase 2: Build (Linux + macOS + Windows) ────────────────────────
+  build-linux:
+    name: Build (Linux)
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          shared-cache-key: ubuntu-build
+
+  build-macos:
+    name: Build (macOS)
+    runs-on: macos-latest-large
+    needs: lint
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+
+  build-windows:
+    name: Build (Windows)
+    runs-on: windows-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+
+  # ── Phase 3: E2E (Ubuntu, after Linux build) ───────────────────────
+  e2e:
+    name: E2E (Ubuntu)
+    runs-on: ubuntu-latest
+    needs: build-linux
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          shared-cache-key: ubuntu-build
+          cache-on-failure: 'true'
+
+      - name: Install Playwright browsers
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Run E2E tests
+        run: cargo xtask e2e
+
+      - name: Regenerate baselines (on failure)
+        if: failure()
+        run: cargo xtask e2e --update-snapshots
+
+      - name: Upload updated baselines (on failure)
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-updated-baselines
+          path: |
+            examples/app/*/tests/*.spec.ts-snapshots/
+            packages/*/tests/*.spec.ts-snapshots/
+          retention-days: 7
+
+      - name: Upload test results (on failure)
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-test-results
+          path: |
+            examples/app/*/test-results/
+            packages/*/test-results/
+          retention-days: 7
+
+  # ── Phase 2: WASM (Ubuntu) ─────────────────────────────────────────
+  wasm:
+    name: WASM
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup-wasm
+
+  # ── Phase 2: Docs ─────────────────────────────────────────────────
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+    needs: build-linux
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          shared-cache-key: ubuntu-build
+
+      - name: Build docs
+        run: pnpm --filter @webui/docs... build
+
+  # ── Phase 3: FFI bindings (after Linux build) ──────────────────────
+  # Exercises the C ABI from Python, Go, and C#. Depends on build-linux and
+  # shares its cache key: these are the same debug workspace crates that job
+  # already compiled, so the cargo steps below are a cache hit rather than a
+  # second full build.
+  ffi:
+    name: FFI
+    runs-on: ubuntu-latest
+    needs: build-linux
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          skip-build: 'true'
+          shared-cache-key: ubuntu-build
+          dotnet: '8.0.x'
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.21'
+
+      - name: Build FFI library and protocol fixture
+        run: |
+          cargo build -p microsoft-webui-ffi
+          cargo run -p microsoft-webui-cli -- build \
+            crates/webui-ffi/tests/fixtures/app \
+            --out crates/webui-ffi/tests/fixtures/protocol.bin
+
+      - name: Run Python FFI tests
+        run: python crates/webui-ffi/tests/python/test_webui_ffi.py -v
+        env:
+          LD_LIBRARY_PATH: target/debug
+
+      - name: Run Go FFI tests
+        working-directory: crates/webui-ffi/tests/go
+        run: go test -v
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/target/debug
+          CGO_LDFLAGS: -L${{ github.workspace }}/target/debug -lwebui_ffi -lm -ldl -lpthread
+
+      - name: Run C# FFI tests
+        working-directory: crates/webui-ffi/tests/csharp
+        run: dotnet test -v normal
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/target/debug
+
+  # ── Phase 2: Python wheels ─────────────────────────────────────────
+  # Build every wheel in the release contract. The x64 wheels feed python-test
+  # below; the ARM64 wheels are cross-compiled exactly as the release pipeline
+  # cross-compiles them, so an ARM64 build break surfaces on the PR that causes
+  # it. They are never installed here - that needs ARM64 hardware.
+  python-wheel:
+    name: Python wheel (${{ matrix.platform.label }})
+    runs-on: ${{ matrix.platform.os }}
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - label: Linux x64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            platform_tag: manylinux_2_17_x86_64.manylinux2014_x86_64
+            image: messense/manylinux2014-cross:x86_64@sha256:13670ccc63c35e072661938181c046243c01d7bca7976b3914177fb9b162998d
+            artifact: python-wheel-linux-x64
+          - label: macOS x64
+            os: macos-latest-large
+            target: x86_64-apple-darwin
+            platform_tag: macosx_10_12_x86_64
+            artifact: python-wheel-macos-x64
+          - label: Windows x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            platform_tag: win_amd64
+            artifact: python-wheel-windows-x64
+          - label: Linux ARM64
+            os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            platform_tag: manylinux_2_17_aarch64.manylinux2014_aarch64
+            image: messense/manylinux2014-cross:aarch64@sha256:32c92568ebee8db53e0598c21bcd06a6dd1649d45d507646a8a49313c50325f8
+            artifact: ''
+          - label: macOS ARM64
+            os: macos-latest-large
+            target: aarch64-apple-darwin
+            platform_tag: macosx_11_0_arm64
+            artifact: ''
+          - label: Windows ARM64
+            os: windows-latest
+            target: aarch64-pc-windows-msvc
+            platform_tag: win_arm64
+            artifact: ''
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Linux wheels build entirely inside the pinned manylinux image, so the
+      # host toolchain is only needed for the targets built natively here.
+      - uses: ./.github/actions/build
+        if: runner.os != 'Linux'
+        with:
+          skip-build: 'true'
+          rust-targets: ${{ matrix.platform.target }}
+          shared-cache-key: python-${{ matrix.platform.target }}
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.11'
+
+      # abi3 needs no target interpreter and `generate-import-lib` synthesizes
+      # the Windows ARM64 import library, so every target cross-compiles here.
+      - name: Build wheel
+        if: runner.os != 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade "maturin==1.14.1"
+          cargo xtask publish-build --target "${{ matrix.platform.target }}" --python-only
+
+      - name: Build manylinux wheel
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm --platform linux/amd64 \
+            -v "$GITHUB_WORKSPACE:/io" -w /io "${{ matrix.platform.image }}" \
+            bash crates/webui-python/scripts/build-manylinux-wheel.sh \
+              "${{ matrix.platform.target }}"
+
+      - name: Validate wheel name, tags, and license metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          python crates/webui-python/tests/validate_wheel.py \
+            publish/python "${{ matrix.platform.platform_tag }}"
+          python crates/webui-python/tests/validate_artifacts.py publish/python/*.whl
+
+      - name: Upload wheel
+        if: matrix.platform.artifact != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.platform.artifact }}
+          path: publish/python/*.whl
+          if-no-files-found: error
+          retention-days: 1
+
+  # ── Phase 3: Python tests (after wheels) ───────────────────────────
+  # One abi3 wheel must serve every supported interpreter, so the Linux wheel is
+  # installed on each CPython. macOS and Windows only re-verify that the wheel
+  # loads on its platform, which 3.11 already proves.
+  python-test:
+    name: Python test (${{ matrix.platform.label }} / CPython ${{ matrix.python }})
+    runs-on: ${{ matrix.platform.os }}
+    needs: python-wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - label: Linux x64
+            os: ubuntu-latest
+            artifact: python-wheel-linux-x64
+        python: ['3.11', '3.12', '3.13', '3.14']
+        include:
+          - platform:
+              label: macOS x64
+              os: macos-latest-large
+              artifact: python-wheel-macos-x64
+            python: '3.11'
+          - platform:
+              label: Windows x64
+              os: windows-latest
+              artifact: python-wheel-windows-x64
+            python: '3.11'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ matrix.platform.artifact }}
+          path: publish/python
+
+      - name: Install the built wheel and test it
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade "pytest>=8.3,<10"
+          python -m pip install --force-reinstall --no-deps --no-index publish/python/*.whl
+          python -m pytest crates/webui-python/tests -q
+
+      - name: Validate lint, strict typing, and stubs
+        if: runner.os == 'Linux' && matrix.python == '3.11'
+        working-directory: crates/webui-python
+        run: |
+          python -m pip install --upgrade "mypy>=1.19,<2" "ruff>=0.15,<1"
+          python -m ruff check python tests benchmarks
+          python -m mypy
+          python -m mypy.stubtest microsoft_webui
+
+  # ── Phase 3: Python fixture drift (after Linux build) ──────────────
+  # The committed protocol fixtures are build outputs, so rebuild them and fail
+  # if they drift, keeping the Python tests from asserting against stale binaries.
+  python-fixture:
+    name: Python fixture
+    runs-on: ubuntu-latest
+    needs: build-linux
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/build
+        with:
+          skip-build: 'true'
+          shared-cache-key: ubuntu-build
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.11'
+
+      - name: Verify the release-target contract is restated consistently
+        run: python crates/webui-python/tests/validate_release_targets.py
+
+      - name: Rebuild and compare the protocol fixtures
+        run: |
+          set -euo pipefail
+          output="target/python-fixture-check"
+          streaming_output="target/python-streaming-fixture-check"
+          rm -rf "$output" "$streaming_output"
+          cargo run --quiet -p microsoft-webui-cli -- build \
+            "crates/webui-python/tests/fixtures/app" --plugin webui --out "$output"
+          cargo run --quiet -p microsoft-webui-cli -- build \
+            "crates/webui-python/tests/fixtures/streaming-app" \
+            --plugin webui --out "$streaming_output"
+          cargo run --quiet -p microsoft-webui-cli -- inspect \
+            "crates/webui-python/tests/fixtures/protocol.bin" \
+            > "$output/committed.json"
+          cargo run --quiet -p microsoft-webui-cli -- inspect \
+            "$output/protocol.bin" > "$output/generated.json"
+          python "crates/webui-python/tests/compare_fixture.py" \
+            "$output/committed.json" "$output/generated.json" \
+            "crates/webui-python/tests/fixtures/protocol.bin"
+          cargo run --quiet -p microsoft-webui-cli -- inspect \
+            "crates/webui-python/tests/fixtures/streaming_protocol.bin" \
+            > "$streaming_output/committed.json"
+          cargo run --quiet -p microsoft-webui-cli -- inspect \
+            "$streaming_output/protocol.bin" \
+            > "$streaming_output/generated.json"
+          python "crates/webui-python/tests/compare_fixture.py" \
+            "$streaming_output/committed.json" \
+            "$streaming_output/generated.json" \
+            "crates/webui-python/tests/fixtures/streaming_protocol.bin"
+          cmp "crates/webui-python/tests/fixtures/greeting-card.css" \
+            "$output/greeting-card.css"
+
+  # ── Gate: one stable required check ────────────────────────────────
+  # Branch protection can only require per-job contexts, so requiring the jobs
+  # individually means editing that list every time one is added, renamed, or
+  # removed. Require this job instead: it is the only context that has to be
+  # protected, and it stays correct as the matrix above evolves.
+  pr-checks:
+    name: PR Checks
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - lint
+      - test
+      - build-linux
+      - build-macos
+      - build-windows
+      - e2e
+      - wasm
+      - docs
+      - ffi
+      - python-wheel
+      - python-test
+      - python-fixture
+    steps:
+      # `needs` collapses each matrix to a single result, so this covers every
+      # wheel and interpreter leg too. Skipped counts as failure: nothing here
+      # is conditionally skipped, so a skip only happens when a dependency
+      # failed and took its dependents with it.
+      - name: Verify every job succeeded
+        if: >-
+          contains(needs.*.result, 'failure') ||
+          contains(needs.*.result, 'cancelled') ||
+          contains(needs.*.result, 'skipped')
+        run: |
+          echo "::error::One or more PR checks did not succeed."
+          exit 1
diff --git a/DESIGN.md b/DESIGN.md
index 5a42ce93d..b376cc1fe 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -44,8 +44,6 @@ pub struct WebUIProtocol {
     pub initial_state_strategy: InitialStateStrategy,
     /// Ordered modulepreload hrefs for critical shared JavaScript chunks.
     pub module_preloads: Vec<String>,
-    /// Entry fragment boundary names in declaration order.
-    pub streaming_boundaries: HashMap<String, StreamingBoundaryList>,
     /// Deterministic document-level CSS for build-authored component rendering
     /// policies. Empty when no component uses `w-render="lazy"`.
     pub component_render_css: String,
@@ -108,6 +106,8 @@ pub enum StateProjectionMode {
 /// A list of fragments (needed because protobuf maps cannot have repeated values directly).
 pub struct FragmentList {
     pub fragments: Vec<WebUIFragment>,
+    /// True when this record directly or transitively reaches a boundary.
+    pub contains_boundary: bool,
 }
 
 /// A mapping of unique fragment identifiers to their corresponding fragment lists.
@@ -119,6 +119,28 @@ pub struct WebUIFragment {
     pub fragment: Option<web_ui_fragment::Fragment>,
 }
 
+/// Which end of an inline boundary tape a fragment marks.
+pub enum BoundaryPhase {
+    Start = 0,
+    End = 1,
+}
+
+/// Compile-time declaration preserved in the fragment graph as an inline tape.
+pub struct WebUIFragmentBoundary {
+    /// Stable build-local declaration identity, shared by the start/end pair.
+    pub declaration_id: u32,
+    /// Entry or reusable component template that owns the declaration.
+    pub owner_fragment_id: String,
+    /// Static authored name, unique within `owner_fragment_id`.
+    pub name: String,
+    /// Optional expression evaluated for each runtime occurrence.
+    pub key: Option<String>,
+    /// Conservative build-time result for declarations that may occur repeatedly.
+    pub may_repeat: bool,
+    /// Whether this fragment opens or closes the declaration's body.
+    pub phase: BoundaryPhase,
+}
+
 /// The fragment oneof variants.
 pub enum Fragment {
     Raw(WebUIFragmentRaw),
@@ -130,6 +152,7 @@ pub enum Fragment {
     Plugin(WebUIFragmentPlugin),
     Route(WebUIFragmentRoute),
     Outlet(WebUIFragmentOutlet),
+    Boundary(WebUIFragmentBoundary),
 }
 ```
 ### Fragment Types
@@ -147,6 +170,29 @@ pub struct WebUIFragmentComponent {
     pub fragment_id: String,
 }
 ```
+#### Boundary Fragment
+
+`Boundary` is a typed declaration in the normal fragment graph, written as an
+**inline tape**: a `Start` marker, the body fragments, and an `End` marker
+carrying the same `declaration_id`, all in the owner's own record. Ordinary
+rendering therefore walks the body without an extra record lookup and simply
+skips both markers, while streaming suspends at `Start` and resumes inside the
+record it is already traversing. It may be reached through entries, reusable
+components, conditions, loops, outlets, and the selected route. Runtime
+traversal, not declaration order, creates response-local occurrences.
+
+Markers always pair within one record, because a `<boundary>`'s children are
+lexically inside it; constructs that own their own record (`<if>`, `<for>`,
+components, route content) still nest as separate records. Nesting a boundary
+inside another — lexically or transitively through those records — is rejected
+at build time, so a response has at most one active occurrence and matching is
+stack-free.
+
+The compiler assigns `declaration_id`, records the authoring
+`owner_fragment_id`, and sets `contains_boundary` on every directly or
+transitively boundary-bearing `FragmentList`. Field 8 of `WebUIProtocol` and
+field 5 of `WebUIFragmentBoundary` are reserved and must not be reused.
+
 #### For Loop Fragment
 ```rust
 pub struct WebUIFragmentFor {
@@ -925,6 +971,77 @@ The `webui::streaming` module provides:
   across requests, eliminating per-flush heap allocation in
   steady-state high-RPS workloads.
 
+### Progressive Response API
+
+Progressive rendering discovers occurrences while it executes the normal
+fragment graph. There is no compile-time boundary count and no name lookup API.
+
+```rust
+pub struct BoundaryDescriptor {
+    pub instance_id: BoundaryInstanceId,
+    pub declaration_id: u32,
+    /// Interned per protocol; discovering an occurrence shares the compiled
+    /// string instead of allocating a copy.
+    pub owner: Arc<str>,
+    pub name: Arc<str>,
+    pub key: Option<BoundaryKey>,
+}
+
+pub struct StreamStatus {
+    pub boundary: Option<BoundaryDescriptor>,
+    pub done: bool,
+}
+
+pub struct StreamStep {
+    pub bytes: Vec<u8>,
+    pub boundary: Option<BoundaryDescriptor>,
+    pub done: bool,
+}
+
+impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
+    pub fn start(&mut self, state: &Value) -> Result<StreamStatus>;
+    pub fn resume(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        state: &Value,
+        mode: BoundaryMode,
+    ) -> Result<StreamStatus>;
+    pub fn update(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        patch: &Value,
+    ) -> Result<()>;
+}
+
+impl StreamingSession {
+    pub fn start(&mut self, state: &Value) -> Result<StreamStep>;
+    pub fn resume(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        state: &Value,
+        mode: BoundaryMode,
+    ) -> Result<StreamStep>;
+    pub fn update(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        patch: &Value,
+    ) -> Result<Vec<u8>>;
+}
+```
+
+`start` renders until the first runtime occurrence or through the terminal.
+`resume` must target the descriptor currently returned by the session. It
+commits that occurrence, then continues until the next occurrence or terminal.
+The final successful call returns `done = true`, no boundary, and bytes that
+already contain the terminal record and document suffix. There is no separate
+terminal call.
+
+`update` accepts only an object patch and only a committed `Updatable`
+occurrence. It emits projected state bytes and no application markup. A
+borrowed `StreamingResponse` writes directly to its `FlushWriter`; an owned
+`StreamingSession` returns one complete byte vector per call for language
+bindings and host-controlled backpressure.
+
 ### Per-Render HTML Injection
 
 For HTML that must be spliced at the structural `</head>` or `</body>`
@@ -2028,563 +2145,257 @@ into `<f-repeat>` markup.
 
 ## Progressive Streaming Hydration
 
-An interactive island that has already arrived in the HTML response hydrates
-while `document.readyState === "loading"`, without waiting for a slow response
-tail or `DOMContentLoaded`. This works in current browsers using ordinary
-in-order incremental HTML parsing; it does not depend on any out-of-order DOM
-protocol.
-
-Streaming is selected per response. A page opts in by placing `<boundary>`
-directives in its entry template and rendering through a `FlushWriter`;
-everything else about the framework is unchanged, and non-streaming output is
-byte-identical to a build without boundaries.
-
-Hydration is gated through `TemplateElement`'s deferral seam —
-`$deferredSSR` / `$shouldDeferSSRHydration()` / `$activateDeferredSSR()` — the
-same primitive the compiler-owned `StaticTemplateHost` uses to stay dormant
-until a browser state write. Streaming is its second caller, gated by
-streaming-mode plus boundary commit rather than by `setState`, so the framework
-has one hydration-gating mechanism rather than two.
-
-### Stream contract (version 1, normative)
-
-These invariants are binding. Every one is enforced somewhere — by the
-compiler, by the coordinator, or by a test — and none may be relaxed without a
-corresponding change here. Any additional transport must satisfy this same
-contract rather than introduce a parallel one.
-
-**Record format**
-
-1. **Gapless monotonic record order.** Every checkpoint, state update, and
-   terminal record carries one response-local record sequence starting at `0`
-   and increasing by exactly one. Any other value is rejected and halts the
-   stream. There is no reordering buffer and no out-of-order tolerance.
-2. **Typed records and exactly one empty terminal.** The five-element envelope
-   is `[version, record_sequence, kind, target, payload]`. `kind` is `0` for a
-   final boundary checkpoint, `1` for an updatable boundary checkpoint, `2`
-   for a state update, and `3` for the terminal. Every response ends with
-   exactly one markerless `[1, sequence, 3, 0, {}]` after all scriptless tail
-   bytes. A record arriving after it is corruption: it is rejected, its
-   scaffolding released, and the stream is halted without disturbing the
-   successful completion the terminal record already drove. The empty terminal
-   payload binds the *emitter*; a reader ignores unrecognized terminal payload
-   fields rather than halting a page that has already fully rendered (rule 21).
-3. **Self-sufficient records.** Given all prior records, a record carries
-   everything needed to commit itself: its own template delta, inventory delta,
-   and projected state. A record never forward-references a later one, so a
-   truncated response is always a prefix of a valid one.
-4. **Additive global merge; ordered island state.** Global handoff merges
-   accumulate only:
-   inventory bits are OR-ed, CSS/style lists are appended with deduplication,
-   templates are registered additively. No record may overwrite or invalidate
-   an earlier record's contribution. Boundary state is ephemeral and never
-   published to `window.__webui.state`. A state-update record is a shallow
-   patch applied in record order to one already-committed updatable boundary;
-   repeated writes to the same key are last-writer-wins.
-5. **Identity is not placement.** A record never contains a selector, node
-   path, or DOM position. Checkpoints carry the compiler-assigned integer
-   boundary ID in `target`; state updates carry the same ID. The integer
-   resolves through coordinator-owned references captured during the original
-   range walk and never requires a document scan. Placement remains expressed
-   only through the marker pair the browser's HTML parser materializes.
-6. **Boundary-local payload.** A record carries only the templates and state
-   reachable from its own roots. Boundary 0 must not contain metadata or state
-   reachable only from a later boundary. This requires a state-projection
-   manifest; without one the build falls back to full state and every
-   checkpoint costs `O(boundaries × full state)`, which the compiler reports as
-   a `streaming-without-projection` warning.
-
-**Coordinator**
-
-7. **One queue, one record in flight.** Sentinels enqueue onto a single shared
-   task pump; exactly one checkpoint or update commits at a time, and neither
-   hydration nor a state write runs inside the parser's sentinel-upgrade
-   callback. No per-record timer, observer, or root listener is created.
-8. **Range resolution is the only placement-aware step.**
-   `resolveBoundaryRange()` is the sole function that inspects DOM adjacency.
-   Template registration, state seeding, activation, scaffolding removal, and
-   lifecycle accounting all consume an abstract `HydrationRange`. State updates
-   bypass range resolution and use only the roots retained by their original
-   updatable checkpoint.
-9. **`data-ws` is per-element deferral state, not a boundary marker.** It is
-   compiler-owned, identifies exactly the SSR roots the server deferred, and is
-   removed on activation, rejection, or abandonment. An element without it
-   mounts normally even while a streaming response is still open.
-10. **Definitions and waiters are metadata-gated by tag name.** The browser
-    snapshots `observedAttributes` during `customElements.define()`, so a
-    streaming `.define(tag)` request waits until that tag's template metadata is
-    registered. Undefined custom elements then share one
-    `customElements.whenDefined` reaction per tag with a bounded root set,
-    never one promise closure per root instance.
-11. **Undefined parents are activation barriers.** If an outer streamed root is
-    undefined, the range walk counts but does not activate its descendants or
-    register descendant tag waiters. The retained subtree is revisited only
-    after the outer definition arrives and activates, preserving parent-first
-    hydration and preventing children from mutating an unhydrated parent tree.
-12. **Retention is opt-in and response-bounded.** A final checkpoint releases
-    its payload script, sentinel, marker pair, parsed envelope, projected state,
-    and root references immediately. An updatable checkpoint retains only its
-    bounded root array until the terminal record or fatal cleanup, when all
-    update targets and queued state are released together. Final boundaries pay
-    no target-map or root-retention cost. That array holds **live roots only**:
-    a root joins when it activates successfully, so one that was ignored,
-    failed, or was abandoned is never an update target and its element is not
-    kept alive by the boundary. Liveness is never inferred from `data-ws`,
-    which rule 9 strips on rejection and abandonment as well as on activation,
-    and which would therefore mark an inert root as ready to receive. The
-    retention budget is charged separately, at scan time, against every marked
-    root the checkpoint saw, so activating a root after its boundary was
-    retained can never grow that boundary past its bound. Delivering an update
-    to a live root is consequently an array walk with no DOM access. Because
-    `setState()` is defined on `TemplateElement` itself, a live root missing it
-    is a framework invariant violation and halts the stream rather than
-    reporting the same failure on every later update.
-13. **Bounded terminal failure.** On malformed, truncated, or overflow input
-    the coordinator releases every discoverable scaffold and pending reference
-    within its configured bounds, balances the pending-boundary count, and
-    suppresses `webui:hydration-complete`. A halt never leaves a root stuck in
-    the deferred state and never wedges completion on a stuck pending count.
-    Valid commits never scan the document; a bounded document sweep is reserved
-    for fatal cleanup when the malformed stream no longer exposes a complete
-    marker range.
-14. **Post-hydration author code runs exactly once.** `hydratedCallback()` runs
-    synchronously with the first successful ordinary hydration, client mount,
-    streamed activation, or dormant static-host wake. A Link-mode client mount
-    whose CSP blocks the prepaint guard remains resource-deferred until its
-    native styles load. Reactive writes made during that interval are reconciled
-    against the staging instance immediately before detached content is
-    appended; the callback runs only after the live container is installed.
-    Its latch is set before author code runs, so reconnects and exceptions never
-    retry it.
-15. **Updates never rehydrate.** A state update calls the existing reactive
-    `setState()` path on each target root. It does not rerun
-    `$activateDeferredSSR()`, template wiring, or `hydratedCallback()`. If the
-    target class is not defined or its boundary is still activating, one
-    bounded shallow patch is queued per target and replayed through that same
-    `setState()` path immediately after the root activates - never merged into
-    the state the root hydrates from. Hydration wires bindings against the
-    server's bytes without evaluating them, so seeding a post-render value
-    first would bind the branch the DOM actually shows while the element
-    believed it held the new one, and the next equal-valued write would skip
-    the patch entirely. A root retained behind an undefined ancestor is
-    patched after its own activation, parent first.
-    A state update may reference only an earlier updatable
-    checkpoint; forward references and updates to final checkpoints are fatal
-    protocol errors. An application component whose `setState()` or change
-    handler throws degrades that root alone: the failure is reported and the
-    walk continues to the remaining targets, including the retained
-    descendants of a throwing root, because one
-    component's bug must never strand later boundaries.
-
-**Compile time**
-
-16. **`<boundary>` is a directive, not an element.** It emits no wrapper
-    node, never nests or overlaps another boundary, and may not cut through a
-    component template or host content, native raw/inert HTML content, `<if>`,
-    `<for>`, route, or hydration-marker scope.
-17. **Boundaries are rejected in HTML foster-parenting contexts.** Inside
-    `table`, `thead`, `tbody`, `tfoot`, `tr`, `colgroup`, `select`, or
-    `optgroup` the browser relocates the unknown `<webui-hydrate>` sentinel out
-    of the table while the payload `<script>` stays inside, permanently
-    breaking their adjacency. This is a build error
-    (`boundary-in-foster-context`), never a runtime failure. `td`, `th`, and
-    `caption` return to "in body" insertion rules and are allowed.
-18. **Boundary names are free-form and resolve once.** Names are author-chosen
-    strings validated at build time for non-emptiness, staticness, and
-    per-entry uniqueness. The protocol stores their declaration order so a
-    response session can resolve `boundary("weather-shell")` once to a
-    `BoundaryId`. Only that integer reaches the HTML response; no generated
-    language symbols or name strings reach the wire.
-
-**Host**
-
-19. **The compiler decides where a flush is legal; the host decides when to
-    write.** A `StreamingResponse` writes the shell, each compile-time boundary,
-    state updates, and the tail only when the host calls it. Each synchronous
-    call borrows its state only for that call, so the host may await backend
-    work between calls without retaining a state borrow. Rendering requires a
-    `FlushWriter` and never silently degrades to buffering. Every shell,
-    checkpoint, update, and terminal write flushes through the same transport,
-    preserving its backpressure and disconnect errors.
-
-**Compatibility**
-
-20. **The reader validates transport and version, not its own serializer.**
-    A record is written by this repository's handler and read back by this
-    repository's coordinator, so the coordinator re-derives nothing the
-    serializer already guaranteed. Exactly three conditions are checked before
-    the tuple is trusted: `JSON.parse` success, which is a *complete*
-    truncation detector because every proper prefix of a JSON array is invalid
-    JSON (rule 3 seen from the transport side); a five-element array, so
-    destructuring is total; and `version`. Everything past those is document
-    state rather than record shape, and is enforced where it is actually
-    known — the coordinator halts the stream on a sequence or target mismatch,
-    and commits inside an error boundary so any payload defect fails closed
-    instead of hydrating partially.
-21. **`version` is the only compatibility mechanism.** Because rule 20 removes
-    per-field checks, a stale cached client reads an unrecognized `kind` as a
-    final checkpoint. Any new record kind, tuple shape, or incompatible payload
-    meaning must therefore bump `version`, which is gated before any element is
-    read. Purely additive payload fields do not bump it and are ignored by
-    older readers, which is what makes tolerating an unexpected terminal
-    payload (rule 2) safe rather than lax.
-
-### Directive spelling and the structural signal namespace
-
-`<boundary>` is one arm of the parser's existing bare-element dispatch
-(`HtmlParser::parse`, `match element.name()`: `"for"`, `"if"`, `"body"`,
-`"head"`, `"route"`, `"outlet"`, then the component-registry fallback). Its
-handler `enter_boundary_directive` follows the shape `enter_body_element`
-established: it pushes compiler-owned structure before children and after them
-via a raw signal fragment, reusing `WebUIFragmentSignal` for
-`boundary_start:<seq>` / `boundary_end:<seq>` rather than adding `oneof`
-variants to `webui.proto`.
-
-All compiler-owned structural signal values use the internal wire namespace
-`}}}webui:<token>` (for example `}}}webui:body_end` and
-`}}}webui:boundary_start:0`). The parser's authored double/triple bindings
-cannot produce a value beginning with `}}}` because those bytes close the
-binding; CSS comment bindings also reject braces in paths. The handler strips
-this prefix only from raw signals before interpreting structure. Unprefixed
-values such as authored `{{{head_start}}}`, `{{{head_end}}}`,
-`{{{body_start}}}`, `{{{body_end}}}`, and `{{{streaming_root}}}` always remain
-ordinary public state keys. Protocols built before this namespace therefore no
-longer receive structural hooks and must be rebuilt. Such a protocol also
-cannot enter streaming mode because it lacks namespaced `head_start`, boundary,
-and streamed-root signals. This namespace is an internal parser/handler
-contract, not author syntax.
-
-Boundary validation — unique static `name`, no nesting, outermost entry
-template only, and "must not cut through a component, native raw/inert content,
-`<if>`, `<for>`, route, or hydration-marker scope" — is parse-time structural
-analysis of the same order as the existing `key`-on-`<for>` validation
-(`invalid-for-key`). Marking a statically-provable, independently-hydratable
-fragment subtree is inherently a parse-time question, so no surface spelling
-avoids that cost. An attribute spelling (`<div boundary="name">`) would carry
-identical validation cost while losing "emits no wrapper element" and a clean
-reserved-tag diagnostic.
-
-The bare, unhyphenated spelling follows the rule the rest of the compiler uses:
-
-| Spelling | Meaning | Examples |
-| --- | --- | --- |
-| Bare tag | Compile-time directive, erased at build, never in the DOM | `<if>`, `<for>`, `<route>`, `<outlet>`, `<boundary>` |
-| `webui-` tag | Real custom element defined at runtime | `<webui-hydrate>` |
-| `data-webui-*` | Runtime marker attribute on emitted output | `data-webui-boundary`, `data-webui-ssr-preload` |
-
-A hyphenated name is the HTML requirement for *custom elements*, so spending it
-on a directive that is deleted before the browser ever sees it would imply a
-runtime element that does not exist. `<boundary>` cannot collide with a
-component either: WebUI components are discovered from hyphenated filenames, so
-no component can ever be named `boundary`.
-
-### Author-facing syntax
+Progressive streaming is one version-2 contract shared by the compiler, Rust
+handler, host bindings, CLI proxy, and browser coordinator. It discovers
+boundaries by executing the compiled fragment graph and hydrates complete
+regions while the document is still loading.
+
+### Normative invariants
+
+1. **Runtime discovery.** `<boundary name>` is valid in entries and reusable
+   components, including runtime `<if>`, `<for>`, outlet, and selected-route
+   paths. A false branch, empty loop, or unselected route produces no
+   occurrence. Authored boundaries must not directly or transitively contain
+   another authored boundary in this version.
+2. **Local declaration identity.** `name` is static, non-empty, and unique only
+   within its owning entry or component template. `declarationId` is a stable
+   build-local integer. Each runtime occurrence receives a gapless
+   response-local `instanceId` and the host receives
+   `{ instanceId, declarationId, owner, name, key }`.
+3. **Repeated occurrence identity.** A declaration that can occur more than
+   once must author `key`. The expression must resolve in that occurrence's
+   lexical scope to a finite JSON number or string. Keys for simultaneously
+   live occurrences of one declaration must be unique.
+4. **Pull session.** `start(state)` renders until the first occurrence or
+   terminal. `resume(instanceId, state, mode)` must target the currently pending
+   descriptor, commits it, and renders until the next occurrence or terminal.
+   `update(instanceId, patch)` targets only a committed updatable occurrence and
+   returns or writes one markerless update record. A final step has
+   `done = true`, has no descriptor, and already includes the document tail,
+   terminal record, final flush, and writer end.
+5. **Frozen continuation state.** At `start`, the handler projects and freezes
+   only top-level state keys reachable by the continuation. It also preserves
+   lexical locals, component attributes, route state, inventories, and
+   continuation frames. Resume state overlays the frozen parent projection for
+   selected keys. Expression resolution remains lexical first, then the
+   boundary resume overlay, then frozen parent state.
+6. **Generated component spans.** When traversal suspends inside a reusable
+   component, the handler opens a generated component span around its unfinished
+   host. An early child checkpoint may bypass exactly its nearest unfinished
+   spanning ancestor. Other descendants remain opaque behind that parent until
+   its span completion record arrives. Nested generated spans complete
+   inner-first. This rule is identical for light and shadow DOM; the browser
+   crosses open shadow roots, slots, and hosts without leaving the bounded
+   range.
+7. **Exactly-once activation.** Streamed roots hydrate parent-first and
+   `hydratedCallback()` runs exactly once after their first successful
+   activation. Undefined roots wait by tag. An undefined or unfinished parent
+   is an activation barrier except for a compiler-marked early child matching
+   the nearest span ID.
+8. **Updates are state only.** An update applies the existing projected
+   `setState()` path to roots retained by an updatable checkpoint. It never
+   inserts, replaces, relocates, or reparses application markup and never
+   re-runs hydration or `hydratedCallback()`. A patch that arrives before a
+   retained root activates is shallow-merged and replayed after activation.
+9. **Ordered, self-sufficient wire.** Records use a gapless response-local
+   sequence starting at zero. Each checkpoint or span completion carries all
+   template, inventory, CSS, route, nonce, and projected-state deltas needed to
+   commit it after prior records. Global metadata merges additively. Boundary
+   state remains ephemeral and is not published to `window.__webui.state`.
+10. **Fail closed.** Version, tuple arity, record sequence, occurrence sequence,
+    target kind, marker closure, span ancestry, and all configured work and
+    retention limits are mandatory. Malformed, truncated, stale, duplicate, or
+    overflowing input halts the coordinator, suppresses successful completion,
+    and releases discoverable scripts, sentinels, markers, waiters, span state,
+    and update roots within fixed bounds.
+11. **Mode isolation.** Streaming is explicitly selected per response and
+    requires a `FlushWriter` or owned `StreamingSession`. Ordinary `render`,
+    partial navigation, and component-template operations do not emit streaming
+    markers or browser records.
+
+### Compilation and author syntax
+
+`<boundary>` is a bare compile-time directive. The parser erases its tags and
+brackets its body with a `WebUIFragmentBoundary` start/end pair emitted inline
+in the owner's record. It is valid in an entry or reusable component and may be
+reached through conditions, loops, outlets, and route content. Component
+templates strip directive tags from their browser template HTML, while the
+server fragment graph retains the typed declaration.
 
 ```html
-<head>
-  <script type="module" async src="/index.js"></script>
-</head>
-<body>
-  <boundary name="counter-ready">
-    <my-counter count="{{count}}"></my-counter>
-  </boundary>
+<!-- index.html -->
+<html>
+  <head>
+    <script type="module" async src="/index.js"></script>
+  </head>
+  <body>
+    <ntp-page></ntp-page>
+  </body>
+</html>
+```
 
-  <footer>Slow tail content</footer>
-</body>
+```html
+<!-- ntp-page.html -->
+<main>
+  <h1>{{title}}</h1>
+  <boundary name="search-ready">
+    <search-box query="{{query}}"></search-box>
+  </boundary>
+  <section class="tail">{{slowFeed}}</section>
+</main>
 ```
 
-`<boundary>` is a reserved compile-time directive, resolved by
-`webui-parser`, that emits no wrapper element. The compiler:
-
-- requires a static, unique `name` attribute;
-- requires the directive to be inside a currently open native `<body>`;
-- compiles the children as one independently complete fragment, assigning it
-  the next response-local boundary ID (`0`, `1`, …);
-- rejects nested or overlapping boundaries;
-- rejects a boundary placed in an HTML foster-parenting context (`table`,
-  `thead`, `tbody`, `tfoot`, `tr`, `colgroup`, `select`, `optgroup`) with
-  `boundary-in-foster-context`, because the browser would relocate the unknown
-  `<webui-hydrate>` sentinel out of the table while leaving the payload
-  `<script>` inside, permanently breaking the adjacency the coordinator relies
-  on. `td`, `th`, and `caption` return to "in body" insertion rules, so a
-  boundary inside a cell is allowed even though its ancestors are hostile;
-- permits boundaries only in the outermost entry template, not in route-shell
-  or other reusable component templates;
-- rejects a boundary inside component host content or native content where the
-  browser treats descendants as text or inert DOM (`title`, `textarea`,
-  `script`, `xmp`, `iframe`, `noembed`, `noframes`, `noscript`, `plaintext`,
-  `template`); the generated sentinel could not activate there;
-- rejects a boundary that otherwise cuts through a component, `<if>`, `<for>`,
-  `<route>`, or hydration-marker scope -
-  `ParserError::Template(Diagnostic)` with the stable
-  `boundary-crosses-scope` code;
-- requires every registered component host in a streaming render to be enclosed
-  by a boundary. The handler returns a cold structured streaming error for an
-  outside host because parser-time upgrade could otherwise leave it permanently
-  inert. Native HTML and unregistered static tail markup remain valid outside
-  boundaries;
-- emits a reserved structural signal inside each parser-produced registered
-  component opening tag. Matched route hosts are handler-generated, so the
-  streaming handler requires their `<route>` to render inside an active explicit
-  boundary and inserts `data-ws` while generating the host opening. The render
-  traversal captures the exact component tags that actually render in each
-  checkpoint for DOM inventory. At commit, one iterative fragment-graph walk
-  rooted at those tags also includes descendants behind initially false
-  conditions and empty repeats, without pulling unrelated later boundaries into
-  the checkpoint.
-
-`<webui-hydrate>` is reserved for the generated runtime sentinel (see below)
-and is a build error (`authored-webui-hydrate`) if written by an application
-author.
-
-Streaming pages must load their application entry with `async` (or an
-equivalent non-blocking load) in `<head>`, ahead of any boundary content.
-There is no build-time script-order diagnostic; authors and hosts enforce this
-loading contract. `async` is safe here — and only here — because an upgraded
-element's SSR hydration is deferred until its enclosing boundary commits (see
-"Boundary lifecycle" below), so an entry that executes mid-document cannot
-strand an island the way a single end-of-body metadata block does.
+The only entry component is `<ntp-page>`. Runtime traversal opens a generated
+span for its unfinished host, discovers the component-local `search-ready`
+declaration, and returns that occurrence to the host. The host may resume it
+before the rest of `ntp-page` renders, so `<search-box>` becomes interactive
+before the parent tail arrives.
+
+The compiler enforces:
+
+- `name` is required, static, non-empty, and unique within the current owner.
+- Direct and transitive authored boundary nesting is rejected.
+- A declaration that is lexically inside `<for>` requires `key`; graph analysis
+  conservatively marks declarations reached repeatedly through components too.
+- `key` is a non-empty expression whose runtime value must be a string or finite
+  JSON number.
+- Entry boundaries must be inside `<body>`. Component-local boundaries use the
+  component's template body.
+- Boundaries cannot occur in component host children, raw or inert native
+  content, authored `<template>`, or foster-parenting contexts such as
+  `table`, `tbody`, `tr`, `select`, and `optgroup`.
+- `<webui-hydrate>` is reserved for generated sentinels.
+
+The parser retains namespaced structural signals for document and component-root
+events, including `head_start`, `body_end`, and compiler-owned streaming roots.
+Authored bindings with the same visible text remain ordinary state paths. Typed
+boundary declarations do not use start/end signal pairs.
+
+The application entry imports
+`@microsoft/webui-framework/streaming.js` before component registration modules
+and loads with `async`, or an equivalent non-blocking strategy, in `<head>`
+before the first possible checkpoint. This installs the coordinator while the
+HTML parser is still consuming the response.
 
 ### Generated response shape
 
-Conceptually, the counter boundary becomes:
+Conceptually, the component-local search occurrence and its unfinished parent
+produce:
 
 ```html
+<!--ws:0-->
+<ntp-page data-ws data-ws-span="0">
 <!--wb:0-->
-<my-counter count="0" data-ws>...complete SSR markup...</my-counter>
+<search-box data-ws data-ws-enclosing="0">...</search-box>
 <!--/wb:0-->
 <script type="application/json" data-webui-boundary>
-  [1,0,1,0,{"inventory":"01","state":{"count":0},"templates":{...}}]
+  [2,0,0,0,{"declarationId":0,"enclosingSpanInstanceId":0,"state":{},"templates":{}}]
+</script>
+<webui-hydrate></webui-hydrate>
+...ntp-page tail...
+</ntp-page>
+<!--/ws:0-->
+<script type="application/json" data-webui-boundary>
+  [2,1,3,0,{"state":{},"templates":{}}]
+</script>
+<webui-hydrate></webui-hydrate>
+<script type="application/json" data-webui-boundary>
+  [2,2,4,0,{}]
 </script>
 <webui-hydrate></webui-hydrate>
 ```
 
-- `<!--wb:N-->` / `<!--/wb:N-->` are marker comments, siblings of the
-  existing `<!--wr-->` / `<!--wc-->` family documented under "Plugin data and
-  SSR hydration markers" above — same removal-after-hydration contract.
-- The stream envelope is the script-safe tuple
-  `[version, record_sequence, kind, target, payload]`. A boundary checkpoint
-  uses kind `0` (final) or `1` (updatable), its compiler-assigned boundary ID as
-  `target`, and the existing bootstrap object as `payload`. `bootstrap`
-  reuses the existing object shape (`state`, `templates`, `inventory`, and
-  optional route/CSS/nonce fields), avoiding a second state-selection or
-  serialization implementation. Every checkpoint carries projected state and
-  template/CSS metadata for the transitive component surface reachable from the
-  tags rendered since the previous checkpoint. `Protocol::new` precomputes a
-  compact, integer-indexed entry plan only for entries that declare boundary
-  metadata; ordinary entries allocate no streaming plan. Hand-built protocols
-  without compiler metadata use a request-local fallback plan. Route-free
-  checkpoints expand that
-  graph with one reusable DFS stack; leaf-only checkpoints perform no graph
-  walk. A component surface containing authored routes uses the request-aware
-  traversal so unmatched route branches do not leak into the boundary. This
-  conservative local expansion lets a hydrated condition or repeat create an
-  initially unrendered descendant without a global state block or server
-  round-trip. Inventory remains exact and contains only tags with rendered SSR
-  DOM. Template/CSS metadata is sent once when first reachable; a later rendered
-  instance receives its inventory delta and checkpoint-local state without
-  resending metadata. Per-instance positional state tuples are not part of the
-  wire contract; state is carried as named keys.
-- `data-ws` is a compiler-owned, streaming-only identity inserted into every
-  streamed SSR component opening tag before browser upgrade. It is the sole
-  parser-time deferral signal when the document also has the streaming mode
-  marker. The coordinator removes it after activation or bounded failure
-  cleanup. Ordinary rendering ignores the structural signal, never emits the
-  attribute, and does not reserve an authored `data-ws` attribute.
-- `<webui-hydrate>` is the generated sentinel custom element. Its
-  `connectedCallback` (via `customElements.define`) is the checkpoint signal
-  the coordinator needs when the boundary arrives before its component
-  definitions are loaded (see races below).
-- The handler emits one marker pair, one payload, and one sentinel per boundary,
-  then calls `flush()` (see "Flush contract"). State updates are markerless
-  `[1, record_sequence, 2, boundary_id, projected_state]` records followed by
-  the same sentinel and flush; they resolve only through roots captured by the
-  updatable checkpoint. The coordinator removes every payload and sentinel
-  after processing and removes checkpoint markers after hydration commits.
-- At `body_end`, the handler writes any host-provided body injection and then
-  emits one empty markerless `[1,next_sequence,3,0,{}]` terminal record. The
-  terminal flush also commits preceding native/scriptless tail bytes, but those
-  bytes never manufacture another state or template projection. A static
-  streaming document with no boundaries therefore emits exactly
-  `[1,0,3,0,{}]`. Streaming mode does **not** also emit a page-wide
-  `#webui-data` block. Boundary checkpoints share the existing `WebUiBootstrap`
-  and `write_selected_state` paths, so there is no second state-selection
-  implementation. A request-local key scratch vector is cleared and reused
-  between checkpoints. Any later structural signal, including a boundary
-  start/end, is a malformed protocol error; no record may follow the
-  terminal record.
-- A small `<meta name="webui-streaming" content="1">` mode marker is emitted
-  at the structural `head_start` signal, before authored head children. It is
-  therefore available before an async application entry can define component
-  classes. Route chain, inventory, CSP nonce, CSS bookkeeping, templates, and
-  projected state deltas arrive in the applicable boundary bootstrap.
-- **Streaming does not alter non-streaming output, byte-for-byte.** Streaming
-  is a distinct, explicitly selected render/session mode. Non-streaming
-  rendering ignores namespaced raw structural signals; ordinary element and
-  fragment rendering is identical in both modes. Boundary emission is gated on
-  session mode and reuses the existing per-signal dedup pattern.
+- Every browser record is the five-element tuple
+  `[2, sequence, kind, target, payload]`.
+- Kinds are `0` final checkpoint, `1` updatable checkpoint, `2` state update,
+  `3` generated span completion, and `4` terminal.
+- A checkpoint target is `BoundaryInstanceId`; a span-completion target is
+  `SpanInstanceId`. They are separate response-local namespaces. Update targets
+  reuse the committed boundary instance ID. Terminal target is zero.
+- `<!--wb:N-->` and `<!--/wb:N-->` delimit occurrence `N`.
+  `<!--ws:N-->` and `<!--/ws:N-->` delimit generated component span `N`.
+- `data-ws` marks a deferred component root. `data-ws-span="N"` identifies the
+  unfinished host for span `N`. `data-ws-enclosing="N"` permits an early child
+  root to bypass exactly that nearest unfinished ancestor.
+- Boundary payloads include `declarationId`, optional
+  `enclosingSpanInstanceId`, projected `state`, and additive template,
+  inventory, route, nonce, CSS, and style deltas as needed. Span completion
+  payloads use the same bootstrap fields except declaration identity.
+- State updates are markerless `[2, sequence, 2, instanceId, patch]` records.
+  They carry no templates and insert no application markup.
+- Exactly one markerless `[2, sequence, 4, 0, {}]` terminal follows the final
+  tail bytes. A boundary-free streaming render emits the terminal from
+  `start`.
+- Each record script is followed by one generated `<webui-hydrate>` sentinel.
+  The coordinator removes scripts, sentinels, range markers, and compiler
+  attributes when they are no longer needed.
+- `<meta name="webui-streaming" content="1">` is emitted at `head_start`.
+  Streaming mode does not emit a page-wide `#webui-data` block.
 
 ### Initialization ordering
 
 1. Streaming mode marker at `head_start`, before authored head children and
    therefore before the async application entry `<script type="module">`.
-2. Per boundary, in document order: complete child markup, then the checkpoint
-   payload and executable template-function side channel, then the sentinel,
-   then an explicit flush.
-3. Between committed boundaries: zero or more markerless state-update payloads,
-   each followed by a sentinel and an explicit flush.
-4. At `body_end`: any native/scriptless tail bytes, one empty markerless
-   terminal record, then one final explicit flush.
+2. `start` writes the prefix and stops immediately before the first discovered
+   occurrence, or writes through terminal if none occurs.
+3. Each `resume` writes the selected occurrence and any subsequent static bytes
+   and span completions, stopping before the next discovered occurrence or
+   after terminal.
+4. `update` records may interleave after their updatable target commits.
+5. The call that reaches `body_end` writes tail bytes, terminal, final flush,
+   and writer end.
 
 The application entry imports
 `@microsoft/webui-framework/streaming.js` before component registration modules.
 This keeps the coordinator out of ordinary application bundles and installs it
 synchronously before any authored `.define()` call in the same module graph.
-The head marker lets that entry no-op safely on non-streaming pages, while the
-per-host `data-ws` attribute determines whether a particular SSR element must
-defer.
+The head marker lets that entry no-op safely on non-streaming pages.
 
 ### Boundary lifecycle and races
 
-Reuses the existing `$deferredSSR` / `$shouldDeferSSRHydration` /
-`$activateDeferredSSR` primitive on `TemplateElement`
-(`packages/webui-framework/src/template-element.ts`) as its mechanism; the
-streaming coordinator is a second caller of that primitive alongside the
-existing `StaticTemplateHost` caller, gated by streaming-mode + boundary
-commit instead of by a state write.
-
-**Definition request before checkpoint** (`MyCounter.define("my-counter")`
-runs while its metadata and SSR host are still arriving):
-
-1. Streaming mode holds the native `customElements.define()` call until
-   template metadata for `my-counter` is registered. This is required because
-   the browser snapshots `observedAttributes` at native definition time.
-2. The boundary registers metadata before walking its range. Native definition
-   then upgrades the parsed host, whose `connectedCallback()` sees the
-   compiler-owned `data-ws` attribute, sets `$deferredSSR = true`, and returns
-   without inspecting or mutating the subtree. An unmarked client-created empty
-   element still mounts normally while a streaming response remains open.
-3. The boundary walk calls `$activateDeferredSSR()` only after the closing
-   marker and payload exist. If metadata is still missing, the stream fails
-   instead of publishing a false successful completion.
-
-**Checkpoint before definition** (the boundary arrives first):
-
-1. Defining the generated `<webui-hydrate>` sentinel upgrades existing
-   sentinels via its own `connectedCallback` — no `MutationObserver`, no
-   document scan.
-2. The coordinator registers the boundary's new template metadata and holds
-   the boundary as pending.
-3. The boundary releases (calls `$activateDeferredSSR(state)` on each root)
-   once its authored component definitions are available. Undefined roots share
-   one `whenDefined` reaction per unique tag, not one promise closure per root.
-   A bounded per-tag set retains the exact pending roots so detached instances
-   and instances accumulated across checkpoints are not lost to DOM rediscovery.
-   Once the tag is defined, detached roots are upgraded explicitly with
-   `customElements.upgrade()` and activated without waiting for reattachment.
-   An undefined outer root is a barrier: its descendants are neither activated
-   nor assigned definition waiters until that outer root defines and activates.
-
-This is also the mechanism that lets a boundary carry its own module loader.
-An authored `<script type="module" async src="…">` placed inside boundary
-content is discovered by the parser when that chunk arrives, so an island's
-code need not be part of the critical entry. The boundary commits first, its
-roots park on the per-tag waiter above, and activation happens when the module
-calls `.define()`. Streaming mode is a document-level `<meta>` query rather
-than an import-order side effect, so a late-arriving definition still defers
-its connected SSR hosts correctly. Boundary teardown removes only generated
-scaffolding — payload, sentinel, and marker pair — so the authored script
-survives.
-
-Splitting an island into a separate bundle entry is an application build
-concern rather than a protocol one, and it carries a performance trap the
-build closes automatically: the shared runtime chunk becomes a static import of
-the critical entry, invisible to the preload scanner, costing a round trip that
-erases what splitting saves. The build therefore emits a
-`<link rel="modulepreload">` for each of the critical entry's shared chunks,
-ordered largest first, with deferred islands excluded.
-
-Three inputs make this computable, and each is recorded where the build
-already has it in hand:
-
-- **Module sizes.** The bundler adapter reads `metafile.outputs[path].bytes`,
-  which it already iterates for `.inputs`. Ordering is not incidental:
-  `examples/app/streaming` measures a **125 ms swing from ordering alone**,
-  larger than the split itself, because preloads are issued in document order
-  over one shared connection. Only the bundler knows output sizes, so it sorts
-  once at build time and ships the answer.
-- **Island exclusion.** The parser maintains `in_boundary` to reject nested
-  boundaries, and a `<script type="module" src>` seen while it is set is
-  island-owned by definition. Only non-boundary module entries are recorded,
-  so an island loader is excluded without any subtraction pass. This matters:
-  preloading the island is precisely the regression the hint exists to remove.
-  A chunk the island *shares* with the critical entry still gets preloaded,
-  because it is genuinely critical.
-- **The output import graph.** A shared runtime chunk defines no component, so
-  it appears in no component's `outputs` — yet it is exactly the file the hint
-  must cover. In `examples/app/streaming` the critical entry's closure is
-  45,912 B, of which the unmapped shared chunk is 35,827 B (78%); the mapped
-  `index.js` is 9,801 B and the scanner already finds it unaided. The manifest
-  therefore records output-to-output edges in `entryClosures`, filtered to
-  `kind === "import-statement"` so a dynamic `import()` — which is *meant* to
-  cost a round trip — is never hoisted onto the critical path. Every known
-  entry remains a map key even when this filtered closure is empty; the empty
-  ownership record prevents an equal basename from another merged build from
-  being selected.
-
-Two constraints govern the design. The closure is computed at **build time and
-shipped as an ordered list of finished hrefs** in `WebUIProtocol
-.module_preloads`, not shipped as a graph and traversed per request — so
-request-time emission is N writes against a precomputed slice, with no
-traversal, sorting, or scratch collections. And the hint set lives on the
-entry rather than on `ComponentData`, because a critical closure is a
-per-entry property.
-
-Resolution joins the authored `src` URL to build-root-relative manifest keys.
-It fails safe throughout: an entry whose basename matches more than one
-manifest key emits nothing and warns, because a wrong preload costs a 404 and
-a wasted connection while a missing one costs only speed; an unrecognized
-`src` is skipped silently, since a third-party script is not a build mistake;
-cross-origin, protocol-relative, and query-bearing authored URLs are skipped
-because they do not describe a path the manifest covers; the list is capped so
-a runaway closure cannot starve the entry itself; and an href that cannot be
-written verbatim into an attribute is rejected at build time rather than
-escaped per request. Compiler-generated query-bearing URLs are accepted only
-through an exact physical-output-to-served-URL map. A non-empty esbuild
-`publicPath` also suppresses closure members unless the host supplies that
-explicit map: the metafile exposes local output paths while emitted imports use
-the configured served URL, so synthesizing same-origin hrefs would be unsafe.
-
-CSS delivery strategy is selected once per build and is not boundary-local.
-
-**Commit.** For one boundary, the coordinator:
-
-1. Validates sequence, size, marker closure, template indexes, state arity,
-   and response identity.
-2. Registers new templates/functions and compiler-owned hosts immediately;
-   streamed registrations do not wait for `DOMContentLoaded`.
-3. Resolves the boundary's `HydrationRange` (`resolveBoundaryRange()` — the
-   only placement-aware step), then walks that range once in boundary order,
-   including open declarative shadow roots, without a root list or per-element
-   document-position comparisons.
-4. Passes the checkpoint-local projected state directly into component
-   activation. It does not merge ephemeral state into `window.__webui.state`.
-   Inventory deltas are ORed into the cumulative global bitmask; CSS/style
-   bookkeeping deltas are appended with deduplication.
-5. Hydrates outer roots before descendants. After each successful first
-   hydration or mount, `hydratedCallback()` runs synchronously with completion
-   exactly once; a CSP-deferred Link mount completes only after its native styles
-   load and detached content is appended. Reconnects and callback exceptions do
-   not retry it.
-6. Removes the payload, sentinel, markers, and `data-ws` identities and releases
-   parsed arrays before dispatching diagnostics or completion.
-
-Hydration runs through one shared task pump so it never executes inside the
-parser's sentinel-upgrade callback. No per-boundary timer, observer, or root
-listener is created. `webui:hydration-complete` fires only after the
-terminal record and zero pending boundaries. Truncated or malformed streams
-abort that completion gate and release discoverable generated scaffolding within
-the configured bounds.
+Streaming reuses `TemplateElement`'s existing deferred SSR activation seam.
+There is no second component hydration implementation.
+
+**Parent already defined.** The unfinished parent host has `data-ws-span`.
+Normal descendants remain behind its activation barrier. A child root in the
+early boundary carries the matching `data-ws-enclosing` value and may bypass
+that one barrier. It hydrates from its complete boundary range while the parent
+tail remains unparsed.
+
+**Parent not defined.** The boundary still registers template metadata first.
+Undefined roots share one `customElements.whenDefined()` waiter per tag. The
+early child's matching enclosing-span marker remains sufficient when its class
+defines. Other descendants are not assigned waiters until the opaque parent
+defines and its barrier releases.
+
+**Span completion.** Closing the boundary-bearing component emits the matching
+`ws` end marker and a kind-3 record. The coordinator validates that the span is
+open, its nested spans have completed, the marker pair is root-local, and the
+host lies inside the range. It then activates the parent range, removes span
+attributes and scaffolding, and decrements the parent span's open-child count.
+
+This algorithm works for light DOM and open declarative shadow DOM. Bounded
+walks cross a `ShadowRoot` through its host and follow assigned slots without a
+global selector or document-position comparison. The nearest generated span is
+load-bearing: an unmarked child or a child carrying another span ID remains
+dormant.
+
+For every final or updatable boundary checkpoint the coordinator:
+
+1. Resolves its root-local `wb` marker pair.
+2. Registers additive template, inventory, route, nonce, CSS, and style deltas.
+3. Registers any enclosing `ws` ancestry from the compiler-owned host
+   attributes.
+4. Walks the bounded range parent-first and activates only `data-ws` roots.
+5. Retains successfully activated roots only when the occurrence is updatable.
+6. Removes the record script, sentinel, boundary markers, and consumed
+   compiler attributes.
+
+Hydration runs through one document-scoped FIFO pump, never directly from the
+sentinel upgrade callback. `webui:hydration-complete` fires only after the
+terminal record, all queued records, definition waiters, ancestor barriers, and
+generated spans settle successfully. `hydratedCallback()` is latched before
+author code runs and is never retried after reconnect or exception.
 
 #### Commit observability
 
@@ -2592,8 +2403,9 @@ Every commit is recorded twice, for two different consumers:
 
 - A `performance.mark()` is emitted **unconditionally**: `webui:boundary:<id>`
   for a checkpoint, `webui:boundary:<id>:update` for a projected state update,
-  and `webui:streaming:terminal` for the terminal. Marks are not gated on the
-  debug flag because they are read *retroactively* — an analytics or RUM script
+  `webui:span:<id>` for a generated component span completion, and
+  `webui:streaming:terminal` for the terminal. Marks are not gated on the
+  debug flag because they are read *retroactively* - an analytics or RUM script
   that loads after hydration can still call
   `performance.getEntriesByType('mark')`, whereas a listener must be installed
   before the first checkpoint commits and the coordinator is a separate async
@@ -2602,25 +2414,24 @@ Every commit is recorded twice, for two different consumers:
 - `webui:boundary-hydrated` is emitted only when
   `window.__WEBUI_STREAMING_DEBUG__ === true`, avoiding a `CustomEvent`
   allocation per commit in production. Its `detail` is
-  `{ sequence, terminal, kind }`, where `kind` is `'checkpoint'`, `'update'`,
-  or `'terminal'`.
+  `{ sequence, terminal, kind }`, where `kind` is `'checkpoint'`, `'span'`,
+  `'update'`, or `'terminal'`.
 
-Marks are keyed by the integer boundary ID, never the authored name, because
-rule 18 keeps name strings off the wire. The ID is the boundary's declaration
-index, so it is a stable build-time constant that resolves back to the authored
-name offline through the build manifest.
+Boundary marks are keyed by response-local `BoundaryInstanceId`, not by
+`declarationId` or authored name. Span marks use the separate response-local
+`SpanInstanceId` namespace.
 
 #### Drain policy
 
 The pump drains its queue in one uninterrupted pass by default: that finishes
 hydration soonest and keeps `webui:hydration-complete` early, which is right
-when boundaries arrive spread across the response.
+when records arrive spread across the response.
 
 Setting `window.__WEBUI_STREAMING_SLICE_MS__` to a positive millisecond budget
 opts into a time-sliced drain that yields to the renderer (`scheduler.yield()`
 where available, otherwise a task) whenever the budget is exhausted. This
-matters when an intermediary coalesces the response so every boundary lands in
-one chunk — the single long hydration task streaming exists to avoid. It costs
+matters when an intermediary coalesces the response so every record lands in
+one chunk - the single long hydration task streaming exists to avoid. It costs
 total hydration time and delays the last boundary's interactivity, so it is
 opt-in rather than the default. Record order, per-boundary validation, and the
 single-terminal contract are unchanged; the drain holds the pump open across
@@ -2643,36 +2454,31 @@ existing private `flush_buf` (`crates/webui/src/streaming.rs`) as a public
 `FlushWriter`; a writer that only implements `ResponseWriter` must be
 rejected at the streaming-render entry point rather than silently buffering.
 
-When the handler reaches `</boundary>` it finishes all child markup,
-emits template/state deltas, emits the sentinel, then calls `flush()` — this
-sequence is atomic from the host's perspective. "Flush" means bytes were
+When `resume` completes a checkpoint, it finishes all child markup, emits
+template/state deltas and the sentinel, then calls `flush()`. Span completion,
+update, and terminal records also flush. This sequence is atomic from the
+host's perspective. "Flush" means bytes were
 handed to the HTTP transport; intermediary proxies may still coalesce them,
 so production guidance must document disabling reverse-proxy response
 buffering where applicable (this is a deployment note, not something the
 library can enforce).
 
-Because each boundary's payload and sentinel are emitted before the flush that
-follows it, a streamed response rendered to a full string and split at an
-arbitrary byte offset still hydrates every boundary contained in the prefix.
-This is contract rule 3 observed from the transport side: flush points are an
-optimization of delivery timing, not a correctness requirement of the format.
+Because each complete record and sentinel precedes its flush, a transport prefix
+can commit only complete records. Flush points control delivery timing, not
+wire correctness.
 
 ### Limits, errors, and malformed input
 
-- Client-side caps bound *work*, not record shape: queued boundaries, retained
-  updatable boundaries, retained update roots, pending undefined roots,
-  elements walked per boundary, marker-scan nodes, and the payload-script
-  lookback. Exceeding a cap is a stream error, not a silent truncation. Record
-  size and template count are not capped client-side — they are properties of
-  our own serializer, which rule 20 does not re-check.
-- Exact roots waiting on undefined custom-element classes are cumulatively
-  capped across checkpoints; exceeding that retention cap also fails the stream.
-- A malformed/truncated boundary (missing closing marker, bad sequence
-  number, arity mismatch) is invalid input, consistent with the existing
-  hydration-marker trust contract ("WebUI Framework hydration assumes the SSR
-  DOM, hydration markers, and compiled metadata were generated by the same
-  trusted WebUI compiler/handler version" — see "Plugin data and SSR
-  hydration markers" above) — it is not a recoverable runtime condition.
+- Server limits are 256 continuation frames, 512 runtime boundary occurrences,
+  512 keyed occurrences, 128 open generated spans, 32 nested generated spans,
+  and 1,024 frozen top-level state keys.
+- Browser limits are 512 queued records, 128 updatable boundaries, 50,000
+  retained update roots, 50,000 pending undefined roots, 50,000 pending
+  ancestor-barrier roots, 10,000 elements per checkpoint, 50,000 marker-scan
+  nodes, and an eight-element payload-script lookback.
+- Exceeding any limit is a stream error, never silent truncation. A malformed
+  tuple, bad version or sequence, stale target, duplicate live key, missing
+  marker, impossible span ancestry, or truncated response also fails closed.
 - Client disconnect during a boundary flush surfaces through the existing
   `HandlerError::ClientDisconnected` path (`streaming.rs`); no new error type
   is needed on the Rust side.
@@ -2680,6 +2486,21 @@ optimization of delivery timing, not a correctness requirement of the format.
   `<meta name="webui-nonce">` plus nonce on every SSR-emitted inline
   `<script>`); boundary payload/sentinel scripts get the same nonce.
 
+Stable parser diagnostics are `missing-boundary-name`,
+`invalid-boundary-name`, `duplicate-boundary-name`,
+`missing-boundary-key`, `invalid-boundary-key`, `too-many-boundaries`,
+`nested-boundary`, `boundary-crosses-scope`, `boundary-outside-body`,
+`boundary-in-foster-context`, `invalid-route-boundary-placement`, and
+`authored-webui-hydrate`. `streaming-without-projection` remains a warning.
+
+Runtime ordering, key, continuation, span, and marker failures use
+`HandlerError::StreamingBoundary`. Missing or duplicate document initialization
+uses `MissingStreamingHeadStart` or `DuplicateStreamingHeadStart`; a render
+that reaches no `body_end` uses `MissingStreamingBodyEnd`. Transport failures
+remain `ClientDisconnected` and `StreamTimeout`. Once rendering or transport
+has failed after bytes may have escaped, subsequent session work is rejected as
+poisoned.
+
 ### Rendering-mode isolation
 
 - Streaming boundaries are strictly opt-in (a distinct render/session mode);
@@ -2687,7 +2508,7 @@ optimization of delivery timing, not a correctness requirement of the format.
 - Non-streaming pages carry one `#webui-data` block and the ordinary script
   behavior, byte-for-byte identical to a build with no streaming support.
 - `render()` and complete `renderPartial()` are unaffected by streaming.
-- Router JSON and NDJSON use independent response formats and are unaffected.
+- Router JSON and navigation NDJSON use independent response formats.
 - Host-driven response sessions are available from every host. Rust drives a
   `StreamingResponse` that writes into a `ResponseWriter`; Node, WASM, C, and C#
   drive a `StreamingSession` that returns each chunk's bytes to the caller.
@@ -2698,230 +2519,122 @@ optimization of delivery timing, not a correctness requirement of the format.
 
 ### Performance invariants
 
-Enforced by the streaming-browser-bench harness
-(`examples/integration/streaming-browser-bench`): byte-identical
-non-streaming output with ≤2% throughput regression; zero per-root Rust
-allocation in the boundary collector (one reusable state buffer, cleared -
-not reallocated - after each boundary, plus startup-indexed reachability and a
-reusable integer DFS stack); no `MutationObserver`, polling, or document-wide
-query on a valid client path; fatal cleanup may perform one bounded document
-sweep when marker-local cleanup is impossible; at most one actively parsed
-boundary payload at a time; boundary payload/marker/sentinel/root references
-released immediately after commit.
-
-### Reference application: `examples/app/streaming`
-
-The end-to-end reference for this design. It follows the standard example
-layout (`src/`, `server/`, `tests/`, `playwright.config.ts`, and
-`package.json`). A Node TypeScript API owns backend readiness and record order.
-It returns a host-control stream to `webui serve --api-port`; the CLI owns the
-compiled protocol, `StreamingResponse`, blocking response worker, pooled
-`StreamingWriter`, and browser-facing bytes.
-
-It exercises the three boundary shapes this design supports:
-
-1. **An updatable self-loading island.** The weather panel's
-   `<script type="module">`
-   lives inside its own boundary, so its code is excluded from the critical
-   entry and from the build's preload hints. Its loading shell commits without
-   waiting for forecast data, then a projected state record can arrive between
-   any two feed checkpoints on the original response.
-2. **A critical island.** The composer hydrates and is clickable long before
-   `DOMContentLoaded`, which is the property the whole design exists to
-   provide.
-3. **Repeated boundaries.** Three feed batches flush on a jittered interval,
-   each hydrating and staying independently interactive while later batches
-   are still in flight.
-
-Its Playwright suite covers hydration before `DOMContentLoaded`, server state
-arriving between feed chunks without a second browser request, per-batch
-independence and ordering, island module arrival after commit, compiler-emitted
-preload ordering, `webui:hydration-complete` firing only after the terminal
-record, complete scaffolding removal, and stream closure.
+The continuation VM is iterative and retains bounded frames, lexical scopes,
+projected parent keys, occurrence-key sets, open-span captures, and reusable
+scratch buffers. It does not clone the complete parent state. Runtime discovery
+follows only the selected fragment path and uses `FragmentList::contains_boundary`
+to avoid probing boundary-free subgraphs. Capture buffers are swapped and
+recycled rather than rebuilt for nested spans.
+
+The browser performs no `MutationObserver`, polling, or document-wide query on
+a valid path. It resolves root-local markers, walks each committed range once,
+and retains root references only for updatable occurrences and pending
+definitions or barriers. Fatal cleanup alone may perform one bounded document
+sweep when marker-local cleanup is impossible.
+
+### Reference scenario
+
+The primary scenario has one `<ntp-page>` in the entry. Its reusable component
+template owns `search-ready` around `<search-box>` and continues with a slow
+parent tail. `start` returns the component-local descriptor after writing the
+document prefix and the opening `ntp-page` span. Resuming that descriptor
+commits and hydrates `search-box`; traversal then writes the rest of
+`ntp-page`, completes the generated span, and emits terminal. The early child
+is interactive before the parent tail, without an authored outer boundary.
 
 ### Server-driven response sessions
 
-The host drives one response with integer handles resolved once from free-form
-boundary names:
-
 ```rust
 let mut page = handler.stream_response(&protocol, &options, writer)?;
-let weather = page.boundary("weather-shell")?;
-let composer = page.boundary("composer-ready")?;
+let mut step = page.start(&initial_state)?;
+
+while !step.done {
+    let boundary = step.boundary.as_ref().ok_or_else(missing_boundary)?;
+    let state = load_boundary_state(
+        &boundary.owner,
+        &boundary.name,
+        boundary.key.as_ref(),
+    )?;
+    step = page.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+}
+```
 
-page.write_shell(&shell_state)?;
-page.write_boundary(weather, &weather_loading, BoundaryMode::Updatable)?;
-page.write_boundary(composer, &composer_state, BoundaryMode::Final)?;
+Each call is synchronous and borrows state only for that call. An asynchronous
+host may await between calls but must serialize one session onto one admitted
+worker. A stale or non-pending instance ID is rejected. A rendering or
+transport failure poisons the session because emitted bytes cannot be rewound.
 
-// Backend work may be awaited between synchronous writes.
-page.update(weather, &forecast)?;
-page.finish(&tail_state)?;
+An occurrence committed as `Updatable` may receive object patches before the
+terminal:
+
+```rust
+page.update(search.instance_id, &search_patch)?;
 ```
 
-`write_boundary` accepts only the next boundary in document order. It renders
-the static bytes between the previous checkpoint and that boundary, then the
-complete boundary, its projected checkpoint, and one semantic flush. `update`
-accepts only an earlier boundary committed as `Updatable`; it projects through
-the same compiled component state surface as initial hydration, emits no HTML
-content or marker range, and flushes immediately. `finish` requires every
-compiled boundary to have committed, renders the scriptless tail, emits the
-terminal record, flushes, and ends the writer.
-
-The session never awaits and never retains a borrowed state value between calls.
-Rust async hosts await data between calls and serialize commands onto the one
-worker that owns the response and transport. Concurrent calls to one session are
-not allowed. `StreamingSession` is `Send`, so ownership may move between worker
-threads. It is not required to be `Sync`; a binding that exposes one session
-through a shared host object synchronizes it (for example,
-`Mutex<StreamingSession>`), which is `Send + Sync`.
+The patch is projected through the update plan captured by that checkpoint.
 
 ### Host-owned streaming sessions
 
-Rust's `StreamingResponse` writes into a `ResponseWriter` it borrows for the
-life of the response. That is the right contract when WebUI and the transport
-are in the same address space and the same language, but it is not expressible
-across a language boundary: a napi/FFI/WASM host cannot lend a writer whose
-lifetime outlives a single call.
-
-Non-Rust hosts therefore drive `StreamingSession`, which owns its state and
-**returns** each chunk instead of writing it:
-
-| Host | Type | Chunk type |
-|------|------|-----------|
-| Rust | `webui_handler::StreamingSession` | `Vec<u8>` |
-| Node | `StreamingSession` from `@microsoft/webui` | `Buffer` |
-| WASM | `StreamingSession` from `@microsoft/webui-wasm` | `Uint8Array` |
-| C | `webui_streaming_session_*` | `uint8_t *` + length |
-| C# | `Microsoft.WebUI.StreamingSession` | `byte[]` |
-| Python | `StreamingSession` from `microsoft_webui` | `bytes` |
-
-Every host has the same six operations — `boundary`, `writeShell`,
-`writeBoundary`, `update`, `finish`, plus the `boundaryCount` / `isFinished`
-observers — with identical ordering rules and identical diagnostics.
-
-This inverts exactly one thing, and it is the thing that matters: **the host
-owns the socket.** It decides when to write, how to signal backpressure, and
-what to do when the client disconnects, using its own runtime's idioms
-(`res.write()` plus `drain` on Node, `HttpResponse.Body.WriteAsync` plus
-`FlushAsync` on ASP.NET). WebUI never sees the transport, so it cannot get its
-backpressure or cancellation semantics wrong.
-
-The two topologies are complementary, not ranked:
-
-- **In-process** (`StreamingSession`) — the host already terminates HTTP and
-  wants WebUI as a library. One process, no loopback hop.
-- **API proxy** (`webui serve --api-port`) — the host owns backend readiness and
-  record ordering but wants the CLI to own rendering, static assets, and the
-  browser transport.
-
-Ordering, boundary identity, projection, the wire envelope, and every error are
-shared: both topologies are thin adapters over the same session.
-
-Because a session holds its own reference to the handler and the protocol,
-destruction order between the three is irrelevant, and a rejected call leaves
-the session usable so a host may recover from bad input without discarding the
-response.
-
-`examples/integration/node/streaming-server.js` is the reference in-process
-host: an ordinary `node:http` server, no sidecar, with the whole transport half
-expressed as one write helper that honours backpressure and client aborts.
+Rust's borrowed `StreamingResponse` writes to a `FlushWriter`. Language
+boundaries use owned `StreamingSession`, which returns bytes:
 
-### API-proxy host-control stream
+| Host | Step bytes | API spelling |
+|------|------------|--------------|
+| Rust | `Vec<u8>` | `start`, `resume`, `update` |
+| Node | `Buffer` | `start`, `resume`, `update` |
+| WASM | `Uint8Array` | `start`, `resume`, `update` |
+| C | `uint8_t *` plus length | `webui_streaming_session_start`, `_resume`, `_update` |
+| C# | `byte[]` | `Start`, `Resume`, `Update` |
+| Python | `bytes` | `start`, `resume`, `update` |
 
-For HTTP backends, `webui serve --api-port` advertises
-`Accept: application/x-webui-stream, application/json`. A backend selects
-progressive rendering by returning
-`Content-Type: application/x-webui-stream`; returning JSON keeps the ordinary
-buffered state path.
+Step results carry bytes, optional descriptor, and `done`. Descriptor fields
+preserve JSON key identity across bindings: string keys remain strings and
+finite numeric keys remain numbers. The host owns socket writes, flushing,
+backpressure, cancellation, and one session per in-flight response.
 
-The streaming body is UTF-8 newline-delimited JSON. Version 1 has four record
-shapes:
+### API-proxy host-control stream
+
+With `webui serve --api-port`, the backend selects
+`Content-Type: application/x-webui-stream` and writes UTF-8 NDJSON controls.
+The version-2 control vocabulary mirrors the session:
 
 ```text
-{"type":"shell","version":1,"state":{...}}
-{"type":"boundary","name":"weather-shell","mode":"updatable"}
-{"type":"update","name":"weather-shell","state":{...}}
-{"type":"finish"}
+{"type":"start","version":2,"state":{"query":""}}
+{"type":"resume","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":""},"mode":"updatable"}
+{"type":"update","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":"webui"}}
 ```
 
-- `shell` is the first record and appears exactly once. Its object-valued state
-  becomes the response's reusable base state.
-- `boundary` names the next compile-time boundary in document order. `mode` is
-  `final` when omitted or `updatable`. An optional object-valued `state`
-  applies only to that write; otherwise the base state is borrowed.
-- `update` requires object-valued patch state and targets an already committed
-  updatable boundary.
-- `finish` appears exactly once after all boundaries. Its optional state applies
-  only to the tail write; otherwise the base state is borrowed.
-
-The CLI injects resolved token CSS, `basePath`, and route parameters into shell
-and explicit boundary/finish states before rendering. Updates remain patches and
-receive no unrelated defaults. Boundary names exist only on this loopback
-control channel: the Rust response resolves each distinct name once to
-`BoundaryId`, and the browser wire remains the existing integer-targeted
-five-field envelope.
-
-Each record is capped at 2,000,000 bytes before the newline. The decoder scans
-incrementally and retains only its pending byte buffer. A capacity-one command
-channel connects the async backend reader to one blocking Rust response owner;
-the existing capacity-four `StreamingWriter` channel bounds live browser output.
-While validating the initial shell, the CLI concurrently drains that channel
-into a zero-copy staging list capped at 4,000,000 bytes. It constructs the
-compiled streaming plan and renders through the first semantic flush before
-committing a success response, then prepends the staged chunks to the live
-stream. Malformed control input, invalid entry plans, shell rendering failures,
-and shells over the precommit cap therefore produce an HTTP error rather than an
-empty 200.
-Consequently backpressure propagates from the browser transport through the Rust
-renderer and API response. The backend must also honor its HTTP writer's
-backpressure signal and bound concurrent admitted streams before writing the
-success response. Dropping the browser response cancels backend ingestion,
-which drops the capacity-one command sender and wakes a renderer waiting for its
-next command.
-
-An unsupported version, malformed record, invalid order, unknown boundary,
-renderer failure, or truncated stream closes the response and is logged. A
-non-success backend status is forwarded before browser streaming starts.
-
-Late state and late placement are different operations. A known component shell
-whose data is slow uses `update`: the live island receives a projected state
-patch through WebUI reactivity. Unknown or replacement markup requires deferred
-boundary placement and a DOM patch transport. Weather is the first case and
-does not require a client fetch, a second request, a `DocumentFragment`, or
-declarative partial updates.
-
-### Current scope and limits
-
-- Boundary HTML commits once in authored document order. Markerless state
-  updates may interleave between those checkpoints, but they update existing
-  component roots and do not relocate or replace server markup.
-- The boundary list is fixed at compile time. There is no open-ended append or
-  dynamic boundary API.
-- Router/client-navigation streams use their existing formats and do not reuse
-  response-session records.
-- Host scheduling is external. `StreamingResponse` and `StreamingSession`
-  methods are synchronous so a server can dedicate a bounded worker and preserve
-  transport backpressure.
-- Concurrent calls to one session are not allowed. Sessions are independent, so
-  a server may hold one per in-flight response.
-- CSS strategy is selected per build, not per boundary.
-- Declarative partial updates and client-side DOM patch transports are not used.
-  A slow known region is an updatable WebUI component; structure that cannot be
-  represented by that component is outside this protocol.
-
-### Boundary identity
-
-Boundary names are free-form author-chosen strings used only to resolve stable
-integer handles. The compiler validates names and stores them in declaration
-order in the entry's `StreamingBoundaryList`. At response setup,
-`StreamingResponse::boundary(&str) -> Result<BoundaryId>` performs the one cold
-lookup. `BoundaryId` is a `u32`-backed index, and every render/update method
-accepts only that handle, so no string lookup or hashing appears in hot calls.
-
-Only integer boundary targets reach the wire. An unknown name returns an
-actionable error listing valid names and a "did you mean ...?" suggestion.
-Names are not included in production diagnostics records, avoiding repeated
-wire bytes.
+`start` appears exactly once and drives `StreamingSession::start`. Every
+`resume.boundary` must match the currently returned descriptor by `owner`,
+`name`, and `key`; omit `key` only when the descriptor has none. An optional
+`declarationId` can tighten the match. The CLI passes the descriptor's
+response-local `instanceId` to Rust. `update.boundary` uses the same identity to
+select one previously committed updatable occurrence; multiple matches fail.
+The control stream ends after the `start` or `resume` whose returned step is
+done. There is no end-control record.
+
+Resolved token CSS, `basePath`, and route parameters are injected into start
+and resume state. Update state receives no unrelated defaults. Each NDJSON
+record remains capped at 2,000,000 bytes and the initial bytes produced by
+`start` are staged up to 4,000,000 bytes before HTTP success. A capacity-one
+command channel and the bounded `StreamingWriter` preserve backpressure.
+Disconnect cancels backend ingestion. Unsupported versions, descriptor
+mismatches, invalid order, malformed state, renderer failure, or truncation
+close and log the response.
+
+### Scope
+
+- Runtime occurrences follow the selected document path. Their order is
+  deterministic for a given start state and resume overlays.
+- Authored boundary nesting is not supported. Generated component spans provide
+  the only ancestor mechanism.
+- Updates affect existing retained roots only and never carry markup.
+- Router partial responses keep their independent JSON and NDJSON formats.
+- Host scheduling is external and concurrent calls to one session are invalid.
+- CSS strategy is selected per build, not per occurrence.
+- Only response-local integer targets reach the browser wire. `owner`, `name`,
+  and `key` are host-side descriptor identity and are not repeated in checkpoint
+  envelopes.
 
 ---
 
@@ -4208,7 +3921,7 @@ WebUI Framework hydration assumes the SSR DOM, hydration markers, and compiled m
   root set when its boundary is updatable, accepts later shallow patches through
   `setState`, and releases the retained state when visibility or interaction
   invokes the same `$activateDeferredSSR` path. The coordinator still removes
-  `data-ws` and all boundary scaffolding at commit. `hydratedCallback()` runs
+  `data-ws` and checkpoint/span scaffolding at commit. `hydratedCallback()` runs
   only at the eventual successful hydration.
 - Parser-startup lazy roots hold `webui:hydration-complete` only until
   `DOMContentLoaded` and their first intersection result. Roots intersecting
@@ -4234,6 +3947,11 @@ WebUI Framework hydration assumes the SSR DOM, hydration markers, and compiled m
   continue, then the collected error is rethrown. This supports arbitrarily deep
   definition order without recursion, per-depth promise allocation, lost state,
   or child mutation of authored-parent markers.
+- Progressive component spans add one narrow exception to the parent barrier.
+  A root with `data-ws-enclosing="N"` may bypass only the nearest unfinished
+  ancestor whose compiler-owned `data-ws-span` is `N`. Unmarked, mismatched, or
+  more deeply blocked roots remain dormant. A kind-3 span-completion record
+  later releases the parent through the same exactly-once activation path.
 - A complex `:` property has no durable HTML representation. During SSR
   hydration, the parent resolves every known complex property in the existing
   attribute-binding pass. An upgraded child receives the value through the
@@ -4418,7 +4136,10 @@ consumers only ship the parser and/or handler code they need:
   protobuf protocol bytes and depends on `webui-handler` and `webui-protocol`,
   not `webui-parser`. `Protocol` decodes and indexes once, binds the selected
   plugin at construction, and provides `render`, `renderStream`,
-  `renderPartial`, `renderComponentTemplates`, and `tokens`. Callback rendering
+  `streamResponse`, `renderPartial`, `renderComponentTemplates`, and `tokens`.
+  `streamResponse(entry, requestPath, options)` returns an owned session whose
+  `start` and `resume` methods return `{ bytes, done, boundary? }` and whose
+  `update` method returns bytes. Callback rendering
   coalesces handler fragments with a
   16 KiB target before crossing the WASM-to-JavaScript boundary.
 - `parser` builds `webui_wasm_parser.js` and exports `build_protocol`. It
@@ -4450,6 +4171,10 @@ The `@microsoft/webui` npm package follows the esbuild single-package model:
   callbacks are synchronous, arbitrary return values are ignored, and thrown
   errors abort rendering immediately; the API cannot await Node transport
   `drain` and therefore does not provide backpressure
+- `Protocol.streamResponse()` returns an owned session. The public package
+  accepts object or serialized state, converts once per call, and exposes
+  `start`, `resume`, and `update`; native steps carry `Buffer`, `done`, and an
+  optional camel-case descriptor
 - render currently requires the native addon; no WASM render fallback is wired
 
 ### .NET / NuGet Distribution
@@ -4463,6 +4188,12 @@ token queries are protocol-owned operations exposed as `RenderPartial`,
 `RenderComponentTemplates`, and `Tokens`. The type is thread-safe and releases
 both decoded protocol data and reusable indices on dispose.
 
+`WebUIHandler.StreamResponse` returns a single-driver `StreamingSession`.
+`Start` and `Resume` return immutable `StreamingStep` values; `Update` returns a
+`byte[]`. `BoundaryDescriptor` exposes response-local and declaration IDs,
+owner, name, and a typed `BoundaryKey`. Native step handles are copied into
+managed values and disposed before each call returns.
+
 Native assets are split into `Microsoft.WebUI.Runtime.<rid>` packages for each supported RID. The runtime packages share `dotnet/runtime/README.md`, include NuGet release notes pointing to the GitHub release notes, and carry the matching `runtimes/<rid>/native` asset. The managed package references every runtime package so NuGet restores them transitively; .NET then resolves `webui_ffi` from the matching native asset. `WEBUI_LIB_PATH` remains the override for custom local native builds.
 
 `dotnet/Directory.Build.props` applies NuGet metadata to packable .NET projects: `Authors=Microsoft`, `PackageOwners=Microsoft`, the SPDX `MIT` license expression with `PackageRequireLicenseAcceptance=true`, project and repository URLs, Source Link, release notes links, discoverability tags, the required `© Microsoft Corporation. All rights reserved.` copyright notice, and `.snupkg` symbol package generation. `cargo xtask publish-stage --pack-only` invokes `dotnet pack` on `dotnet/Microsoft.WebUI.sln` and stages both `.nupkg` and `.snupkg` files under `publish/nuget`.
@@ -4499,13 +4230,12 @@ every other host binding. Every rendering call releases the GIL for the
 duration of the Rust work via `Python::detach`, so concurrent Python
 threads render through one `Renderer` without serializing on CPython's
 interpreter lock. `StreamingSession` is synchronized for memory safety but is
-logically **single-driver** — drive one session from one Python thread at a
+logically **single-driver** - drive one session from one Python thread at a
 time, exactly like the Node and C# session types (see
 [Host-owned streaming sessions](#host-owned-streaming-sessions)); independent
-sessions on the same `Renderer` may run concurrently. Every session method,
-including the `boundary_count` and `finished` observers, acquires the session
-lock with the GIL already released, so a misuse that contends on one session
-can never stall unrelated Python threads.
+sessions on the same `Renderer` may run concurrently. Session calls acquire the
+session lock with the GIL already released, so contention on one session cannot
+stall unrelated Python threads.
 
 **API surface.**
 
@@ -4520,14 +4250,13 @@ can never stall unrelated Python threads.
 | `renderer.tokens` | `tuple[str, ...]` of CSS token names in build order |
 | `renderer.stream_response(*, entry="index.html", request_path="/", nonce=None, head_inject=None, body_inject=None)` | Open a host-driven `StreamingSession` |
 
-`StreamingSession` exposes `boundary(name) -> int`, `boundary_count`,
-`finished`, `write_shell(state) -> bytes`,
-`write_boundary(id, state, mode=BoundaryMode.FINAL) -> bytes`,
-`update(id, state) -> bytes`, and `finish(state) -> bytes`. Every method
-returns `bytes`; WebUI never touches a Python socket or ASGI/WSGI transport,
-so ordering (shell, then boundaries in declaration order, then updates to
-already-committed `updatable` boundaries, then `finish()` last) and
-backpressure are the caller's responsibility, exactly as documented in
+`StreamingSession.start(state) -> StreamStep` and
+`StreamingSession.resume(instance_id, state, mode) -> StreamStep` return
+`bytes`, `done`, and an optional descriptor with `instance_id`,
+`declaration_id`, `owner`, `name`, and `key`.
+`StreamingSession.update(instance_id, patch) -> bytes` targets a committed
+updatable occurrence. WebUI never touches a Python socket or ASGI/WSGI
+transport, so the caller owns writes and backpressure exactly as documented in
 [Host-owned streaming sessions](#host-owned-streaming-sessions).
 
 **State encoding.** `state` accepts a Python `Mapping`, which the facade
@@ -4623,20 +4352,19 @@ host, and lets the host apply its own backpressure policy.
 |----------|-------------|
 | `webui_streaming_session_create(handler, protocol, entry_id, request_path)` | Open a session. It inherits the handler's already-configured nonce (see `webui_handler_set_nonce`); head/body injection travels through the reserved `$webui` state key on `state_json` (see [Reserved State Inject Channel](#reserved-state-inject-channel)), not a create-time argument. The session clones its own references to the handler and protocol, so destruction order between the three is irrelevant. |
 | `webui_streaming_session_destroy(session)` | Destroy a session. `NULL` is a safe no-op. Destroying an unfinished session discards its pending output. |
-| `webui_streaming_session_boundary(session, name, out_id)` | Resolve an authored boundary name to its integer handle once, outside the write loop. Returns `false` and sets an error listing the valid names on an unknown name. |
-| `webui_streaming_session_boundary_count(session)` | Number of boundaries declared by the entry template. |
-| `webui_streaming_session_is_finished(session)` | Whether the terminal record has been written. |
-| `webui_streaming_session_write_shell(session, state_json, out_len)` | Produce the document prefix through the first semantic flush. |
-| `webui_streaming_session_write_boundary(session, boundary_id, state_json, mode, out_len)` | Produce one boundary's markup, metadata delta, and checkpoint. `mode` is `0` for final or `1` for updatable. |
-| `webui_streaming_session_update(session, boundary_id, state_json, out_len)` | Produce a projected state patch for a boundary already committed as updatable. |
-| `webui_streaming_session_finish(session, state_json, out_len)` | Produce the implicit tail checkpoint, the terminal record, and the document suffix. |
-
-Chunk-producing functions return a heap-allocated byte pointer plus its length
-through `out_len`, and are freed with `webui_free`. The length is authoritative:
-chunks are binary-safe and must never be treated as NUL-terminated. A `NULL`
-return means the call was rejected; `webui_last_error()` explains why. A
-rejected call leaves the session usable, so a host may recover from an invalid
-state document without discarding the response.
+| `webui_streaming_session_start(session, state_json)` | Return an owned step through the first runtime occurrence or terminal, or `NULL`. |
+| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Commit the pending occurrence as mode `0` final or `1` updatable, then return the next owned step. |
+| `webui_streaming_session_update(session, instance_id, patch_json, out_len)` | Produce a projected state patch for a committed updatable occurrence. |
+| `webui_streaming_step_bytes(step, out_len)` | Borrow the step's binary-safe bytes until destroy. |
+| `webui_streaming_step_done(step)` / `webui_streaming_step_has_boundary(step)` | Observe completion and descriptor presence. |
+| `webui_streaming_step_boundary_*` | Read instance ID, declaration ID, owner, name, key type, and typed key value. |
+| `webui_streaming_step_destroy(step)` | Release the opaque step and all borrowed pointers. `NULL` is safe. |
+
+`webui_streaming_step_t` is opaque. Owner, name, string key, and step bytes are
+borrowed slices with explicit lengths and are not NUL-terminated. Numeric keys
+are read as `double`; key type is none, string, or number. Update bytes are
+released with `webui_free`. A failing function returns `false` or `NULL`, and
+`webui_last_error()` explains the rejection.
 
 Host parity: the same session shape is available as `StreamingSession` from
 Rust (`webui-handler`), Node (`Protocol.streamResponse`), WASM
diff --git a/crates/webui-cli/README.md b/crates/webui-cli/README.md
index e634d8873..d7010e4e9 100644
--- a/crates/webui-cli/README.md
+++ b/crates/webui-cli/README.md
@@ -70,9 +70,25 @@ Features:
 - HMR polling at `/hmr` when `--watch` is enabled
 - API proxy when `--api-port` is set. Backends may return JSON state or a
   versioned, newline-delimited `application/x-webui-stream` control response;
-  the CLI retains the Rust renderer, caps precommit shell staging at 4,000,000
+  the CLI retains the Rust renderer, caps precommit output staging at 4,000,000
   bytes, and cancels the backend when the browser disconnects.
 
+The control response uses version 2 and exactly three command types:
+
+```json
+{"type":"start","version":2,"state":{"title":"Initial state"}}
+{"type":"resume","boundary":{"owner":"index.html","name":"hero"},"mode":"updatable","state":{}}
+{"type":"update","boundary":{"owner":"index.html","name":"hero"},"state":{"status":"ready"}}
+```
+
+`start` is first and supplies the initial object state. Each `resume` must echo
+the pending runtime descriptor's `owner`, `name`, and optional string-or-number
+`key`; `declarationId` may also be supplied for validation. The CLI retains
+committed descriptors, so `update` uses the same target without a reverse
+acknowledgement channel. Ambiguous unkeyed update targets are rejected. A
+`resume` automatically completes the response when its returned step is done;
+the backend then closes its NDJSON body. There is no terminal control command.
+
 ### `webui inspect`
 
 Convert a compiled protocol to JSON for debugging.
diff --git a/crates/webui-cli/src/commands/inspect.rs b/crates/webui-cli/src/commands/inspect.rs
index feb43fe5d..4610cc088 100644
--- a/crates/webui-cli/src/commands/inspect.rs
+++ b/crates/webui-cli/src/commands/inspect.rs
@@ -42,6 +42,7 @@ mod tests {
                     WebUIFragment::raw("Hello"),
                     WebUIFragment::signal("name", false),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
diff --git a/crates/webui-cli/src/commands/serve.rs b/crates/webui-cli/src/commands/serve.rs
index 2d936bc7a..3799ae774 100644
--- a/crates/webui-cli/src/commands/serve.rs
+++ b/crates/webui-cli/src/commands/serve.rs
@@ -1595,12 +1595,14 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "docs-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<main>docs</main>")],
+                contains_boundary: false,
             },
         );
         Arc::new(Protocol::new(WebUIProtocol::with_tokens(
@@ -1951,6 +1953,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-app")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -1973,36 +1976,42 @@ mod tests {
                         ..Default::default()
                     }),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-category-nav".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<nav></nav>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-page-search".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-grid")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-grid".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div></div>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-page-product".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-detail")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-detail".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<article></article>")],
+                contains_boundary: false,
             },
         );
 
@@ -2122,6 +2131,7 @@ mod tests {
                 fragments: vec![WebUIFragment::raw(
                     "<html><body><main>fallback rendered</main></body></html>",
                 )],
+                contains_boundary: false,
             },
         );
         let protocol = Arc::new(Protocol::new(WebUIProtocol::with_tokens(
diff --git a/crates/webui-cli/src/commands/serve/streaming_api.rs b/crates/webui-cli/src/commands/serve/streaming_api.rs
index f3e3733a6..1066ae5b6 100644
--- a/crates/webui-cli/src/commands/serve/streaming_api.rs
+++ b/crates/webui-cli/src/commands/serve/streaming_api.rs
@@ -12,13 +12,16 @@ use std::time::Duration;
 use actix_web::http::header::{HeaderMap, CONTENT_TYPE};
 use actix_web::HttpResponse;
 use bytes::{Bytes, BytesMut};
-use serde::Deserialize;
+use serde::{Deserialize, Deserializer};
 use serde_json::Value;
 use thiserror::Error;
 use tokio::sync::{mpsc, oneshot};
 use tokio_stream::{Stream, StreamExt};
 use webui::streaming::{ChunkPool, StreamingWriter};
-use webui::{BoundaryId, BoundaryMode, HandlerError, Protocol, RenderOptions, StreamingResponse};
+use webui::{
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, HandlerError, Protocol,
+    RenderOptions,
+};
 
 use super::create_handler;
 use crate::commands::common::Plugin;
@@ -26,9 +29,9 @@ use crate::commands::common::Plugin;
 pub(super) const MEDIA_TYPE: &str = "application/x-webui-stream";
 pub(super) const ACCEPT: &str = "application/x-webui-stream, application/json";
 
-const VERSION: u8 = 1;
+const VERSION: u8 = 2;
 const MAX_RECORD_BYTES: usize = 2_000_000;
-const MAX_INITIAL_SHELL_BYTES: usize = 4_000_000;
+const MAX_PRECOMMIT_BYTES: usize = 4_000_000;
 const INITIAL_RECORD_CAPACITY: usize = 4 * 1024;
 
 pub(super) struct StateDefaults {
@@ -84,51 +87,99 @@ pub(super) struct RenderConfig {
 #[derive(Debug, Deserialize)]
 #[serde(tag = "type", rename_all = "lowercase", deny_unknown_fields)]
 enum ApiStreamCommand {
-    Shell {
+    Start {
         version: u8,
         state: Value,
     },
-    Boundary {
-        name: String,
+    Resume {
+        boundary: ApiBoundaryTarget,
         #[serde(default)]
         mode: ApiBoundaryMode,
-        state: Option<Value>,
+        state: Value,
     },
     Update {
-        name: String,
+        boundary: ApiBoundaryTarget,
         state: Value,
     },
-    Finish {
-        state: Option<Value>,
-    },
 }
 
 impl ApiStreamCommand {
     fn prepare(&mut self, defaults: &StateDefaults, record: usize) -> Result<(), ApiStreamError> {
         match self {
-            Self::Shell { state, .. } => defaults.apply_record(state, record),
-            Self::Boundary {
-                state: Some(state), ..
+            Self::Start { state, .. } | Self::Resume { state, .. } => {
+                defaults.apply_record(state, record)
             }
-            | Self::Finish { state: Some(state) } => defaults.apply_record(state, record),
             Self::Update { state, .. } if !state.is_object() => {
                 Err(ApiStreamError::StateMustBeObject { record })
             }
-            Self::Boundary { state: None, .. }
-            | Self::Finish { state: None }
-            | Self::Update { .. } => Ok(()),
+            Self::Update { .. } => Ok(()),
         }
     }
 
-    fn shell_version(&self) -> Option<u8> {
+    fn start_version(&self) -> Option<u8> {
         match self {
-            Self::Shell { version, .. } => Some(*version),
+            Self::Start { version, .. } => Some(*version),
             _ => None,
         }
     }
 
-    fn is_finish(&self) -> bool {
-        matches!(self, Self::Finish { .. })
+    const fn name(&self) -> &'static str {
+        match self {
+            Self::Start { .. } => "start",
+            Self::Resume { .. } => "resume",
+            Self::Update { .. } => "update",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ApiBoundaryTarget {
+    owner: String,
+    name: String,
+    #[serde(default, deserialize_with = "deserialize_boundary_key")]
+    key: Option<ApiBoundaryKey>,
+    #[serde(default)]
+    declaration_id: Option<u32>,
+}
+
+impl ApiBoundaryTarget {
+    fn matches(&self, boundary: &BoundaryDescriptor) -> bool {
+        self.owner.as_str() == boundary.owner.as_ref()
+            && self.name.as_str() == boundary.name.as_ref()
+            && self.key.matches(&boundary.key)
+            && self
+                .declaration_id
+                .is_none_or(|id| id == boundary.declaration_id)
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
+#[serde(untagged)]
+enum ApiBoundaryKey {
+    String(String),
+    Number(serde_json::Number),
+}
+
+fn deserialize_boundary_key<'de, D>(deserializer: D) -> Result<Option<ApiBoundaryKey>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    ApiBoundaryKey::deserialize(deserializer).map(Some)
+}
+
+trait ApiBoundaryKeyOptionExt {
+    fn matches(&self, key: &Option<BoundaryKey>) -> bool;
+}
+
+impl ApiBoundaryKeyOptionExt for Option<ApiBoundaryKey> {
+    fn matches(&self, key: &Option<BoundaryKey>) -> bool {
+        match (self, key) {
+            (None, None) => true,
+            (Some(ApiBoundaryKey::String(left)), Some(BoundaryKey::String(right))) => left == right,
+            (Some(ApiBoundaryKey::Number(left)), Some(BoundaryKey::Number(right))) => left == right,
+            _ => false,
+        }
     }
 }
 
@@ -163,16 +214,14 @@ enum ApiStreamError {
     },
     #[error("WebUI API stream record {record} must contain an object-valued state")]
     StateMustBeObject { record: usize },
-    #[error("WebUI API stream record {record} must be the initial shell record")]
-    MissingShell { record: usize },
-    #[error("WebUI API stream record {record} repeats the shell record")]
-    DuplicateShell { record: usize },
+    #[error("WebUI API stream record {record} must be the initial start record")]
+    MissingStart { record: usize },
+    #[error("WebUI API stream record {record} repeats the start record")]
+    DuplicateStart { record: usize },
     #[error(
         "WebUI API stream record {record} uses unsupported version {version}; send version {VERSION}"
     )]
     UnsupportedVersion { record: usize, version: u8 },
-    #[error("WebUI API stream ended before a finish record; send {{\"type\":\"finish\"}}")]
-    MissingFinish,
     #[error("WebUI API stream transport failed: {0}")]
     Backend(String),
     #[error("WebUI API stream renderer stopped before accepting record {record}")]
@@ -180,17 +229,62 @@ enum ApiStreamError {
 }
 
 #[derive(Debug, Error)]
-enum ShellInitializationError {
+enum StreamInitializationError {
     #[error("{0}")]
     Render(String),
-    #[error("WebUI streaming renderer stopped during initialization")]
+    #[error("WebUI streaming renderer stopped during start")]
     RendererStopped,
     #[error(
-        "WebUI initial streaming shell exceeds the 4,000,000-byte precommit limit; reduce the initial state or move content behind a boundary"
+        "WebUI initial streaming output exceeds the 4,000,000-byte precommit limit; reduce the initial state or move content behind a boundary"
     )]
     TooLarge,
 }
 
+#[derive(Debug, Error)]
+enum RendererError {
+    #[error(transparent)]
+    Handler(#[from] HandlerError),
+    #[error("WebUI API stream renderer expected the validated initial start record")]
+    ExpectedStart,
+    #[error("WebUI API stream renderer stopped before receiving the initial start record")]
+    MissingStart,
+    #[error("WebUI API stream record {record} repeats the start record")]
+    DuplicateStart { record: usize },
+    #[error(
+        "WebUI API stream record {record} resumes {received}, but the current cursor is {expected}; echo the pending boundary owner, name, and typed key exactly"
+    )]
+    ResumeMismatch {
+        record: usize,
+        received: String,
+        expected: String,
+    },
+    #[error(
+        "WebUI API stream record {record} updates {target}, but no matching occurrence was committed as updatable; target an earlier resume with the same owner, name, and typed key"
+    )]
+    UpdateNotCommitted { record: usize, target: String },
+    #[error(
+        "WebUI API stream record {record} updates {target}, but the matching occurrence was committed as final; resume it with mode \"updatable\" before sending updates"
+    )]
+    UpdateFinal { record: usize, target: String },
+    #[error(
+        "WebUI API stream record {record} updates {target}, which matches multiple updatable occurrences; add a stable <boundary key> and include its typed value"
+    )]
+    AmbiguousUpdate { record: usize, target: String },
+    #[error(
+        "WebUI API stream ended while waiting to resume {pending}; send the matching resume record before closing the response body"
+    )]
+    Truncated { pending: String },
+    #[error(
+        "WebUI API stream record {record} sends {command} after the streaming response completed; close the response body after the resume that returns done"
+    )]
+    CommandAfterDone {
+        record: usize,
+        command: &'static str,
+    },
+    #[error("WebUI streaming session returned an unfinished step without a boundary descriptor")]
+    MissingDescriptor,
+}
+
 struct RecordDecoder {
     bytes: BytesMut,
     next_record: usize,
@@ -253,26 +347,33 @@ fn record_too_large(record: usize) -> ApiStreamError {
 }
 
 struct CommandIngest {
-    sender: mpsc::Sender<ApiStreamCommand>,
+    sender: mpsc::Sender<ApiStreamRecord>,
     state_defaults: StateDefaults,
     record: usize,
-    shell_seen: bool,
+    start_seen: bool,
+}
+
+struct ApiStreamRecord {
+    index: usize,
+    command: ApiStreamCommand,
 }
 
 impl CommandIngest {
-    async fn dispatch(&mut self, bytes: &[u8]) -> Result<bool, ApiStreamError> {
+    async fn dispatch(&mut self, bytes: &[u8]) -> Result<(), ApiStreamError> {
         let record = self.record;
         self.record += 1;
         let mut command = serde_json::from_slice::<ApiStreamCommand>(bytes)
             .map_err(|source| ApiStreamError::InvalidJson { record, source })?;
         self.validate_order(&command, record)?;
         command.prepare(&self.state_defaults, record)?;
-        let finished = command.is_finish();
         self.sender
-            .send(command)
+            .send(ApiStreamRecord {
+                index: record,
+                command,
+            })
             .await
             .map_err(|_| ApiStreamError::RendererStopped { record })?;
-        Ok(finished)
+        Ok(())
     }
 
     fn validate_order(
@@ -280,18 +381,18 @@ impl CommandIngest {
         command: &ApiStreamCommand,
         record: usize,
     ) -> Result<(), ApiStreamError> {
-        if let Some(version) = command.shell_version() {
-            if self.shell_seen {
-                return Err(duplicate_shell(record));
+        if let Some(version) = command.start_version() {
+            if self.start_seen {
+                return Err(duplicate_start(record));
             }
             if version != VERSION {
                 return Err(unsupported_version(record, version));
             }
-            self.shell_seen = true;
+            self.start_seen = true;
             return Ok(());
         }
-        if !self.shell_seen {
-            return Err(missing_shell(record));
+        if !self.start_seen {
+            return Err(missing_start(record));
         }
         Ok(())
     }
@@ -299,14 +400,14 @@ impl CommandIngest {
 
 #[cold]
 #[inline(never)]
-fn duplicate_shell(record: usize) -> ApiStreamError {
-    ApiStreamError::DuplicateShell { record }
+fn duplicate_start(record: usize) -> ApiStreamError {
+    ApiStreamError::DuplicateStart { record }
 }
 
 #[cold]
 #[inline(never)]
-fn missing_shell(record: usize) -> ApiStreamError {
-    ApiStreamError::MissingShell { record }
+fn missing_start(record: usize) -> ApiStreamError {
+    ApiStreamError::MissingStart { record }
 }
 
 #[cold]
@@ -389,7 +490,7 @@ where
         sender: command_tx,
         state_defaults,
         record: 0,
-        shell_seen: false,
+        start_seen: false,
     };
 
     if let Err(error) = ingest_first(&mut backend, &mut decoder, &mut ingest).await {
@@ -411,7 +512,7 @@ where
         }
     });
 
-    let (initial_html, html_rx) = match stage_initial_shell(ready_rx, html_rx).await {
+    let (initial_html, html_rx) = match stage_precommit_output(ready_rx, html_rx).await {
         Ok(output) => output,
         Err(error) => {
             log::error!(
@@ -444,10 +545,10 @@ where
         .streaming(stream)
 }
 
-async fn stage_initial_shell(
+async fn stage_precommit_output(
     mut ready: oneshot::Receiver<Result<(), String>>,
     mut html: mpsc::Receiver<Bytes>,
-) -> Result<(Vec<Bytes>, mpsc::Receiver<Bytes>), ShellInitializationError> {
+) -> Result<(Vec<Bytes>, mpsc::Receiver<Bytes>), StreamInitializationError> {
     let mut initial = Vec::with_capacity(StreamingWriter::DEFAULT_CHANNEL_CAPACITY);
     let mut total = 0usize;
     loop {
@@ -472,11 +573,11 @@ async fn stage_initial_shell(
 
 fn validate_renderer_ready(
     result: Result<Result<(), String>, oneshot::error::RecvError>,
-) -> Result<(), ShellInitializationError> {
+) -> Result<(), StreamInitializationError> {
     match result {
         Ok(Ok(())) => Ok(()),
-        Ok(Err(error)) => Err(ShellInitializationError::Render(error)),
-        Err(_) => Err(ShellInitializationError::RendererStopped),
+        Ok(Err(error)) => Err(StreamInitializationError::Render(error)),
+        Err(_) => Err(StreamInitializationError::RendererStopped),
     }
 }
 
@@ -484,10 +585,10 @@ fn stage_initial_chunk(
     initial: &mut Vec<Bytes>,
     total: &mut usize,
     chunk: Bytes,
-) -> Result<(), ShellInitializationError> {
+) -> Result<(), StreamInitializationError> {
     let next_total = total.saturating_add(chunk.len());
-    if next_total > MAX_INITIAL_SHELL_BYTES {
-        return Err(ShellInitializationError::TooLarge);
+    if next_total > MAX_PRECOMMIT_BYTES {
+        return Err(StreamInitializationError::TooLarge);
     }
     *total = next_total;
     initial.push(chunk);
@@ -496,10 +597,10 @@ fn stage_initial_chunk(
 
 fn run_renderer(
     config: RenderConfig,
-    mut commands: mpsc::Receiver<ApiStreamCommand>,
+    mut commands: mpsc::Receiver<ApiStreamRecord>,
     writer: &mut StreamingWriter,
     ready: oneshot::Sender<Result<(), String>>,
-) -> Result<(), HandlerError> {
+) -> Result<(), RendererError> {
     let handler = create_handler(config.plugin);
     let options = RenderOptions::new(&config.entry, &config.route_path);
     let options = match config.body_inject.as_deref() {
@@ -510,82 +611,194 @@ fn run_renderer(
         Ok(response) => response,
         Err(error) => {
             let _ = ready.send(Err(error.to_string()));
-            return Err(error);
+            return Err(error.into());
         }
     };
-    let mut boundaries = HashMap::with_capacity(response.boundary_count());
-    let base_state = match commands.blocking_recv() {
-        Some(ApiStreamCommand::Shell { state, .. }) => {
-            if let Err(error) = response.write_shell(&state) {
+    let mut committed = Vec::with_capacity(8);
+    let mut status = match commands.blocking_recv() {
+        Some(ApiStreamRecord {
+            command: ApiStreamCommand::Start { state, .. },
+            ..
+        }) => match response.start(&state) {
+            Ok(status) => status,
+            Err(error) => {
                 let _ = ready.send(Err(error.to_string()));
-                return Err(error);
+                return Err(error.into());
             }
-            Some(state)
-        }
+        },
         Some(_) => {
-            let error = HandlerError::Invariant(
-                "streaming API renderer did not receive the validated shell first".to_owned(),
-            );
+            let error = RendererError::ExpectedStart;
             let _ = ready.send(Err(error.to_string()));
             return Err(error);
         }
         None => {
-            let error = HandlerError::Writer(
-                "streaming API command producer stopped before shell rendering".to_owned(),
-            );
+            let error = RendererError::MissingStart;
             let _ = ready.send(Err(error.to_string()));
             return Err(error);
         }
     };
     let _ = ready.send(Ok(()));
 
-    while let Some(command) = commands.blocking_recv() {
-        match command {
-            ApiStreamCommand::Shell { .. } => {
-                return Err(HandlerError::Invariant(
-                    "streaming API renderer received a duplicate shell".to_owned(),
-                ));
+    loop {
+        let Some(record) = commands.blocking_recv() else {
+            if status.done {
+                return Ok(());
             }
-            ApiStreamCommand::Boundary { name, mode, state } => {
-                let boundary = resolve_boundary(&response, &mut boundaries, name)?;
-                let state = state.as_ref().or(base_state.as_ref()).ok_or_else(|| {
-                    HandlerError::Invariant(
-                        "streaming API boundary has no shell or explicit state".to_owned(),
-                    )
-                })?;
-                response.write_boundary(boundary, state, mode.into())?;
+            return Err(RendererError::Truncated {
+                pending: pending_descriptor(&status)?,
+            });
+        };
+        if status.done {
+            return Err(RendererError::CommandAfterDone {
+                record: record.index,
+                command: record.command.name(),
+            });
+        }
+
+        match record.command {
+            ApiStreamCommand::Start { .. } => {
+                return Err(RendererError::DuplicateStart {
+                    record: record.index,
+                });
             }
-            ApiStreamCommand::Update { name, state } => {
-                let boundary = resolve_boundary(&response, &mut boundaries, name)?;
-                response.update(boundary, &state)?;
+            ApiStreamCommand::Resume {
+                boundary,
+                mode,
+                state,
+            } => {
+                let pending = status
+                    .boundary
+                    .as_ref()
+                    .ok_or(RendererError::MissingDescriptor)?;
+                if !boundary.matches(pending) {
+                    return Err(RendererError::ResumeMismatch {
+                        record: record.index,
+                        received: format_target(&boundary),
+                        expected: format_descriptor(pending),
+                    });
+                }
+                let descriptor = pending.clone();
+                let mode = BoundaryMode::from(mode);
+                status = response.resume(descriptor.instance_id, &state, mode)?;
+                committed.push(CommittedBoundary { descriptor, mode });
             }
-            ApiStreamCommand::Finish { state } => {
-                let state = state.as_ref().or(base_state.as_ref()).ok_or_else(|| {
-                    HandlerError::Invariant(
-                        "streaming API finish has no shell or explicit state".to_owned(),
-                    )
-                })?;
-                return response.finish(state);
+            ApiStreamCommand::Update { boundary, state } => {
+                let instance_id = resolve_update(&committed, &boundary, record.index)?;
+                response.update(instance_id, &state)?;
             }
         }
     }
+}
 
-    Err(HandlerError::Writer(
-        "streaming API command producer stopped before finish".to_owned(),
-    ))
+struct CommittedBoundary {
+    descriptor: BoundaryDescriptor,
+    mode: BoundaryMode,
 }
 
-fn resolve_boundary(
-    response: &StreamingResponse<'_, StreamingWriter>,
-    boundaries: &mut HashMap<String, BoundaryId>,
-    name: String,
-) -> Result<BoundaryId, HandlerError> {
-    if let Some(boundary) = boundaries.get(&name) {
-        return Ok(*boundary);
+fn resolve_update(
+    committed: &[CommittedBoundary],
+    target: &ApiBoundaryTarget,
+    record: usize,
+) -> Result<BoundaryInstanceId, RendererError> {
+    let mut updatable = None;
+    let mut final_match = false;
+    for boundary in committed {
+        if !target.matches(&boundary.descriptor) {
+            continue;
+        }
+        if boundary.mode == BoundaryMode::Final {
+            final_match = true;
+            continue;
+        }
+        if updatable.is_some() {
+            return Err(RendererError::AmbiguousUpdate {
+                record,
+                target: format_target(target),
+            });
+        }
+        updatable = Some(boundary.descriptor.instance_id);
+    }
+    if let Some(instance_id) = updatable {
+        return Ok(instance_id);
+    }
+    let target = format_target(target);
+    if final_match {
+        Err(RendererError::UpdateFinal { record, target })
+    } else {
+        Err(RendererError::UpdateNotCommitted { record, target })
+    }
+}
+
+fn pending_descriptor(status: &webui::StreamStatus) -> Result<String, RendererError> {
+    status
+        .boundary
+        .as_ref()
+        .map(format_descriptor)
+        .ok_or(RendererError::MissingDescriptor)
+}
+
+#[cold]
+#[inline(never)]
+fn format_target(target: &ApiBoundaryTarget) -> String {
+    format_boundary_identity(
+        &target.owner,
+        &target.name,
+        target.key.as_ref().map(ApiBoundaryKeyRef::from),
+        target.declaration_id,
+    )
+}
+
+#[cold]
+#[inline(never)]
+fn format_descriptor(boundary: &BoundaryDescriptor) -> String {
+    format_boundary_identity(
+        &boundary.owner,
+        &boundary.name,
+        boundary.key.as_ref().map(ApiBoundaryKeyRef::from),
+        Some(boundary.declaration_id),
+    )
+}
+
+enum ApiBoundaryKeyRef<'a> {
+    String(&'a str),
+    Number(&'a serde_json::Number),
+}
+
+impl<'a> From<&'a ApiBoundaryKey> for ApiBoundaryKeyRef<'a> {
+    fn from(value: &'a ApiBoundaryKey) -> Self {
+        match value {
+            ApiBoundaryKey::String(value) => Self::String(value),
+            ApiBoundaryKey::Number(value) => Self::Number(value),
+        }
+    }
+}
+
+impl<'a> From<&'a BoundaryKey> for ApiBoundaryKeyRef<'a> {
+    fn from(value: &'a BoundaryKey) -> Self {
+        match value {
+            BoundaryKey::String(value) => Self::String(value),
+            BoundaryKey::Number(value) => Self::Number(value),
+        }
+    }
+}
+
+fn format_boundary_identity(
+    owner: &str,
+    name: &str,
+    key: Option<ApiBoundaryKeyRef<'_>>,
+    declaration_id: Option<u32>,
+) -> String {
+    let key = match key {
+        Some(ApiBoundaryKeyRef::String(value)) => format!("{value:?}"),
+        Some(ApiBoundaryKeyRef::Number(value)) => value.to_string(),
+        None => "<none>".to_owned(),
+    };
+    match declaration_id {
+        Some(id) => {
+            format!("boundary owner={owner:?}, name={name:?}, key={key}, declarationId={id}")
+        }
+        None => format!("boundary owner={owner:?}, name={name:?}, key={key}"),
     }
-    let boundary = response.boundary(&name)?;
-    boundaries.insert(name, boundary);
-    Ok(boundary)
 }
 
 async fn ingest_first<S>(
@@ -606,7 +819,7 @@ where
                 ingest.dispatch(&record).await?;
                 return Ok(());
             }
-            return Err(missing_shell(0));
+            return Err(missing_start(0));
         };
         decoder.push(&chunk.map_err(ApiStreamError::Backend)?);
     }
@@ -621,32 +834,26 @@ where
     S: Stream<Item = Result<Bytes, String>> + Unpin,
 {
     while let Some(record) = decoder.next()? {
-        if ingest.dispatch(&record).await? {
-            return Ok(());
-        }
+        ingest.dispatch(&record).await?;
     }
     while let Some(chunk) = backend.next().await {
         let chunk = chunk.map_err(ApiStreamError::Backend)?;
         decoder.push(&chunk);
         while let Some(record) = decoder.next()? {
-            if ingest.dispatch(&record).await? {
-                return Ok(());
-            }
+            ingest.dispatch(&record).await?;
         }
     }
 
     if let Some(record) = decoder.finish()? {
-        if ingest.dispatch(&record).await? {
-            return Ok(());
-        }
+        ingest.dispatch(&record).await?;
     }
-    Err(ApiStreamError::MissingFinish)
+    Ok(())
 }
 
 #[cfg(test)]
 async fn ingest<S>(
     mut backend: S,
-    sender: mpsc::Sender<ApiStreamCommand>,
+    sender: mpsc::Sender<ApiStreamRecord>,
     state_defaults: StateDefaults,
 ) -> Result<(), ApiStreamError>
 where
@@ -657,13 +864,14 @@ where
         sender,
         state_defaults,
         record: 0,
-        shell_seen: false,
+        start_seen: false,
     };
     ingest_first(&mut backend, &mut decoder, &mut ingest).await?;
     ingest_remaining(backend, decoder, ingest).await
 }
 
 #[cfg(test)]
+#[allow(clippy::disallowed_methods)]
 mod tests {
     use super::*;
     use actix_web::body::to_bytes;
@@ -674,14 +882,14 @@ mod tests {
         StateDefaults::new(None, "/".to_owned(), HashMap::new())
     }
 
-    fn shell_render_failure_config() -> RenderConfig {
-        fn structural(value: &str) -> WebUIFragment {
-            let mut signal = String::with_capacity(value.len() + 9);
-            signal.push_str("}}}webui:");
-            signal.push_str(value);
-            WebUIFragment::signal(signal, true)
-        }
+    fn structural(value: &str) -> WebUIFragment {
+        let mut signal = String::with_capacity(value.len() + 9);
+        signal.push_str("}}}webui:");
+        signal.push_str(value);
+        WebUIFragment::signal(signal, true)
+    }
 
+    fn start_render_failure_config() -> RenderConfig {
         let fragments = vec![
             WebUIFragment::raw("<html><head>"),
             structural("head_start"),
@@ -689,28 +897,28 @@ mod tests {
             WebUIFragment::raw("</head><body>"),
             structural("body_start"),
             structural("streaming_root:outside-boundary"),
-            structural("boundary_start:0"),
+            WebUIFragment::boundary(0, "index.html", "content", None),
             WebUIFragment::raw("<main>ready</main>"),
-            structural("boundary_end:0"),
+            WebUIFragment::boundary_end(0),
             structural("body_end"),
             WebUIFragment::raw("</body></html>"),
         ];
         let document = WebUIProtocol::new(HashMap::from([(
             "index.html".to_owned(),
-            FragmentList { fragments },
+            FragmentList {
+                fragments,
+                contains_boundary: true,
+            },
         )]));
         render_config(document)
     }
 
-    fn valid_streaming_config(shell_fragments: Vec<WebUIFragment>) -> RenderConfig {
-        fn structural(value: &str) -> WebUIFragment {
-            let mut signal = String::with_capacity(value.len() + 9);
-            signal.push_str("}}}webui:");
-            signal.push_str(value);
-            WebUIFragment::signal(signal, true)
-        }
-
-        let mut fragments = Vec::with_capacity(shell_fragments.len() + 11);
+    fn valid_streaming_config(
+        precommit_fragments: Vec<WebUIFragment>,
+        boundary_names: &[&str],
+    ) -> RenderConfig {
+        let mut fragments =
+            Vec::with_capacity(precommit_fragments.len() + boundary_names.len() * 3 + 7);
         fragments.extend([
             WebUIFragment::raw("<html><head>"),
             structural("head_start"),
@@ -718,24 +926,31 @@ mod tests {
             WebUIFragment::raw("</head><body>"),
             structural("body_start"),
         ]);
-        fragments.extend(shell_fragments);
-        fragments.extend([
-            structural("boundary_start:0"),
-            WebUIFragment::raw("<main>ready</main>"),
-            structural("boundary_end:0"),
-            structural("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ]);
-        let mut document = WebUIProtocol::new(HashMap::from([(
-            "index.html".to_owned(),
-            FragmentList { fragments },
-        )]));
-        document.streaming_boundaries.insert(
+        fragments.extend(precommit_fragments);
+        let mut records = HashMap::with_capacity(1);
+        for (declaration_id, name) in boundary_names.iter().enumerate() {
+            let declaration_id = u32::try_from(declaration_id)
+                .unwrap_or_else(|_| panic!("test boundary ID does not fit u32"));
+            fragments.push(WebUIFragment::boundary(
+                declaration_id,
+                "index.html",
+                *name,
+                None,
+            ));
+            fragments.push(WebUIFragment::raw(format!(
+                "<main data-boundary=\"{name}\">ready</main>"
+            )));
+            fragments.push(WebUIFragment::boundary_end(declaration_id));
+        }
+        fragments.extend([structural("body_end"), WebUIFragment::raw("</body></html>")]);
+        records.insert(
             "index.html".to_owned(),
-            webui_protocol::StreamingBoundaryList {
-                names: vec!["content".to_owned()],
+            FragmentList {
+                fragments,
+                contains_boundary: !boundary_names.is_empty(),
             },
         );
+        let document = WebUIProtocol::new(records);
         render_config(document)
     }
 
@@ -754,7 +969,7 @@ mod tests {
     }
 
     struct StalledBackend {
-        shell: Option<Bytes>,
+        start: Option<Bytes>,
         dropped: Option<oneshot::Sender<()>>,
     }
 
@@ -762,8 +977,8 @@ mod tests {
         type Item = Result<Bytes, String>;
 
         fn poll_next(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
-            match self.shell.take() {
-                Some(shell) => Poll::Ready(Some(Ok(shell))),
+            match self.start.take() {
+                Some(start) => Poll::Ready(Some(Ok(start))),
                 None => Poll::Pending,
             }
         }
@@ -783,38 +998,70 @@ mod tests {
             .unwrap_or_else(|error| panic!("decode failed: {error}"))
     }
 
+    fn target(owner: &str, name: &str) -> ApiBoundaryTarget {
+        ApiBoundaryTarget {
+            owner: owner.to_owned(),
+            name: name.to_owned(),
+            key: None,
+            declaration_id: None,
+        }
+    }
+
+    fn run_commands(
+        config: RenderConfig,
+        commands: Vec<ApiStreamCommand>,
+    ) -> (Result<(), RendererError>, Vec<u8>) {
+        let (command_tx, command_rx) = mpsc::channel(commands.len().max(1));
+        for (index, command) in commands.into_iter().enumerate() {
+            command_tx
+                .try_send(ApiStreamRecord { index, command })
+                .unwrap_or_else(|error| panic!("failed to stage test command: {error}"));
+        }
+        drop(command_tx);
+        let (html_tx, mut html_rx) = mpsc::channel(32);
+        let mut writer = StreamingWriter::new(html_tx);
+        let (ready_tx, _ready_rx) = oneshot::channel();
+        let result = run_renderer(config, command_rx, &mut writer, ready_tx);
+        drop(writer);
+        let mut html = Vec::new();
+        while let Ok(chunk) = html_rx.try_recv() {
+            html.extend_from_slice(&chunk);
+        }
+        (result, html)
+    }
+
     #[test]
     fn decoder_reassembles_split_records() {
         let mut decoder = RecordDecoder::new();
-        decoder.push(br#"{"type":"shell","#);
+        decoder.push(br#"{"type":"start","#);
         assert!(next_record(&mut decoder).is_none());
         decoder.push(
             br#""state":{}}
-{"type":"finish"}
+{"type":"resume","boundary":{"owner":"index.html","name":"ready"},"state":{}}
 "#,
         );
 
         assert_eq!(
-            next_record(&mut decoder).unwrap_or_else(|| panic!("missing shell record")),
-            br#"{"type":"shell","state":{}}"#[..]
+            next_record(&mut decoder).unwrap_or_else(|| panic!("missing start record")),
+            br#"{"type":"start","state":{}}"#[..]
         );
         assert_eq!(
-            next_record(&mut decoder).unwrap_or_else(|| panic!("missing finish record")),
-            br#"{"type":"finish"}"#[..]
+            next_record(&mut decoder).unwrap_or_else(|| panic!("missing resume record")),
+            br#"{"type":"resume","boundary":{"owner":"index.html","name":"ready"},"state":{}}"#[..]
         );
         assert!(next_record(&mut decoder).is_none());
         assert!(decoder
             .finish()
-            .unwrap_or_else(|error| panic!("finish failed: {error}"))
+            .unwrap_or_else(|error| panic!("decoder finalization failed: {error}"))
             .is_none());
     }
 
     #[tokio::test]
-    async fn command_stream_requires_shell_and_finish() {
+    async fn command_stream_accepts_start_resume_and_update() {
         let chunks = tokio_stream::iter([Ok(Bytes::from_static(
-            br#"{"type":"shell","version":1,"state":{}}
-{"type":"boundary","name":"ready"}
-{"type":"finish"}
+            br#"{"type":"start","version":2,"state":{}}
+{"type":"resume","boundary":{"owner":"index.html","name":"ready","declarationId":0},"mode":"updatable","state":{}}
+{"type":"update","boundary":{"owner":"index.html","name":"ready"},"state":{"count":2}}
 "#,
         ))]);
         let (sender, mut receiver) = mpsc::channel(4);
@@ -824,39 +1071,48 @@ mod tests {
 
         assert!(matches!(
             receiver.recv().await,
-            Some(ApiStreamCommand::Shell {
-                version: VERSION,
-                ..
+            Some(ApiStreamRecord {
+                command: ApiStreamCommand::Start {
+                    version: VERSION,
+                    ..
+                },
+                index: 0
             })
         ));
         assert!(matches!(
             receiver.recv().await,
-            Some(ApiStreamCommand::Boundary { .. })
+            Some(ApiStreamRecord {
+                command: ApiStreamCommand::Resume { .. },
+                index: 1
+            })
         ));
         assert!(matches!(
             receiver.recv().await,
-            Some(ApiStreamCommand::Finish { .. })
+            Some(ApiStreamRecord {
+                command: ApiStreamCommand::Update { .. },
+                index: 2
+            })
         ));
     }
 
     #[tokio::test]
-    async fn command_before_shell_is_rejected() {
+    async fn command_before_start_is_rejected() {
         let chunks = tokio_stream::iter([Ok(Bytes::from_static(
-            br#"{"type":"boundary","name":"ready"}
+            br#"{"type":"resume","boundary":{"owner":"index.html","name":"ready"},"state":{}}
 "#,
         ))]);
         let (sender, _receiver) = mpsc::channel(1);
         let error = ingest(chunks, sender, defaults())
             .await
             .err()
-            .unwrap_or_else(|| panic!("command before shell was accepted"));
-        assert!(matches!(error, ApiStreamError::MissingShell { record: 0 }));
+            .unwrap_or_else(|| panic!("command before start was accepted"));
+        assert!(matches!(error, ApiStreamError::MissingStart { record: 0 }));
     }
 
     #[tokio::test]
     async fn unsupported_stream_version_is_rejected() {
         let chunks = tokio_stream::iter([Ok(Bytes::from_static(
-            br#"{"type":"shell","version":2,"state":{}}
+            br#"{"type":"start","version":3,"state":{}}
 "#,
         ))]);
         let (sender, _receiver) = mpsc::channel(1);
@@ -868,7 +1124,7 @@ mod tests {
             error,
             ApiStreamError::UnsupportedVersion {
                 record: 0,
-                version: 2
+                version: 3
             }
         ));
     }
@@ -881,18 +1137,173 @@ mod tests {
             .await
             .err()
             .unwrap_or_else(|| panic!("empty stream was accepted"));
-        assert!(matches!(error, ApiStreamError::MissingShell { record: 0 }));
+        assert!(matches!(error, ApiStreamError::MissingStart { record: 0 }));
+    }
+
+    #[test]
+    fn boundary_target_preserves_typed_keys_and_optionally_checks_declaration() {
+        let descriptor = BoundaryDescriptor {
+            instance_id: BoundaryInstanceId::from_raw(4),
+            declaration_id: 9,
+            owner: Arc::from("feed-list"),
+            name: Arc::from("row"),
+            key: Some(BoundaryKey::Number(7.into())),
+        };
+        let mut matching = target("feed-list", "row");
+        matching.key = Some(ApiBoundaryKey::Number(7.into()));
+        assert!(matching.matches(&descriptor));
+        matching.declaration_id = Some(9);
+        assert!(matching.matches(&descriptor));
+        matching.declaration_id = Some(10);
+        assert!(!matching.matches(&descriptor));
+        matching.declaration_id = None;
+        matching.key = Some(ApiBoundaryKey::String("7".to_owned()));
+        assert!(!matching.matches(&descriptor));
+
+        assert!(serde_json::from_str::<ApiStreamCommand>(
+            r#"{"type":"update","boundary":{"owner":"feed-list","name":"row","key":null},"state":{}}"#
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn renderer_uses_start_resume_update_and_completes_without_finish_command() {
+        let commands = vec![
+            ApiStreamCommand::Start {
+                version: VERSION,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Resume {
+                boundary: target("index.html", "content"),
+                mode: ApiBoundaryMode::Updatable,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Update {
+                boundary: target("index.html", "content"),
+                state: serde_json::json!({ "count": 2 }),
+            },
+            ApiStreamCommand::Resume {
+                boundary: target("index.html", "tail"),
+                mode: ApiBoundaryMode::Final,
+                state: serde_json::json!({}),
+            },
+        ];
+        let (result, html) = run_commands(
+            valid_streaming_config(Vec::new(), &["content", "tail"]),
+            commands,
+        );
+        result.unwrap_or_else(|error| panic!("renderer failed: {error}"));
+        let html = String::from_utf8(html)
+            .unwrap_or_else(|error| panic!("renderer produced invalid UTF-8: {error}"));
+        assert!(html.contains("data-boundary=\"content\""));
+        assert!(html.contains("data-boundary=\"tail\""));
+        assert!(html.contains("[2,3,4,0,{}]"));
+    }
+
+    #[test]
+    fn renderer_rejects_a_resume_that_does_not_match_the_current_cursor() {
+        let commands = vec![
+            ApiStreamCommand::Start {
+                version: VERSION,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Resume {
+                boundary: target("wrong-owner", "content"),
+                mode: ApiBoundaryMode::Final,
+                state: serde_json::json!({}),
+            },
+        ];
+        let (result, _) = run_commands(valid_streaming_config(Vec::new(), &["content"]), commands);
+        assert!(matches!(
+            result,
+            Err(RendererError::ResumeMismatch { record: 1, .. })
+        ));
+    }
+
+    #[test]
+    fn renderer_rejects_truncation_while_a_cursor_is_pending() {
+        let commands = vec![ApiStreamCommand::Start {
+            version: VERSION,
+            state: serde_json::json!({}),
+        }];
+        let (result, _) = run_commands(valid_streaming_config(Vec::new(), &["content"]), commands);
+        assert!(matches!(result, Err(RendererError::Truncated { .. })));
+    }
+
+    #[test]
+    fn renderer_rejects_commands_after_automatic_completion() {
+        let commands = vec![
+            ApiStreamCommand::Start {
+                version: VERSION,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Resume {
+                boundary: target("index.html", "content"),
+                mode: ApiBoundaryMode::Final,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Update {
+                boundary: target("index.html", "content"),
+                state: serde_json::json!({}),
+            },
+        ];
+        let (result, _) = run_commands(valid_streaming_config(Vec::new(), &["content"]), commands);
+        assert!(matches!(
+            result,
+            Err(RendererError::CommandAfterDone {
+                record: 2,
+                command: "update"
+            })
+        ));
+    }
+
+    #[test]
+    fn boundary_free_start_completes_when_the_backend_body_ends() {
+        let commands = vec![ApiStreamCommand::Start {
+            version: VERSION,
+            state: serde_json::json!({}),
+        }];
+        let (result, html) = run_commands(valid_streaming_config(Vec::new(), &[]), commands);
+        result.unwrap_or_else(|error| panic!("boundary-free render failed: {error}"));
+        assert!(String::from_utf8_lossy(&html).contains("[2,0,4,0,{}]"));
+    }
+
+    #[test]
+    fn update_rejects_ambiguous_unkeyed_occurrences() {
+        let descriptor = BoundaryDescriptor {
+            instance_id: BoundaryInstanceId::from_raw(0),
+            declaration_id: 0,
+            owner: Arc::from("row-list"),
+            name: Arc::from("row"),
+            key: None,
+        };
+        let committed = vec![
+            CommittedBoundary {
+                descriptor: descriptor.clone(),
+                mode: BoundaryMode::Updatable,
+            },
+            CommittedBoundary {
+                descriptor: BoundaryDescriptor {
+                    instance_id: BoundaryInstanceId::from_raw(1),
+                    ..descriptor
+                },
+                mode: BoundaryMode::Updatable,
+            },
+        ];
+        assert!(matches!(
+            resolve_update(&committed, &target("row-list", "row"), 3),
+            Err(RendererError::AmbiguousUpdate { record: 3, .. })
+        ));
     }
 
     #[actix_web::test]
-    async fn shell_render_failure_is_reported_before_http_success() {
+    async fn start_render_failure_is_reported_before_http_success() {
         let chunks = tokio_stream::iter([Ok::<Bytes, String>(Bytes::from_static(
-            br#"{"type":"shell","version":1,"state":{}}
-{"type":"finish"}
+            br#"{"type":"start","version":2,"state":{}}
 "#,
         ))]);
 
-        let response = render(chunks, shell_render_failure_config(), defaults()).await;
+        let response = render(chunks, start_render_failure_config(), defaults()).await;
 
         assert_eq!(
             response.status(),
@@ -901,57 +1312,64 @@ mod tests {
     }
 
     #[actix_web::test]
-    async fn initial_shell_larger_than_the_live_channel_is_staged_without_deadlock() {
-        let shell_bytes =
+    async fn precommit_output_larger_than_the_live_channel_is_staged_without_deadlock() {
+        let precommit_bytes =
             (StreamingWriter::DEFAULT_CHANNEL_CAPACITY + 1) * StreamingWriter::CHUNK_TARGET;
-        let shell_fragments = (0..=StreamingWriter::DEFAULT_CHANNEL_CAPACITY)
+        let precommit_fragments = (0..=StreamingWriter::DEFAULT_CHANNEL_CAPACITY)
             .map(|_| WebUIFragment::raw("~".repeat(StreamingWriter::CHUNK_TARGET)))
             .collect();
         let chunks = tokio_stream::iter([Ok::<Bytes, String>(Bytes::from_static(
-            br#"{"type":"shell","version":1,"state":{}}
-{"type":"boundary","name":"content"}
-{"type":"finish"}
+            br#"{"type":"start","version":2,"state":{}}
+{"type":"resume","boundary":{"owner":"index.html","name":"content"},"state":{}}
 "#,
         ))]);
 
         let response = tokio::time::timeout(
             Duration::from_secs(2),
-            render(chunks, valid_streaming_config(shell_fragments), defaults()),
+            render(
+                chunks,
+                valid_streaming_config(precommit_fragments, &["content"]),
+                defaults(),
+            ),
         )
         .await
-        .unwrap_or_else(|_| panic!("initial shell staging deadlocked"));
+        .unwrap_or_else(|_| panic!("precommit staging deadlocked"));
         assert_eq!(response.status(), actix_web::http::StatusCode::OK);
 
         let body = tokio::time::timeout(Duration::from_secs(2), to_bytes(response.into_body()))
             .await
             .unwrap_or_else(|_| panic!("staged response did not finish"))
             .unwrap_or_else(|error| panic!("failed to read staged response: {error}"));
-        assert_eq!(memchr::memchr_iter(b'~', &body).count(), shell_bytes);
-        let shell_position = body
+        assert_eq!(memchr::memchr_iter(b'~', &body).count(), precommit_bytes);
+        let precommit_position = body
             .iter()
             .position(|byte| *byte == b'~')
-            .unwrap_or_else(|| panic!("staged shell bytes are missing"));
+            .unwrap_or_else(|| panic!("staged precommit bytes are missing"));
         let boundary_position = body
-            .windows(b"<main>ready</main>".len())
-            .position(|window| window == b"<main>ready</main>")
+            .windows(b"data-boundary=\"content\"".len())
+            .position(|window| window == b"data-boundary=\"content\"")
             .unwrap_or_else(|| panic!("boundary output is missing"));
-        assert!(shell_position < boundary_position);
+        assert!(precommit_position < boundary_position);
     }
 
     #[actix_web::test]
-    async fn initial_shell_over_precommit_limit_is_rejected() {
+    async fn initial_output_over_precommit_limit_is_rejected() {
         let chunks = tokio_stream::iter([Ok::<Bytes, String>(Bytes::from_static(
-            br#"{"type":"shell","version":1,"state":{}}
+            br#"{"type":"start","version":2,"state":{}}
 "#,
         ))]);
-        let shell = WebUIFragment::raw("x".repeat(MAX_INITIAL_SHELL_BYTES + 1));
+        let precommit = WebUIFragment::raw("x".repeat(MAX_PRECOMMIT_BYTES + 1));
 
         let response = tokio::time::timeout(
             Duration::from_secs(2),
-            render(chunks, valid_streaming_config(vec![shell]), defaults()),
+            render(
+                chunks,
+                valid_streaming_config(vec![precommit], &["content"]),
+                defaults(),
+            ),
         )
         .await
-        .unwrap_or_else(|_| panic!("oversized initial shell timed out"));
+        .unwrap_or_else(|_| panic!("oversized precommit output timed out"));
         assert_eq!(
             response.status(),
             actix_web::http::StatusCode::INTERNAL_SERVER_ERROR
@@ -966,14 +1384,19 @@ mod tests {
     async fn dropping_browser_response_cancels_stalled_backend() {
         let (dropped_tx, dropped_rx) = oneshot::channel();
         let backend = StalledBackend {
-            shell: Some(Bytes::from_static(
-                br#"{"type":"shell","version":1,"state":{}}
+            start: Some(Bytes::from_static(
+                br#"{"type":"start","version":2,"state":{}}
 "#,
             )),
             dropped: Some(dropped_tx),
         };
 
-        let response = render(backend, valid_streaming_config(Vec::new()), defaults()).await;
+        let response = render(
+            backend,
+            valid_streaming_config(Vec::new(), &["content"]),
+            defaults(),
+        )
+        .await;
         assert_eq!(response.status(), actix_web::http::StatusCode::OK);
 
         drop(response);
diff --git a/crates/webui-ffi/README.md b/crates/webui-ffi/README.md
index 59cc13037..d5d20ee0c 100644
--- a/crates/webui-ffi/README.md
+++ b/crates/webui-ffi/README.md
@@ -12,6 +12,24 @@ component-template, and token functions. This avoids protobuf decoding and
 deterministic index construction on every request. Release the shared handle with
 `webui_protocol_destroy`.
 
+## Progressive streaming
+
+Create one `webui_streaming_session_t` per response. Drive it with
+`webui_streaming_session_start`, `webui_streaming_session_resume`, and
+`webui_streaming_session_update`. Start and resume return an opaque
+`webui_streaming_step_t` with accessors for binary-safe bytes, `done`, and an
+optional runtime descriptor:
+
+```text
+{ instance_id, declaration_id, owner, name, key }
+```
+
+The completed step already contains terminal and document-tail bytes. Resume
+must target the currently pending instance. Update targets a previously
+committed updatable instance and emits state only, never markup. Release step
+storage with `webui_streaming_step_destroy`; its byte and descriptor string
+pointers are borrowed until that call. Free update byte buffers with `webui_free`.
+
 ## Documentation
 
 See the [WebUI repository](https://github.com/microsoft/webui) for full usage guides and integration examples.
diff --git a/crates/webui-ffi/benches/protocol_bench.rs b/crates/webui-ffi/benches/protocol_bench.rs
index 21ba6910e..8521ff7ab 100644
--- a/crates/webui-ffi/benches/protocol_bench.rs
+++ b/crates/webui-ffi/benches/protocol_bench.rs
@@ -22,6 +22,7 @@ fn build_protocol(component_count: usize) -> Vec<u8> {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<main>ready</main>")],
+            contains_boundary: false,
         },
     );
 
@@ -34,6 +35,7 @@ fn build_protocol(component_count: usize) -> Vec<u8> {
             name.clone(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>component</div>")],
+                contains_boundary: false,
             },
         );
         protocol.components.insert(
diff --git a/crates/webui-ffi/include/webui_ffi.h b/crates/webui-ffi/include/webui_ffi.h
index 3fef1d81b..81022b9b7 100644
--- a/crates/webui-ffi/include/webui_ffi.h
+++ b/crates/webui-ffi/include/webui_ffi.h
@@ -13,6 +13,47 @@ typedef void webui_protocol_t;
  */
 typedef void webui_streaming_session_t;
 
+/**
+ * Opaque owned result from one streaming start or resume call.
+ */
+typedef void webui_streaming_step_t;
+
+/**
+ * C-safe boundary mode value accepted by [`webui_streaming_session_resume`].
+ */
+typedef uint32_t webui_boundary_mode_t;
+
+/**
+ * C-safe boundary key discriminator returned by
+ * [`webui_streaming_step_boundary_key_type`].
+ */
+typedef uint32_t webui_boundary_key_type_t;
+
+/**
+ * Commit the boundary once and release its boundary-local roots.
+ */
+#define WEBUI_BOUNDARY_MODE_FINAL 0
+
+/**
+ * Retain live roots until terminal so updates may target the boundary.
+ */
+#define WEBUI_BOUNDARY_MODE_UPDATABLE 1
+
+/**
+ * The boundary declaration has no runtime key.
+ */
+#define WEBUI_BOUNDARY_KEY_NONE 0
+
+/**
+ * The boundary key is a UTF-8 string.
+ */
+#define WEBUI_BOUNDARY_KEY_STRING 1
+
+/**
+ * The boundary key is a finite JSON number.
+ */
+#define WEBUI_BOUNDARY_KEY_NUMBER 2
+
 #ifdef __cplusplus
 extern "C" {
 #endif // __cplusplus
@@ -180,13 +221,13 @@ char *webui_protocol_tokens(const webui_protocol_t *protocol_ptr);
  * Open a host-driven progressive response for a streaming entry.
  *
  * Unlike [`webui_handler_render`], which produces the whole document in one
- * call, the returned session hands back one chunk per call so the host owns
- * the socket, the write order, and backpressure. Any nonce previously set
- * with [`webui_handler_set_nonce`] is captured for the life of the session.
+ * call, the returned session advances through [`webui_streaming_session_start`]
+ * and [`webui_streaming_session_resume`] so the host owns the socket, write
+ * order, and backpressure. Any nonce previously set with
+ * [`webui_handler_set_nonce`] is captured for the life of the session.
  *
  * Returns `NULL` on error; call [`webui_last_error`] for details. The handle
- * must be released with [`webui_streaming_session_destroy`] even after
- * [`webui_streaming_session_finish`] succeeds.
+ * must be released with [`webui_streaming_session_destroy`].
  *
  * # Thread Safety
  *
@@ -219,126 +260,215 @@ webui_streaming_session_t *webui_streaming_session_create(void *handler_ptr,
 void webui_streaming_session_destroy(webui_streaming_session_t *session_ptr);
 
 /**
- * Resolve an authored boundary name to a stable integer handle.
+ * Render until the first runtime boundary occurrence or terminal completion.
  *
- * Resolve once outside the write loop and reuse the handle; the write calls
- * never hash a name.
+ * The returned owned step must be released with
+ * [`webui_streaming_step_destroy`]. A `NULL` return indicates an error
+ * available through [`webui_last_error`].
  *
- * Returns `true` on success and writes the handle to `out_boundary`. On
- * failure returns `false` and leaves `out_boundary` untouched; call
- * [`webui_last_error`] for the valid names and a suggestion.
+ * # Safety
+ *
+ * * `session_ptr` must be a live session handle with no concurrent operation.
+ * * `state_json` must be non-null, null-terminated UTF-8 and remain readable
+ *   for this call.
+ */
+webui_streaming_step_t *webui_streaming_session_start(webui_streaming_session_t *session_ptr,
+                                                      const char *state_json);
+
+/**
+ * Commit the pending occurrence and advance to the next occurrence or terminal.
+ *
+ * `mode` must be [`WEBUI_BOUNDARY_MODE_FINAL`] or
+ * [`WEBUI_BOUNDARY_MODE_UPDATABLE`]. The returned owned step must be released
+ * with [`webui_streaming_step_destroy`]. A `NULL` return indicates an error
+ * available through [`webui_last_error`].
  *
  * # Safety
  *
- * * `session_ptr` must be a live session handle.
- * * `name` must be non-null, null-terminated UTF-8.
- * * `out_boundary` must be non-null and writable.
+ * * `session_ptr` must be a live session handle with no concurrent operation.
+ * * `state_json` must be non-null, null-terminated UTF-8 and remain readable
+ *   for this call.
  */
-bool webui_streaming_session_boundary(const webui_streaming_session_t *session_ptr,
-                                      const char *name,
-                                      uint32_t *out_boundary);
+webui_streaming_step_t *webui_streaming_session_resume(webui_streaming_session_t *session_ptr,
+                                                       uint32_t instance_id,
+                                                       const char *state_json,
+                                                       webui_boundary_mode_t mode);
 
 /**
- * Return the number of compile-time boundaries declared by this entry.
+ * Emit a projected state patch for a committed updatable occurrence.
  *
- * Returns `0` for a `NULL` handle.
+ * Returns allocated bytes that must be freed with [`webui_free`]. On success,
+ * `out_len` receives the authoritative byte length excluding the allocation's
+ * trailing NUL. On failure, `NULL` is returned and `out_len` is untouched.
+ * Call [`webui_last_error`] for details.
  *
  * # Safety
  *
- * `session_ptr` must be a live session handle, or `NULL`.
+ * * `session_ptr` must be a live session handle with no concurrent operation.
+ * * `patch_json` must be non-null, null-terminated UTF-8 and remain readable
+ *   for this call.
+ * * `out_len` must be non-null and writable.
  */
-uint32_t webui_streaming_session_boundary_count(const webui_streaming_session_t *session_ptr);
+char *webui_streaming_session_update(webui_streaming_session_t *session_ptr,
+                                     uint32_t instance_id,
+                                     const char *patch_json,
+                                     uintptr_t *out_len);
 
 /**
- * Report whether the terminal record has been written.
+ * Release an owned streaming step.
  *
- * Returns `true` for a `NULL` handle, because a session that does not exist
- * can never accept another call.
+ * Destroying a step invalidates its byte pointer and all descriptor string
+ * pointers previously returned by step accessors.
  *
  * # Safety
  *
- * `session_ptr` must be a live session handle, or `NULL`.
+ * `step_ptr` must be a pointer returned by
+ * [`webui_streaming_session_start`] or [`webui_streaming_session_resume`], or
+ * `NULL` for a no-op. A non-null pointer must not be used after this call.
  */
-bool webui_streaming_session_is_finished(const webui_streaming_session_t *session_ptr);
+void webui_streaming_step_destroy(webui_streaming_step_t *step_ptr);
 
 /**
- * Render everything before the first boundary.
+ * Borrow the bytes produced by this step and write their length to `out_len`.
  *
- * Returns a NUL-terminated UTF-8 chunk that must be freed with
- * [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
- * the byte length excluding the terminator, so hosts writing to a socket do
- * not need `strlen`.
+ * The returned pointer is borrowed from `step_ptr`, is not NUL-terminated,
+ * and remains valid only until [`webui_streaming_step_destroy`]. It may be
+ * read for exactly `out_len` bytes. Returns `NULL` on error.
  *
  * # Safety
  *
- * * `session_ptr` must be a live session handle.
- * * `state_json` must be non-null, null-terminated UTF-8.
- * * `out_len` must be writable, or `NULL`.
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_len` must be non-null and writable.
  */
-char *webui_streaming_session_write_shell(webui_streaming_session_t *session_ptr,
-                                          const char *state_json,
+const uint8_t *webui_streaming_step_bytes(const webui_streaming_step_t *step_ptr,
                                           uintptr_t *out_len);
 
 /**
- * Render and commit the next boundary in declaration order.
+ * Observe whether this step emitted the terminal record.
  *
- * Pass `updatable = true` only for boundaries you intend to patch later with
- * [`webui_streaming_session_update`]; an updatable boundary retains its roots
- * and projection until the terminal record.
+ * A valid non-terminal step returns `false` with no last error. A null handle
+ * returns `false` and sets [`webui_last_error`].
+ *
+ * # Safety
+ *
+ * `step_ptr` must be a live step handle with no concurrent destroy.
+ */
+bool webui_streaming_step_done(const webui_streaming_step_t *step_ptr);
+
+/**
+ * Observe whether this step carries a pending boundary descriptor.
  *
- * Returns a NUL-terminated UTF-8 chunk that must be freed with
- * [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
- * the byte length excluding the terminator.
+ * A valid boundary-free step returns `false` with no last error. A null handle
+ * returns `false` and sets [`webui_last_error`].
  *
  * # Safety
  *
- * * `session_ptr` must be a live session handle.
- * * `state_json` must be non-null, null-terminated UTF-8.
- * * `out_len` must be writable, or `NULL`.
+ * `step_ptr` must be a live step handle with no concurrent destroy.
  */
-char *webui_streaming_session_write_boundary(webui_streaming_session_t *session_ptr,
-                                             uint32_t boundary,
-                                             const char *state_json,
-                                             bool updatable,
-                                             uintptr_t *out_len);
+bool webui_streaming_step_has_boundary(const webui_streaming_step_t *step_ptr);
 
 /**
- * Push a projected state patch to a committed updatable boundary.
+ * Read the pending boundary's response-local instance ID.
  *
- * Returns a NUL-terminated UTF-8 chunk that must be freed with
- * [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
- * the byte length excluding the terminator.
+ * Returns `false` and leaves `out_instance_id` untouched when the step has no
+ * boundary or an argument is invalid.
  *
  * # Safety
  *
- * * `session_ptr` must be a live session handle.
- * * `state_json` must be non-null, null-terminated UTF-8.
- * * `out_len` must be writable, or `NULL`.
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_instance_id` must be non-null and writable.
  */
-char *webui_streaming_session_update(webui_streaming_session_t *session_ptr,
-                                     uint32_t boundary,
-                                     const char *state_json,
-                                     uintptr_t *out_len);
+bool webui_streaming_step_boundary_instance_id(const webui_streaming_step_t *step_ptr,
+                                               uint32_t *out_instance_id);
 
 /**
- * Render the document tail and emit the terminal record.
+ * Read the pending boundary's stable compiler declaration ID.
+ *
+ * Returns `false` and leaves `out_declaration_id` untouched when the step has
+ * no boundary or an argument is invalid.
+ *
+ * # Safety
  *
- * Every later call fails. The handle must still be released with
- * [`webui_streaming_session_destroy`].
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_declaration_id` must be non-null and writable.
+ */
+bool webui_streaming_step_boundary_declaration_id(const webui_streaming_step_t *step_ptr,
+                                                  uint32_t *out_declaration_id);
+
+/**
+ * Borrow the pending boundary owner's UTF-8 bytes.
  *
- * Returns a NUL-terminated UTF-8 chunk that must be freed with
- * [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
- * the byte length excluding the terminator.
+ * The returned string pointer is not NUL-terminated. It is borrowed from the
+ * step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+ * for exactly the byte length written to `out_len`. Returns `NULL` on error.
  *
  * # Safety
  *
- * * `session_ptr` must be a live session handle.
- * * `state_json` must be non-null, null-terminated UTF-8.
- * * `out_len` must be writable, or `NULL`.
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_len` must be non-null and writable.
  */
-char *webui_streaming_session_finish(webui_streaming_session_t *session_ptr,
-                                     const char *state_json,
-                                     uintptr_t *out_len);
+const char *webui_streaming_step_boundary_owner(const webui_streaming_step_t *step_ptr,
+                                                uintptr_t *out_len);
+
+/**
+ * Borrow the pending boundary name's UTF-8 bytes.
+ *
+ * The returned string pointer is not NUL-terminated. It is borrowed from the
+ * step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+ * for exactly the byte length written to `out_len`. Returns `NULL` on error.
+ *
+ * # Safety
+ *
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_len` must be non-null and writable.
+ */
+const char *webui_streaming_step_boundary_name(const webui_streaming_step_t *step_ptr,
+                                               uintptr_t *out_len);
+
+/**
+ * Read the pending boundary key discriminator.
+ *
+ * On success, writes exactly one of [`WEBUI_BOUNDARY_KEY_NONE`],
+ * [`WEBUI_BOUNDARY_KEY_STRING`], or [`WEBUI_BOUNDARY_KEY_NUMBER`]. Returns
+ * `false` and leaves `out_key_type` untouched on error.
+ *
+ * # Safety
+ *
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_key_type` must be non-null and writable.
+ */
+bool webui_streaming_step_boundary_key_type(const webui_streaming_step_t *step_ptr,
+                                            webui_boundary_key_type_t *out_key_type);
+
+/**
+ * Borrow the pending boundary's string key as UTF-8 bytes.
+ *
+ * The returned string pointer is not NUL-terminated. It is borrowed from the
+ * step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+ * for exactly the byte length written to `out_len`. A non-string key returns
+ * `NULL`, leaves `out_len` untouched, and sets [`webui_last_error`].
+ *
+ * # Safety
+ *
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_len` must be non-null and writable.
+ */
+const char *webui_streaming_step_boundary_key_string(const webui_streaming_step_t *step_ptr,
+                                                     uintptr_t *out_len);
+
+/**
+ * Read the pending boundary's numeric key.
+ *
+ * Returns `false`, leaves `out_value` untouched, and sets
+ * [`webui_last_error`] when the key is absent or is a string.
+ *
+ * # Safety
+ *
+ * * `step_ptr` must be a live step handle with no concurrent destroy.
+ * * `out_value` must be non-null and writable.
+ */
+bool webui_streaming_step_boundary_key_number(const webui_streaming_step_t *step_ptr,
+                                              double *out_value);
 
 #ifdef __cplusplus
 }  // extern "C"
diff --git a/crates/webui-ffi/src/lib.rs b/crates/webui-ffi/src/lib.rs
index a6dc6ec5f..8a1c7b476 100644
--- a/crates/webui-ffi/src/lib.rs
+++ b/crates/webui-ffi/src/lib.rs
@@ -27,8 +27,8 @@ use webui_handler::plugin::fast_v2::FastV2HydrationPlugin;
 use webui_handler::plugin::fast_v3::FastV3HydrationPlugin;
 use webui_handler::plugin::webui::WebUIHydrationPlugin;
 use webui_handler::{
-    BoundaryId, BoundaryMode, Protocol, RenderOptions, ResponseWriter, SessionOptions,
-    StreamingSession, WebUIHandler,
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, Protocol, RenderOptions,
+    ResponseWriter, SessionOptions, StreamStep, StreamingSession, WebUIHandler,
 };
 
 /// Opaque C handle for a loaded WebUI protocol.
@@ -658,21 +658,54 @@ pub unsafe extern "C" fn webui_protocol_tokens(
 #[allow(non_camel_case_types)]
 pub type webui_streaming_session_t = c_void;
 
+/// Opaque owned result from one streaming start or resume call.
+#[allow(non_camel_case_types)]
+pub type webui_streaming_step_t = c_void;
+
+/// C-safe boundary mode value accepted by [`webui_streaming_session_resume`].
+#[allow(non_camel_case_types)]
+pub type webui_boundary_mode_t = u32;
+
+/// Commit the boundary once and release its boundary-local roots.
+pub const WEBUI_BOUNDARY_MODE_FINAL: webui_boundary_mode_t = 0;
+
+/// Retain live roots until terminal so updates may target the boundary.
+pub const WEBUI_BOUNDARY_MODE_UPDATABLE: webui_boundary_mode_t = 1;
+
+/// C-safe boundary key discriminator returned by
+/// [`webui_streaming_step_boundary_key_type`].
+#[allow(non_camel_case_types)]
+pub type webui_boundary_key_type_t = u32;
+
+/// The boundary declaration has no runtime key.
+pub const WEBUI_BOUNDARY_KEY_NONE: webui_boundary_key_type_t = 0;
+
+/// The boundary key is a UTF-8 string.
+pub const WEBUI_BOUNDARY_KEY_STRING: webui_boundary_key_type_t = 1;
+
+/// The boundary key is a finite JSON number.
+pub const WEBUI_BOUNDARY_KEY_NUMBER: webui_boundary_key_type_t = 2;
+
 /// Owns one progressive response between host calls.
 struct StreamingSessionContext {
     session: StreamingSession,
 }
 
+/// Owns one result and every pointer borrowed from it.
+struct StreamingStepContext {
+    step: StreamStep,
+}
+
 /// Open a host-driven progressive response for a streaming entry.
 ///
 /// Unlike [`webui_handler_render`], which produces the whole document in one
-/// call, the returned session hands back one chunk per call so the host owns
-/// the socket, the write order, and backpressure. Any nonce previously set
-/// with [`webui_handler_set_nonce`] is captured for the life of the session.
+/// call, the returned session advances through [`webui_streaming_session_start`]
+/// and [`webui_streaming_session_resume`] so the host owns the socket, write
+/// order, and backpressure. Any nonce previously set with
+/// [`webui_handler_set_nonce`] is captured for the life of the session.
 ///
 /// Returns `NULL` on error; call [`webui_last_error`] for details. The handle
-/// must be released with [`webui_streaming_session_destroy`] even after
-/// [`webui_streaming_session_finish`] succeeds.
+/// must be released with [`webui_streaming_session_destroy`].
 ///
 /// # Thread Safety
 ///
@@ -754,301 +787,627 @@ pub unsafe extern "C" fn webui_streaming_session_create(
 pub unsafe extern "C" fn webui_streaming_session_destroy(
     session_ptr: *mut webui_streaming_session_t,
 ) {
-    if !session_ptr.is_null() {
+    clear_last_error();
+    if session_ptr.is_null() {
+        return;
+    }
+    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
         // SAFETY: The caller guarantees this pointer came from
         // `webui_streaming_session_create` and has not already been destroyed.
-        let _ = unsafe { Box::from_raw(session_ptr as *mut StreamingSessionContext) };
+        drop(unsafe { Box::from_raw(session_ptr as *mut StreamingSessionContext) });
+    }));
+    if result.is_err() {
+        set_last_error("panic in webui_streaming_session_destroy");
     }
 }
 
-/// Resolve an authored boundary name to a stable integer handle.
-///
-/// Resolve once outside the write loop and reuse the handle; the write calls
-/// never hash a name.
+/// Render until the first runtime boundary occurrence or terminal completion.
 ///
-/// Returns `true` on success and writes the handle to `out_boundary`. On
-/// failure returns `false` and leaves `out_boundary` untouched; call
-/// [`webui_last_error`] for the valid names and a suggestion.
+/// The returned owned step must be released with
+/// [`webui_streaming_step_destroy`]. A `NULL` return indicates an error
+/// available through [`webui_last_error`].
 ///
 /// # Safety
 ///
-/// * `session_ptr` must be a live session handle.
-/// * `name` must be non-null, null-terminated UTF-8.
-/// * `out_boundary` must be non-null and writable.
+/// * `session_ptr` must be a live session handle with no concurrent operation.
+/// * `state_json` must be non-null, null-terminated UTF-8 and remain readable
+///   for this call.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_boundary(
-    session_ptr: *const webui_streaming_session_t,
-    name: *const c_char,
-    out_boundary: *mut u32,
-) -> bool {
+pub unsafe extern "C" fn webui_streaming_session_start(
+    session_ptr: *mut webui_streaming_session_t,
+    state_json: *const c_char,
+) -> *mut webui_streaming_step_t {
     clear_last_error();
-
-    match std::panic::catch_unwind(|| {
-        if session_ptr.is_null() || name.is_null() || out_boundary.is_null() {
-            set_last_error("one or more required arguments are null");
-            return false;
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        if session_ptr.is_null() || state_json.is_null() {
+            set_last_error("session_ptr and state_json must not be null");
+            return std::ptr::null_mut();
         }
-
-        // SAFETY: The caller guarantees the session handle is live.
-        let context = unsafe { &*(session_ptr as *const StreamingSessionContext) };
-        // SAFETY: The caller guarantees `name` is valid and terminated.
-        let Some(name) = (unsafe { utf8_arg(name, "name") }) else {
-            return false;
+        // SAFETY: The caller guarantees exclusive access to a live session.
+        let context = unsafe { &mut *(session_ptr as *mut StreamingSessionContext) };
+        // SAFETY: The caller guarantees the string is readable and terminated.
+        let Some(state) = (unsafe { streaming_json_arg(state_json, "state_json") }) else {
+            return std::ptr::null_mut();
         };
-
-        match context.session.boundary(name) {
-            Ok(boundary) => {
-                // SAFETY: The caller guarantees `out_boundary` is writable.
-                unsafe { *out_boundary = boundary.raw() };
-                true
+        match context.session.start(&state) {
+            Ok(step) => owned_streaming_step(step),
+            Err(error) => {
+                set_last_error(error.to_string());
+                std::ptr::null_mut()
             }
+        }
+    })) {
+        Ok(step) => step,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_session_start");
+            std::ptr::null_mut()
+        }
+    }
+}
+
+/// Commit the pending occurrence and advance to the next occurrence or terminal.
+///
+/// `mode` must be [`WEBUI_BOUNDARY_MODE_FINAL`] or
+/// [`WEBUI_BOUNDARY_MODE_UPDATABLE`]. The returned owned step must be released
+/// with [`webui_streaming_step_destroy`]. A `NULL` return indicates an error
+/// available through [`webui_last_error`].
+///
+/// # Safety
+///
+/// * `session_ptr` must be a live session handle with no concurrent operation.
+/// * `state_json` must be non-null, null-terminated UTF-8 and remain readable
+///   for this call.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_session_resume(
+    session_ptr: *mut webui_streaming_session_t,
+    instance_id: u32,
+    state_json: *const c_char,
+    mode: webui_boundary_mode_t,
+) -> *mut webui_streaming_step_t {
+    clear_last_error();
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        if session_ptr.is_null() || state_json.is_null() {
+            set_last_error("session_ptr and state_json must not be null");
+            return std::ptr::null_mut();
+        }
+        let Some(mode) = streaming_boundary_mode(mode) else {
+            return std::ptr::null_mut();
+        };
+        // SAFETY: The caller guarantees exclusive access to a live session.
+        let context = unsafe { &mut *(session_ptr as *mut StreamingSessionContext) };
+        // SAFETY: The caller guarantees the string is readable and terminated.
+        let Some(state) = (unsafe { streaming_json_arg(state_json, "state_json") }) else {
+            return std::ptr::null_mut();
+        };
+        match context
+            .session
+            .resume(BoundaryInstanceId::from_raw(instance_id), &state, mode)
+        {
+            Ok(step) => owned_streaming_step(step),
             Err(error) => {
                 set_last_error(error.to_string());
-                false
+                std::ptr::null_mut()
             }
         }
-    }) {
-        Ok(ok) => ok,
+    })) {
+        Ok(step) => step,
         Err(_) => {
-            set_last_error("panic in webui_streaming_session_boundary");
-            false
+            set_last_error("panic in webui_streaming_session_resume");
+            std::ptr::null_mut()
         }
     }
 }
 
-/// Return the number of compile-time boundaries declared by this entry.
+/// Emit a projected state patch for a committed updatable occurrence.
 ///
-/// Returns `0` for a `NULL` handle.
+/// Returns allocated bytes that must be freed with [`webui_free`]. On success,
+/// `out_len` receives the authoritative byte length excluding the allocation's
+/// trailing NUL. On failure, `NULL` is returned and `out_len` is untouched.
+/// Call [`webui_last_error`] for details.
 ///
 /// # Safety
 ///
-/// `session_ptr` must be a live session handle, or `NULL`.
+/// * `session_ptr` must be a live session handle with no concurrent operation.
+/// * `patch_json` must be non-null, null-terminated UTF-8 and remain readable
+///   for this call.
+/// * `out_len` must be non-null and writable.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_boundary_count(
-    session_ptr: *const webui_streaming_session_t,
-) -> u32 {
-    if session_ptr.is_null() {
-        return 0;
+pub unsafe extern "C" fn webui_streaming_session_update(
+    session_ptr: *mut webui_streaming_session_t,
+    instance_id: u32,
+    patch_json: *const c_char,
+    out_len: *mut usize,
+) -> *mut c_char {
+    clear_last_error();
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        if session_ptr.is_null() || patch_json.is_null() || out_len.is_null() {
+            set_last_error("session_ptr, patch_json, and out_len must not be null");
+            return std::ptr::null_mut();
+        }
+        // SAFETY: The caller guarantees exclusive access to the live session.
+        let context = unsafe { &mut *(session_ptr as *mut StreamingSessionContext) };
+        // SAFETY: The caller guarantees the string is readable and terminated.
+        let Some(patch) = (unsafe { streaming_json_arg(patch_json, "patch_json") }) else {
+            return std::ptr::null_mut();
+        };
+        let bytes = match context
+            .session
+            .update(BoundaryInstanceId::from_raw(instance_id), &patch)
+        {
+            Ok(bytes) => bytes,
+            Err(error) => {
+                set_last_error(error.to_string());
+                return std::ptr::null_mut();
+            }
+        };
+        let length = bytes.len();
+        match CString::new(bytes) {
+            Ok(chunk) => {
+                // SAFETY: The caller guarantees `out_len` is writable.
+                unsafe { *out_len = length };
+                chunk.into_raw()
+            }
+            Err(error) => {
+                set_last_error(format!(
+                    "streaming update contains an interior NUL byte: {error}"
+                ));
+                std::ptr::null_mut()
+            }
+        }
+    })) {
+        Ok(bytes) => bytes,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_session_update");
+            std::ptr::null_mut()
+        }
     }
-    // SAFETY: The caller guarantees the session handle is live.
-    let context = unsafe { &*(session_ptr as *const StreamingSessionContext) };
-    u32::try_from(context.session.boundary_count()).unwrap_or(u32::MAX)
 }
 
-/// Report whether the terminal record has been written.
+/// Release an owned streaming step.
 ///
-/// Returns `true` for a `NULL` handle, because a session that does not exist
-/// can never accept another call.
+/// Destroying a step invalidates its byte pointer and all descriptor string
+/// pointers previously returned by step accessors.
 ///
 /// # Safety
 ///
-/// `session_ptr` must be a live session handle, or `NULL`.
+/// `step_ptr` must be a pointer returned by
+/// [`webui_streaming_session_start`] or [`webui_streaming_session_resume`], or
+/// `NULL` for a no-op. A non-null pointer must not be used after this call.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_is_finished(
-    session_ptr: *const webui_streaming_session_t,
-) -> bool {
-    if session_ptr.is_null() {
-        return true;
+pub unsafe extern "C" fn webui_streaming_step_destroy(step_ptr: *mut webui_streaming_step_t) {
+    clear_last_error();
+    if step_ptr.is_null() {
+        return;
+    }
+    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        // SAFETY: The caller guarantees this is one live owned step.
+        drop(unsafe { Box::from_raw(step_ptr as *mut StreamingStepContext) });
+    }));
+    if result.is_err() {
+        set_last_error("panic in webui_streaming_step_destroy");
     }
-    // SAFETY: The caller guarantees the session handle is live.
-    let context = unsafe { &*(session_ptr as *const StreamingSessionContext) };
-    context.session.is_finished()
 }
 
-/// Render everything before the first boundary.
+/// Borrow the bytes produced by this step and write their length to `out_len`.
 ///
-/// Returns a NUL-terminated UTF-8 chunk that must be freed with
-/// [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
-/// the byte length excluding the terminator, so hosts writing to a socket do
-/// not need `strlen`.
+/// The returned pointer is borrowed from `step_ptr`, is not NUL-terminated,
+/// and remains valid only until [`webui_streaming_step_destroy`]. It may be
+/// read for exactly `out_len` bytes. Returns `NULL` on error.
 ///
 /// # Safety
 ///
-/// * `session_ptr` must be a live session handle.
-/// * `state_json` must be non-null, null-terminated UTF-8.
-/// * `out_len` must be writable, or `NULL`.
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_len` must be non-null and writable.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_write_shell(
-    session_ptr: *mut webui_streaming_session_t,
-    state_json: *const c_char,
+pub unsafe extern "C" fn webui_streaming_step_bytes(
+    step_ptr: *const webui_streaming_step_t,
     out_len: *mut usize,
-) -> *mut c_char {
-    // SAFETY: Forwarded verbatim; this helper repeats every check.
-    unsafe {
-        streaming_chunk_call(
-            session_ptr,
-            state_json,
-            out_len,
-            "webui_streaming_session_write_shell",
-            |session, state| session.write_shell(state),
-        )
+) -> *const u8 {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_len.is_null() {
+            set_last_error("step_ptr and out_len must not be null");
+            return std::ptr::null();
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        // SAFETY: The caller guarantees `out_len` is writable.
+        unsafe { *out_len = context.step.bytes.len() };
+        context.step.bytes.as_ptr()
+    }) {
+        Ok(bytes) => bytes,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_bytes");
+            std::ptr::null()
+        }
     }
 }
 
-/// Render and commit the next boundary in declaration order.
+/// Observe whether this step emitted the terminal record.
+///
+/// A valid non-terminal step returns `false` with no last error. A null handle
+/// returns `false` and sets [`webui_last_error`].
 ///
-/// Pass `updatable = true` only for boundaries you intend to patch later with
-/// [`webui_streaming_session_update`]; an updatable boundary retains its roots
-/// and projection until the terminal record.
+/// # Safety
+///
+/// `step_ptr` must be a live step handle with no concurrent destroy.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_done(
+    step_ptr: *const webui_streaming_step_t,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() {
+            set_last_error("step_ptr is null");
+            return false;
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        unsafe { (*(step_ptr as *const StreamingStepContext)).step.done }
+    }) {
+        Ok(done) => done,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_done");
+            false
+        }
+    }
+}
+
+/// Observe whether this step carries a pending boundary descriptor.
 ///
-/// Returns a NUL-terminated UTF-8 chunk that must be freed with
-/// [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
-/// the byte length excluding the terminator.
+/// A valid boundary-free step returns `false` with no last error. A null handle
+/// returns `false` and sets [`webui_last_error`].
 ///
 /// # Safety
 ///
-/// * `session_ptr` must be a live session handle.
-/// * `state_json` must be non-null, null-terminated UTF-8.
-/// * `out_len` must be writable, or `NULL`.
+/// `step_ptr` must be a live step handle with no concurrent destroy.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_write_boundary(
-    session_ptr: *mut webui_streaming_session_t,
-    boundary: u32,
-    state_json: *const c_char,
-    updatable: bool,
-    out_len: *mut usize,
-) -> *mut c_char {
-    let mode = if updatable {
-        BoundaryMode::Updatable
-    } else {
-        BoundaryMode::Final
-    };
-    // SAFETY: Forwarded verbatim; this helper repeats every check.
-    unsafe {
-        streaming_chunk_call(
-            session_ptr,
-            state_json,
-            out_len,
-            "webui_streaming_session_write_boundary",
-            |session, state| session.write_boundary(BoundaryId::from_raw(boundary), state, mode),
-        )
+pub unsafe extern "C" fn webui_streaming_step_has_boundary(
+    step_ptr: *const webui_streaming_step_t,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() {
+            set_last_error("step_ptr is null");
+            return false;
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        unsafe {
+            (*(step_ptr as *const StreamingStepContext))
+                .step
+                .boundary
+                .is_some()
+        }
+    }) {
+        Ok(has_boundary) => has_boundary,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_has_boundary");
+            false
+        }
     }
 }
 
-/// Push a projected state patch to a committed updatable boundary.
+/// Read the pending boundary's response-local instance ID.
 ///
-/// Returns a NUL-terminated UTF-8 chunk that must be freed with
-/// [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
-/// the byte length excluding the terminator.
+/// Returns `false` and leaves `out_instance_id` untouched when the step has no
+/// boundary or an argument is invalid.
 ///
 /// # Safety
 ///
-/// * `session_ptr` must be a live session handle.
-/// * `state_json` must be non-null, null-terminated UTF-8.
-/// * `out_len` must be writable, or `NULL`.
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_instance_id` must be non-null and writable.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_update(
-    session_ptr: *mut webui_streaming_session_t,
-    boundary: u32,
-    state_json: *const c_char,
-    out_len: *mut usize,
-) -> *mut c_char {
-    // SAFETY: Forwarded verbatim; this helper repeats every check.
-    unsafe {
-        streaming_chunk_call(
-            session_ptr,
-            state_json,
-            out_len,
-            "webui_streaming_session_update",
-            |session, state| session.update(BoundaryId::from_raw(boundary), state),
-        )
+pub unsafe extern "C" fn webui_streaming_step_boundary_instance_id(
+    step_ptr: *const webui_streaming_step_t,
+    out_instance_id: *mut u32,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_instance_id.is_null() {
+            set_last_error("step_ptr and out_instance_id must not be null");
+            return false;
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return false;
+        };
+        // SAFETY: The caller guarantees `out_instance_id` is writable.
+        unsafe { *out_instance_id = boundary.instance_id.raw() };
+        true
+    }) {
+        Ok(ok) => ok,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_instance_id");
+            false
+        }
     }
 }
 
-/// Render the document tail and emit the terminal record.
+/// Read the pending boundary's stable compiler declaration ID.
 ///
-/// Every later call fails. The handle must still be released with
-/// [`webui_streaming_session_destroy`].
+/// Returns `false` and leaves `out_declaration_id` untouched when the step has
+/// no boundary or an argument is invalid.
 ///
-/// Returns a NUL-terminated UTF-8 chunk that must be freed with
-/// [`webui_free`], or `NULL` on error. When `out_len` is non-null it receives
-/// the byte length excluding the terminator.
+/// # Safety
+///
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_declaration_id` must be non-null and writable.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_boundary_declaration_id(
+    step_ptr: *const webui_streaming_step_t,
+    out_declaration_id: *mut u32,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_declaration_id.is_null() {
+            set_last_error("step_ptr and out_declaration_id must not be null");
+            return false;
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return false;
+        };
+        // SAFETY: The caller guarantees `out_declaration_id` is writable.
+        unsafe { *out_declaration_id = boundary.declaration_id };
+        true
+    }) {
+        Ok(ok) => ok,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_declaration_id");
+            false
+        }
+    }
+}
+
+/// Borrow the pending boundary owner's UTF-8 bytes.
+///
+/// The returned string pointer is not NUL-terminated. It is borrowed from the
+/// step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+/// for exactly the byte length written to `out_len`. Returns `NULL` on error.
 ///
 /// # Safety
 ///
-/// * `session_ptr` must be a live session handle.
-/// * `state_json` must be non-null, null-terminated UTF-8.
-/// * `out_len` must be writable, or `NULL`.
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_len` must be non-null and writable.
 #[no_mangle]
-pub unsafe extern "C" fn webui_streaming_session_finish(
-    session_ptr: *mut webui_streaming_session_t,
-    state_json: *const c_char,
+pub unsafe extern "C" fn webui_streaming_step_boundary_owner(
+    step_ptr: *const webui_streaming_step_t,
     out_len: *mut usize,
-) -> *mut c_char {
-    // SAFETY: Forwarded verbatim; this helper repeats every check.
-    unsafe {
-        streaming_chunk_call(
-            session_ptr,
-            state_json,
-            out_len,
-            "webui_streaming_session_finish",
-            |session, state| session.finish(state),
-        )
+) -> *const c_char {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_len.is_null() {
+            set_last_error("step_ptr and out_len must not be null");
+            return std::ptr::null();
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return std::ptr::null();
+        };
+        // SAFETY: The caller guarantees `out_len` is writable.
+        unsafe { *out_len = boundary.owner.len() };
+        boundary.owner.as_ptr().cast()
+    }) {
+        Ok(owner) => owner,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_owner");
+            std::ptr::null()
+        }
     }
 }
 
-/// Shared body for every chunk-producing session call.
+/// Borrow the pending boundary name's UTF-8 bytes.
+///
+/// The returned string pointer is not NUL-terminated. It is borrowed from the
+/// step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+/// for exactly the byte length written to `out_len`. Returns `NULL` on error.
 ///
 /// # Safety
 ///
-/// Pointers must satisfy the contract documented on the calling function.
-unsafe fn streaming_chunk_call(
-    session_ptr: *mut webui_streaming_session_t,
-    state_json: *const c_char,
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_len` must be non-null and writable.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_boundary_name(
+    step_ptr: *const webui_streaming_step_t,
     out_len: *mut usize,
-    operation: &str,
-    render: impl FnOnce(&mut StreamingSession, &Value) -> webui_handler::Result<Vec<u8>>,
-) -> *mut c_char {
+) -> *const c_char {
     clear_last_error();
-
-    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-        if session_ptr.is_null() || state_json.is_null() {
-            set_last_error("one or more required arguments are null");
-            return std::ptr::null_mut();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_len.is_null() {
+            set_last_error("step_ptr and out_len must not be null");
+            return std::ptr::null();
         }
-
-        // SAFETY: The caller guarantees exclusive access to a live session.
-        let context = unsafe { &mut *(session_ptr as *mut StreamingSessionContext) };
-        // SAFETY: The caller guarantees `state_json` is valid and terminated.
-        let Some(state_str) = (unsafe { utf8_arg(state_json, "state_json") }) else {
-            return std::ptr::null_mut();
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return std::ptr::null();
         };
+        // SAFETY: The caller guarantees `out_len` is writable.
+        unsafe { *out_len = boundary.name.len() };
+        boundary.name.as_ptr().cast()
+    }) {
+        Ok(name) => name,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_name");
+            std::ptr::null()
+        }
+    }
+}
 
-        let state: Value = match serde_json::from_str(state_str) {
-            Ok(value) => value,
-            Err(error) => {
-                set_last_error(format!("failed to parse state JSON: {error}"));
-                return std::ptr::null_mut();
-            }
+/// Read the pending boundary key discriminator.
+///
+/// On success, writes exactly one of [`WEBUI_BOUNDARY_KEY_NONE`],
+/// [`WEBUI_BOUNDARY_KEY_STRING`], or [`WEBUI_BOUNDARY_KEY_NUMBER`]. Returns
+/// `false` and leaves `out_key_type` untouched on error.
+///
+/// # Safety
+///
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_key_type` must be non-null and writable.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_boundary_key_type(
+    step_ptr: *const webui_streaming_step_t,
+    out_key_type: *mut webui_boundary_key_type_t,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_key_type.is_null() {
+            set_last_error("step_ptr and out_key_type must not be null");
+            return false;
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return false;
         };
+        let key_type = match boundary.key {
+            None => WEBUI_BOUNDARY_KEY_NONE,
+            Some(BoundaryKey::String(_)) => WEBUI_BOUNDARY_KEY_STRING,
+            Some(BoundaryKey::Number(_)) => WEBUI_BOUNDARY_KEY_NUMBER,
+        };
+        // SAFETY: The caller guarantees `out_key_type` is writable.
+        unsafe { *out_key_type = key_type };
+        true
+    }) {
+        Ok(ok) => ok,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_key_type");
+            false
+        }
+    }
+}
 
-        let bytes = match render(&mut context.session, &state) {
-            Ok(bytes) => bytes,
-            Err(error) => {
-                set_last_error(error.to_string());
-                return std::ptr::null_mut();
-            }
+/// Borrow the pending boundary's string key as UTF-8 bytes.
+///
+/// The returned string pointer is not NUL-terminated. It is borrowed from the
+/// step and remains valid only until [`webui_streaming_step_destroy`]. Read it
+/// for exactly the byte length written to `out_len`. A non-string key returns
+/// `NULL`, leaves `out_len` untouched, and sets [`webui_last_error`].
+///
+/// # Safety
+///
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_len` must be non-null and writable.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_boundary_key_string(
+    step_ptr: *const webui_streaming_step_t,
+    out_len: *mut usize,
+) -> *const c_char {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_len.is_null() {
+            set_last_error("step_ptr and out_len must not be null");
+            return std::ptr::null();
+        }
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return std::ptr::null();
         };
+        let Some(BoundaryKey::String(value)) = boundary.key.as_ref() else {
+            set_last_error("pending boundary key is not a string");
+            return std::ptr::null();
+        };
+        // SAFETY: The caller guarantees `out_len` is writable.
+        unsafe { *out_len = value.len() };
+        value.as_ptr().cast()
+    }) {
+        Ok(value) => value,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_step_boundary_key_string");
+            std::ptr::null()
+        }
+    }
+}
 
-        let length = bytes.len();
-        match CString::new(bytes) {
-            Ok(chunk) => {
-                if !out_len.is_null() {
-                    // SAFETY: The caller guarantees `out_len` is writable.
-                    unsafe { *out_len = length };
-                }
-                chunk.into_raw()
-            }
-            Err(error) => {
-                set_last_error(format!("chunk contains interior NUL byte: {error}"));
-                std::ptr::null_mut()
-            }
+/// Read the pending boundary's numeric key.
+///
+/// Returns `false`, leaves `out_value` untouched, and sets
+/// [`webui_last_error`] when the key is absent or is a string.
+///
+/// # Safety
+///
+/// * `step_ptr` must be a live step handle with no concurrent destroy.
+/// * `out_value` must be non-null and writable.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_step_boundary_key_number(
+    step_ptr: *const webui_streaming_step_t,
+    out_value: *mut f64,
+) -> bool {
+    clear_last_error();
+    match std::panic::catch_unwind(|| {
+        if step_ptr.is_null() || out_value.is_null() {
+            set_last_error("step_ptr and out_value must not be null");
+            return false;
         }
-    })) {
-        Ok(ptr) => ptr,
+        // SAFETY: The caller guarantees a live step handle.
+        let context = unsafe { &*(step_ptr as *const StreamingStepContext) };
+        let Some(boundary) = streaming_step_boundary(context) else {
+            return false;
+        };
+        let Some(BoundaryKey::Number(value)) = boundary.key.as_ref() else {
+            set_last_error("pending boundary key is not a number");
+            return false;
+        };
+        let Some(value) = value.as_f64() else {
+            set_last_error("pending boundary key cannot be represented as a finite number");
+            return false;
+        };
+        // SAFETY: The caller guarantees `out_value` is writable.
+        unsafe { *out_value = value };
+        true
+    }) {
+        Ok(ok) => ok,
         Err(_) => {
-            set_last_error(format!("panic in {operation}"));
-            std::ptr::null_mut()
+            set_last_error("panic in webui_streaming_step_boundary_key_number");
+            false
+        }
+    }
+}
+
+fn owned_streaming_step(step: StreamStep) -> *mut webui_streaming_step_t {
+    Box::into_raw(Box::new(StreamingStepContext { step })) as *mut webui_streaming_step_t
+}
+
+fn streaming_step_boundary(context: &StreamingStepContext) -> Option<&BoundaryDescriptor> {
+    match context.step.boundary.as_ref() {
+        Some(boundary) => Some(boundary),
+        None => {
+            set_last_error("streaming step has no pending boundary");
+            None
+        }
+    }
+}
+
+fn streaming_boundary_mode(mode: webui_boundary_mode_t) -> Option<BoundaryMode> {
+    match mode {
+        WEBUI_BOUNDARY_MODE_FINAL => Some(BoundaryMode::Final),
+        WEBUI_BOUNDARY_MODE_UPDATABLE => Some(BoundaryMode::Updatable),
+        _ => {
+            set_last_error(format!(
+                "invalid boundary mode {mode}; expected WEBUI_BOUNDARY_MODE_FINAL (0) \
+                 or WEBUI_BOUNDARY_MODE_UPDATABLE (1)"
+            ));
+            None
+        }
+    }
+}
+
+/// Parse one required JSON string argument.
+///
+/// # Safety
+///
+/// `value` must be non-null, null-terminated, and readable for this call.
+unsafe fn streaming_json_arg(value: *const c_char, name: &str) -> Option<Value> {
+    // SAFETY: The caller guarantees the string pointer is valid and terminated.
+    let text = unsafe { utf8_arg(value, name) }?;
+    match serde_json::from_str(text) {
+        Ok(value) => Some(value),
+        Err(error) => {
+            set_last_error(format!("failed to parse {name}: {error}"));
+            None
         }
     }
 }
diff --git a/crates/webui-ffi/tests/ffi_test.rs b/crates/webui-ffi/tests/ffi_test.rs
index bedb53033..987ac3b18 100644
--- a/crates/webui-ffi/tests/ffi_test.rs
+++ b/crates/webui-ffi/tests/ffi_test.rs
@@ -3,6 +3,7 @@
 
 // FFI tests exercise unsafe C ABI functions.
 #![allow(unsafe_code)]
+#![allow(clippy::disallowed_methods)]
 
 //! Integration tests for the webui-ffi C ABI.
 //!
@@ -20,15 +21,19 @@ use webui_ffi::{
     webui_free, webui_handler_create, webui_handler_create_with_plugin, webui_handler_destroy,
     webui_handler_render, webui_handler_set_nonce, webui_last_error, webui_protocol_create,
     webui_protocol_destroy, webui_protocol_render_partial, webui_protocol_tokens,
-    webui_streaming_session_boundary, webui_streaming_session_boundary_count,
     webui_streaming_session_create, webui_streaming_session_destroy,
-    webui_streaming_session_finish, webui_streaming_session_is_finished,
-    webui_streaming_session_update, webui_streaming_session_write_boundary,
-    webui_streaming_session_write_shell,
+    webui_streaming_session_resume, webui_streaming_session_start, webui_streaming_session_update,
+    webui_streaming_step_boundary_declaration_id, webui_streaming_step_boundary_instance_id,
+    webui_streaming_step_boundary_key_number, webui_streaming_step_boundary_key_string,
+    webui_streaming_step_boundary_key_type, webui_streaming_step_boundary_name,
+    webui_streaming_step_boundary_owner, webui_streaming_step_bytes, webui_streaming_step_destroy,
+    webui_streaming_step_done, webui_streaming_step_has_boundary, WEBUI_BOUNDARY_KEY_NONE,
+    WEBUI_BOUNDARY_KEY_NUMBER, WEBUI_BOUNDARY_KEY_STRING, WEBUI_BOUNDARY_MODE_FINAL,
+    WEBUI_BOUNDARY_MODE_UPDATABLE,
 };
 use webui_protocol::{
-    FragmentList, InitialStateStrategy, StateProjectionMode, WebUIFragment, WebUIProtocol,
-    WebUiFragmentRoute,
+    web_ui_fragment, FragmentList, InitialStateStrategy, StateProjectionMode, WebUIFragment,
+    WebUIProtocol, WebUiFragmentRoute,
 };
 
 // ---------------------------------------------------------------------------
@@ -122,6 +127,7 @@ fn render_partial_returns_templates_inventory_and_chain() {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::component("mp-app")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
@@ -144,36 +150,42 @@ fn render_partial_returns_templates_inventory_and_chain() {
                     ..Default::default()
                 }),
             ],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "mp-category-nav".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<nav></nav>")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "mp-search-page".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::component("mp-product-grid")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "mp-product-grid".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<grid></grid>")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "mp-product-page".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::component("mp-product-detail")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "mp-product-detail".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<detail></detail>")],
+            contains_boundary: false,
         },
     );
 
@@ -330,6 +342,7 @@ fn protocol_tokens_empty_vec_returns_empty_string() {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>hello</p>")],
+            contains_boundary: false,
         },
     );
     let protocol = WebUIProtocol::with_tokens(fragments, Vec::new());
@@ -351,6 +364,7 @@ fn protocol_tokens_single_token() {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>hello</p>")],
+            contains_boundary: false,
         },
     );
     let protocol = WebUIProtocol::with_tokens(fragments, vec!["colorBrandBackground".to_string()]);
@@ -368,6 +382,7 @@ fn protocol_tokens_multiple_tokens_newline_delimited() {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>hello</p>")],
+            contains_boundary: false,
         },
     );
     let protocol = WebUIProtocol::with_tokens(
@@ -408,6 +423,7 @@ fn build_protocol_with_body_end() -> Vec<u8> {
                 structural_fragment("body_end"),
                 WebUIFragment::raw("</body></html>"),
             ],
+            contains_boundary: false,
         },
     );
     let protocol = WebUIProtocol {
@@ -658,6 +674,7 @@ fn protocol_tokens_preserves_order_and_duplicates() {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>hello</p>")],
+            contains_boundary: false,
         },
     );
     let protocol = WebUIProtocol::with_tokens(
@@ -736,12 +753,14 @@ fn build_protocol_with_hydration_keys(hydration_keys: &[&str]) -> Vec<u8> {
                 structural_fragment("body_end"),
                 WebUIFragment::raw("</body></html>"),
             ],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "client-card".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>client</p>")],
+            contains_boundary: false,
         },
     );
     let mut protocol = WebUIProtocol::new(fragments);
@@ -825,6 +844,7 @@ fn handler_render_emits_module_preloads_through_the_c_abi() {
                 structural_fragment("body_end"),
                 WebUIFragment::raw("</body></html>"),
             ],
+            contains_boundary: false,
         },
     );
     let mut protocol = WebUIProtocol::new(fragments);
@@ -943,76 +963,136 @@ fn protocol_destroy_null_is_safe() {
 // Tests: host-driven streaming sessions
 // ---------------------------------------------------------------------------
 
-/// Build a two-boundary streaming entry with one hydrating component each.
+/// Build one repeated declaration that discovers string and number keys.
 fn build_streaming_protocol() -> Vec<u8> {
-    let hosts = ["comp-a", "comp-b"];
-    let mut entry = vec![
-        WebUIFragment::raw("<!DOCTYPE html><html><head>"),
-        structural_fragment("head_start"),
-        structural_fragment("head_end"),
-        WebUIFragment::raw("</head><body>"),
-        structural_fragment("body_start"),
-    ];
-    for (sequence, host) in hosts.iter().enumerate() {
-        entry.push(structural_fragment(&format!("boundary_start:{sequence}")));
-        entry.push(WebUIFragment::raw(format!("<{host}")));
-        entry.push(structural_fragment(&format!("streaming_root:{host}")));
-        entry.push(WebUIFragment::raw(">"));
-        entry.push(WebUIFragment::component(*host));
-        entry.push(WebUIFragment::raw(format!("</{host}>")));
-        entry.push(structural_fragment(&format!("boundary_end:{sequence}")));
+    let mut row_boundary =
+        WebUIFragment::boundary(41, "index.html", "row", Some("{{item.id}}".to_string()));
+    if let Some(web_ui_fragment::Fragment::Boundary(boundary)) = row_boundary.fragment.as_mut() {
+        boundary.may_repeat = true;
     }
-    entry.push(structural_fragment("body_end"));
-    entry.push(WebUIFragment::raw("</body></html>"));
 
-    let mut fragments = HashMap::new();
-    fragments.insert("index.html".to_string(), FragmentList { fragments: entry });
-    for host in hosts {
-        fragments.insert(
-            host.to_string(),
+    let fragments = HashMap::from([
+        (
+            "index.html".to_string(),
             FragmentList {
-                fragments: vec![WebUIFragment::raw(format!("<b>{host}</b>"))],
+                fragments: vec![
+                    WebUIFragment::raw("<!DOCTYPE html><html><head>"),
+                    structural_fragment("head_start"),
+                    structural_fragment("head_end"),
+                    WebUIFragment::raw("</head><body>"),
+                    structural_fragment("body_start"),
+                    WebUIFragment::for_loop("item", "items", "rows"),
+                    structural_fragment("body_end"),
+                    WebUIFragment::raw("</body></html>"),
+                ],
+                contains_boundary: true,
             },
-        );
-    }
+        ),
+        (
+            "rows".to_string(),
+            FragmentList {
+                fragments: vec![
+                    row_boundary,
+                    WebUIFragment::raw("<p>"),
+                    WebUIFragment::signal("item.label", false),
+                    WebUIFragment::raw("/"),
+                    WebUIFragment::signal("count", false),
+                    WebUIFragment::raw("</p>"),
+                    WebUIFragment::boundary_end(41),
+                ],
+                contains_boundary: true,
+            },
+        ),
+    ]);
+    WebUIProtocol::new(fragments)
+        .to_protobuf()
+        .expect("streaming protocol must serialize")
+}
 
-    let mut document = WebUIProtocol::new(fragments);
-    document.initial_state_strategy = InitialStateStrategy::Components as i32;
-    document.streaming_boundaries.insert(
+fn build_unkeyed_streaming_protocol() -> Vec<u8> {
+    let fragments = HashMap::from([(
         "index.html".to_string(),
-        webui_protocol::StreamingBoundaryList {
-            names: vec!["first".to_string(), "second".to_string()],
+        FragmentList {
+            fragments: vec![
+                WebUIFragment::raw("<html><head>"),
+                structural_fragment("head_start"),
+                structural_fragment("head_end"),
+                WebUIFragment::raw("</head><body>"),
+                structural_fragment("body_start"),
+                WebUIFragment::boundary(9, "index.html", "plain", None),
+                WebUIFragment::raw("<p>plain</p>"),
+                WebUIFragment::boundary_end(9),
+                structural_fragment("body_end"),
+                WebUIFragment::raw("</body></html>"),
+            ],
+            contains_boundary: true,
         },
-    );
-    for (host, key) in hosts.iter().zip(["a_count", "b_count"]) {
-        document.components.insert(
-            (*host).to_string(),
-            webui_protocol::ComponentData {
-                template_json: format!(r#"{{"h":"<i>{host}</i>","th":1}}"#),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec![key.to_string()],
-                ..Default::default()
-            },
-        );
-    }
-    document
+    )]);
+    WebUIProtocol::new(fragments)
         .to_protobuf()
-        .expect("streaming protocol must serialize")
+        .expect("unkeyed streaming protocol must serialize")
+}
+
+fn build_boundary_free_protocol() -> Vec<u8> {
+    WebUIProtocol::new(HashMap::from([(
+        "index.html".to_string(),
+        FragmentList {
+            fragments: vec![
+                WebUIFragment::raw("<!DOCTYPE html><html><head>"),
+                structural_fragment("head_start"),
+                structural_fragment("head_end"),
+                WebUIFragment::raw("</head><body>"),
+                structural_fragment("body_start"),
+                WebUIFragment::raw("<p>complete</p>"),
+                structural_fragment("body_end"),
+                WebUIFragment::raw("</body></html>"),
+            ],
+            contains_boundary: false,
+        },
+    )]))
+    .to_protobuf()
+    .expect("boundary-free protocol must serialize")
 }
 
-/// Drive one chunk-producing call and return its bytes plus the reported length.
-unsafe fn take_chunk(ptr: *mut std::os::raw::c_char, len: usize) -> String {
+unsafe fn take_allocated_bytes(ptr: *mut std::os::raw::c_char, len: usize) -> String {
     assert!(
         !ptr.is_null(),
         "streaming call failed: {}",
         last_error_string().unwrap_or_else(|| "<none>".to_string())
     );
-    let chunk = CStr::from_ptr(ptr).to_string_lossy().into_owned();
-    assert_eq!(chunk.len(), len, "out_len must match the chunk byte length");
+    let bytes = std::slice::from_raw_parts(ptr.cast::<u8>(), len);
+    let chunk = String::from_utf8(bytes.to_vec()).expect("streaming bytes must be UTF-8");
     webui_free(ptr);
     chunk
 }
 
+unsafe fn step_bytes(step: *const c_void) -> String {
+    let mut len = usize::MAX;
+    let ptr = webui_streaming_step_bytes(step, &mut len);
+    assert!(
+        !ptr.is_null(),
+        "step byte access failed: {}",
+        last_error_string().unwrap_or_else(|| "<none>".to_string())
+    );
+    String::from_utf8(std::slice::from_raw_parts(ptr, len).to_vec())
+        .expect("streaming step bytes must be UTF-8")
+}
+
+unsafe fn borrowed_step_string(
+    step: *const c_void,
+    getter: unsafe extern "C" fn(*const c_void, *mut usize) -> *const std::os::raw::c_char,
+) -> String {
+    let mut len = usize::MAX;
+    let ptr = getter(step, &mut len);
+    assert!(
+        !ptr.is_null(),
+        "descriptor string access failed: {}",
+        last_error_string().unwrap_or_else(|| "<none>".to_string())
+    );
+    String::from_utf8(std::slice::from_raw_parts(ptr.cast::<u8>(), len).to_vec())
+        .expect("descriptor string must be UTF-8")
+}
+
 unsafe fn open_streaming_session(handler: *mut c_void, protocol: *mut c_void) -> *mut c_void {
     let entry = CString::new("index.html").unwrap();
     let path = CString::new("/").unwrap();
@@ -1026,77 +1106,131 @@ unsafe fn open_streaming_session(handler: *mut c_void, protocol: *mut c_void) ->
 }
 
 #[test]
-fn streaming_session_returns_one_chunk_per_call_through_the_c_abi() {
+fn streaming_session_discovers_typed_boundaries_resumes_updates_and_completes() {
     let proto_bytes = build_streaming_protocol();
     unsafe {
         let handler = webui_handler_create_with_plugin(CString::new("webui").unwrap().as_ptr());
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
-
-        assert_eq!(webui_streaming_session_boundary_count(session), 2);
-        assert!(!webui_streaming_session_is_finished(session));
-
-        let mut first = u32::MAX;
-        let mut second = u32::MAX;
-        assert!(webui_streaming_session_boundary(
-            session,
-            CString::new("first").unwrap().as_ptr(),
-            &mut first
+        let state = CString::new(
+            r#"{"items":[{"id":"alpha\u0000omega","label":"first"},{"id":7,"label":"second"}],"count":1}"#,
+        )
+        .unwrap();
+
+        let first_step = webui_streaming_session_start(session, state.as_ptr());
+        assert!(!first_step.is_null());
+        assert!(!webui_streaming_step_done(first_step));
+        assert!(last_error_string().is_none());
+        assert!(webui_streaming_step_has_boundary(first_step));
+
+        let mut first_id = u32::MAX;
+        let mut declaration_id = u32::MAX;
+        let mut key_type = u32::MAX;
+        assert!(webui_streaming_step_boundary_instance_id(
+            first_step,
+            &mut first_id
         ));
-        assert!(webui_streaming_session_boundary(
-            session,
-            CString::new("second").unwrap().as_ptr(),
-            &mut second
+        assert!(webui_streaming_step_boundary_declaration_id(
+            first_step,
+            &mut declaration_id
         ));
-        assert_eq!(first, 0);
-        assert_eq!(second, 1);
-
-        let empty = CString::new("{}").unwrap();
-        let a_state = CString::new(r#"{"a_count":1}"#).unwrap();
-        let a_patch = CString::new(r#"{"a_count":7}"#).unwrap();
-        let b_state = CString::new(r#"{"b_count":2}"#).unwrap();
-
-        let mut document = String::new();
-        let mut len = 0usize;
-        document.push_str(&take_chunk(
-            webui_streaming_session_write_shell(session, empty.as_ptr(), &mut len),
-            len,
+        assert!(webui_streaming_step_boundary_key_type(
+            first_step,
+            &mut key_type
         ));
-        document.push_str(&take_chunk(
-            webui_streaming_session_write_boundary(
-                session,
-                first,
-                a_state.as_ptr(),
-                true,
-                &mut len,
-            ),
-            len,
-        ));
-        document.push_str(&take_chunk(
-            webui_streaming_session_update(session, first, a_patch.as_ptr(), &mut len),
-            len,
+        assert_eq!(first_id, 0);
+        assert_eq!(declaration_id, 41);
+        assert_eq!(key_type, WEBUI_BOUNDARY_KEY_STRING);
+        assert_eq!(
+            borrowed_step_string(first_step, webui_streaming_step_boundary_owner),
+            "index.html"
+        );
+        assert_eq!(
+            borrowed_step_string(first_step, webui_streaming_step_boundary_name),
+            "row"
+        );
+        assert_eq!(
+            borrowed_step_string(first_step, webui_streaming_step_boundary_key_string),
+            "alpha\0omega"
+        );
+
+        let mut document = step_bytes(first_step);
+        webui_streaming_step_destroy(first_step);
+
+        let second_step = webui_streaming_session_resume(
+            session,
+            first_id,
+            state.as_ptr(),
+            WEBUI_BOUNDARY_MODE_UPDATABLE,
+        );
+        assert!(!second_step.is_null());
+        let mut second_id = u32::MAX;
+        key_type = u32::MAX;
+        assert!(webui_streaming_step_boundary_instance_id(
+            second_step,
+            &mut second_id
         ));
-        document.push_str(&take_chunk(
-            webui_streaming_session_write_boundary(
-                session,
-                second,
-                b_state.as_ptr(),
-                false,
-                &mut len,
-            ),
-            len,
+        assert!(webui_streaming_step_boundary_key_type(
+            second_step,
+            &mut key_type
         ));
-        document.push_str(&take_chunk(
-            webui_streaming_session_finish(session, empty.as_ptr(), &mut len),
-            len,
+        assert_eq!(second_id, 1);
+        assert_eq!(key_type, WEBUI_BOUNDARY_KEY_NUMBER);
+        let mut number_key = f64::NAN;
+        assert!(webui_streaming_step_boundary_key_number(
+            second_step,
+            &mut number_key
         ));
+        assert_eq!(number_key, 7.0);
+        document.push_str(&step_bytes(second_step));
+        webui_streaming_step_destroy(second_step);
+
+        let patch = CString::new(r#"{"count":2}"#).unwrap();
+        let mut untouched_len = usize::MAX;
+        assert!(webui_streaming_session_update(
+            session,
+            first_id,
+            std::ptr::null(),
+            &mut untouched_len
+        )
+        .is_null());
+        assert_eq!(untouched_len, usize::MAX);
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("patch_json"));
+        assert!(webui_streaming_session_update(
+            session,
+            first_id,
+            patch.as_ptr(),
+            std::ptr::null_mut()
+        )
+        .is_null());
+        assert!(last_error_string().unwrap_or_default().contains("out_len"));
+
+        let mut update_len = usize::MAX;
+        let update =
+            webui_streaming_session_update(session, first_id, patch.as_ptr(), &mut update_len);
+        let update = take_allocated_bytes(update, update_len);
+        assert!(update.contains(r#""count":2"#), "update: {update}");
+        document.push_str(&update);
+
+        let final_step = webui_streaming_session_resume(
+            session,
+            second_id,
+            state.as_ptr(),
+            WEBUI_BOUNDARY_MODE_FINAL,
+        );
+        assert!(!final_step.is_null());
+        assert!(webui_streaming_step_done(final_step));
+        assert!(!webui_streaming_step_has_boundary(final_step));
+        assert!(last_error_string().is_none());
+        document.push_str(&step_bytes(final_step));
+        webui_streaming_step_destroy(final_step);
 
-        assert!(webui_streaming_session_is_finished(session));
         assert!(document.starts_with("<!DOCTYPE html>"));
-        assert!(document.contains("<b>comp-a</b>"));
-        assert!(document.contains("<b>comp-b</b>"));
-        assert!(document.contains(r#"{"a_count":7}"#));
-        assert!(document.ends_with("</html>"));
+        assert!(document.contains("first"));
+        assert!(document.contains("second"));
+        assert!(document.contains("</html>"));
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1105,18 +1239,23 @@ fn streaming_session_returns_one_chunk_per_call_through_the_c_abi() {
 }
 
 #[test]
-fn streaming_session_accepts_a_null_out_len() {
-    let proto_bytes = build_streaming_protocol();
+fn streaming_step_accessors_reject_null_output_pointers() {
+    let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create();
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
 
         let empty = CString::new("{}").unwrap();
-        let chunk =
-            webui_streaming_session_write_shell(session, empty.as_ptr(), std::ptr::null_mut());
-        assert!(!chunk.is_null());
-        webui_free(chunk);
+        let step = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!step.is_null());
+
+        assert!(webui_streaming_step_bytes(step, std::ptr::null_mut()).is_null());
+        assert!(last_error_string().unwrap_or_default().contains("out_len"));
+        assert!(webui_streaming_step_boundary_owner(step, std::ptr::null_mut()).is_null());
+        assert!(last_error_string().unwrap_or_default().contains("out_len"));
+
+        webui_streaming_step_destroy(step);
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1125,23 +1264,34 @@ fn streaming_session_accepts_a_null_out_len() {
 }
 
 #[test]
-fn streaming_session_reports_an_unknown_boundary_name() {
-    let proto_bytes = build_streaming_protocol();
+fn streaming_step_reports_an_unkeyed_boundary_unambiguously() {
+    let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create();
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
 
-        let mut boundary = u32::MAX;
-        let ok = webui_streaming_session_boundary(
-            session,
-            CString::new("firts").unwrap().as_ptr(),
-            &mut boundary,
-        );
-        assert!(!ok);
-        assert_eq!(boundary, u32::MAX, "out_boundary must stay untouched");
-        let error = last_error_string().unwrap_or_default();
-        assert!(error.contains("first"), "error: {error}");
+        let empty = CString::new("{}").unwrap();
+        let step = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!step.is_null());
+        let mut key_type = u32::MAX;
+        assert!(webui_streaming_step_boundary_key_type(step, &mut key_type));
+        assert_eq!(key_type, WEBUI_BOUNDARY_KEY_NONE);
+
+        let mut len = usize::MAX;
+        assert!(webui_streaming_step_boundary_key_string(step, &mut len).is_null());
+        assert_eq!(len, usize::MAX);
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("not a string"));
+
+        let mut number = 12.0;
+        assert!(!webui_streaming_step_boundary_key_number(step, &mut number));
+        assert_eq!(number, 12.0);
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("not a number"));
+        webui_streaming_step_destroy(step);
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1150,46 +1300,57 @@ fn streaming_session_reports_an_unknown_boundary_name() {
 }
 
 #[test]
-fn streaming_session_rejects_out_of_order_and_post_finish_calls() {
-    let proto_bytes = build_streaming_protocol();
+fn streaming_session_rejects_stale_resume_and_post_completion_calls() {
+    let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create();
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
 
         let empty = CString::new("{}").unwrap();
-        let mut len = 0usize;
-        let shell = webui_streaming_session_write_shell(session, empty.as_ptr(), &mut len);
-        assert!(!shell.is_null());
-        webui_free(shell);
-
-        // Boundary 1 before boundary 0.
-        let chunk =
-            webui_streaming_session_write_boundary(session, 1, empty.as_ptr(), false, &mut len);
-        assert!(chunk.is_null());
+        let first = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!first.is_null());
+        let mut instance_id = u32::MAX;
+        assert!(webui_streaming_step_boundary_instance_id(
+            first,
+            &mut instance_id
+        ));
+        webui_streaming_step_destroy(first);
+
+        assert!(webui_streaming_session_resume(
+            session,
+            instance_id,
+            std::ptr::null(),
+            WEBUI_BOUNDARY_MODE_FINAL
+        )
+        .is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("state_json"));
+
+        let rejected =
+            webui_streaming_session_resume(session, 99, empty.as_ptr(), WEBUI_BOUNDARY_MODE_FINAL);
+        assert!(rejected.is_null());
         let error = last_error_string().unwrap_or_default();
-        assert!(error.contains("order"), "error: {error}");
-
-        // The rejected call wrote nothing, so the response is still usable.
-        for boundary in [0u32, 1u32] {
-            let chunk = webui_streaming_session_write_boundary(
-                session,
-                boundary,
-                empty.as_ptr(),
-                false,
-                &mut len,
-            );
-            assert!(!chunk.is_null());
-            webui_free(chunk);
-        }
-        let tail = webui_streaming_session_finish(session, empty.as_ptr(), &mut len);
-        assert!(!tail.is_null());
-        webui_free(tail);
+        assert!(error.contains("stale"), "error: {error}");
 
-        let after = webui_streaming_session_write_shell(session, empty.as_ptr(), &mut len);
+        let final_step = webui_streaming_session_resume(
+            session,
+            instance_id,
+            empty.as_ptr(),
+            WEBUI_BOUNDARY_MODE_FINAL,
+        );
+        assert!(!final_step.is_null());
+        assert!(webui_streaming_step_done(final_step));
+        webui_streaming_step_destroy(final_step);
+
+        let after = webui_streaming_session_start(session, empty.as_ptr());
         assert!(after.is_null());
         let error = last_error_string().unwrap_or_default();
-        assert!(error.contains("already finished"), "error: {error}");
+        assert!(
+            error.contains("completed") || error.contains("started"),
+            "error: {error}"
+        );
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1198,44 +1359,31 @@ fn streaming_session_rejects_out_of_order_and_post_finish_calls() {
 }
 
 #[test]
-fn streaming_session_survives_an_out_of_order_finish() {
-    let proto_bytes = build_streaming_protocol();
+fn streaming_session_boundary_free_start_completes() {
+    let proto_bytes = build_boundary_free_protocol();
     unsafe {
         let handler = webui_handler_create();
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
 
         let empty = CString::new("{}").unwrap();
-        let mut len = 0usize;
-        let shell = webui_streaming_session_write_shell(session, empty.as_ptr(), &mut len);
-        assert!(!shell.is_null());
-        webui_free(shell);
-
-        let first =
-            webui_streaming_session_write_boundary(session, 0, empty.as_ptr(), false, &mut len);
-        assert!(!first.is_null());
-        webui_free(first);
-
-        // Boundary 1 is still outstanding, so finish is rejected before it
-        // writes anything and the open response must survive.
-        let rejected = webui_streaming_session_finish(session, empty.as_ptr(), &mut len);
-        assert!(rejected.is_null());
-        let error = last_error_string().unwrap_or_default();
-        assert!(
-            error.contains("every boundary must be committed"),
-            "error: {error}"
-        );
-        assert!(!webui_streaming_session_is_finished(session));
-
-        let second =
-            webui_streaming_session_write_boundary(session, 1, empty.as_ptr(), false, &mut len);
-        assert!(!second.is_null());
-        webui_free(second);
-
-        let tail = webui_streaming_session_finish(session, empty.as_ptr(), &mut len);
-        assert!(!tail.is_null());
-        webui_free(tail);
-        assert!(webui_streaming_session_is_finished(session));
+        let step = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!step.is_null());
+        assert!(webui_streaming_step_done(step));
+        assert!(!webui_streaming_step_has_boundary(step));
+        let html = step_bytes(step);
+        assert!(html.contains("<p>complete</p>"));
+
+        let mut untouched = 77u32;
+        assert!(!webui_streaming_step_boundary_instance_id(
+            step,
+            &mut untouched
+        ));
+        assert_eq!(untouched, 77);
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("no pending boundary"));
+        webui_streaming_step_destroy(step);
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1245,18 +1393,28 @@ fn streaming_session_survives_an_out_of_order_finish() {
 
 #[test]
 fn streaming_session_rejects_invalid_state_json() {
-    let proto_bytes = build_streaming_protocol();
+    let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create();
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
 
+        assert!(webui_streaming_session_start(session, std::ptr::null()).is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("state_json"));
+
         let broken = CString::new("{not json").unwrap();
-        let mut len = 0usize;
-        let chunk = webui_streaming_session_write_shell(session, broken.as_ptr(), &mut len);
-        assert!(chunk.is_null());
+        let step = webui_streaming_session_start(session, broken.as_ptr());
+        assert!(step.is_null());
         let error = last_error_string().unwrap_or_default();
-        assert!(error.contains("state JSON"), "error: {error}");
+        assert!(error.contains("state_json"), "error: {error}");
+
+        let empty = CString::new("{}").unwrap();
+        let recovered = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!recovered.is_null());
+        assert!(last_error_string().is_none());
+        webui_streaming_step_destroy(recovered);
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1268,7 +1426,8 @@ fn streaming_session_rejects_invalid_state_json() {
 fn streaming_session_null_arguments_are_safe() {
     unsafe {
         let empty = CString::new("{}").unwrap();
-        let mut len = 0usize;
+        let mut len = usize::MAX;
+        let mut value = u32::MAX;
 
         assert!(webui_streaming_session_create(
             std::ptr::null_mut(),
@@ -1277,27 +1436,64 @@ fn streaming_session_null_arguments_are_safe() {
             std::ptr::null()
         )
         .is_null());
-        assert!(webui_streaming_session_write_shell(
+        assert!(webui_streaming_session_start(std::ptr::null_mut(), empty.as_ptr()).is_null());
+        assert!(webui_streaming_session_resume(
             std::ptr::null_mut(),
+            0,
             empty.as_ptr(),
-            &mut len
+            WEBUI_BOUNDARY_MODE_FINAL
         )
         .is_null());
-        assert!(!webui_streaming_session_boundary(
+        assert!(
+            webui_streaming_session_update(std::ptr::null_mut(), 0, empty.as_ptr(), &mut len)
+                .is_null()
+        );
+        assert!(webui_streaming_session_update(
+            std::ptr::null_mut(),
+            0,
+            empty.as_ptr(),
+            std::ptr::null_mut()
+        )
+        .is_null());
+
+        assert!(webui_streaming_step_bytes(std::ptr::null(), &mut len).is_null());
+        assert!(!webui_streaming_step_done(std::ptr::null()));
+        assert!(!webui_streaming_step_has_boundary(std::ptr::null()));
+        assert!(!webui_streaming_step_boundary_instance_id(
             std::ptr::null(),
+            &mut value
+        ));
+        assert!(webui_streaming_step_boundary_name(std::ptr::null(), &mut len).is_null());
+        assert!(!webui_streaming_step_boundary_key_type(
             std::ptr::null(),
-            std::ptr::null_mut()
+            &mut value
         ));
-        assert_eq!(webui_streaming_session_boundary_count(std::ptr::null()), 0);
-        // A handle that does not exist can never accept another call.
-        assert!(webui_streaming_session_is_finished(std::ptr::null()));
+        assert!(last_error_string().is_some());
+
         webui_streaming_session_destroy(std::ptr::null_mut());
+        webui_streaming_step_destroy(std::ptr::null_mut());
+
+        let proto_bytes = build_unkeyed_streaming_protocol();
+        let handler = webui_handler_create();
+        let protocol = prepare_protocol(&proto_bytes);
+        let session = open_streaming_session(handler, protocol);
+        let step = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!step.is_null());
+        let rejected = webui_streaming_session_resume(session, 0, empty.as_ptr(), 99);
+        assert!(rejected.is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("invalid boundary mode"));
+        webui_streaming_step_destroy(step);
+        webui_streaming_session_destroy(session);
+        webui_protocol_destroy(protocol);
+        webui_handler_destroy(handler);
     }
 }
 
 #[test]
 fn streaming_session_applies_the_handler_nonce() {
-    let proto_bytes = build_streaming_protocol();
+    let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create_with_plugin(CString::new("webui").unwrap().as_ptr());
         webui_handler_set_nonce(handler, CString::new("abc123").unwrap().as_ptr());
@@ -1305,16 +1501,25 @@ fn streaming_session_applies_the_handler_nonce() {
         let session = open_streaming_session(handler, protocol);
 
         let empty = CString::new("{}").unwrap();
-        let state = CString::new(r#"{"a_count":1}"#).unwrap();
-        let mut len = 0usize;
-        let mut document = take_chunk(
-            webui_streaming_session_write_shell(session, empty.as_ptr(), &mut len),
-            len,
-        );
-        document.push_str(&take_chunk(
-            webui_streaming_session_write_boundary(session, 0, state.as_ptr(), false, &mut len),
-            len,
+        let first = webui_streaming_session_start(session, empty.as_ptr());
+        assert!(!first.is_null());
+        let mut instance_id = u32::MAX;
+        assert!(webui_streaming_step_boundary_instance_id(
+            first,
+            &mut instance_id
         ));
+        let mut document = step_bytes(first);
+        webui_streaming_step_destroy(first);
+
+        let final_step = webui_streaming_session_resume(
+            session,
+            instance_id,
+            empty.as_ptr(),
+            WEBUI_BOUNDARY_MODE_FINAL,
+        );
+        assert!(!final_step.is_null());
+        document.push_str(&step_bytes(final_step));
+        webui_streaming_step_destroy(final_step);
 
         assert!(document.contains("abc123"), "document: {document}");
 
diff --git a/crates/webui-handler/README.md b/crates/webui-handler/README.md
index b300039f2..23d30ddd0 100644
--- a/crates/webui-handler/README.md
+++ b/crates/webui-handler/README.md
@@ -25,6 +25,31 @@ let result = protocol.render_component_templates(
 
 Available via all bindings: Rust (`Protocol::render_component_templates`), Node/WASM/npm (`Protocol.renderComponentTemplates`), and FFI (`webui_protocol_render_component_templates`).
 
+### Runtime-discovered streaming
+
+`WebUIHandler::stream_response` returns a borrowed `StreamingResponse`.
+`StreamingSession` is the owned byte-returning form used by host bindings.
+
+```rust
+let mut session = StreamingSession::new(handler, protocol, options)?;
+let mut step = session.start(&initial_state)?;
+
+while let Some(boundary) = step.boundary {
+    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+    step = session.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+}
+```
+
+`start` and `resume` return `StreamStep { bytes, boundary, done }`. A descriptor
+contains response-local `instance_id`, stable `declaration_id`, owner-local
+`name`, `owner`, and an optional string or numeric `key`. The done step includes
+terminal and document-tail bytes.
+
+Commit an occurrence as `BoundaryMode::Updatable` to call
+`update(instance_id, patch)` later. Updates are projected state records and do
+not insert markup. Component-local occurrences use generated parent spans so an
+early child can hydrate before the parent tail.
+
 ## Documentation
 
 See the [WebUI repository](https://github.com/microsoft/webui) for full usage guides and examples.
diff --git a/crates/webui-handler/benches/bootstrap_state_bench.rs b/crates/webui-handler/benches/bootstrap_state_bench.rs
index f54e8043c..b4c22ab74 100644
--- a/crates/webui-handler/benches/bootstrap_state_bench.rs
+++ b/crates/webui-handler/benches/bootstrap_state_bench.rs
@@ -193,12 +193,14 @@ fn build_partial_protocol(
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::route("/", "benchmark-page")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "benchmark-page".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>Benchmark</p>")],
+            contains_boundary: false,
         },
     );
     let mut protocol = WebUIProtocol::new(fragments);
@@ -255,18 +257,22 @@ fn build_routed_protocol() -> WebUIProtocol {
                 structural_fragment("body_end"),
                 WebUIFragment::raw("</body></html>"),
             ],
+
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "dashboard-page".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>Dashboard</p>")],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "contacts-page".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>Contacts</p>")],
+            contains_boundary: false,
         },
     );
 
@@ -316,12 +322,14 @@ fn build_bootstrap_protocol(
                 structural_fragment("body_end"),
                 WebUIFragment::raw("</body></html>"),
             ],
+            contains_boundary: false,
         },
     );
     fragments.insert(
         "bench-component".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<p>ready</p>")],
+            contains_boundary: false,
         },
     );
     let mut protocol = WebUIProtocol::new(fragments);
diff --git a/crates/webui-handler/benches/handler_bench.rs b/crates/webui-handler/benches/handler_bench.rs
index 0eebd96ac..4392913c0 100644
--- a/crates/webui-handler/benches/handler_bench.rs
+++ b/crates/webui-handler/benches/handler_bench.rs
@@ -75,6 +75,7 @@ fn build_mixed_protocol() -> Protocol {
                 WebUIFragment::component("card"),
                 WebUIFragment::raw("</section>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -100,6 +101,7 @@ fn build_mixed_protocol() -> Protocol {
                 WebUIFragment::plugin((3u32).to_le_bytes().to_vec()),
                 WebUIFragment::raw("</x-card>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -112,6 +114,7 @@ fn build_mixed_protocol() -> Protocol {
                 WebUIFragment::raw(" size-"),
                 WebUIFragment::signal("size", false),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -125,6 +128,7 @@ fn build_mixed_protocol() -> Protocol {
                 WebUIFragment::signal("item.name", false),
                 WebUIFragment::raw("</li>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -136,6 +140,7 @@ fn build_mixed_protocol() -> Protocol {
                 WebUIFragment::signal("footer", false),
                 WebUIFragment::raw("</footer>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -276,6 +281,7 @@ fn build_condition_protocol() -> Protocol {
                 ),
                 WebUIFragment::raw("</div>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -290,6 +296,7 @@ fn build_condition_protocol() -> Protocol {
             id.to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(content)],
+                contains_boundary: false,
             },
         );
     }
@@ -378,6 +385,7 @@ fn build_nested_component_protocol() -> Protocol {
                 WebUIFragment::component("app"),
                 WebUIFragment::raw("</body></html>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -393,6 +401,7 @@ fn build_nested_component_protocol() -> Protocol {
                 WebUIFragment::for_loop("item", "items", "item-component"),
                 WebUIFragment::raw("</ul></div>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -408,6 +417,7 @@ fn build_nested_component_protocol() -> Protocol {
                 WebUIFragment::if_cond(ConditionExpr::identifier("item.enabled"), "enabled-badge"),
                 WebUIFragment::raw("</li>"),
             ],
+            contains_boundary: false,
         },
     );
 
@@ -415,6 +425,7 @@ fn build_nested_component_protocol() -> Protocol {
         "enabled-badge".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<span class=\"badge\">✓</span>")],
+            contains_boundary: false,
         },
     );
 
@@ -466,6 +477,7 @@ fn build_signal_protocol(signal_path: &str) -> Protocol {
                 WebUIFragment::signal(signal_path, false),
                 WebUIFragment::raw("</div>"),
             ],
+            contains_boundary: false,
         },
     );
     Protocol::new(WebUIProtocol::new(fragments))
diff --git a/crates/webui-handler/benches/streaming_hydration_bench.rs b/crates/webui-handler/benches/streaming_hydration_bench.rs
index 3d05bbaff..783f182c6 100644
--- a/crates/webui-handler/benches/streaming_hydration_bench.rs
+++ b/crates/webui-handler/benches/streaming_hydration_bench.rs
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
+#![allow(clippy::disallowed_methods)]
+
 //! Progressive streaming hydration benchmark.
 //!
 //! Compares legacy one-shot [`WebUIHandler::render`] with
@@ -22,7 +24,6 @@ use webui_handler::{
 };
 use webui_parser::plugin::webui::WebUIParserPlugin;
 use webui_parser::{ComponentRegistration, CssStrategy, HtmlParser};
-use webui_protocol::StreamingBoundaryList;
 use webui_protocol::{ComponentData, InitialStateStrategy, StateProjectionMode, WebUIProtocol};
 
 const BOUNDARY_COUNTS: &[usize] = &[1, 3, 10, 100];
@@ -136,16 +137,6 @@ fn parser_protocol(boundaries: usize) -> Protocol {
 
     let mut document = WebUIProtocol::new(parser.into_fragment_records());
     document.initial_state_strategy = InitialStateStrategy::Components as i32;
-    if boundaries > 0 {
-        document.streaming_boundaries.insert(
-            ENTRY_ID.to_string(),
-            StreamingBoundaryList {
-                names: (0..boundaries)
-                    .map(|index| format!("boundary-{index}"))
-                    .collect(),
-            },
-        );
-    }
     // Attach the benchmark's known component surface after parsing so the timed
     // protocol carries a deterministic hydration payload without depending on
     // the plugin's artifact pipeline.
@@ -211,10 +202,18 @@ fn verify_streaming_case(boundaries: usize) -> StreamingCase {
         legacy.flushes.is_empty(),
         "legacy rendering must not request streaming flushes"
     );
+    // Every boundary commits a checkpoint that flushes, plus the terminal
+    // record. A semantic step that returns without producing bytes since the
+    // checkpoint (adjacent boundaries) collapses into the checkpoint flush, so
+    // only steps that actually emit a prefix add one.
     assert_eq!(
         streaming.flushes.len(),
-        boundaries + 1,
-        "each explicit boundary and the terminal record must flush once"
+        boundaries + 2,
+        "each checkpoint flushes, plus the shell prefix and the terminal"
+    );
+    assert!(
+        streaming.flushes.windows(2).all(|pair| pair[0] < pair[1]),
+        "every flush must release bytes that the previous flush did not"
     );
     assert_eq!(
         occurrences(&streaming.output, "data-webui-boundary"),
@@ -278,31 +277,26 @@ fn verify_streaming_case(boundaries: usize) -> StreamingCase {
         assert!(
             streaming
                 .output
-                .contains(&format!("[1,{sequence},0,{sequence},")),
+                .contains(&format!("[2,{sequence},0,{sequence},")),
             "streaming output is missing boundary {sequence} envelope"
         );
     }
 
-    assert!(
-        streaming.flushes.windows(2).all(|pair| pair[0] < pair[1]),
-        "flush positions must advance in document order"
-    );
     assert!(
         streaming
             .output
-            .contains(&format!("[1,{boundaries},3,0,{{}}]")),
+            .contains(&format!("[2,{boundaries},4,0,{{}}]")),
         "streaming output is missing the terminal envelope"
-    );
-    // The empty terminal record is always the last envelope and never carries a
-    // bootstrap, regardless of native or scriptless tail bytes.
-    // Every envelope (each boundary commit plus the terminal) opens with the
-    // boundary sentinel prefix, so the prefix count equals boundaries + 1.
+    ); // The empty terminal record is always the last envelope and never carries a
+       // bootstrap, regardless of native or scriptless tail bytes.
+       // Every envelope (each boundary commit plus the terminal) opens with the
+       // boundary sentinel prefix, so the prefix count equals boundaries + 1.
     assert_eq!(
-        occurrences(&streaming.output, "data-webui-boundary>[1,"),
+        occurrences(&streaming.output, "data-webui-boundary>[2,"),
         boundaries + 1,
         "each envelope opens with the boundary sentinel prefix"
     );
-    if let Some(terminal) = streaming.output.find(&format!("[1,{boundaries},3,0,{{}}]")) {
+    if let Some(terminal) = streaming.output.find(&format!("[2,{boundaries},4,0,{{}}]")) {
         if boundaries > 0 {
             match streaming
                 .output
@@ -393,40 +387,46 @@ fn render_state_updates(
         Ok(response) => response,
         Err(error) => panic!("starting streaming response failed: {error}"),
     };
-    let boundary = match response.boundary("boundary-0") {
-        Ok(boundary) => boundary,
-        Err(error) => panic!("resolving benchmark boundary failed: {error}"),
+    let first = match response.start(state) {
+        Ok(status) => status.boundary,
+        Err(error) => panic!("writing benchmark shell failed: {error}"),
+    };
+    let Some(first) = first else {
+        panic!("benchmark response did not discover its first boundary");
+    };
+    let second = match response.resume(first.instance_id, state, BoundaryMode::Updatable) {
+        Ok(status) => status.boundary,
+        Err(error) => panic!("writing benchmark boundary failed: {error}"),
+    };
+    let Some(second) = second else {
+        panic!("benchmark response completed before state updates");
     };
-    if let Err(error) = response.write_shell(state) {
-        panic!("writing benchmark shell failed: {error}");
-    }
-    if let Err(error) = response.write_boundary(boundary, state, BoundaryMode::Updatable) {
-        panic!("writing benchmark boundary failed: {error}");
-    }
     for _ in 0..updates {
-        if let Err(error) = response.update(boundary, state) {
+        if let Err(error) = response.update(first.instance_id, state) {
             panic!("writing benchmark state update failed: {error}");
         }
     }
-    if let Err(error) = response.finish(state) {
-        panic!("finishing benchmark response failed: {error}");
+    match response.resume(second.instance_id, state, BoundaryMode::Final) {
+        Ok(status) if status.done => {}
+        Ok(_) => panic!("benchmark response did not complete"),
+        Err(error) => panic!("finishing benchmark response failed: {error}"),
     }
 }
 
 fn verify_state_updates(updates: usize) -> (Protocol, usize, usize) {
-    let protocol = parser_protocol(1);
+    let protocol = parser_protocol(2);
     let handler = hydration_handler();
     let state = benchmark_state();
-    let mut writer = BenchWriter::new(updates + 3);
+    let mut writer = BenchWriter::new(updates + 4);
     render_state_updates(&handler, &protocol, &state, updates, &mut writer);
 
     assert_eq!(
         writer.flushes.len(),
-        updates + 3,
-        "shell, checkpoint, updates, and terminal must flush independently",
+        updates + 4,
+        "shell prefix, two checkpoints, every update, and the terminal flush independently",
     );
     assert_eq!(
-        occurrences(&writer.output, ",2,0,"),
+        occurrences(&writer.output, ",2,0,{"),
         updates,
         "each update needs one typed state-update record",
     );
diff --git a/crates/webui-handler/src/css_module.rs b/crates/webui-handler/src/css_module.rs
index a39bfd8c3..67605a79f 100644
--- a/crates/webui-handler/src/css_module.rs
+++ b/crates/webui-handler/src/css_module.rs
@@ -41,12 +41,46 @@ pub fn build_importmap_tag(specifier: &str, css: &str, nonce: Option<&str>) -> S
         out.push_str(n);
         out.push('"');
     }
+
     out.push('>');
     out.push_str(&body);
     out.push_str("</script>");
     out
 }
 
+/// Build one import map containing every supplied CSS module.
+///
+/// Streaming checkpoints use one element so the payload script remains within
+/// the browser coordinator's bounded sentinel lookback even when several
+/// reachable-but-not-yet-rendered components first become available together.
+pub(crate) fn build_importmap_tag_batch(
+    modules: &[(&str, &str)],
+    nonce: Option<&str>,
+) -> Option<String> {
+    if modules.is_empty() {
+        return None;
+    }
+    let mut imports = serde_json::Map::with_capacity(modules.len());
+    for &(specifier, css) in modules {
+        imports.insert(specifier.to_owned(), Value::String(build_data_uri(css)));
+    }
+    let mut root = serde_json::Map::with_capacity(1);
+    root.insert("imports".into(), Value::Object(imports));
+    let body = Value::Object(root).to_string();
+    let cap = 40 + body.len() + nonce.map_or(0, |value| value.len() + 9);
+    let mut out = String::with_capacity(cap);
+    out.push_str("<script type=\"importmap\"");
+    if let Some(value) = nonce {
+        out.push_str(" nonce=\"");
+        out.push_str(value);
+        out.push('"');
+    }
+    out.push('>');
+    out.push_str(&body);
+    out.push_str("</script>");
+    Some(out)
+}
+
 fn build_data_uri(css: &str) -> String {
     let mut out = String::with_capacity("data:text/css,".len() + css.len());
     out.push_str("data:text/css,");
@@ -127,6 +161,16 @@ mod tests {
         assert!(tag.contains(r#""empty":"data:text/css,""#));
     }
 
+    #[test]
+    fn batch_importmap_uses_one_script_for_multiple_modules() {
+        let modules = [("a-card", "a{}"), ("b-card", "b{}")];
+        let tag = build_importmap_tag_batch(&modules, Some("nonce")).unwrap();
+        assert_eq!(tag.matches("<script").count(), 1);
+        assert!(tag.contains(r#""a-card":"data:text/css,a{}""#));
+        assert!(tag.contains(r#""b-card":"data:text/css,b{}""#));
+        assert!(tag.contains(r#"nonce="nonce""#));
+    }
+
     #[test]
     fn json_layer_escapes_backslash_in_css() {
         // CSS escapes like `\E000` survive the percent encoder (the bytes
diff --git a/crates/webui-handler/src/lib.rs b/crates/webui-handler/src/lib.rs
index f046b82d8..eec8a3a88 100644
--- a/crates/webui-handler/src/lib.rs
+++ b/crates/webui-handler/src/lib.rs
@@ -43,7 +43,10 @@ use streaming::{
     StreamingRenderState,
 };
 pub use streaming::{
-    BoundaryId, BoundaryMode, BufferSink, SessionOptions, StreamingResponse, StreamingSession,
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, BufferSink, SessionOptions,
+    SpanInstanceId, StreamStatus, StreamStep, StreamingResponse, StreamingSession,
+    MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH, MAX_KEYED_INSTANCES, MAX_OPEN_SPANS,
+    MAX_SPAN_NESTING,
 };
 use thiserror::Error;
 use webui_expressions::{evaluate_with_resolver, ExpressionError};
@@ -187,6 +190,33 @@ pub trait ResponseWriter {
     fn stream_flush(&mut self) -> Result<()> {
         Ok(())
     }
+
+    #[doc(hidden)]
+    fn stream_begin_component(&mut self) -> Result<()> {
+        Err(HandlerError::Invariant(
+            "component opening buffering requires a streaming sink".to_string(),
+        ))
+    }
+
+    #[doc(hidden)]
+    fn stream_mark_component_root(&mut self) -> Result<()> {
+        Err(HandlerError::Invariant(
+            "component root buffering requires a streaming sink".to_string(),
+        ))
+    }
+
+    #[doc(hidden)]
+    fn stream_commit_component(
+        &mut self,
+        span_id: Option<u32>,
+        enclosing_span_id: Option<u32>,
+        deferred: bool,
+    ) -> Result<()> {
+        let _ = (span_id, enclosing_span_id, deferred);
+        Err(HandlerError::Invariant(
+            "component opening commit requires a streaming sink".to_string(),
+        ))
+    }
 }
 
 /// A response writer that can hand buffered bytes to its transport immediately.
@@ -548,6 +578,8 @@ fn recycle_scope_map(pool: &mut Vec<HashMap<String, Value>>, mut map: HashMap<St
 }
 
 pub(crate) struct WebUiBootstrap<'a> {
+    pub(crate) declaration_id: Option<u32>,
+    pub(crate) enclosing_span_instance_id: Option<u32>,
     pub(crate) state: &'a Value,
     pub(crate) state_selection: StateSelection<'a>,
     pub(crate) chain: &'a [Value],
@@ -935,6 +967,24 @@ pub(crate) fn write_webui_bootstrap(
     let mut wrote_field = false;
 
     writer.write("{")?;
+    if let Some(declaration_id) = bootstrap.declaration_id {
+        write_json_field(
+            writer,
+            scratch,
+            &mut wrote_field,
+            "declarationId",
+            &declaration_id,
+        )?;
+    }
+    if let Some(span_id) = bootstrap.enclosing_span_instance_id {
+        write_json_field(
+            writer,
+            scratch,
+            &mut wrote_field,
+            "enclosingSpanInstanceId",
+            &span_id,
+        )?;
+    }
     if !bootstrap.chain.is_empty() {
         write_json_field(writer, scratch, &mut wrote_field, "chain", bootstrap.chain)?;
     }
@@ -1192,6 +1242,7 @@ impl WebUIHandler {
                 Some(Fragment::Outlet(_)) => {
                     self.process_outlet(context)?;
                 }
+                Some(Fragment::Boundary(_)) => {}
                 None => {}
             }
         }
@@ -1274,6 +1325,10 @@ impl WebUIHandler {
                 write_usize(context.writer, ri)?;
                 context.writer.write("\" active>")?;
 
+                if !matched_child.content_fragment_id.is_empty() {
+                    self.process_fragment_id(&matched_child.content_fragment_id, context)?;
+                }
+
                 context.writer.write("<")?;
                 context.writer.write(comp)?;
                 if let Some(p) = &context.plugin {
@@ -1415,18 +1470,21 @@ impl WebUIHandler {
             write_usize(context.writer, ri)?;
             context.writer.write("\" active>")?;
 
-            if !route_frag.fragment_id.is_empty() {
-                let saved_route_base = context.route_base.clone();
-                let saved_route_children = std::mem::take(&mut context.route_children);
-                if let Some((_, ref rm)) = best_route {
-                    context.route_base = Cow::Owned(route_matcher::compute_route_base(
-                        context.request_path,
-                        rm.consumed_segments,
-                    ));
-                }
+            let saved_route_base = context.route_base.clone();
+            let saved_route_children = std::mem::take(&mut context.route_children);
+            if let Some((_, ref rm)) = best_route {
+                context.route_base = Cow::Owned(route_matcher::compute_route_base(
+                    context.request_path,
+                    rm.consumed_segments,
+                ));
+            }
+            context.route_children = route_frag.children.clone();
 
-                context.route_children = route_frag.children.clone();
+            if !route_frag.content_fragment_id.is_empty() {
+                self.process_fragment_id(&route_frag.content_fragment_id, context)?;
+            }
 
+            if !route_frag.fragment_id.is_empty() {
                 let comp = webui_protocol::WebUIFragmentComponent {
                     fragment_id: route_frag.fragment_id.clone(),
                 };
@@ -1444,10 +1502,9 @@ impl WebUIHandler {
                 context.writer.write("</")?;
                 context.writer.write(&route_frag.fragment_id)?;
                 context.writer.write(">")?;
-
-                context.route_base = saved_route_base;
-                context.route_children = saved_route_children;
             }
+            context.route_base = saved_route_base;
+            context.route_children = saved_route_children;
         } else {
             context.writer.write(" style=\"display:none\">")?;
         }
@@ -1899,6 +1956,8 @@ impl WebUIHandler {
                     context.writer,
                     &mut context.json_scratch,
                     WebUiBootstrap {
+                        declaration_id: None,
+                        enclosing_span_instance_id: None,
                         state: context.state,
                         state_selection,
                         chain: &chain_json,
@@ -2240,10 +2299,8 @@ fn handle(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::streaming::STREAMING_MARKER;
     use std::cell::RefCell;
-    use std::sync::Arc;
-    use webui_parser::{ComponentRegistration, DomStrategy, HtmlParser};
+    use webui_parser::HtmlParser;
     use webui_protocol::{
         web_ui_fragment, ComparisonOperator, ConditionExpr, FragmentList, LogicalOperator,
         WebUIFragmentAttribute,
@@ -2300,6 +2357,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("Hello, WebUI!")],
+                contains_boundary: false,
             },
         );
 
@@ -2338,6 +2396,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("!"),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2375,6 +2434,7 @@ mod tests {
                     WebUIFragment::raw("People: "),
                     WebUIFragment::for_loop("person", "people", "person-item"),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2385,6 +2445,7 @@ mod tests {
                     WebUIFragment::signal("person.name", false),
                     WebUIFragment::raw(", "),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2432,6 +2493,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("End"),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2439,6 +2501,7 @@ mod tests {
             "active-content".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("Active")],
+                contains_boundary: false,
             },
         );
 
@@ -2518,6 +2581,7 @@ mod tests {
                     WebUIFragment::raw("Component: "),
                     WebUIFragment::component("my-component"),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2525,6 +2589,7 @@ mod tests {
             "my-component".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Component Content</div>")],
+                contains_boundary: false,
             },
         );
 
@@ -2562,6 +2627,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("missing-component")],
+                contains_boundary: false,
             },
         );
 
@@ -2600,6 +2666,7 @@ mod tests {
                     WebUIFragment::signal("missing_field", false),
                     WebUIFragment::raw("!"),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -2639,6 +2706,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">Click</button>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2668,6 +2736,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">Click</button>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2697,6 +2766,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2730,6 +2800,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2758,6 +2829,7 @@ mod tests {
                     WebUIFragment::attribute("value", "inputValue"),
                     WebUIFragment::raw(">"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2784,6 +2856,7 @@ mod tests {
                     WebUIFragment::attribute("handle", "number"),
                     WebUIFragment::raw("></div>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2815,6 +2888,7 @@ mod tests {
                     WebUIFragment::attribute("href", "value"),
                     WebUIFragment::raw(">demo</a>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2854,6 +2928,7 @@ mod tests {
                     WebUIFragment::attribute("data-cfg", "cfg"),
                     WebUIFragment::raw("></div>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2891,6 +2966,7 @@ mod tests {
                     WebUIFragment::attribute_template("value", "attr-1"),
                     WebUIFragment::raw(">"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -2900,6 +2976,7 @@ mod tests {
                     WebUIFragment::raw("hello "),
                     WebUIFragment::signal("item", false),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2927,6 +3004,7 @@ mod tests {
                     WebUIFragment::signal("html", false),
                     WebUIFragment::signal("html", true),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2958,6 +3036,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outer"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -2968,12 +3047,14 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "inner"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "inner".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>Inner</span>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3008,6 +3089,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3018,6 +3100,7 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3028,6 +3111,7 @@ mod tests {
                     WebUIFragment::signal("innerItem.name", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3062,6 +3146,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3073,6 +3158,7 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3084,6 +3170,7 @@ mod tests {
                     WebUIFragment::signal("globalInner", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3118,6 +3205,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "item-tpl")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3127,12 +3215,14 @@ mod tests {
                     ConditionExpr::identifier("item.visible"),
                     "visible-tpl",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "visible-tpl".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("item.name", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3155,6 +3245,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "item-tpl")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3164,12 +3255,14 @@ mod tests {
                     ConditionExpr::identifier("item.flag"),
                     "show-tpl",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "show-tpl".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("yes")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3211,6 +3304,8 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::raw("</my-comp>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3221,6 +3316,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3261,6 +3357,8 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::raw("</my-comp>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3270,6 +3368,7 @@ mod tests {
                     WebUIFragment::raw("hello "),
                     WebUIFragment::signal("item", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3280,6 +3379,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3320,6 +3420,8 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::raw("</my-comp>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3329,6 +3431,7 @@ mod tests {
                     WebUIFragment::raw("prefix "),
                     WebUIFragment::signal("item", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3339,6 +3442,7 @@ mod tests {
                     WebUIFragment::signal("dataTitle", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3380,6 +3484,8 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::raw("</my-comp>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3392,6 +3498,7 @@ mod tests {
                     WebUIFragment::signal("item.bar", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3432,6 +3539,8 @@ mod tests {
                     WebUIFragment::component("parent"),
                     WebUIFragment::raw("</parent>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3456,9 +3565,17 @@ mod tests {
                     WebUIFragment::raw("Label</child>After: "),
                     WebUIFragment::signal("var", false),
                 ],
+
+                contains_boundary: false,
+            },
+        );
+        fragments.insert(
+            "child".to_string(),
+            FragmentList {
+                fragments: vec![],
+                contains_boundary: false,
             },
         );
-        fragments.insert("child".to_string(), FragmentList { fragments: vec![] });
         let protocol = WebUIProtocol::new(fragments);
         let state = test_json!({"var": "original"});
         let mut writer = TestWriter::new();
@@ -3497,6 +3614,8 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::raw("</my-comp>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3506,12 +3625,14 @@ mod tests {
                     ConditionExpr::identifier("disabled"),
                     "show",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "show".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("disabled!")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3539,6 +3660,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("v", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3656,6 +3778,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3684,6 +3807,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3712,6 +3836,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3741,6 +3866,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3773,6 +3899,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3801,6 +3928,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3829,6 +3957,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3857,6 +3986,7 @@ mod tests {
                         ),
                         WebUIFragment::raw(">"),
                     ],
+                    contains_boundary: false,
                 },
             );
             let protocol = WebUIProtocol::new(fragments);
@@ -3887,6 +4017,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">Click</button>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3916,6 +4047,7 @@ mod tests {
                     ),
                     WebUIFragment::raw(">Click</button>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -3955,6 +4087,8 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3964,6 +4098,7 @@ mod tests {
                     WebUIFragment::raw("Hello "),
                     WebUIFragment::signal("who", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3985,6 +4120,8 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3994,6 +4131,7 @@ mod tests {
                     WebUIFragment::raw("Child of "),
                     WebUIFragment::signal("title", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4004,6 +4142,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4044,12 +4183,15 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "p-title".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("P:"), WebUIFragment::signal("p", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4071,6 +4213,8 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4082,6 +4226,7 @@ mod tests {
                     WebUIFragment::raw(")-"),
                     WebUIFragment::signal("cExtra", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4103,6 +4248,8 @@ mod tests {
                     WebUIFragment::component("grandchild-component"),
                     WebUIFragment::raw("</grandchild-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4113,6 +4260,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4153,6 +4301,8 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4162,12 +4312,14 @@ mod tests {
                     WebUIFragment::raw("Parent:"),
                     WebUIFragment::signal("who", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "parent-component".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "child-loop")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4189,6 +4341,8 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4200,6 +4354,7 @@ mod tests {
                     WebUIFragment::raw(" / "),
                     WebUIFragment::signal("title", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4210,6 +4365,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4270,24 +4426,29 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "attr-title".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("T:"), WebUIFragment::signal("t", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "attr-data-title".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("D:"), WebUIFragment::signal("d", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "attr-aria-label".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("A:"), WebUIFragment::signal("a", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4302,6 +4463,7 @@ mod tests {
                     WebUIFragment::signal("ariaLabel", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4343,6 +4505,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4353,6 +4517,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4378,6 +4543,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "loop")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4400,6 +4566,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4410,6 +4578,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4461,6 +4630,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4475,12 +4646,14 @@ mod tests {
                     WebUIFragment::signal("label", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "disabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Disabled</div>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4522,6 +4695,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4532,6 +4707,7 @@ mod tests {
                     WebUIFragment::signal("keyHyphen", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4631,6 +4807,8 @@ mod tests {
                     WebUIFragment::component("test-component"),
                     WebUIFragment::raw("</test-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4651,6 +4829,7 @@ mod tests {
                     WebUIFragment::signal("ariaLabel", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4704,6 +4883,8 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4727,6 +4908,8 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4737,6 +4920,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</h2>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4778,6 +4962,8 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4800,6 +4986,8 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4821,6 +5009,8 @@ mod tests {
                     WebUIFragment::component("grandchild-component"),
                     WebUIFragment::raw("</grandchild-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4831,6 +5021,7 @@ mod tests {
                     WebUIFragment::signal("title", false),
                     WebUIFragment::raw("</h3>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4872,6 +5063,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4884,6 +5077,7 @@ mod tests {
                     WebUIFragment::signal("item.bar", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4913,6 +5107,7 @@ mod tests {
                     "list.items",
                     "listTemplate",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4932,6 +5127,8 @@ mod tests {
                     },
                     WebUIFragment::component("item_component"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4942,6 +5139,7 @@ mod tests {
                     WebUIFragment::signal("item.name", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4968,6 +5166,7 @@ mod tests {
                     "data.outer",
                     "outerTemplate",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4978,6 +5177,7 @@ mod tests {
                     "outer.middle",
                     "middleTemplate",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -4988,6 +5188,7 @@ mod tests {
                     "middle.inner",
                     "innerTemplate",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5032,6 +5233,8 @@ mod tests {
                     WebUIFragment::component("card_component"),
                     WebUIFragment::raw("</card>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5046,6 +5249,7 @@ mod tests {
                     WebUIFragment::signal("inner.label", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5091,6 +5295,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5106,18 +5312,21 @@ mod tests {
                         "enabledTemplate",
                     ),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "disabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>Disabled</span>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "enabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>Enabled</span>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5158,6 +5367,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5173,18 +5384,21 @@ mod tests {
                         "enabledTemplate",
                     ),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "disabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>Disabled</span>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "enabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>Enabled</span>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5225,6 +5439,8 @@ mod tests {
                     WebUIFragment::component("parent-component"),
                     WebUIFragment::raw("</parent-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5250,12 +5466,15 @@ mod tests {
                     WebUIFragment::component("child-component"),
                     WebUIFragment::raw("</child-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "parentDisabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Parent Disabled</div>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5271,18 +5490,21 @@ mod tests {
                         "childEnabledTemplate",
                     ),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "childDisabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Child Disabled</div>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "childEnabledTemplate".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Child Enabled</div>")],
+                contains_boundary: false,
             },
         );
 
@@ -5340,12 +5562,14 @@ mod tests {
                     WebUIFragment::component("custom-element"),
                     WebUIFragment::raw("</custom-element>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "custom-element".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Custom Element</div>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5376,12 +5600,14 @@ mod tests {
                     WebUIFragment::component("custom-element"),
                     WebUIFragment::raw("Hello World</custom-element>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "custom-element".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<slot></slot>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5412,12 +5638,14 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "templateRepeat"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "custom-button".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<slot></slot>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5428,12 +5656,14 @@ mod tests {
                     WebUIFragment::component("custom-child"),
                     WebUIFragment::raw("</custom-child><slot></slot>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "custom-child".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>Hello World!</h1>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5446,6 +5676,7 @@ mod tests {
                     WebUIFragment::component("custom-button"),
                     WebUIFragment::raw("Ok</custom-button></custom-element>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5481,12 +5712,14 @@ mod tests {
                     ),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-1".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>If 1</span>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5527,6 +5760,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "template1"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5537,6 +5771,7 @@ mod tests {
                     WebUIFragment::if_cond(ConditionExpr::identifier("item.flag"), "ifBlock"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5547,6 +5782,7 @@ mod tests {
                     WebUIFragment::signal("item.label", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5583,6 +5819,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "template1"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5593,6 +5830,7 @@ mod tests {
                     WebUIFragment::if_cond(ConditionExpr::identifier("item.flag"), "ifBlock"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5603,6 +5841,7 @@ mod tests {
                     WebUIFragment::signal("item.label", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5637,6 +5876,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "static")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5653,6 +5893,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "item.children", "static"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5694,6 +5935,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "templateComponent"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5704,6 +5946,7 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</component-tag>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5714,6 +5957,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5743,6 +5987,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5755,6 +6000,7 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5768,6 +6014,7 @@ mod tests {
                     WebUIFragment::signal("innerItem.innerLabel", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5803,6 +6050,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "templateComponent"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5813,6 +6061,7 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</component-tag>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5825,6 +6074,7 @@ mod tests {
                     WebUIFragment::signal("globalSuffix", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5855,6 +6105,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "templateComponent"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5865,6 +6116,7 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</component-tag>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5877,6 +6129,7 @@ mod tests {
                     WebUIFragment::signal("globalSuffix", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5907,6 +6160,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "template1"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5917,6 +6171,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -5946,6 +6201,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5961,6 +6217,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5971,6 +6228,7 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -5983,6 +6241,7 @@ mod tests {
                     WebUIFragment::signal("innerItem.innerLabel", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6020,6 +6279,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6036,6 +6296,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6049,6 +6310,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6059,6 +6321,7 @@ mod tests {
                     WebUIFragment::signal("middleItem.value", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6095,6 +6358,7 @@ mod tests {
                     WebUIFragment::for_loop("outerItem", "outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6106,6 +6370,7 @@ mod tests {
                     WebUIFragment::for_loop("innerItem", "outerItem.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6119,6 +6384,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</article>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6129,6 +6395,7 @@ mod tests {
                     WebUIFragment::signal("innerItem.detail", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6163,6 +6430,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "template1"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6179,6 +6447,7 @@ mod tests {
                     WebUIFragment::signal("item.otherVal", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6214,6 +6483,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "templateComponent"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6224,6 +6494,7 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</component-tag>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6240,6 +6511,7 @@ mod tests {
                     WebUIFragment::signal("item.otherVal", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6275,6 +6547,7 @@ mod tests {
                     WebUIFragment::for_loop("outer", "list.outer_items", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6285,6 +6558,7 @@ mod tests {
                     WebUIFragment::for_loop("inner_item", "outer.inner_items", "innerTemplate"),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6294,6 +6568,7 @@ mod tests {
                     ConditionExpr::identifier("inner_item.flag"),
                     "ifInner",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6304,6 +6579,7 @@ mod tests {
                     WebUIFragment::signal("inner_item.value", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6336,6 +6612,7 @@ mod tests {
                     WebUIFragment::for_loop("outer", "list.outer_items", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6346,6 +6623,7 @@ mod tests {
                     WebUIFragment::for_loop("inner_item", "outer.inner_items", "innerTemplate"),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6355,6 +6633,7 @@ mod tests {
                     ConditionExpr::identifier("inner_item.flag"),
                     "ifInner",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6365,6 +6644,7 @@ mod tests {
                     WebUIFragment::signal("inner_item.value", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6397,6 +6677,7 @@ mod tests {
                     WebUIFragment::for_loop("outer", "list.outerItems", "outerTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6408,6 +6689,7 @@ mod tests {
                     WebUIFragment::for_loop("inner", "outer.innerItems", "innerTemplate"),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6425,6 +6707,7 @@ mod tests {
                     ),
                     "ifInner",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -6435,6 +6718,7 @@ mod tests {
                     WebUIFragment::signal("inner.value", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -6488,6 +6772,8 @@ mod tests {
                         ..Default::default()
                     }),
                 ],
+
+                contains_boundary: false,
             },
         );
 
@@ -6496,6 +6782,7 @@ mod tests {
             "dash-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Dashboard</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -6504,6 +6791,7 @@ mod tests {
             "detail-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Detail</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -6540,6 +6828,8 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
 
@@ -6550,6 +6840,7 @@ mod tests {
                     WebUIFragment::raw("<h1>Shell</h1>"),
                     WebUIFragment::outlet(),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -6560,6 +6851,7 @@ mod tests {
                     WebUIFragment::raw("<h2>Section</h2>"),
                     WebUIFragment::outlet(),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -6567,6 +6859,7 @@ mod tests {
             "topic-comp".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Topic content</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -6989,12 +7282,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(template.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7054,12 +7349,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(r#"<p>hello</p>"#.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7099,12 +7396,14 @@ mod tests {
                     WebUIFragment::component("my-card"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(template.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7150,6 +7449,7 @@ mod tests {
                     WebUIFragment::component("my-card"),
                     WebUIFragment::raw("</my-card></body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -7159,7 +7459,8 @@ mod tests {
                     "<template shadowrootmode=\"open\"><style>.card{color:red}</style><div>card</div></template>"
                         .to_string(),
                 )],
-            },
+                        contains_boundary: false,
+},
         );
 
         let protocol = WebUIProtocol::new(fragments);
@@ -7207,12 +7508,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>card</div>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7280,18 +7583,21 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "o-loading-state".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>loading</div>".to_string())],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>card</div>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7367,6 +7673,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
 
@@ -7407,6 +7714,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -7448,18 +7756,21 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "z-widget".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>z</div>".to_string())],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "a-widget".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>a</div>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7527,12 +7838,14 @@ mod tests {
                     WebUIFragment::raw("</my-card>".to_string()),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(r#"<p>hi</p>"#.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7591,12 +7904,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "dash-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(template.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7647,18 +7962,21 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "has-css".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>styled</p>".to_string())],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "no-css".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>plain</p>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7721,6 +8039,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         // app-shell contains a cart panel
@@ -7731,6 +8050,7 @@ mod tests {
                     WebUIFragment::raw("<div>Shell</div>".to_string()),
                     WebUIFragment::component("cart-panel"),
                 ],
+                contains_boundary: false,
             },
         );
         // cart-panel has an <if> block containing product-card
@@ -7742,6 +8062,7 @@ mod tests {
                     WebUIFragment::if_cond(ConditionExpr::identifier("hasItems"), "cart-items"),
                     WebUIFragment::raw("</aside>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         // cart-items (if block body) contains product-card
@@ -7749,12 +8070,14 @@ mod tests {
             "cart-items".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("product-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "product-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Card</div>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -7882,6 +8205,7 @@ mod tests {
                     structural_fragment("body_start"),
                     WebUIFragment::raw("<main>Body-only host</main></body>".to_string()),
                 ],
+                contains_boundary: false,
             },
         )]);
         let mut protocol = WebUIProtocol::new(fragments);
@@ -7917,6 +8241,7 @@ mod tests {
                     structural_fragment("head_end"),
                     WebUIFragment::raw("</head>".to_string()),
                 ],
+                contains_boundary: false,
             },
         )]);
         let mut protocol = WebUIProtocol::new(fragments);
@@ -7953,6 +8278,7 @@ mod tests {
                     structural_fragment("head_end"),
                     WebUIFragment::raw("</head><body></body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         )]);
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8020,12 +8346,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "dash-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw(template.to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -8076,6 +8404,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -8085,18 +8414,21 @@ mod tests {
                     ConditionExpr::identifier("hasItems"),
                     "cart-items",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "cart-items".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("product-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "product-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Card</div>".to_string())],
+                contains_boundary: false,
             },
         );
 
@@ -8147,12 +8479,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>shell</span>".to_string())],
+                contains_boundary: false,
             },
         );
         let index_fragments = fragments
@@ -8212,6 +8546,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -8247,12 +8582,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Shell</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8296,12 +8633,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Shell</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8338,12 +8677,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Shell</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8419,6 +8760,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8456,12 +8798,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "items-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Items</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -8646,18 +8990,22 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "home-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Home</p>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "admin-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Admin</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -8779,6 +9127,8 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
 
@@ -8786,18 +9136,21 @@ mod tests {
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>App</h1>"), WebUIFragment::outlet()],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "compose-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Compose</p>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "settings-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Settings</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -8896,6 +9249,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         WebUIProtocol::new(fragments)
@@ -8984,6 +9338,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         WebUIProtocol::new(fragments)
@@ -9147,12 +9502,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Shell</p>")],
+                contains_boundary: false,
             },
         );
         let mut document = WebUIProtocol::new(fragments);
@@ -9258,6 +9615,7 @@ mod tests {
                     structural_fragment("body_start"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -9341,6 +9699,7 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -9415,6 +9774,7 @@ mod tests {
                     structural_fragment("body_end"), // duplicate
                     WebUIFragment::raw("</body></html>".to_string()),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -9449,6 +9809,7 @@ mod tests {
                 fragments: vec![WebUIFragment::raw(
                     "<my-component>hi</my-component>".to_string(),
                 )],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -9650,6 +10011,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "outer", "outer_body"),
                     WebUIFragment::raw("]"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -9663,6 +10025,7 @@ mod tests {
                     WebUIFragment::signal("item.tag", false),
                     WebUIFragment::raw(")"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -9673,6 +10036,7 @@ mod tests {
                     WebUIFragment::signal("item.tag", false),
                     WebUIFragment::raw("]"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -9705,2060 +10069,4 @@ mod tests {
             "outer `item` must stay bound to its iteration value across the inner loop's save/restore"
         );
     }
-
-    #[derive(Default)]
-    struct FlushTestWriter {
-        output: String,
-        flushes: Vec<usize>,
-        fail_flush: bool,
-        fail_flush_at: Option<usize>,
-        flush_attempts: usize,
-        ended: bool,
-    }
-
-    impl ResponseWriter for FlushTestWriter {
-        fn write(&mut self, content: &str) -> Result<()> {
-            self.output.push_str(content);
-            Ok(())
-        }
-
-        fn end(&mut self) -> Result<()> {
-            self.ended = true;
-            Ok(())
-        }
-    }
-
-    impl FlushWriter for FlushTestWriter {
-        fn flush(&mut self) -> Result<()> {
-            let attempt = self.flush_attempts;
-            self.flush_attempts += 1;
-            if self.fail_flush || self.fail_flush_at == Some(attempt) {
-                return Err(HandlerError::ClientDisconnected);
-            }
-            self.flushes.push(self.output.len());
-            Ok(())
-        }
-    }
-
-    fn streaming_protocol(with_boundaries: bool) -> Protocol {
-        streaming_protocol_with_state_strategy(with_boundaries, InitialStateStrategy::Components)
-    }
-
-    fn streaming_protocol_with_state_strategy(
-        with_boundaries: bool,
-        state_strategy: InitialStateStrategy,
-    ) -> Protocol {
-        let mut fragments = HashMap::new();
-        let mut entry = vec![
-            WebUIFragment::raw("<!DOCTYPE html><html><HEAD data-shell=\"main\">"),
-            structural_fragment("head_start"),
-            WebUIFragment::raw("<script type=\"module\" async src=\"/index.js\"></script>"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</HEAD><body>"),
-            structural_fragment("body_start"),
-        ];
-        if with_boundaries {
-            entry.push(structural_fragment("boundary_start:0"));
-        }
-        entry.extend([
-            WebUIFragment::raw("<my-counter"),
-            structural_fragment("streaming_root:my-counter"),
-            WebUIFragment::raw(">"),
-            WebUIFragment::component("my-counter"),
-            WebUIFragment::raw("</my-counter>"),
-        ]);
-        if with_boundaries {
-            entry.push(structural_fragment("boundary_end:0"));
-        }
-        entry.extend([
-            WebUIFragment::raw("<app-footer>slow tail</app-footer>"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ]);
-        fragments.insert("index.html".to_string(), FragmentList { fragments: entry });
-        fragments.insert(
-            "my-counter".to_string(),
-            FragmentList {
-                fragments: vec![WebUIFragment::raw("<button>Count</button>")],
-            },
-        );
-
-        let mut document = WebUIProtocol::new(fragments);
-        document.initial_state_strategy = state_strategy as i32;
-        document.components.insert(
-            "my-counter".to_string(),
-            webui_protocol::ComponentData {
-                template_json: r#"{"h":"<button>Count</button>","th":1}"#.to_string(),
-                template_functions: "[function(){return true}]".to_string(),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["count".to_string()],
-                ..Default::default()
-            },
-        );
-        Protocol::new(document)
-    }
-
-    #[test]
-    fn handler_error_stays_small() {
-        // Boxing the cold `StreamingBoundary` payload keeps `HandlerError` — and
-        // therefore `Result<(), HandlerError>` threaded through the hot legacy
-        // render path — down to a single `String`-sized payload plus a
-        // discriminant word. If the boundary payload is un-boxed back to
-        // `{ signal, reason }` it grows to two `String`s (48-byte payload) and
-        // this fails.
-        assert!(
-            std::mem::size_of::<HandlerError>()
-                <= std::mem::size_of::<String>() + std::mem::size_of::<usize>(),
-            "HandlerError grew to {} bytes",
-            std::mem::size_of::<HandlerError>()
-        );
-    }
-
-    #[test]
-    fn streaming_render_flushes_bootstrap_before_slow_tail_and_emits_terminal() {
-        let protocol = streaming_protocol(true);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let state = test_json!({ "count": 1, "serverOnly": "secret" });
-        let mut writer = FlushTestWriter::default();
-
-        handler
-            .render_streaming(
-                &protocol,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-
-        assert!(writer.ended);
-        assert_eq!(
-            writer.flushes.len(),
-            2,
-            "boundary commit plus one coalesced terminal-tail flush"
-        );
-        let first_flush = &writer.output[..writer.flushes[0]];
-        assert!(first_flush.contains("<!--wb:0-->"));
-        assert!(first_flush.contains("<!--/wb:0-->"));
-        assert!(first_flush.contains(r#"[1,0,0,0,{"inventory":"01","state":{"count":1}"#));
-        assert!(first_flush.contains(r#""templates":{"my-counter":"#));
-        assert!(!first_flush.contains("slow tail"));
-        assert!(!writer.output.contains("id=\"webui-data\""));
-        // The terminal flush commits the scriptless tail without manufacturing
-        // another state/template projection.
-        assert!(writer.output.contains("[1,1,3,0,{}]"));
-        assert!(!writer.output.contains("[1,1,0,1,"));
-        assert!(!writer.output.contains("[1,2,3,0,{}]"));
-
-        let marker = writer
-            .output
-            .find(STREAMING_MARKER)
-            .expect("streaming marker");
-        let attributed_head = writer
-            .output
-            .find("<HEAD data-shell=\"main\">")
-            .expect("attributed mixed-case head");
-        let authored_script = writer
-            .output
-            .find("src=\"/index.js\"")
-            .expect("entry script");
-        assert!(attributed_head < marker && marker < authored_script);
-    }
-
-    #[test]
-    fn streaming_terminal_tail_never_resends_full_state() {
-        let protocol = streaming_protocol_with_state_strategy(true, InitialStateStrategy::Full);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({ "count": 1, "serverOnly": "secret" }),
-                &RenderOptions::new("index.html", "/").with_body_inject(" \n"),
-                &mut writer,
-            )
-            .unwrap();
-
-        assert_eq!(
-            writer.output.matches("serverOnly").count(),
-            1,
-            "full state belongs only to the interactive boundary"
-        );
-        assert!(writer.output.contains("[1,1,3,0,{}]"));
-    }
-
-    /// Streaming must place the reserved-state injects exactly where the
-    /// ordinary render does, so a host can switch modes without its
-    /// boundary HTML moving.
-    #[test]
-    fn state_inject_placement_matches_between_render_modes() {
-        let entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            WebUIFragment::raw("<main>static</main>"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ];
-        let fragments =
-            HashMap::from([("index.html".to_string(), FragmentList { fragments: entry })]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let state = test_json!({
-            "$webui": {
-                "headEnd": "<meta name=he>",
-                "bodyStart": "<span id=bs></span>",
-                "bodyEnd": "<script>be</script>",
-            }
-        });
-        let options = RenderOptions::new("index.html", "/");
-
-        let mut ordinary = TestWriter::new();
-        WebUIHandler::new()
-            .render(&protocol, &state, &options, &mut ordinary)
-            .unwrap();
-        let ordinary_html = ordinary.get_content().to_string();
-
-        let mut streamed = FlushTestWriter::default();
-        WebUIHandler::new()
-            .render_streaming(&protocol, &state, &options, &mut streamed)
-            .unwrap();
-        let streamed_html = &streamed.output;
-
-        for html in [ordinary_html.as_str(), streamed_html.as_str()] {
-            let head_end = html.find("<meta name=he>").expect("headEnd missing");
-            let head_close = html.find("</head>").expect("</head> missing");
-            let body_start = html.find("<span id=bs></span>").expect("bodyStart missing");
-            let main = html.find("<main>static</main>").expect("content missing");
-            let body_end = html.find("<script>be</script>").expect("bodyEnd missing");
-            let body_close = html.find("</body>").expect("</body> missing");
-            assert!(head_end < head_close, "headEnd misplaced: {html}");
-            assert!(body_start < main, "bodyStart misplaced: {html}");
-            assert!(
-                main < body_end && body_end < body_close,
-                "bodyEnd misplaced: {html}"
-            );
-        }
-
-        // The streaming response still terminates with its single empty
-        // terminal record: an inject must not perturb the record stream.
-        assert!(
-            streamed_html.contains(",3,0,{}]"),
-            "streaming must still end in one empty terminal record: {streamed_html}"
-        );
-    }
-
-    #[test]
-    fn streaming_state_inject_emits_and_strips_reserved_key() {
-        let entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ];
-        let fragments =
-            HashMap::from([("index.html".to_string(), FragmentList { fragments: entry })]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let state = test_json!({ "$webui": { "bodyEnd": "<script>be</script>" } });
-
-        let mut writer = FlushTestWriter::default();
-        WebUIHandler::new()
-            .render_streaming(
-                &protocol,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-        assert!(writer.output.contains("<script>be</script>"));
-        assert!(!writer.output.contains("$webui"));
-    }
-
-    #[test]
-    fn static_streaming_document_uses_one_empty_terminal_record() {
-        let fragments = HashMap::from([(
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw("<html><head>"),
-                    structural_fragment("head_start"),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</head><body>"),
-                    structural_fragment("body_start"),
-                    WebUIFragment::raw("<main>static</main>"),
-                    structural_fragment("body_end"),
-                    WebUIFragment::raw("</body></html>"),
-                ],
-            },
-        )]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut writer = FlushTestWriter::default();
-
-        WebUIHandler::new()
-            .render_streaming(
-                &protocol,
-                &test_json!({ "serverOnly": "secret" }),
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-
-        assert_eq!(writer.flushes.len(), 1);
-        assert!(writer.output.contains(STREAMING_MARKER));
-        assert!(writer.output.contains("[1,0,3,0,{}]"));
-        assert!(!writer.output.contains("serverOnly"));
-        assert!(!writer.output.contains("id=\"webui-data\""));
-        assert!(!writer.output.contains("<!--wb:"));
-    }
-
-    #[test]
-    fn streaming_render_emits_nonce_and_functions_before_sentinel() {
-        let protocol = streaming_protocol(true);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({ "count": 1 }),
-                &RenderOptions::new("index.html", "/").with_nonce("test-nonce-123"),
-                &mut writer,
-            )
-            .unwrap();
-
-        let boundary_end = writer.output.find("<!--/wb:0-->").expect("end marker");
-        let envelope = writer.output[boundary_end..]
-            .find("data-webui-boundary nonce=\"test-nonce-123\"")
-            .map(|index| index + boundary_end)
-            .expect("nonce-bearing envelope");
-        let functions = writer
-            .output
-            .find("templateFns")
-            .expect("function side channel");
-        let sentinel = writer
-            .output
-            .find("<webui-hydrate>")
-            .expect("hydration sentinel");
-        assert!(boundary_end < envelope && envelope < functions && functions < sentinel);
-        assert!(writer.output.contains("<script nonce=\"test-nonce-123\">"));
-    }
-
-    #[test]
-    fn streaming_render_rejects_out_of_order_and_nested_boundaries() {
-        fn protocol(signals: &[&str]) -> Protocol {
-            let mut protocol_signals = Vec::with_capacity(signals.len() + 1);
-            protocol_signals.push(structural_fragment("head_start"));
-            protocol_signals.extend(signals.iter().map(|signal| structural_fragment(*signal)));
-            let fragments = HashMap::from([(
-                "index.html".to_string(),
-                FragmentList {
-                    fragments: protocol_signals,
-                },
-            )]);
-            Protocol::new(WebUIProtocol::new(fragments))
-        }
-
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let result = handler.render_streaming(
-            &protocol(&["boundary_start:1"]),
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-        match result {
-            Err(HandlerError::StreamingBoundary(err)) => {
-                assert_eq!(err.signal, "boundary_start:1");
-                assert!(err.reason.contains("expected boundary sequence 0"));
-            }
-            other => panic!("expected ordered-boundary error, got {other:?}"),
-        }
-
-        let mut writer = FlushTestWriter::default();
-        let result = handler.render_streaming(
-            &protocol(&["boundary_start:0", "boundary_start:1"]),
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-        assert!(matches!(result, Err(HandlerError::StreamingBoundary(_))));
-    }
-
-    #[test]
-    fn streaming_render_propagates_boundary_flush_disconnect() {
-        let protocol = streaming_protocol(true);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter {
-            fail_flush: true,
-            ..FlushTestWriter::default()
-        };
-        let result = handler.render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-        assert!(matches!(result, Err(HandlerError::ClientDisconnected)));
-        assert!(!writer.ended);
-    }
-
-    #[test]
-    fn streaming_render_requires_structural_head_start_before_writing() {
-        let fragments = HashMap::from([(
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw(
-                        "<html><HEAD data-shell=\"main\"><script src=\"/early.js\"></script>",
-                    ),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</HEAD><body>"),
-                    structural_fragment("body_start"),
-                    structural_fragment("body_end"),
-                ],
-            },
-        )]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut writer = FlushTestWriter::default();
-
-        let result = WebUIHandler::new().render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-
-        assert!(matches!(
-            result,
-            Err(HandlerError::MissingStreamingHeadStart { before: "head_end" })
-        ));
-        assert!(
-            writer.output.is_empty(),
-            "preflight must fail before output"
-        );
-        assert!(writer.flushes.is_empty());
-        assert!(!writer.ended);
-    }
-
-    #[test]
-    fn streaming_render_rejects_duplicate_head_start() {
-        let fragments = HashMap::from([(
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw("<html><head>"),
-                    structural_fragment("head_start"),
-                    structural_fragment("head_start"),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</head><body>"),
-                    structural_fragment("body_start"),
-                    structural_fragment("body_end"),
-                ],
-            },
-        )]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut writer = FlushTestWriter::default();
-
-        let result = WebUIHandler::new().render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-
-        assert!(matches!(
-            result,
-            Err(HandlerError::DuplicateStreamingHeadStart)
-        ));
-        assert_eq!(writer.output.matches(STREAMING_MARKER).count(), 1);
-        assert!(writer.flushes.is_empty());
-    }
-
-    #[test]
-    fn legacy_render_is_byte_identical_when_boundary_signals_are_present() {
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let state = test_json!({
-            "count": 1,
-            "head_start": "must not render",
-            "boundary_start:0": "must not render",
-            "boundary_end:0": "must not render",
-        });
-        let mut with_boundaries = TestWriter::new();
-        let mut without_boundaries = TestWriter::new();
-        handler
-            .render(
-                &streaming_protocol(true),
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut with_boundaries,
-            )
-            .unwrap();
-        handler
-            .render(
-                &streaming_protocol(false),
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut without_boundaries,
-            )
-            .unwrap();
-        assert_eq!(
-            with_boundaries.get_content(),
-            without_boundaries.get_content()
-        );
-    }
-
-    #[test]
-    fn parser_head_attributes_preserve_legacy_ordinary_render_bytes() {
-        for source in [
-            r#"<html><head data-theme="dark"><title>T</title></head><body>x</body></html>"#,
-            r#"<html><head data-theme="{{theme}}"><title>T</title></head><body>x</body></html>"#,
-        ] {
-            let mut parser = HtmlParser::new();
-            parser
-                .parse("index.html", source)
-                .expect("parse head fixture");
-            let protocol = Protocol::new(WebUIProtocol::new(parser.into_fragment_records()));
-            let mut writer = TestWriter::new();
-            WebUIHandler::new()
-                .render(
-                    &protocol,
-                    &test_json!({ "theme": "light" }),
-                    &RenderOptions::new("index.html", "/"),
-                    &mut writer,
-                )
-                .unwrap();
-
-            assert_eq!(
-                writer.get_content(),
-                "<html><head><title>T</title></head><body>x</body></html>"
-            );
-        }
-    }
-
-    #[test]
-    fn mixed_case_native_tags_preserve_ordinary_bytes_and_stream_structurally() {
-        let source =
-            r#"<html><HEAD data-theme="dark"><title>T</title></HEAD><BODY>x</BODY></html>"#;
-        let mut parser = HtmlParser::new();
-        parser.parse("index.html", source).expect("parse fixture");
-        let protocol = Protocol::new(WebUIProtocol::new(parser.into_fragment_records()));
-
-        let mut ordinary = TestWriter::new();
-        WebUIHandler::new()
-            .render(
-                &protocol,
-                &test_json!({}),
-                &RenderOptions::new("index.html", "/"),
-                &mut ordinary,
-            )
-            .unwrap();
-        assert_eq!(ordinary.get_content(), source);
-
-        let mut streaming = FlushTestWriter::default();
-        WebUIHandler::new()
-            .render_streaming(
-                &protocol,
-                &test_json!({}),
-                &RenderOptions::new("index.html", "/"),
-                &mut streaming,
-            )
-            .unwrap();
-        assert!(streaming.output.contains(r#"<HEAD data-theme="dark">"#));
-        assert!(streaming.output.contains("</HEAD><BODY>x"));
-        let opening = streaming.output.find("<HEAD").expect("mixed-case head");
-        let marker = streaming.output.find(STREAMING_MARKER).expect("marker");
-        let title = streaming.output.find("<title>").expect("title");
-        assert!(opening < marker && marker < title);
-        assert_eq!(streaming.output.matches("data-webui-boundary").count(), 1);
-    }
-
-    /// Only `}}}webui:`-namespaced signals are compiler-owned, so an
-    /// unprefixed `body_end` is ordinary authored content.
-    #[test]
-    fn unnamespaced_signal_is_ordinary_content() {
-        let fragments = HashMap::from([(
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw("<html><head>"),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</head><body>"),
-                    WebUIFragment::signal("body_end".to_string(), false),
-                    structural_fragment("body_end"),
-                    WebUIFragment::raw("</body></html>"),
-                ],
-            },
-        )]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut writer = TestWriter::new();
-        WebUIHandler::new()
-            .render(
-                &protocol,
-                &test_json!({ "body_end": "content" }),
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .expect("current protocol must render");
-        assert!(writer.get_content().contains("content"));
-    }
-
-    #[test]
-    fn authored_raw_signal_keys_remain_content_in_both_render_modes() {
-        let source = concat!(
-            "<html><head></head><body>",
-            "{{{head_start}}}|{{{head_end}}}|{{{body_start}}}|{{{body_end}}}|",
-            "{{{boundary_start:0}}}|{{{boundary_end:0}}}|{{{streaming_root:forged}}}",
-            "</body></html>",
-        );
-        let state = test_json!({
-            "head_start": "hs",
-            "head_end": "he",
-            "body_start": "bs",
-            "body_end": "be",
-            "boundary_start:0": "b0s",
-            "boundary_end:0": "b0e",
-            "streaming_root:forged": "root",
-        });
-        let mut parser = HtmlParser::new();
-        parser.parse("index.html", source).expect("parse fixture");
-        let protocol = Protocol::new(WebUIProtocol::new(parser.into_fragment_records()));
-        let expected = "<html><head></head><body>hs|he|bs|be|b0s|b0e|root</body></html>";
-
-        let mut ordinary = TestWriter::new();
-        WebUIHandler::new()
-            .render(
-                &protocol,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut ordinary,
-            )
-            .unwrap();
-        assert_eq!(ordinary.get_content(), expected);
-
-        let mut streaming = FlushTestWriter::default();
-        WebUIHandler::new()
-            .render_streaming(
-                &protocol,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut streaming,
-            )
-            .unwrap();
-        assert!(streaming.output.contains("<body>hs|he|bs|be|b0s|b0e|root"));
-        assert!(!streaming.output.contains("<!--wb:"));
-        assert_eq!(streaming.output.matches(STREAMING_MARKER).count(), 1);
-        assert_eq!(streaming.output.matches("data-webui-boundary").count(), 1);
-    }
-
-    #[test]
-    fn streaming_rejects_structural_signals_after_terminal() {
-        let fragments = HashMap::from([(
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw("<html><head>"),
-                    structural_fragment("head_start"),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</head><body>"),
-                    structural_fragment("body_start"),
-                    structural_fragment("body_end"),
-                    WebUIFragment::raw("</body>"),
-                    structural_fragment("boundary_start:0"),
-                    WebUIFragment::raw("</html>"),
-                ],
-            },
-        )]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut streaming = FlushTestWriter::default();
-        let result = WebUIHandler::new().render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut streaming,
-        );
-
-        match result {
-            Err(HandlerError::StreamingBoundary(error)) => {
-                assert_eq!(error.signal, "boundary_start:0");
-                assert!(error.reason.contains("after the body_end terminal record"));
-            }
-            other => panic!("expected post-terminal rejection, got {other:?}"),
-        }
-        assert!(streaming.output.is_empty());
-        assert!(!streaming.output.contains("<!--wb:0-->"));
-
-        let mut ordinary = TestWriter::new();
-        WebUIHandler::new()
-            .render(
-                &protocol,
-                &test_json!({}),
-                &RenderOptions::new("index.html", "/"),
-                &mut ordinary,
-            )
-            .unwrap();
-        assert_eq!(
-            ordinary.get_content(),
-            "<html><head></head><body></body></html>"
-        );
-    }
-
-    /// Build a streaming protocol with one boundary per `hosts` entry. Each
-    /// boundary wraps a component host whose opening tag is split so the
-    /// compiler-owned `streaming_root:<tag>` signal (optionally emitted) lands
-    /// inside the tag, exactly as `HtmlParser` produces. Components `comp-a` and
-    /// `comp-b` carry disjoint templates and disjoint hydration keys.
-    fn disjoint_streaming_protocol_ext(hosts: &[&str], emit_root_signal: bool) -> Protocol {
-        let mut fragments = HashMap::new();
-        let mut entry = vec![
-            WebUIFragment::raw("<!DOCTYPE html><html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-        ];
-        for (sequence, host) in hosts.iter().enumerate() {
-            entry.push(structural_fragment(format!("boundary_start:{sequence}")));
-            entry.push(WebUIFragment::raw(format!("<{host}")));
-            if emit_root_signal {
-                entry.push(structural_fragment(format!("streaming_root:{host}")));
-            }
-            entry.push(WebUIFragment::raw(">"));
-            entry.push(WebUIFragment::component(*host));
-            entry.push(WebUIFragment::raw(format!("</{host}>")));
-            entry.push(structural_fragment(format!("boundary_end:{sequence}")));
-        }
-        entry.push(structural_fragment("body_end"));
-        entry.push(WebUIFragment::raw("</body></html>"));
-        fragments.insert("index.html".to_string(), FragmentList { fragments: entry });
-        fragments.insert(
-            "comp-a".to_string(),
-            FragmentList {
-                fragments: vec![WebUIFragment::raw("<b>A</b>")],
-            },
-        );
-        fragments.insert(
-            "comp-b".to_string(),
-            FragmentList {
-                fragments: vec![WebUIFragment::raw("<b>B</b>")],
-            },
-        );
-
-        let mut document = WebUIProtocol::new(fragments);
-        document.initial_state_strategy = InitialStateStrategy::Components as i32;
-        document.streaming_boundaries.insert(
-            "index.html".to_string(),
-            webui_protocol::StreamingBoundaryList {
-                names: (0..hosts.len())
-                    .map(|index| format!("boundary-{index}"))
-                    .collect(),
-            },
-        );
-        document.components.insert(
-            "comp-a".to_string(),
-            webui_protocol::ComponentData {
-                template_json: r#"{"h":"<i>A</i>","th":1}"#.to_string(),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["a_count".to_string()],
-                ..Default::default()
-            },
-        );
-        document.components.insert(
-            "comp-b".to_string(),
-            webui_protocol::ComponentData {
-                template_json: r#"{"h":"<i>B</i>","th":1}"#.to_string(),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["b_count".to_string()],
-                ..Default::default()
-            },
-        );
-        Protocol::new(document)
-    }
-
-    fn disjoint_streaming_protocol(hosts: &[&str]) -> Protocol {
-        disjoint_streaming_protocol_ext(hosts, true)
-    }
-
-    fn streaming_plan_validation_protocol(signals: &[&str], names: &[&str]) -> Protocol {
-        let mut entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-        ];
-        entry.extend(signals.iter().map(structural_fragment));
-        entry.extend([
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ]);
-
-        let mut document = WebUIProtocol::new(HashMap::from([(
-            "index.html".to_string(),
-            FragmentList { fragments: entry },
-        )]));
-        document.streaming_boundaries.insert(
-            "index.html".to_string(),
-            webui_protocol::StreamingBoundaryList {
-                names: names.iter().map(|name| (*name).to_string()).collect(),
-            },
-        );
-        Protocol::new(document)
-    }
-
-    #[test]
-    fn streaming_response_rejects_cached_malformed_boundary_plan_before_writing() {
-        let protocol =
-            streaming_plan_validation_protocol(&["boundary_start:0", "boundary_end:1"], &["one"]);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-
-        let error = match handler.stream_response(&protocol, &options, &mut writer) {
-            Ok(_) => panic!("malformed boundary plan unexpectedly opened a response"),
-            Err(error) => error,
-        };
-
-        assert!(
-            matches!(error, HandlerError::StreamingBoundary(_)),
-            "error: {error}"
-        );
-        assert!(writer.output.is_empty());
-        assert!(writer.flushes.is_empty());
-    }
-
-    #[test]
-    fn streaming_response_rejects_boundary_name_count_mismatch_before_writing() {
-        let protocol = streaming_plan_validation_protocol(
-            &["boundary_start:0", "boundary_end:0"],
-            &["one", "two"],
-        );
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-
-        let error = match handler.stream_response(&protocol, &options, &mut writer) {
-            Ok(_) => panic!("mismatched boundary names unexpectedly opened a response"),
-            Err(error) => error,
-        };
-
-        assert!(
-            matches!(error, HandlerError::Invariant(_)),
-            "error: {error}"
-        );
-        assert!(writer.output.is_empty());
-        assert!(writer.flushes.is_empty());
-    }
-
-    #[test]
-    fn streaming_response_interleaves_projected_updates_with_later_boundaries() {
-        let protocol = disjoint_streaming_protocol(&["comp-a", "comp-b"]);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-        let mut response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-        let first = response.boundary("boundary-0").unwrap();
-        let second = response.boundary("boundary-1").unwrap();
-
-        response.write_shell(&test_json!({})).unwrap();
-        response
-            .write_boundary(
-                first,
-                &test_json!({ "a_count": 1, "serverOnly": "secret" }),
-                BoundaryMode::Updatable,
-            )
-            .unwrap();
-        response
-            .update(first, &test_json!({ "a_count": 7, "serverOnly": "secret" }))
-            .unwrap();
-        response
-            .write_boundary(
-                second,
-                &test_json!({ "b_count": 2, "serverOnly": "secret" }),
-                BoundaryMode::Final,
-            )
-            .unwrap();
-        response.finish(&test_json!({})).unwrap();
-
-        assert_eq!(writer.flushes.len(), 5);
-        assert!(writer.output.contains(r#"[1,0,1,0,{"#));
-        assert!(writer.output.contains(r#""state":{"a_count":1}"#));
-        assert!(writer.output.contains(r#"[1,1,2,0,{"a_count":7}]"#));
-        assert!(writer.output.contains(r#"[1,2,0,1,{"#));
-        assert!(writer.output.contains(r#""state":{"b_count":2}"#));
-        assert!(writer.output.contains("[1,3,3,0,{}]"));
-        assert_eq!(writer.output.matches("serverOnly").count(), 0);
-
-        let update_start = writer.output.find("[1,1,2,0,").unwrap();
-        let update_end = writer.output[update_start..]
-            .find("</script>")
-            .map(|offset| update_start + offset)
-            .unwrap();
-        let update = &writer.output[update_start..update_end];
-        assert!(!update.contains("inventory"));
-        assert!(!update.contains("templates"));
-    }
-
-    #[test]
-    fn owned_streaming_session_matches_borrowed_response_bytes() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a", "comp-b"]));
-        let handler = Arc::new(WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        }));
-
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-        let mut response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-        let first = response.boundary("boundary-0").unwrap();
-        let second = response.boundary("boundary-1").unwrap();
-        response.write_shell(&test_json!({})).unwrap();
-        response
-            .write_boundary(
-                first,
-                &test_json!({ "a_count": 1 }),
-                BoundaryMode::Updatable,
-            )
-            .unwrap();
-        response
-            .update(first, &test_json!({ "a_count": 7 }))
-            .unwrap();
-        response
-            .write_boundary(second, &test_json!({ "b_count": 2 }), BoundaryMode::Final)
-            .unwrap();
-        response.finish(&test_json!({})).unwrap();
-
-        let mut session = StreamingSession::new(
-            Arc::clone(&handler),
-            Arc::clone(&protocol),
-            SessionOptions::new("index.html", "/"),
-        )
-        .unwrap();
-        let session_first = session.boundary("boundary-0").unwrap();
-        let session_second = session.boundary("boundary-1").unwrap();
-        assert_eq!(session_first, first);
-        assert_eq!(session_second, second);
-        assert_eq!(session.boundary_count(), 2);
-
-        let chunks: Vec<Vec<u8>> = vec![
-            session.write_shell(&test_json!({})).unwrap(),
-            session
-                .write_boundary(
-                    session_first,
-                    &test_json!({ "a_count": 1 }),
-                    BoundaryMode::Updatable,
-                )
-                .unwrap(),
-            session
-                .update(session_first, &test_json!({ "a_count": 7 }))
-                .unwrap(),
-            session
-                .write_boundary(
-                    session_second,
-                    &test_json!({ "b_count": 2 }),
-                    BoundaryMode::Final,
-                )
-                .unwrap(),
-            session.finish(&test_json!({})).unwrap(),
-        ];
-
-        // One chunk per host call, matching the borrowed path's flush count.
-        assert_eq!(chunks.len(), writer.flushes.len());
-        assert!(session.is_finished());
-        let joined = String::from_utf8(chunks.concat()).unwrap();
-        assert_eq!(joined, writer.output);
-    }
-
-    #[test]
-    fn owned_streaming_session_rejects_use_after_finish() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a"]));
-        let handler = Arc::new(WebUIHandler::new());
-        let mut session =
-            StreamingSession::new(handler, protocol, SessionOptions::new("index.html", "/"))
-                .unwrap();
-        let boundary = session.boundary("boundary-0").unwrap();
-        session.write_shell(&test_json!({})).unwrap();
-        session
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-        session.finish(&test_json!({})).unwrap();
-
-        let error = session.write_shell(&test_json!({})).unwrap_err();
-        assert!(error.to_string().contains("already finished"));
-        assert!(session.finish(&test_json!({})).is_err());
-    }
-
-    #[test]
-    fn owned_streaming_session_surfaces_unknown_boundary_names() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a"]));
-        let handler = Arc::new(WebUIHandler::new());
-        let session =
-            StreamingSession::new(handler, protocol, SessionOptions::new("index.html", "/"))
-                .unwrap();
-        let error = session.boundary("boundary-O").unwrap_err().to_string();
-        assert!(error.contains("boundary-0"));
-    }
-
-    #[test]
-    fn owned_streaming_session_stays_usable_after_a_rejected_call() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a"]));
-        let handler = Arc::new(WebUIHandler::new());
-        let mut session =
-            StreamingSession::new(handler, protocol, SessionOptions::new("index.html", "/"))
-                .unwrap();
-        let boundary = session.boundary("boundary-0").unwrap();
-        session.write_shell(&test_json!({})).unwrap();
-        // Rejected before any byte is written, so the session is not poisoned.
-        assert!(session.update(boundary, &test_json!({ "a": 1 })).is_err());
-        assert!(!session.is_finished());
-        session
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-        session.finish(&test_json!({})).unwrap();
-    }
-
-    #[test]
-    fn owned_streaming_session_recovers_from_a_rejected_finish() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a", "comp-b"]));
-        let handler = Arc::new(WebUIHandler::new());
-        let mut session =
-            StreamingSession::new(handler, protocol, SessionOptions::new("index.html", "/"))
-                .unwrap();
-        let first = session.boundary("boundary-0").unwrap();
-        let second = session.boundary("boundary-1").unwrap();
-        session.write_shell(&test_json!({})).unwrap();
-        session
-            .write_boundary(first, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-
-        // Rejected before any byte is written, so the response must survive.
-        let error = session.finish(&test_json!({})).unwrap_err();
-        assert!(
-            error
-                .to_string()
-                .contains("every boundary must be committed"),
-            "unexpected error: {error}"
-        );
-        assert!(!session.is_finished());
-
-        session
-            .write_boundary(second, &test_json!({ "b_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-        let tail = session.finish(&test_json!({})).unwrap();
-        assert!(!tail.is_empty());
-        assert!(session.is_finished());
-    }
-
-    #[test]
-    fn owned_streaming_session_rejects_finish_before_the_shell() {
-        let protocol = Arc::new(disjoint_streaming_protocol(&["comp-a"]));
-        let handler = Arc::new(WebUIHandler::new());
-        let mut session =
-            StreamingSession::new(handler, protocol, SessionOptions::new("index.html", "/"))
-                .unwrap();
-        let boundary = session.boundary("boundary-0").unwrap();
-
-        let error = session.finish(&test_json!({})).unwrap_err();
-        assert!(
-            error.to_string().contains("write_shell must be called"),
-            "unexpected error: {error}"
-        );
-        assert!(!session.is_finished());
-
-        session.write_shell(&test_json!({})).unwrap();
-        session
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-        session.finish(&test_json!({})).unwrap();
-        assert!(session.is_finished());
-    }
-
-    #[test]
-    fn streaming_response_is_poisoned_after_partial_boundary_flush_failure() {
-        let protocol = disjoint_streaming_protocol(&["comp-a"]);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter {
-            fail_flush_at: Some(1),
-            ..FlushTestWriter::default()
-        };
-        let options = RenderOptions::new("index.html", "/");
-        let mut response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-        let boundary = response.boundary("boundary-0").unwrap();
-        response.write_shell(&test_json!({})).unwrap();
-
-        let first_error = response
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap_err();
-        assert!(matches!(first_error, HandlerError::ClientDisconnected));
-
-        let retry_error = response
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap_err();
-        assert!(
-            retry_error
-                .to_string()
-                .contains("unusable after a previous render or transport failure"),
-            "error: {retry_error}"
-        );
-
-        drop(response);
-        assert_eq!(writer.output.matches("<!--wb:0-->").count(), 1);
-        assert_eq!(writer.flushes.len(), 1);
-        assert!(!writer.ended);
-    }
-
-    #[test]
-    fn streaming_response_rejects_updates_to_final_boundaries() {
-        let protocol = disjoint_streaming_protocol(&["comp-a"]);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-        let mut response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-        let boundary = response.boundary("boundary-0").unwrap();
-        response.write_shell(&test_json!({})).unwrap();
-        response
-            .write_boundary(boundary, &test_json!({ "a_count": 1 }), BoundaryMode::Final)
-            .unwrap();
-
-        let error = response
-            .update(boundary, &test_json!({ "a_count": 2 }))
-            .unwrap_err();
-        assert!(
-            error.to_string().contains("committed as final"),
-            "error: {error}"
-        );
-    }
-
-    #[test]
-    fn streaming_response_rejects_non_object_updates_before_writing() {
-        let protocol = disjoint_streaming_protocol(&["comp-a"]);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-        let mut response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-        let boundary = response.boundary("boundary-0").unwrap();
-        response.write_shell(&test_json!({})).unwrap();
-        response
-            .write_boundary(
-                boundary,
-                &test_json!({ "a_count": 1 }),
-                BoundaryMode::Updatable,
-            )
-            .unwrap();
-        let error = response
-            .update(boundary, &test_json!("invalid"))
-            .unwrap_err();
-        assert!(error.to_string().contains("JSON object"), "error: {error}");
-
-        response
-            .update(boundary, &test_json!({ "a_count": 2 }))
-            .unwrap();
-        response.finish(&test_json!({})).unwrap();
-        assert_eq!(writer.flushes.len(), 4);
-        assert_eq!(writer.output.matches("data-webui-boundary").count(), 3);
-        assert!(writer.output.contains(r#"[1,1,2,0,{"a_count":2}]"#));
-    }
-
-    #[test]
-    fn streaming_response_unknown_boundary_suggests_valid_name() {
-        let protocol = disjoint_streaming_protocol(&["comp-a"]);
-        let handler = WebUIHandler::new();
-        let mut writer = FlushTestWriter::default();
-        let options = RenderOptions::new("index.html", "/");
-        let response = handler
-            .stream_response(&protocol, &options, &mut writer)
-            .unwrap();
-
-        let error = response.boundary("boundry-0").unwrap_err();
-        assert!(
-            error.to_string().contains("did you mean `boundary-0`?"),
-            "error: {error}"
-        );
-    }
-
-    fn streaming_root_validation_protocol(
-        mut host_fragments: Vec<WebUIFragment>,
-        tail: Vec<WebUIFragment>,
-    ) -> Protocol {
-        let mut entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            structural_fragment("boundary_start:0"),
-        ];
-        entry.append(&mut host_fragments);
-        entry.extend(tail);
-        let fragments = HashMap::from([
-            ("index.html".to_string(), FragmentList { fragments: entry }),
-            (
-                "comp-a".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<b>A</b>")],
-                },
-            ),
-            (
-                "comp-b".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<b>B</b>")],
-                },
-            ),
-        ]);
-        Protocol::new(WebUIProtocol::new(fragments))
-    }
-
-    fn completed_streaming_tail() -> Vec<WebUIFragment> {
-        vec![
-            WebUIFragment::raw("</comp-a>"),
-            structural_fragment("boundary_end:0"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ]
-    }
-
-    fn assert_streaming_root_error(
-        protocol: &Protocol,
-        expected_signal: &str,
-        expected_reason: &str,
-    ) {
-        let mut writer = FlushTestWriter::default();
-        let result = WebUIHandler::new().render_streaming(
-            protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-        match result {
-            Err(HandlerError::StreamingBoundary(error)) => {
-                assert_eq!(error.signal, expected_signal);
-                assert!(
-                    error.reason.contains(expected_reason),
-                    "reason: {}",
-                    error.reason
-                );
-            }
-            other => panic!("expected streaming-root rejection, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn streaming_root_signal_injects_data_ws_inside_boundary() {
-        let protocol = disjoint_streaming_protocol(&["comp-a"]);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({ "a_count": 1 }),
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-        // The parser-owned signal is consumed to inject exactly ` data-ws`
-        // inside the host's opening tag, before the custom element upgrades.
-        assert!(
-            writer.output.contains("<comp-a data-ws>"),
-            "streamed host must carry data-ws: {}",
-            writer.output
-        );
-    }
-
-    #[test]
-    fn streaming_root_signal_preserves_ordinary_output_bytes() {
-        // Ordinary rendering ignores `streaming_root` byte-for-byte: identical
-        // output with and without the signal, and never a `data-ws` attribute.
-        let with_signal = disjoint_streaming_protocol_ext(&["comp-a", "comp-b"], true);
-        let without_signal = disjoint_streaming_protocol_ext(&["comp-a", "comp-b"], false);
-        let state = test_json!({ "a_count": 1, "b_count": 2 });
-        let plugin = || {
-            WebUIHandler::with_plugin(
-                || Box::new(crate::plugin::webui::WebUIHydrationPlugin::new()),
-            )
-        };
-        let mut with_writer = TestWriter::new();
-        let mut without_writer = TestWriter::new();
-        plugin()
-            .render(
-                &with_signal,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut with_writer,
-            )
-            .unwrap();
-        plugin()
-            .render(
-                &without_signal,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut without_writer,
-            )
-            .unwrap();
-        // The rendered DOM (everything up to the inert data block) is
-        // deterministic and is where a leaked `data-ws` would appear. The
-        // ordinary template map is HashSet-ordered, so compare the DOM prefix
-        // for byte identity rather than the whole document.
-        let dom_prefix = |content: &str| -> String {
-            content
-                .split_once(r#"<script type="application/json" id="webui-data""#)
-                .map_or_else(|| content.to_string(), |(head, _)| head.to_string())
-        };
-        assert_eq!(
-            dom_prefix(&with_writer.get_content()),
-            dom_prefix(&without_writer.get_content())
-        );
-        assert!(!with_writer.get_content().contains("data-ws"));
-        assert!(with_writer.get_content().contains("<comp-a>"));
-    }
-
-    #[test]
-    fn streaming_component_without_root_signal_is_rejected() {
-        let protocol = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("<comp-a>"),
-                WebUIFragment::component("comp-a"),
-            ],
-            completed_streaming_tail(),
-        );
-
-        assert_streaming_root_error(
-            &protocol,
-            "streaming_root:comp-a",
-            "has no matching compiler-owned root signal",
-        );
-    }
-
-    #[test]
-    fn duplicate_and_misplaced_streaming_root_signals_are_rejected() {
-        let duplicate = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("<comp-a"),
-                structural_fragment("streaming_root:comp-a"),
-                structural_fragment("streaming_root:comp-a"),
-                WebUIFragment::raw(">"),
-                WebUIFragment::component("comp-a"),
-            ],
-            completed_streaming_tail(),
-        );
-        assert_streaming_root_error(&duplicate, "streaming_root:comp-a", "is misplaced");
-
-        let after_tag_close = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("<comp-a>"),
-                structural_fragment("streaming_root:comp-a"),
-                WebUIFragment::component("comp-a"),
-            ],
-            completed_streaming_tail(),
-        );
-        assert_streaming_root_error(&after_tag_close, "streaming_root:comp-a", "is misplaced");
-
-        let detached_from_opening = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("not an opening tag"),
-                structural_fragment("streaming_root:comp-a"),
-                WebUIFragment::raw(">"),
-                WebUIFragment::component("comp-a"),
-            ],
-            completed_streaming_tail(),
-        );
-        assert_streaming_root_error(
-            &detached_from_opening,
-            "streaming_root:comp-a",
-            "unclosed component opening-tag close",
-        );
-    }
-
-    #[test]
-    fn mismatched_streaming_root_signal_is_rejected() {
-        let protocol = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("<comp-a"),
-                structural_fragment("streaming_root:comp-b"),
-                WebUIFragment::raw(">"),
-                WebUIFragment::component("comp-a"),
-            ],
-            completed_streaming_tail(),
-        );
-
-        assert_streaming_root_error(
-            &protocol,
-            "streaming_root:comp-b",
-            "opening host renders component <comp-a>",
-        );
-    }
-
-    #[test]
-    fn pending_streaming_root_is_rejected_at_structural_ends() {
-        let protocol = streaming_root_validation_protocol(
-            vec![
-                WebUIFragment::raw("<comp-a"),
-                structural_fragment("streaming_root:comp-a"),
-                WebUIFragment::raw(">"),
-            ],
-            vec![structural_fragment("boundary_end:0")],
-        );
-        assert_streaming_root_error(&protocol, "streaming_root:comp-a", "is misplaced");
-    }
-
-    #[test]
-    fn streaming_root_outside_boundary_is_rejected() {
-        let fragments = HashMap::from([
-            (
-                "index.html".to_string(),
-                FragmentList {
-                    fragments: vec![
-                        WebUIFragment::raw("<html><head>"),
-                        structural_fragment("head_start"),
-                        structural_fragment("head_end"),
-                        WebUIFragment::raw("</head><body>"),
-                        structural_fragment("body_start"),
-                        WebUIFragment::raw("<comp-a"),
-                        structural_fragment("streaming_root:comp-a"),
-                        WebUIFragment::raw(">"),
-                        WebUIFragment::component("comp-a"),
-                        WebUIFragment::raw("</comp-a>"),
-                        structural_fragment("body_end"),
-                        WebUIFragment::raw("</body></html>"),
-                    ],
-                },
-            ),
-            (
-                "comp-a".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<b>A</b>")],
-                },
-            ),
-        ]);
-        let protocol = Protocol::new(WebUIProtocol::new(fragments));
-        let mut writer = FlushTestWriter::default();
-        let result = WebUIHandler::new().render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-        match result {
-            Err(HandlerError::StreamingBoundary(err)) => {
-                assert_eq!(err.signal, "streaming_root:comp-a");
-                assert!(
-                    err.reason.contains("outside any <boundary>"),
-                    "reason: {}",
-                    err.reason
-                );
-            }
-            other => panic!("expected outside-boundary rejection, got {other:?}"),
-        }
-    }
-
-    fn parser_route_protocol(with_boundary: bool) -> Protocol {
-        let mut parser = HtmlParser::with_options(DomStrategy::Light);
-        parser
-            .component_registry_mut()
-            .register_component(ComponentRegistration::new(
-                "route-page",
-                "<p>route content</p>",
-                None,
-                true,
-            ))
-            .expect("register route component");
-        let route = r#"<route path="/" component="route-page" exact />"#;
-        let html = if with_boundary {
-            format!(
-                "<html><head></head><body>\
-                 <boundary name=\"route\">{route}</boundary>\
-                 </body></html>"
-            )
-        } else {
-            format!("<html><head></head><body>{route}</body></html>")
-        };
-        parser
-            .parse("index.html", &html)
-            .expect("parse route streaming fixture");
-        let mut document = WebUIProtocol::new(parser.into_fragment_records());
-        document.components.insert(
-            "route-page".to_string(),
-            webui_protocol::ComponentData::default(),
-        );
-        Protocol::new(document)
-    }
-
-    #[test]
-    fn streaming_parser_route_host_is_marked_inside_explicit_boundary() {
-        let protocol = parser_route_protocol(true);
-        let mut writer = FlushTestWriter::default();
-        WebUIHandler::new()
-            .render_streaming(
-                &protocol,
-                &test_json!({}),
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-
-        assert!(
-            writer
-                .output
-                .contains("<route-page data-ws><p>route content</p></route-page>"),
-            "matched route host must be deferred before upgrade: {}",
-            writer.output
-        );
-    }
-
-    #[test]
-    fn streaming_parser_route_host_outside_boundary_is_rejected() {
-        let protocol = parser_route_protocol(false);
-        let mut writer = FlushTestWriter::default();
-        let result = WebUIHandler::new().render_streaming(
-            &protocol,
-            &test_json!({}),
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        );
-
-        match result {
-            Err(HandlerError::StreamingBoundary(error)) => {
-                assert_eq!(error.signal, "streaming_root:route-page");
-                assert!(error.reason.contains("outside any <boundary>"));
-            }
-            other => panic!("expected route boundary rejection, got {other:?}"),
-        }
-        assert!(
-            !writer.output.contains("<route-page>"),
-            "an unmarked custom-element opening must never be completed"
-        );
-    }
-
-    #[test]
-    fn streaming_checkpoint_preserves_relative_route_base_for_metadata() {
-        let entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            structural_fragment("boundary_start:0"),
-            WebUIFragment::route_from(webui_protocol::WebUiFragmentRoute {
-                path: "/account".into(),
-                fragment_id: "account-shell".into(),
-                exact: false,
-                ..Default::default()
-            }),
-            structural_fragment("boundary_end:0"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ];
-        let fragments = HashMap::from([
-            ("index.html".to_string(), FragmentList { fragments: entry }),
-            (
-                "account-shell".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::route_from(
-                        webui_protocol::WebUiFragmentRoute {
-                            path: "./details".into(),
-                            fragment_id: "details-page".into(),
-                            exact: true,
-                            pending_component: "details-loading".into(),
-                            error_component: "details-error".into(),
-                            ..Default::default()
-                        },
-                    )],
-                },
-            ),
-            (
-                "details-page".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>details</p>")],
-                },
-            ),
-            (
-                "details-loading".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>loading</p>")],
-                },
-            ),
-            (
-                "details-error".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>error</p>")],
-                },
-            ),
-        ]);
-        let mut document = WebUIProtocol::new(fragments);
-        document.initial_state_strategy = InitialStateStrategy::Components as i32;
-        for name in [
-            "account-shell",
-            "details-page",
-            "details-loading",
-            "details-error",
-        ] {
-            document.components.insert(
-                name.to_string(),
-                webui_protocol::ComponentData {
-                    template_json: format!(r#"{{"h":"<{name}></{name}>","th":1}}"#),
-                    ..Default::default()
-                },
-            );
-        }
-        let protocol = Protocol::new(document);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({}),
-                &RenderOptions::new("index.html", "/account/details"),
-                &mut writer,
-            )
-            .unwrap();
-
-        let first = &writer.output[..writer.flushes[0]];
-        assert!(
-            first.contains(r#""details-loading":"#),
-            "relative-route pending metadata missing: {first}"
-        );
-        assert!(
-            first.contains(r#""details-error":"#),
-            "relative-route error metadata missing: {first}"
-        );
-    }
-
-    #[test]
-    fn streaming_checkpoint_keeps_independent_siblings_beside_route_roots() {
-        let entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            structural_fragment("boundary_start:0"),
-            WebUIFragment::raw("<static-shell"),
-            structural_fragment("streaming_root:static-shell"),
-            WebUIFragment::raw(">"),
-            WebUIFragment::component("static-shell"),
-            WebUIFragment::raw("</static-shell>"),
-            WebUIFragment::raw("<route-shell"),
-            structural_fragment("streaming_root:route-shell"),
-            WebUIFragment::raw(">"),
-            WebUIFragment::component("route-shell"),
-            WebUIFragment::raw("</route-shell>"),
-            structural_fragment("boundary_end:0"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ];
-        let fragments = HashMap::from([
-            ("index.html".to_string(), FragmentList { fragments: entry }),
-            (
-                "static-shell".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::if_cond(
-                        ConditionExpr::identifier("show_hidden"),
-                        "static-hidden-if",
-                    )],
-                },
-            ),
-            (
-                "static-hidden-if".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::component("static-hidden")],
-                },
-            ),
-            (
-                "static-hidden".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>hidden</p>")],
-                },
-            ),
-            (
-                "route-shell".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::route_from(
-                        webui_protocol::WebUiFragmentRoute {
-                            path: "/account".into(),
-                            fragment_id: "route-page".into(),
-                            exact: true,
-                            ..Default::default()
-                        },
-                    )],
-                },
-            ),
-            (
-                "route-page".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>route</p>")],
-                },
-            ),
-        ]);
-        let mut document = WebUIProtocol::new(fragments);
-        document.set_css_strategy(webui_protocol::CssStrategy::Link);
-        document.initial_state_strategy = InitialStateStrategy::Components as i32;
-        for (name, keys) in [
-            ("static-shell", vec!["show_hidden", "static_count"]),
-            ("static-hidden", vec!["hidden_count"]),
-            ("route-shell", vec!["route_shell_count"]),
-            ("route-page", vec!["route_count"]),
-        ] {
-            document.components.insert(
-                name.to_string(),
-                webui_protocol::ComponentData {
-                    template_json: format!(r#"{{"h":"<{name}></{name}>","th":1}}"#),
-                    hydration_mode: StateProjectionMode::Keys as i32,
-                    hydration_keys: keys.into_iter().map(str::to_string).collect(),
-                    css_href: format!("/{name}.css"),
-                    ..Default::default()
-                },
-            );
-        }
-        let protocol = Protocol::new(document);
-        assert_eq!(
-            protocol
-                .component_reachability()
-                .is_route_dependent(protocol.component_index()["route-shell"]),
-            Some(true),
-            "fixture must exercise request-aware checkpoint reachability"
-        );
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({
-                    "show_hidden": false,
-                    "static_count": 1,
-                    "hidden_count": 2,
-                    "route_shell_count": 3,
-                    "route_count": 4,
-                    "unrelated": "private",
-                }),
-                &RenderOptions::new("index.html", "/account"),
-                &mut writer,
-            )
-            .unwrap();
-
-        let checkpoint = &writer.output[..writer.flushes[0]];
-        for template in ["static-shell", "static-hidden", "route-shell", "route-page"] {
-            assert!(
-                checkpoint.contains(&format!(r#""{template}":"#)),
-                "{template} metadata missing: {checkpoint}"
-            );
-        }
-        for state in [
-            r#""show_hidden":false"#,
-            r#""static_count":1"#,
-            r#""hidden_count":2"#,
-            r#""route_shell_count":3"#,
-            r#""route_count":4"#,
-        ] {
-            assert!(
-                checkpoint.contains(state),
-                "{state} state missing: {checkpoint}"
-            );
-        }
-        assert!(
-            !checkpoint.contains("unrelated"),
-            "checkpoint leaked unrelated state: {checkpoint}"
-        );
-        assert!(
-            checkpoint.contains(
-                r#""css":["/static-shell.css","/static-hidden.css","/route-shell.css","/route-page.css"]"#
-            ),
-            "checkpoint metadata lost source order: {checkpoint}"
-        );
-    }
-
-    #[test]
-    fn streaming_checkpoints_carry_boundary_local_templates_and_state() {
-        // Three boundaries: comp-a, comp-b, then comp-a reused. Each checkpoint
-        // envelope must be locally scoped — templates/state for exactly the
-        // components rendered since the previous checkpoint, with reused tags
-        // carrying hydration state but never a duplicate template.
-        let protocol = disjoint_streaming_protocol(&["comp-a", "comp-b", "comp-a"]);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let state = test_json!({ "a_count": 1, "b_count": 2, "serverOnly": "secret" });
-        let mut writer = FlushTestWriter::default();
-        handler
-            .render_streaming(
-                &protocol,
-                &state,
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-
-        assert_eq!(
-            writer.flushes.len(),
-            4,
-            "three boundary commits plus one terminal"
-        );
-        let segment = |index: usize| -> &str {
-            let start = if index == 0 {
-                0
-            } else {
-                writer.flushes[index - 1]
-            };
-            &writer.output[start..writer.flushes[index]]
-        };
-        let b0 = segment(0);
-        let b1 = segment(1);
-        let b2 = segment(2);
-
-        // Boundary 0: only comp-a's template/state; no comp-b artifacts.
-        assert!(b0.contains(r#""templates":{"comp-a":"#), "b0: {b0}");
-        assert!(b0.contains(r#""a_count":1"#), "b0: {b0}");
-        assert!(b0.contains(r#"[1,0,0,0,{"inventory":"01""#), "b0: {b0}");
-        assert!(!b0.contains("comp-b"), "b0 leaked comp-b: {b0}");
-        assert!(!b0.contains("b_count"), "b0 leaked b_count: {b0}");
-
-        // Boundary 1: only comp-b's template/state; no duplicate comp-a template.
-        assert!(b1.contains(r#""templates":{"comp-b":"#), "b1: {b1}");
-        assert!(b1.contains(r#""b_count":2"#), "b1: {b1}");
-        assert!(b1.contains(r#"[1,1,0,1,{"inventory":"02""#), "b1: {b1}");
-        assert!(
-            !b1.contains(r#""templates":{"comp-a"#),
-            "b1 re-sent comp-a: {b1}"
-        );
-        assert!(!b1.contains("a_count"), "b1 leaked a_count: {b1}");
-
-        // Boundary 2: comp-a reused — state present, template absent (empty delta).
-        assert!(b2.contains(r#""a_count":1"#), "b2: {b2}");
-        assert!(b2.contains(r#"[1,2,0,2,{"inventory":"""#), "b2: {b2}");
-        assert!(
-            !b2.contains(r#""templates""#),
-            "b2 re-sent a template: {b2}"
-        );
-
-        // Server-only state never leaks into any envelope.
-        assert!(!writer.output.contains("serverOnly"));
-    }
-
-    #[test]
-    fn streaming_checkpoint_carries_reachable_unrendered_metadata_without_inventory() {
-        let entry = vec![
-            WebUIFragment::raw("<html><head>"),
-            structural_fragment("head_start"),
-            structural_fragment("head_end"),
-            WebUIFragment::raw("</head><body>"),
-            structural_fragment("body_start"),
-            structural_fragment("boundary_start:0"),
-            WebUIFragment::raw("<comp-a"),
-            structural_fragment("streaming_root:comp-a"),
-            WebUIFragment::raw(">"),
-            WebUIFragment::component("comp-a"),
-            WebUIFragment::raw("</comp-a>"),
-            structural_fragment("boundary_end:0"),
-            structural_fragment("boundary_start:1"),
-            WebUIFragment::raw("<comp-hidden"),
-            structural_fragment("streaming_root:comp-hidden"),
-            WebUIFragment::raw(">"),
-            WebUIFragment::component("comp-hidden"),
-            WebUIFragment::raw("</comp-hidden>"),
-            structural_fragment("boundary_end:1"),
-            structural_fragment("body_end"),
-            WebUIFragment::raw("</body></html>"),
-        ];
-        let fragments = HashMap::from([
-            ("index.html".to_string(), FragmentList { fragments: entry }),
-            (
-                "comp-a".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::if_cond(
-                        ConditionExpr::identifier("show_hidden"),
-                        "hidden-if",
-                    )],
-                },
-            ),
-            (
-                "hidden-if".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::component("comp-hidden")],
-                },
-            ),
-            (
-                "comp-hidden".to_string(),
-                FragmentList {
-                    fragments: vec![WebUIFragment::raw("<p>hidden</p>")],
-                },
-            ),
-        ]);
-        let mut document = WebUIProtocol::new(fragments);
-        document.initial_state_strategy = InitialStateStrategy::Components as i32;
-        document.components.insert(
-            "comp-a".to_string(),
-            webui_protocol::ComponentData {
-                template_json: r#"{"h":"<div></div>","th":1}"#.to_string(),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["show_hidden".to_string()],
-                ..Default::default()
-            },
-        );
-        document.components.insert(
-            "comp-hidden".to_string(),
-            webui_protocol::ComponentData {
-                template_json: r#"{"h":"<p>hidden</p>","th":1}"#.to_string(),
-                css: ".hidden{display:block}".to_string(),
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["hidden_count".to_string()],
-                ..Default::default()
-            },
-        );
-        let protocol = Protocol::new(document);
-        let handler = WebUIHandler::with_plugin(|| {
-            Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-        });
-        let mut writer = FlushTestWriter::default();
-
-        handler
-            .render_streaming(
-                &protocol,
-                &test_json!({
-                    "show_hidden": false,
-                    "hidden_count": 7,
-                    "unrelated": "private",
-                }),
-                &RenderOptions::new("index.html", "/"),
-                &mut writer,
-            )
-            .unwrap();
-
-        let boundary = |index: usize| -> &str {
-            let start = if index == 0 {
-                0
-            } else {
-                writer.flushes[index - 1]
-            };
-            &writer.output[start..writer.flushes[index]]
-        };
-        let first = boundary(0);
-        let second = boundary(1);
-
-        assert!(first.contains(r#""comp-a":"#), "first: {first}");
-        assert!(first.contains(r#""comp-hidden":"#), "first: {first}");
-        assert!(first.contains(r#""show_hidden":false"#), "first: {first}");
-        assert!(first.contains(r#""hidden_count":7"#), "first: {first}");
-        assert!(first.contains(r#""inventory":"01""#), "first: {first}");
-        assert!(
-            first.contains(r#"<script type="importmap">"#),
-            "first: {first}"
-        );
-        assert!(
-            !first.contains("unrelated"),
-            "first leaked unrelated state: {first}"
-        );
-
-        assert!(
-            !second.contains(r#""templates""#),
-            "second re-sent metadata: {second}"
-        );
-        assert!(
-            !second.contains(r#"<script type="importmap">"#),
-            "second re-sent CSS: {second}"
-        );
-        assert!(second.contains(r#""hidden_count":7"#), "second: {second}");
-        assert!(second.contains(r#""inventory":"02""#), "second: {second}");
-        assert_eq!(
-            writer
-                .output
-                .matches(r#"<script type="importmap">"#)
-                .count(),
-            1
-        );
-    }
-
-    #[test]
-    fn streaming_flush_count_is_boundaries_plus_one() {
-        for &count in &[1usize, 3, 10, 100] {
-            let hosts: Vec<&str> = (0..count)
-                .map(|index| if index % 2 == 0 { "comp-a" } else { "comp-b" })
-                .collect();
-            let protocol = disjoint_streaming_protocol(&hosts);
-            let handler = WebUIHandler::with_plugin(|| {
-                Box::new(crate::plugin::webui::WebUIHydrationPlugin::new())
-            });
-            let mut writer = FlushTestWriter::default();
-            handler
-                .render_streaming(
-                    &protocol,
-                    &test_json!({ "a_count": 1, "b_count": 2 }),
-                    &RenderOptions::new("index.html", "/"),
-                    &mut writer,
-                )
-                .unwrap();
-            assert_eq!(
-                writer.flushes.len(),
-                count + 1,
-                "expected boundaries+1 flushes for {count} boundaries"
-            );
-        }
-    }
-
-    #[test]
-    fn checkpoint_state_key_scratch_reuses_allocation_and_stays_local() {
-        let mut protocol = WebUIProtocol::new(HashMap::new());
-        protocol.initial_state_strategy = InitialStateStrategy::Components as i32;
-        protocol.components.insert(
-            "comp-a".to_string(),
-            webui_protocol::ComponentData {
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["a".to_string(), "shared".to_string()],
-                ..Default::default()
-            },
-        );
-        protocol.components.insert(
-            "comp-b".to_string(),
-            webui_protocol::ComponentData {
-                hydration_mode: StateProjectionMode::Keys as i32,
-                hydration_keys: vec!["b".to_string(), "shared".to_string()],
-                ..Default::default()
-            },
-        );
-
-        let mut scratch = Vec::with_capacity(INITIAL_KEY_CAPACITY);
-        assert!(!collect_hydration_state_into(
-            &protocol,
-            ["comp-a"],
-            &mut scratch,
-        ));
-        assert_eq!(scratch, ["a", "shared"]);
-        let pointer = scratch.as_ptr();
-        let capacity = scratch.capacity();
-
-        assert!(!collect_hydration_state_into(
-            &protocol,
-            ["comp-b"],
-            &mut scratch,
-        ));
-        assert_eq!(scratch, ["b", "shared"]);
-        assert_eq!(scratch.as_ptr(), pointer);
-        assert_eq!(scratch.capacity(), capacity);
-    }
 }
diff --git a/crates/webui-handler/src/plugin/fast_v3.rs b/crates/webui-handler/src/plugin/fast_v3.rs
index ee5df30a9..3b96ad033 100644
--- a/crates/webui-handler/src/plugin/fast_v3.rs
+++ b/crates/webui-handler/src/plugin/fast_v3.rs
@@ -431,6 +431,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -451,6 +452,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -468,12 +470,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "for-1")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "for-1".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("item", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -497,12 +501,14 @@ mod tests {
                     ConditionExpr::identifier("show"),
                     "if-1",
                 )],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-1".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Visible</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -533,12 +539,14 @@ mod tests {
                     WebUIFragment::component("my-comp"),
                     WebUIFragment::signal("after", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-comp".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("inner", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -561,6 +569,7 @@ mod tests {
                     WebUIFragment::plugin(2u32.to_le_bytes().to_vec()),
                     WebUIFragment::raw(">content</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -596,6 +605,8 @@ mod tests {
                     WebUIFragment::component("my-component"),
                     WebUIFragment::raw("</my-component>"),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -605,6 +616,7 @@ mod tests {
                     WebUIFragment::raw("Hello "),
                     WebUIFragment::signal("name", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -615,6 +627,7 @@ mod tests {
                     WebUIFragment::signal("content", false),
                     WebUIFragment::raw("</span>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -655,6 +668,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("hydratableComponent")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -666,6 +680,7 @@ mod tests {
                     WebUIFragment::for_loop("category", "categories", "categoryTemplate"),
                     WebUIFragment::raw("</div>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -688,6 +703,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</section>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -698,6 +714,7 @@ mod tests {
                     WebUIFragment::for_loop("item", "category.items", "itemTemplate"),
                     WebUIFragment::raw("</ul>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -716,6 +733,7 @@ mod tests {
                     ),
                     WebUIFragment::raw("</li>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -725,6 +743,7 @@ mod tests {
                     WebUIFragment::raw("item-"),
                     WebUIFragment::signal("item.id", false),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -735,6 +754,7 @@ mod tests {
                     WebUIFragment::signal("item.specialText", false),
                     WebUIFragment::raw(")"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -820,6 +840,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-comp")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -830,6 +851,7 @@ mod tests {
                     WebUIFragment::signal("missing_field", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -856,6 +878,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-comp")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -866,12 +889,14 @@ mod tests {
                     WebUIFragment::for_loop("item", "missing_items", "loop-body"),
                     WebUIFragment::raw("</ul>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "loop-body".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("item", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -896,6 +921,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-comp")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -906,6 +932,7 @@ mod tests {
                     WebUIFragment::signal("name", false),
                     WebUIFragment::raw("</p>"),
                 ],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -930,6 +957,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-comp")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -940,12 +968,14 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "loop-body"),
                     WebUIFragment::raw("</ul>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "loop-body".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("item", false)],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
diff --git a/crates/webui-handler/src/plugin/webui.rs b/crates/webui-handler/src/plugin/webui.rs
index 0afa26c68..cc5e66234 100644
--- a/crates/webui-handler/src/plugin/webui.rs
+++ b/crates/webui-handler/src/plugin/webui.rs
@@ -623,18 +623,21 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "for-body"),
                     WebUIFragment::if_cond(ConditionExpr::identifier("show"), "if-body"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "for-body".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("item", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-body".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<span>yes</span>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
diff --git a/crates/webui-handler/src/route_handler.rs b/crates/webui-handler/src/route_handler.rs
index 5511e3b0d..3045cad50 100644
--- a/crates/webui-handler/src/route_handler.rs
+++ b/crates/webui-handler/src/route_handler.rs
@@ -18,11 +18,13 @@ use serde_json::{value::RawValue, Map, Value};
 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 use std::fmt;
-use std::sync::{OnceLock, RwLock};
+use std::sync::{Arc, OnceLock, RwLock};
 use webui_protocol::{
     web_ui_fragment::Fragment, CssStrategy, DomStrategy, WebUIFragmentRoute, WebUIProtocol,
 };
 
+use crate::streaming::PreparedContinuationStatePlan;
+
 // ── Protocol Index ──────────────────────────────────────────────────────
 
 /// A decoded protocol with reusable deterministic indices.
@@ -40,11 +42,23 @@ pub struct Protocol {
     component_asset_style_links: String,
     component_index: HashMap<String, u32>,
     component_reachability: OnceLock<ComponentReachabilityIndex>,
-    streaming_plans: HashMap<String, crate::streaming::PreparedStreamingEntryPlan>,
+    fragment_ids: Vec<Arc<str>>,
+    fragment_slots: HashMap<Arc<str>, u32>,
     route_index: CompiledRouteIndex,
+    boundary_declarations: OnceLock<HashMap<u32, BoundaryDeclaration>>,
+    continuation_state_plans: RwLock<HashMap<Box<str>, Arc<PreparedContinuationStatePlan>>>,
     template_metadata_cache: RwLock<HashMap<String, Value>>,
 }
 
+/// Build-time identity of one streaming boundary declaration.
+///
+/// Interned once per protocol so a discovered occurrence clones two pointers
+/// instead of allocating the authored owner and name on every response.
+pub(crate) struct BoundaryDeclaration {
+    pub(crate) owner: Arc<str>,
+    pub(crate) name: Arc<str>,
+}
+
 impl Protocol {
     /// Decode protobuf bytes and build the reusable protocol index.
     ///
@@ -78,30 +92,29 @@ impl Protocol {
             };
         let component_index = build_component_index(&protocol);
         let route_index = CompiledRouteIndex::new(&protocol);
-        let streaming_plans = protocol
-            .streaming_boundaries
+        let mut fragment_ids: Vec<Arc<str>> = protocol
+            .fragments
             .keys()
-            .filter_map(|entry| {
-                protocol.fragments.get(entry).map(|fragments| {
-                    (
-                        entry.clone(),
-                        crate::streaming::PreparedStreamingEntryPlan::new(
-                            entry,
-                            &fragments.fragments,
-                            protocol.streaming_boundaries.get(entry),
-                        ),
-                    )
-                })
-            })
+            .map(|id| Arc::from(id.as_str()))
             .collect();
+        fragment_ids.sort_unstable();
+        let mut fragment_slots = HashMap::with_capacity(fragment_ids.len());
+        for (slot, id) in fragment_ids.iter().enumerate() {
+            // Record counts are bounded by the compiled graph, well inside u32.
+            #[allow(clippy::cast_possible_truncation)]
+            fragment_slots.insert(Arc::clone(id), slot as u32);
+        }
         Self {
             protocol,
             component_asset_style_manifest,
             component_asset_style_links,
             component_index,
             component_reachability: OnceLock::new(),
-            streaming_plans,
+            fragment_ids,
+            fragment_slots,
             route_index,
+            boundary_declarations: OnceLock::new(),
+            continuation_state_plans: RwLock::new(HashMap::new()),
             template_metadata_cache: RwLock::new(HashMap::new()),
         }
     }
@@ -130,24 +143,59 @@ impl Protocol {
             .get_or_init(|| ComponentReachabilityIndex::new(&self.protocol, &self.component_index))
     }
 
-    pub(crate) fn streaming_plan(
-        &self,
-        entry_id: &str,
-    ) -> crate::Result<Option<&crate::streaming::StreamingEntryPlan>> {
-        self.streaming_plans
-            .get(entry_id)
-            .map_or(Ok(None), |plan| plan.resolve().map(Some))
+    pub(crate) fn route_index(&self) -> &CompiledRouteIndex {
+        &self.route_index
     }
 
-    pub(crate) fn streaming_boundary_names(&self, entry_id: &str) -> &[String] {
-        self.protocol
-            .streaming_boundaries
-            .get(entry_id)
-            .map_or(&[], |boundaries| boundaries.names.as_slice())
+    /// Resolve a compiled fragment record ID to its dense slot.
+    ///
+    /// Continuation frames carry slots instead of owned IDs, so descending into
+    /// a component, condition, or loop body allocates nothing.
+    pub(crate) fn fragment_slot(&self, id: &str) -> Option<u32> {
+        self.fragment_slots.get(id).copied()
     }
 
-    pub(crate) fn route_index(&self) -> &CompiledRouteIndex {
-        &self.route_index
+    /// Borrow the compiled fragment record ID for a dense slot.
+    pub(crate) fn fragment_id(&self, slot: u32) -> Option<&str> {
+        usize::try_from(slot)
+            .ok()
+            .and_then(|slot| self.fragment_ids.get(slot))
+            .map(Arc::as_ref)
+    }
+
+    /// Borrow the interned identity of one build-time boundary declaration.
+    ///
+    /// The table is built on first streaming use and shared by every later
+    /// response, so discovering an occurrence never re-allocates the authored
+    /// owner or name.
+    pub(crate) fn boundary_declaration(&self, declaration_id: u32) -> Option<&BoundaryDeclaration> {
+        self.boundary_declarations
+            .get_or_init(|| build_boundary_declarations(&self.protocol))
+            .get(&declaration_id)
+    }
+
+    /// Borrow the memoized continuation projection surface for one entry.
+    ///
+    /// The graph walk that decides which top-level state keys a continuation
+    /// retains depends only on the compiled protocol, so it runs at most once
+    /// per entry for the lifetime of this [`Protocol`]. Responses clone a
+    /// pointer instead of rebuilding the surface. Failures are captured and
+    /// replayed so the memo never re-walks a graph that is known to be
+    /// unusable.
+    pub(crate) fn continuation_state_plan(
+        &self,
+        entry_id: &str,
+    ) -> Arc<PreparedContinuationStatePlan> {
+        if let Ok(plans) = self.continuation_state_plans.read() {
+            if let Some(plan) = plans.get(entry_id) {
+                return Arc::clone(plan);
+            }
+        }
+        let plan = Arc::new(PreparedContinuationStatePlan::new(&self.protocol, entry_id));
+        if let Ok(mut plans) = self.continuation_state_plans.write() {
+            return Arc::clone(plans.entry(entry_id.into()).or_insert(plan));
+        }
+        plan
     }
 
     /// Borrow the build-time CSS token list.
@@ -274,6 +322,31 @@ struct RequestProtocolIndex<'a> {
 
 // ── Component Inventory ─────────────────────────────────────────────────
 
+/// Intern the owner and authored name of every boundary declaration.
+///
+/// Only start markers carry identity; end markers repeat the declaration ID.
+fn build_boundary_declarations(protocol: &WebUIProtocol) -> HashMap<u32, BoundaryDeclaration> {
+    let mut declarations = HashMap::new();
+    for list in protocol.fragments.values() {
+        for fragment in &list.fragments {
+            let Some(Fragment::Boundary(boundary)) = fragment.fragment.as_ref() else {
+                continue;
+            };
+            if boundary.phase() != webui_protocol::BoundaryPhase::Start {
+                continue;
+            }
+            declarations.insert(
+                boundary.declaration_id,
+                BoundaryDeclaration {
+                    owner: Arc::from(boundary.owner_fragment_id.as_str()),
+                    name: Arc::from(boundary.name.as_str()),
+                },
+            );
+        }
+    }
+    declarations
+}
+
 /// Build a deterministic component-name → bit-index map from the protocol.
 ///
 /// Derives names from fragment keys (hyphenated = custom element) since that
@@ -1244,6 +1317,7 @@ fn collect_inventoryable_components_from_stack(
                         route_base: queued.route_base.clone(),
                     });
                 }
+
                 Some(Fragment::Attribute(attr)) if !attr.template.is_empty() => {
                     stack.push(QueuedFragment {
                         id: attr.template.clone(),
@@ -1255,6 +1329,13 @@ fn collect_inventoryable_components_from_stack(
                     let is_selected = matched_route
                         .as_ref()
                         .is_some_and(|(best_key, _)| best_key == route_frag.fragment_id.as_str());
+                    if is_selected && !route_frag.content_fragment_id.is_empty() {
+                        stack.push(QueuedFragment {
+                            id: route_frag.content_fragment_id.clone(),
+                            inventoryable: false,
+                            route_base: queued.route_base.clone(),
+                        });
+                    }
                     if is_selected && !route_frag.fragment_id.is_empty() {
                         // Compute new route base from consumed segments
                         let child_route_base = if let Some((_, ref rm)) = matched_route {
@@ -1490,6 +1571,21 @@ pub fn collect_nested_route_params(
                         route_base: queued.route_base.clone(),
                     });
                 }
+                Some(Fragment::ForLoop(for_loop)) => {
+                    stack.push(QueuedFragment {
+                        id: for_loop.fragment_id.clone(),
+                        inventoryable: false,
+                        route_base: queued.route_base.clone(),
+                    });
+                }
+                Some(Fragment::IfCond(if_cond)) => {
+                    stack.push(QueuedFragment {
+                        id: if_cond.fragment_id.clone(),
+                        inventoryable: false,
+                        route_base: queued.route_base.clone(),
+                    });
+                }
+
                 Some(Fragment::Route(route_frag)) => {
                     let is_selected = matched_route
                         .as_ref()
@@ -1667,6 +1763,7 @@ fn collect_inventory_and_chain(
                         route_base: queued.route_base.clone(),
                     });
                 }
+
                 Some(Fragment::Attribute(attr)) if !attr.template.is_empty() => {
                     stack.push(QueuedFragment {
                         id: attr.template.clone(),
@@ -1678,6 +1775,13 @@ fn collect_inventory_and_chain(
                     let is_selected = matched_route
                         .as_ref()
                         .is_some_and(|(best_key, _)| best_key == route_frag.fragment_id.as_str());
+                    if is_selected && !route_frag.content_fragment_id.is_empty() {
+                        stack.push(QueuedFragment {
+                            id: route_frag.content_fragment_id.clone(),
+                            inventoryable: false,
+                            route_base: queued.route_base.clone(),
+                        });
+                    }
                     if is_selected && !route_frag.fragment_id.is_empty() {
                         if let Some((_, ref rm)) = matched_route {
                             // Chain: record matched route entry
@@ -2285,6 +2389,21 @@ pub(crate) fn collect_route_chain(
                         route_base: queued.route_base.clone(),
                     });
                 }
+                Some(Fragment::ForLoop(for_loop)) => {
+                    stack.push(QueuedFragment {
+                        id: for_loop.fragment_id.clone(),
+                        inventoryable: false,
+                        route_base: queued.route_base.clone(),
+                    });
+                }
+                Some(Fragment::IfCond(if_cond)) => {
+                    stack.push(QueuedFragment {
+                        id: if_cond.fragment_id.clone(),
+                        inventoryable: false,
+                        route_base: queued.route_base.clone(),
+                    });
+                }
+
                 Some(Fragment::Route(route_frag)) => {
                     let is_selected = matched_route
                         .as_ref()
@@ -2388,6 +2507,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Prepared</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::with_tokens(fragments, vec!["colorBrand".to_string()]);
@@ -2468,12 +2588,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route("/", "home-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "home-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Home</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -2495,12 +2617,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route("/", "home-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "home-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Home</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -2541,12 +2665,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route("/", "home-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "home-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Home</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -2828,12 +2954,14 @@ mod tests {
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("card")],
+                contains_boundary: false,
             },
         );
 
@@ -2852,12 +2980,14 @@ mod tests {
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("card")],
+                contains_boundary: false,
             },
         );
 
@@ -2895,36 +3025,42 @@ mod tests {
                     WebUIFragment::for_loop("item", "items", "for-items"),
                     WebUIFragment::attribute_template("title", "attr-title"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-category-nav")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "for-items".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "attr-title".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("Products")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-category-nav".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<nav></nav>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<article></article>")],
+                contains_boundary: false,
             },
         );
 
@@ -2952,6 +3088,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-app")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -2974,36 +3111,43 @@ mod tests {
                         ..Default::default()
                     }),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-category-nav".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<nav></nav>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-search-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-grid")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-grid".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>grid</div>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-detail")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-detail".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>detail</div>")],
+                contains_boundary: false,
             },
         );
 
@@ -3045,6 +3189,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-app")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3057,6 +3202,8 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3079,30 +3226,36 @@ mod tests {
                         ..Default::default()
                     }),
                 ],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-account-nav".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<nav></nav>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-profile-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<profile></profile>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-order-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-order-detail")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-order-detail".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<detail></detail>")],
+                contains_boundary: false,
             },
         );
 
@@ -3149,6 +3302,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-app")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3161,6 +3315,8 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3173,30 +3329,35 @@ mod tests {
                     ),
                     WebUIFragment::for_loop("item", "items", "item-loop"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-filters".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-filter-panel")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "item-loop".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-item-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-filter-panel".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<filters></filters>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-item-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<item></item>")],
+                contains_boundary: false,
             },
         );
 
@@ -3231,6 +3392,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-app")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -3243,18 +3405,22 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-search-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("mp-product-grid")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mp-product-grid".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<grid></grid>")],
+                contains_boundary: false,
             },
         );
 
@@ -3320,6 +3486,8 @@ mod tests {
                     ],
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         for id in [
@@ -3333,6 +3501,7 @@ mod tests {
                 id.to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::raw("<x></x>")],
+                    contains_boundary: false,
                 },
             );
         }
@@ -3376,18 +3545,21 @@ mod tests {
                 "comp-a".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::component("comp-b")],
+                    contains_boundary: false,
                 },
             ),
             (
                 "comp-b".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::route("/", "page-a")],
+                    contains_boundary: false,
                 },
             ),
             (
                 "page-a".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                    contains_boundary: false,
                 },
             ),
         ]));
@@ -3415,12 +3587,14 @@ mod tests {
                 "shared-shell".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::route("details", "detail-page")],
+                    contains_boundary: false,
                 },
             ),
             (
                 "detail-page".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::raw("<p>Detail</p>")],
+                    contains_boundary: false,
                 },
             ),
         ]));
@@ -3460,6 +3634,7 @@ mod tests {
             "comp-a".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>leaf</p>")],
+                contains_boundary: false,
             },
         )])));
 
@@ -3480,12 +3655,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -3533,12 +3710,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -3578,12 +3757,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -3628,12 +3809,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -3664,12 +3847,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -3724,6 +3909,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("app-shell")],
+                contains_boundary: false,
             },
         );
 
@@ -3742,6 +3928,8 @@ mod tests {
                     }),
                     WebUIFragment::component("cart-panel"),
                 ],
+
+                contains_boundary: false,
             },
         );
 
@@ -3750,18 +3938,21 @@ mod tests {
             "my-navbar".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<nav/>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "page-about".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>About</h1>")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "cart-panel".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<aside>Cart</aside>")],
+                contains_boundary: false,
             },
         );
 
@@ -3862,18 +4053,22 @@ mod tests {
                     keep_alive: false,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>App</h1>"), WebUIFragment::outlet()],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "compose-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Compose</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -3913,12 +4108,15 @@ mod tests {
                     exact: true,
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "items-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Items</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -3961,12 +4159,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("authored-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "authored-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Card</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -4002,12 +4202,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("static-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "static-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Static</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -4039,6 +4241,7 @@ mod tests {
             "settings-dialog".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div class='dialog'>Settings</div>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::with_tokens(fragments, Vec::new());
@@ -4085,6 +4288,7 @@ mod tests {
             "my-dialog".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<div>Dialog</div>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::with_tokens(fragments, Vec::new());
@@ -4150,6 +4354,8 @@ mod tests {
                     ],
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
 
@@ -4165,6 +4371,7 @@ mod tests {
                 name.to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::raw(format!("<p>{name}</p>"))],
+                    contains_boundary: false,
                 },
             );
         }
@@ -4312,18 +4519,22 @@ mod tests {
                     cache_tags: vec!["folders".to_string()],
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>App</h1>"), WebUIFragment::outlet()],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "mail-thread".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Thread</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4369,18 +4580,22 @@ mod tests {
                     }],
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>App</h1>"), WebUIFragment::outlet()],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "compose-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Compose</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -4419,18 +4634,22 @@ mod tests {
                     }],
                     ..Default::default()
                 })],
+
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "app-shell".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>App</h1>"), WebUIFragment::outlet()],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "reply-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>Reply</p>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
diff --git a/crates/webui-handler/src/route_matcher.rs b/crates/webui-handler/src/route_matcher.rs
index caf4563a8..ac5278ca4 100644
--- a/crates/webui-handler/src/route_matcher.rs
+++ b/crates/webui-handler/src/route_matcher.rs
@@ -765,6 +765,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route_from(parent)],
+                contains_boundary: false,
             },
         )]));
         let index = CompiledRouteIndex::new(&protocol);
diff --git a/crates/webui-handler/src/streaming/checkpoint.rs b/crates/webui-handler/src/streaming/checkpoint.rs
index 1e58ea6ac..db9a3a107 100644
--- a/crates/webui-handler/src/streaming/checkpoint.rs
+++ b/crates/webui-handler/src/streaming/checkpoint.rs
@@ -1,67 +1,86 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Boundary envelope emission — the wire format half of a commit.
-//!
-//! A checkpoint carries only what changed since the previous one: the newly
-//! rendered component delta, first-delivery template metadata, and the state
-//! keys this surface actually reads.
+//! Version-2 checkpoint, update, span-completion, and terminal serialization.
 
 use super::inventory::{
     commit_checkpoint_inventory, expand_static_checkpoint_reachability,
     mark_streaming_template_sent, replace_checkpoint_reachability,
 };
-use super::{flush_streaming_transport, streaming_state};
+use super::state::StateUpdatePlan;
+use super::{flush_streaming_transport, streaming_state, MarkerBuffer};
 use crate::plugin::WebUiTemplatePayload;
 use crate::{
-    collect_hydration_state_into, write_selected_state, write_usize, write_webui_bootstrap, Result,
-    StateSelection, WebUIHandler, WebUIProcessContext, WebUiBootstrap,
+    collect_hydration_state_into, write_selected_state, write_webui_bootstrap, HandlerError,
+    Result, StateSelection, WebUIHandler, WebUIProcessContext, WebUiBootstrap,
 };
 
-use super::state::StateUpdatePlan;
-
 pub(super) const RECORD_KIND_FINAL_CHECKPOINT: usize = 0;
 pub(super) const RECORD_KIND_UPDATABLE_CHECKPOINT: usize = 1;
 pub(super) const RECORD_KIND_STATE_UPDATE: usize = 2;
-pub(super) const RECORD_KIND_TERMINAL: usize = 3;
+pub(super) const RECORD_KIND_SPAN_COMPLETION: usize = 3;
+pub(super) const RECORD_KIND_TERMINAL: usize = 4;
+const STREAMING_PROTOCOL_VERSION: usize = 2;
+
+/// The range-bearing record currently being committed.
+pub(super) enum RangeRecord {
+    Boundary {
+        instance_id: u32,
+        declaration_id: u32,
+        enclosing_span_instance_id: Option<u32>,
+        updatable: bool,
+    },
+    Span {
+        instance_id: u32,
+    },
+}
+
+impl RangeRecord {
+    fn target(&self) -> u32 {
+        match self {
+            Self::Boundary { instance_id, .. } | Self::Span { instance_id } => *instance_id,
+        }
+    }
+
+    fn kind(&self) -> usize {
+        match self {
+            Self::Boundary {
+                updatable: true, ..
+            } => RECORD_KIND_UPDATABLE_CHECKPOINT,
+            Self::Boundary {
+                updatable: false, ..
+            } => RECORD_KIND_FINAL_CHECKPOINT,
+            Self::Span { .. } => RECORD_KIND_SPAN_COMPLETION,
+        }
+    }
+}
 
 impl WebUIHandler {
-    pub(super) fn emit_streaming_checkpoint(
+    pub(super) fn emit_streaming_range_record(
         &self,
-        record_sequence: usize,
-        boundary_id: usize,
-        updatable: bool,
+        record: RangeRecord,
         context: &mut WebUIProcessContext,
     ) -> Result<()> {
         let first_checkpoint = context
             .streaming
             .as_ref()
             .is_some_and(|streaming| !streaming.bootstrap_sent);
-
-        // Commit the exact rendered roots before expanding the local metadata
-        // surface. The DOM inventory must never claim hidden descendants.
         let component_index = context.component_index;
         let needs_route_walk = {
             let streaming = streaming_state(context)?;
             commit_checkpoint_inventory(streaming)?;
             !expand_static_checkpoint_reachability(streaming)?
         };
-
         if needs_route_walk {
-            // Only a component surface containing authored routes needs request
-            // matching. Route-free surfaces use the startup-built integer graph.
-            // The protocol references are copied out first so they do not borrow
-            // `context` across the mutable streaming-state borrow below.
             let protocol = context.protocol;
             let request_path = context.request_path;
             let route_index = context.route_index;
             let reachable = {
                 let streaming = streaming_state(context)?;
-                let reachability = streaming.component_reachability;
                 crate::route_handler::collect_reachable_components_from_roots(
                     protocol,
                     &streaming.checkpoint_walk_roots,
-                    reachability,
+                    streaming.component_reachability,
                     request_path,
                     route_index,
                 )
@@ -69,25 +88,17 @@ impl WebUIHandler {
             replace_checkpoint_reachability(streaming_state(context)?, component_index, &reachable);
         }
 
-        // Move the reusable buffers out so plugin/state code can borrow them
-        // without retaining a borrow of the render context. Names are resolved
-        // once here; every downstream consumer reads them instead of re-hashing.
-        let (checkpoint_tags, checkpoint_names) = {
+        // Names are derived from the tag indices on demand: materializing them
+        // into a second buffer would allocate once per record for data that is
+        // only ever streamed through twice.
+        let checkpoint_tags = {
             let streaming = streaming_state(context)?;
             let reachability = streaming.component_reachability;
             let tags = std::mem::take(&mut streaming.checkpoint_tags);
-            let mut names = std::mem::take(&mut streaming.checkpoint_name_scratch);
-            names.clear();
-            names.reserve(tags.len());
-            for &index in &tags {
-                let Some(name) = reachability.name(index) else {
-                    return Err(crate::HandlerError::Invariant(
-                        "component reachability name is missing".to_string(),
-                    ));
-                };
-                names.push(name);
+            if tags.iter().any(|&index| reachability.name(index).is_none()) {
+                return Err(missing_reachability_name_error());
             }
-            (tags, names)
+            tags
         };
         let mut new_template_tags = {
             let streaming = streaming_state(context)?;
@@ -96,54 +107,32 @@ impl WebUIHandler {
         new_template_tags.clear();
         {
             let streaming = streaming_state(context)?;
-            for (&index, &name) in checkpoint_tags.iter().zip(checkpoint_names.iter()) {
+            let reachability = streaming.component_reachability;
+            for &index in &checkpoint_tags {
+                let Some(name) = reachability.name(index) else {
+                    return Err(missing_reachability_name_error());
+                };
                 if mark_streaming_template_sent(streaming, index)? {
                     new_template_tags.push(name);
                 }
             }
         }
 
-        // Rendered components emitted module importmaps inline before their
-        // declarative shadow roots. Emit the same metadata here only for
-        // reachable-but-unrendered descendants.
-        for &name in &new_template_tags {
-            if !context.rendered_components.contains(name) {
-                if let Some(css) = context
-                    .protocol
-                    .components
-                    .get(name)
-                    .map(|component| component.css.as_str())
-                    .filter(|css| !css.is_empty())
-                {
-                    self.emit_css_module_importmap(name, css, context)?;
-                }
-            }
-        }
-
         let template_payloads = context.plugin.as_ref().and_then(|plugin| {
             plugin.collect_template_payloads_slice(context.protocol, &new_template_tags)
         });
-        if template_payloads.is_none() {
-            if let Some(plugin) = context.plugin.as_ref() {
-                plugin.emit_templates_slice(
-                    context.protocol,
-                    &new_template_tags,
-                    context.nonce,
-                    context.writer,
-                )?;
-            }
-        }
-
-        // Hydration state covers this root surface even when a descendant is not
-        // initially rendered, so a client-side condition can create it without
-        // consulting a page-global state object.
-        let mut state_key_scratch = {
+        let (mut state_key_scratch, checkpoint_reachability) = {
             let streaming = streaming_state(context)?;
-            std::mem::take(&mut streaming.state_key_scratch)
+            (
+                std::mem::take(&mut streaming.state_key_scratch),
+                streaming.component_reachability,
+            )
         };
         let requires_full_state = collect_hydration_state_into(
             context.protocol,
-            checkpoint_names.iter().copied(),
+            checkpoint_tags
+                .iter()
+                .filter_map(|&index| checkpoint_reachability.name(index)),
             &mut state_key_scratch,
         );
         let chain = if first_checkpoint {
@@ -179,99 +168,111 @@ impl WebUIHandler {
                 }
             }
         }
+        let mut deferred_css_modules = Vec::new();
+        for &name in &new_template_tags {
+            if context.rendered_components.contains(name) {
+                continue;
+            }
+            if let Some(css) = context
+                .protocol
+                .components
+                .get(name)
+                .map(|component| component.css.as_str())
+                .filter(|css| !css.is_empty())
+            {
+                deferred_css_modules.push((name, css));
+            }
+        }
 
         let empty_payloads: [WebUiTemplatePayload<'_>; 0] = [];
         let payloads = template_payloads.as_deref().unwrap_or(&empty_payloads);
-        context
-            .writer
-            .write("<script type=\"application/json\" data-webui-boundary")?;
-        if let Some(nonce) = context.nonce {
-            context.writer.write(" nonce=\"")?;
-            context.writer.write(nonce)?;
-            context.writer.write("\"")?;
-        }
-        context.writer.write(">[1,")?;
-        write_usize(context.writer, record_sequence)?;
-        context.writer.write(",")?;
-        write_usize(
-            context.writer,
-            if updatable {
-                RECORD_KIND_UPDATABLE_CHECKPOINT
-            } else {
-                RECORD_KIND_FINAL_CHECKPOINT
-            },
-        )?;
-        context.writer.write(",")?;
-        write_usize(context.writer, boundary_id)?;
-        context.writer.write(",")?;
+        write_record_open(context, record.kind(), record.target())?;
+        let (declaration_id, enclosing_span_instance_id) = match record {
+            RangeRecord::Boundary {
+                declaration_id,
+                enclosing_span_instance_id,
+                ..
+            } => (Some(declaration_id), enclosing_span_instance_id),
+            RangeRecord::Span { .. } => (None, None),
+        };
+        let state_selection = if requires_full_state {
+            StateSelection::Full
+        } else {
+            StateSelection::BorrowedKeys(&state_key_scratch)
+        };
         let inventory = context
             .streaming
             .as_ref()
             .map_or("", |streaming| streaming.inventory_hex.as_str());
-        {
-            let state_selection = if requires_full_state {
-                StateSelection::Full
-            } else {
-                StateSelection::BorrowedKeys(&state_key_scratch)
-            };
-            write_webui_bootstrap(
-                context.writer,
-                &mut context.json_scratch,
-                WebUiBootstrap {
-                    state: context.state,
-                    state_selection,
-                    chain: &chain,
-                    inventory,
-                    nonce: context.nonce,
-                    css_hrefs: &css_hrefs,
-                    style_specs: &style_specs,
-                    templates: payloads,
-                },
-            )?;
-        }
+        write_webui_bootstrap(
+            context.writer,
+            &mut context.json_scratch,
+            WebUiBootstrap {
+                declaration_id,
+                enclosing_span_instance_id,
+                state: context.state,
+                state_selection,
+                chain: &chain,
+                inventory,
+                nonce: context.nonce,
+                css_hrefs: &css_hrefs,
+                style_specs: &style_specs,
+                templates: payloads,
+            },
+        )?;
         context.writer.write("]</script>")?;
 
+        if let Some(importmap) =
+            crate::css_module::build_importmap_tag_batch(&deferred_css_modules, context.nonce)
+        {
+            context.writer.write(&importmap)?;
+        }
+        if template_payloads.is_none() {
+            if let Some(plugin) = context.plugin.as_ref() {
+                plugin.emit_templates_slice(
+                    context.protocol,
+                    &new_template_tags,
+                    context.nonce,
+                    context.writer,
+                )?;
+            }
+        }
         if let Some(plugin) = context.plugin.as_ref() {
             plugin.emit_bootstrap_extension_payloads(payloads, context.nonce, context.writer)?;
         }
         context.writer.write("<webui-hydrate></webui-hydrate>")?;
         flush_streaming_transport(context)?;
-        if let Some(streaming) = context.streaming.as_mut() {
-            streaming.bootstrap_sent = true;
-            if updatable {
-                let target = boundary_id;
-                if streaming.update_plans.len() <= target {
-                    streaming.update_plans.resize_with(target + 1, || None);
-                }
-                streaming.update_plans[target] = Some(StateUpdatePlan {
-                    requires_full_state,
-                    keys: if requires_full_state {
-                        Vec::new()
-                    } else {
-                        state_key_scratch.iter().copied().map(Box::from).collect()
-                    },
-                });
+
+        let target = usize::try_from(record.target())
+            .map_err(|_| invalid_record_target_error(record.target()))?;
+        if let RangeRecord::Boundary {
+            updatable: true, ..
+        } = record
+        {
+            let streaming = streaming_state(context)?;
+            if streaming.update_plans.len() <= target {
+                streaming.update_plans.resize_with(target + 1, || None);
             }
-            state_key_scratch.clear();
-            streaming.state_key_scratch = state_key_scratch;
-            // Reset the exact-capture buffers for the next checkpoint, retaining
-            // their capacity.
-            let mut checkpoint_tags = checkpoint_tags;
-            checkpoint_tags.clear();
-            streaming.checkpoint_tags = checkpoint_tags;
-            let mut checkpoint_names = checkpoint_names;
-            checkpoint_names.clear();
-            streaming.checkpoint_name_scratch = checkpoint_names;
-            streaming.checkpoint_walk_roots.clear();
-            new_template_tags.clear();
-            streaming.template_tag_scratch = new_template_tags;
-            css_hrefs.clear();
-            streaming.css_href_scratch = css_hrefs;
-            style_specs.clear();
-            streaming.style_spec_scratch = style_specs;
-            streaming.checkpoint_seen.fill(0);
-            streaming.checkpoint_needs_expansion = false;
+            streaming.update_plans[target] = Some(StateUpdatePlan {
+                requires_full_state,
+                keys: if requires_full_state {
+                    Vec::new()
+                } else {
+                    state_key_scratch.iter().copied().map(Box::from).collect()
+                },
+            });
         }
+        finish_capture(
+            context,
+            CapturedBuffers {
+                checkpoint_tags,
+                template_tags: new_template_tags,
+                state_keys: state_key_scratch,
+                css_hrefs,
+                style_specs,
+            },
+        );
+        streaming_state(context)?.bootstrap_sent = true;
         Ok(())
     }
 
@@ -280,21 +281,11 @@ impl WebUIHandler {
         record_sequence: usize,
         context: &mut WebUIProcessContext,
     ) -> Result<()> {
+        write_script_open(context)?;
+        write_record_header(context.writer, record_sequence, RECORD_KIND_TERMINAL, 0)?;
         context
             .writer
-            .write("<script type=\"application/json\" data-webui-boundary")?;
-        if let Some(nonce) = context.nonce {
-            context.writer.write(" nonce=\"")?;
-            context.writer.write(nonce)?;
-            context.writer.write("\"")?;
-        }
-        context.writer.write(">[1,")?;
-        write_usize(context.writer, record_sequence)?;
-        context.writer.write(",")?;
-        write_usize(context.writer, RECORD_KIND_TERMINAL)?;
-        context
-            .writer
-            .write(",0,{}]</script><webui-hydrate></webui-hydrate>")?;
+            .write("{}]</script><webui-hydrate></webui-hydrate>")?;
         flush_streaming_transport(context)
     }
 
@@ -309,28 +300,20 @@ impl WebUIHandler {
         }
         let Some(plan) = context
             .streaming
-            .as_ref()
-            .and_then(|streaming| streaming.update_plans.get(boundary_id))
-            .and_then(Option::as_ref)
+            .as_mut()
+            .and_then(|streaming| streaming.update_plans.get_mut(boundary_id))
+            .and_then(Option::take)
         else {
             return Err(super::error::boundary_not_updatable_error(boundary_id));
         };
 
-        context
-            .writer
-            .write("<script type=\"application/json\" data-webui-boundary")?;
-        if let Some(nonce) = context.nonce {
-            context.writer.write(" nonce=\"")?;
-            context.writer.write(nonce)?;
-            context.writer.write("\"")?;
-        }
-        context.writer.write(">[1,")?;
-        write_usize(context.writer, record_sequence)?;
-        context.writer.write(",")?;
-        write_usize(context.writer, RECORD_KIND_STATE_UPDATE)?;
-        context.writer.write(",")?;
-        write_usize(context.writer, boundary_id)?;
-        context.writer.write(",")?;
+        write_script_open(context)?;
+        write_record_header(
+            context.writer,
+            record_sequence,
+            RECORD_KIND_STATE_UPDATE,
+            boundary_id,
+        )?;
         let selection = if plan.requires_full_state {
             StateSelection::Full
         } else {
@@ -345,6 +328,107 @@ impl WebUIHandler {
         context
             .writer
             .write("]</script><webui-hydrate></webui-hydrate>")?;
-        flush_streaming_transport(context)
+        flush_streaming_transport(context)?;
+        let Some(slot) = context
+            .streaming
+            .as_mut()
+            .and_then(|streaming| streaming.update_plans.get_mut(boundary_id))
+        else {
+            return Err(HandlerError::Invariant(
+                "streaming update projection slot disappeared".to_string(),
+            ));
+        };
+        *slot = Some(plan);
+        Ok(())
+    }
+}
+
+fn write_record_open(
+    context: &mut WebUIProcessContext<'_, '_, '_>,
+    kind: usize,
+    target: u32,
+) -> Result<()> {
+    let record_sequence = streaming_state(context)?.next_record_sequence;
+    let target = usize::try_from(target).map_err(|_| invalid_record_target_error(target))?;
+    write_script_open(context)?;
+    write_record_header(context.writer, record_sequence, kind, target)
+}
+
+/// Emit `>[<version>,<sequence>,<kind>,<target>,` in one writer call.
+fn write_record_header(
+    writer: &mut dyn crate::ResponseWriter,
+    record_sequence: usize,
+    kind: usize,
+    target: usize,
+) -> Result<()> {
+    let mut buffer = MarkerBuffer::new();
+    buffer.push_str(">[")?;
+    buffer.push_usize(STREAMING_PROTOCOL_VERSION)?;
+    buffer.push_str(",")?;
+    buffer.push_usize(record_sequence)?;
+    buffer.push_str(",")?;
+    buffer.push_usize(kind)?;
+    buffer.push_str(",")?;
+    buffer.push_usize(target)?;
+    buffer.push_str(",")?;
+    buffer.flush_to(writer)
+}
+
+fn write_script_open(context: &mut WebUIProcessContext<'_, '_, '_>) -> Result<()> {
+    context
+        .writer
+        .write("<script type=\"application/json\" data-webui-boundary")?;
+    if let Some(nonce) = context.nonce {
+        context.writer.write(" nonce=\"")?;
+        context
+            .writer
+            .write(&crate::html_encode::encode_safe(nonce))?;
+        context.writer.write("\"")?;
     }
+    Ok(())
+}
+
+/// Scratch buffers borrowed for one record and returned for reuse.
+struct CapturedBuffers<'a> {
+    checkpoint_tags: Vec<u32>,
+    template_tags: Vec<&'a str>,
+    state_keys: Vec<&'a str>,
+    css_hrefs: Vec<&'a str>,
+    style_specs: Vec<&'a str>,
+}
+
+fn finish_capture<'a>(
+    context: &mut WebUIProcessContext<'a, '_, '_>,
+    mut buffers: CapturedBuffers<'a>,
+) {
+    let Some(streaming) = context.streaming.as_mut() else {
+        return;
+    };
+    buffers.checkpoint_tags.clear();
+    streaming.checkpoint_tags = buffers.checkpoint_tags;
+    streaming.checkpoint_walk_roots.clear();
+    buffers.template_tags.clear();
+    streaming.template_tag_scratch = buffers.template_tags;
+    buffers.state_keys.clear();
+    streaming.state_key_scratch = buffers.state_keys;
+    buffers.css_hrefs.clear();
+    streaming.css_href_scratch = buffers.css_hrefs;
+    buffers.style_specs.clear();
+    streaming.style_spec_scratch = buffers.style_specs;
+    streaming.checkpoint_seen.fill(0);
+    streaming.checkpoint_needs_expansion = false;
+}
+
+#[cold]
+#[inline(never)]
+fn missing_reachability_name_error() -> HandlerError {
+    HandlerError::Invariant("component reachability name is missing".to_string())
+}
+
+#[cold]
+#[inline(never)]
+fn invalid_record_target_error(target: u32) -> HandlerError {
+    HandlerError::Invariant(format!(
+        "streaming record target {target} does not fit usize"
+    ))
 }
diff --git a/crates/webui-handler/src/streaming/error.rs b/crates/webui-handler/src/streaming/error.rs
index f83300640..1b58d97fe 100644
--- a/crates/webui-handler/src/streaming/error.rs
+++ b/crates/webui-handler/src/streaming/error.rs
@@ -1,31 +1,9 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Cold constructors for streaming boundary diagnostics.
-//!
-//! These are the only paths that allocate error strings, so each is marked
-//! `#[cold]` and `#[inline(never)]`: an inlined error builder perturbs the
-//! layout of the hot render loop it was inlined into. See
-//! `.github/skills/diagnostics/SKILL.md`.
+//! Cold constructors for actionable streaming-session failures.
 
-use crate::{HandlerError, Result, StreamingBoundaryError};
-
-use super::root::STREAMING_ROOT_PREFIX;
-
-pub(super) fn parse_boundary_sequence(signal: &str, sequence: &str) -> Result<usize> {
-    if sequence.is_empty() {
-        return Err(streaming_boundary_error(signal, "missing decimal sequence"));
-    }
-    if !sequence.bytes().all(|byte| byte.is_ascii_digit()) {
-        return Err(streaming_boundary_error(
-            signal,
-            "sequence must contain only decimal digits",
-        ));
-    }
-    sequence
-        .parse::<usize>()
-        .map_err(|_| streaming_boundary_error(signal, "sequence exceeds the platform limit"))
-}
+use crate::{HandlerError, StreamingBoundaryError};
 
 #[cold]
 #[inline(never)]
@@ -36,47 +14,33 @@ pub(crate) fn streaming_boundary_error(signal: &str, reason: &str) -> HandlerErr
     }))
 }
 
-/// A streamed component host (`streaming_root:<tag>`) was authored outside any
-/// `<boundary>`. Such a host can never be progressively activated, so the
-/// streaming render fails with an actionable structured error instead of
-/// emitting dead markup. Cold and out-of-line: reuses the boxed
-/// [`HandlerError::StreamingBoundary`] variant so no error widens the small
-/// hot-path `Result`.
 #[cold]
 #[inline(never)]
 pub(super) fn streaming_root_outside_boundary_error(tag: &str) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("{STREAMING_ROOT_PREFIX}{tag}"),
-        reason: format!(
-            "streamed component host <{tag}> is outside any <boundary>; \
-             author the host, or its matched <route>, inside a boundary so it can be \
-             progressively hydrated"
-        ),
-    }))
+    streaming_boundary_error(
+        tag,
+        "component host has no boundary or generated component span that can activate it; \
+         place it inside <boundary> or inside a component that contains a runtime boundary",
+    )
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn missing_streaming_root_error(tag: &str) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("{STREAMING_ROOT_PREFIX}{tag}"),
-        reason: format!(
-            "component <{tag}> has no matching compiler-owned root signal at its opening-tag \
-             close; rebuild the protocol and place the host inside an explicit <boundary>"
-        ),
-    }))
+    streaming_boundary_error(
+        tag,
+        "component host has no compiler-owned streaming_root signal; rebuild the protocol with \
+         matching parser and handler versions",
+    )
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn misplaced_streaming_root_error(tag: &str, expected: &str) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("{STREAMING_ROOT_PREFIX}{tag}"),
-        reason: format!(
-            "root signal for <{tag}> is misplaced: expected {expected}; rebuild the protocol \
-             with matching parser and handler versions"
-        ),
-    }))
+    streaming_boundary_error(
+        tag,
+        &format!("component root signal is misplaced; expected {expected}"),
+    )
 }
 
 #[cold]
@@ -85,107 +49,131 @@ pub(super) fn mismatched_streaming_root_error(
     signal_tag: &str,
     component_tag: &str,
 ) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("{STREAMING_ROOT_PREFIX}{signal_tag}"),
-        reason: format!(
-            "root signal names <{signal_tag}>, but the opening host renders component \
-             <{component_tag}>; rebuild the protocol so the tags match"
+    streaming_boundary_error(
+        signal_tag,
+        &format!(
+            "root signal names <{signal_tag}>, but the component fragment renders \
+             <{component_tag}>; rebuild the protocol"
         ),
-    }))
+    )
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn generated_streaming_root_error(tag: &str) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("{STREAMING_ROOT_PREFIX}{tag}"),
-        reason: format!(
-            "handler-generated route host <{tag}> was not marked for streaming before it \
-             rendered; place the matched <route> inside an explicit <boundary>"
-        ),
-    }))
+    streaming_boundary_error(
+        tag,
+        "handler-generated route host was not prepared for streaming",
+    )
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn boundary_not_updatable_error(boundary_id: usize) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: format!("state_update:{boundary_id}"),
-        reason: "the target boundary was committed as final; commit it with \
-                 BoundaryMode::Updatable before sending state updates"
-            .to_string(),
-    }))
+    streaming_boundary_error(
+        "update",
+        &format!(
+            "boundary instance {boundary_id} was committed as final; resume it with \
+             BoundaryMode::Updatable before sending updates"
+        ),
+    )
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn state_update_type_error() -> HandlerError {
-    HandlerError::TypeError(
-        "streaming state updates require a JSON object so projected keys can be \
-         applied through component setState()"
-            .to_string(),
-    )
+    HandlerError::TypeError("streaming state updates require a JSON object patch".to_string())
 }
 
 #[cold]
 #[inline(never)]
 pub(super) fn boundary_order_error(operation: &str, reason: &str) -> HandlerError {
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: operation.to_string(),
-        reason: reason.to_string(),
-    }))
+    streaming_boundary_error(operation, reason)
 }
 
 #[cold]
 #[inline(never)]
-pub(super) fn unknown_boundary_name_error(name: &str, valid: &[String]) -> HandlerError {
-    let suggestion = closest_name(name, valid);
-    let mut reason = format!("unknown boundary name `{name}`");
-    if let Some(suggestion) = suggestion {
-        reason.push_str("; did you mean `");
-        reason.push_str(suggestion);
-        reason.push_str("`?");
-    }
-    if !valid.is_empty() {
-        reason.push_str(" valid names: ");
-        for (index, candidate) in valid.iter().enumerate() {
-            if index != 0 {
-                reason.push_str(", ");
-            }
-            reason.push('`');
-            reason.push_str(candidate);
-            reason.push('`');
-        }
-    }
-    HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-        signal: name.to_string(),
-        reason,
-    }))
+pub(super) fn continuation_limit_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "continuation",
+        &format!(
+            "continuation depth exceeds {limit}; split deeply nested components or directives"
+        ),
+    )
 }
 
-fn closest_name<'a>(target: &str, candidates: &'a [String]) -> Option<&'a str> {
-    candidates
-        .iter()
-        .min_by_key(|candidate| levenshtein(target, candidate))
-        .map(String::as_str)
-}
-
-fn levenshtein(left: &str, right: &str) -> usize {
-    let right_len = right.chars().count();
-    let mut previous: Vec<usize> = (0..=right_len).collect();
-    let mut current = vec![0; right_len + 1];
-    for (left_index, left_char) in left.chars().enumerate() {
-        current[0] = left_index + 1;
-        for (right_index, right_char) in right.chars().enumerate() {
-            current[right_index + 1] = if left_char == right_char {
-                previous[right_index]
-            } else {
-                1 + previous[right_index]
-                    .min(previous[right_index + 1])
-                    .min(current[right_index])
-            };
-        }
-        std::mem::swap(&mut previous, &mut current);
-    }
-    previous[right_len]
+#[cold]
+#[inline(never)]
+pub(super) fn boundary_limit_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "boundary",
+        &format!("runtime boundary occurrence count exceeds {limit}; reduce repeated boundaries"),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn span_limit_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "component span",
+        &format!(
+            "open component span count exceeds {limit}; reduce boundary-bearing component nesting"
+        ),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn span_nesting_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "component span",
+        &format!("component span nesting exceeds {limit}; flatten boundary-bearing components"),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn invalid_boundary_key_error(
+    declaration_id: u32,
+    name: &str,
+    reason: &str,
+) -> HandlerError {
+    streaming_boundary_error(
+        name,
+        &format!(
+            "boundary declaration {declaration_id} has an invalid runtime key: {reason}; \
+             keys must resolve to a finite JSON number or string"
+        ),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn duplicate_boundary_key_error(
+    declaration_id: u32,
+    name: &str,
+    key: &str,
+) -> HandlerError {
+    streaming_boundary_error(
+        name,
+        &format!(
+            "boundary declaration {declaration_id} produced duplicate key {key}; \
+             every repeated occurrence must have a unique key"
+        ),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn keyed_instance_limit_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "boundary key",
+        &format!("keyed boundary occurrence count exceeds {limit}; reduce repeated instances"),
+    )
+}
+
+#[cold]
+#[inline(never)]
+pub(super) fn malformed_span_signal_error(signal: &str, reason: &str) -> HandlerError {
+    streaming_boundary_error(signal, reason)
 }
diff --git a/crates/webui-handler/src/streaming/mod.rs b/crates/webui-handler/src/streaming/mod.rs
index 5c3a0c50c..88be732cf 100644
--- a/crates/webui-handler/src/streaming/mod.rs
+++ b/crates/webui-handler/src/streaming/mod.rs
@@ -1,32 +1,16 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Progressive streaming hydration (`WebUIHandler::render_streaming`).
-//!
-//! An opt-in render mode in which each compile-time `<boundary>` commits an
-//! independently hydratable island while the response is still open, instead
-//! of deferring every island to one page-wide `#webui-data` block at
-//! `body_end`. See DESIGN.md, "Progressive Streaming Hydration"
-//! for the normative contract.
-//!
-//! The split mirrors the lifecycle of a single boundary:
-//!
-//! - [`state`] holds the request-local render state and the `head_start`
-//!   precondition.
-//! - [`root`] marks streamed SSR hosts so they defer until their boundary
-//!   commits.
-//! - [`inventory`] tracks what each checkpoint rendered and can reach.
-//! - [`checkpoint`] writes the boundary envelope.
-//! - [`error`] holds the cold diagnostic constructors.
+//! Runtime-discovered progressive streaming hydration.
 
 mod checkpoint;
 mod error;
 mod inventory;
 mod owned;
-mod plan;
 mod root;
 mod session;
 mod state;
+mod vm;
 
 use serde_json::Value;
 
@@ -38,37 +22,127 @@ use crate::{
 
 pub(crate) use error::streaming_boundary_error;
 pub(crate) use inventory::{record_checkpoint_tag, streaming_template_already_sent};
-pub use owned::{BufferSink, SessionOptions, StreamingSession};
-pub(crate) use plan::{PreparedStreamingEntryPlan, StreamingEntryPlan};
+pub use owned::{BufferSink, SessionOptions, StreamStep, StreamingSession};
 pub(crate) use root::{
     consume_streaming_component_root, ensure_no_pending_streaming_root,
     prepare_generated_streaming_root, validate_pending_streaming_root,
     validate_streaming_root_opening, ComponentHostOrigin,
 };
-pub use session::{BoundaryId, BoundaryMode, StreamingResponse};
-pub(crate) use state::{validate_streaming_head_start, StreamingRenderState};
+pub use session::{
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, SpanInstanceId,
+    StreamStatus, StreamingResponse, MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH,
+    MAX_KEYED_INSTANCES, MAX_OPEN_SPANS, MAX_SPAN_NESTING,
+};
+pub(crate) use state::StreamingRenderState;
+pub(crate) use vm::PreparedContinuationStatePlan;
 
-use crate::write_usize;
-use error::parse_boundary_sequence;
 use root::process_streaming_root_signal;
-use state::{
-    increment_streaming_boundary_id, increment_streaming_record_sequence,
-    require_streaming_head_start, BOUNDARY_END_PREFIX, BOUNDARY_START_PREFIX,
-};
+use state::require_streaming_head_start;
 
 pub(crate) const STREAMING_MARKER: &str = "<meta name=\"webui-streaming\" content=\"1\">";
 
-/// Request-local streaming sink selected once at
-/// [`WebUIHandler::render_streaming`] entry.
+/// Fixed-capacity scratch used to assemble short streaming markers and record
+/// headers.
 ///
-/// Wrapping the transport maps the internal streaming flush hook to the
-/// caller's concrete [`FlushWriter`] with no second virtual dispatch.
+/// Every `ResponseWriter::write` is a dynamic call that reaches the transport,
+/// so composing a marker byte-piece by byte-piece costs several indirections
+/// per boundary. Formatting into this stack buffer collapses each marker or
+/// record header into a single write.
+pub(super) struct MarkerBuffer {
+    bytes: [u8; Self::CAPACITY],
+    len: usize,
+}
+
+impl MarkerBuffer {
+    const CAPACITY: usize = 96;
+
+    pub(super) const fn new() -> Self {
+        Self {
+            bytes: [0; Self::CAPACITY],
+            len: 0,
+        }
+    }
+
+    pub(super) fn push_str(&mut self, text: &str) -> Result<()> {
+        let end = self
+            .len
+            .checked_add(text.len())
+            .filter(|end| *end <= Self::CAPACITY)
+            .ok_or_else(marker_overflow_error)?;
+        self.bytes[self.len..end].copy_from_slice(text.as_bytes());
+        self.len = end;
+        Ok(())
+    }
+
+    pub(super) fn push_usize(&mut self, mut value: usize) -> Result<()> {
+        let mut digits = [0u8; 20];
+        let mut offset = digits.len();
+        loop {
+            offset = offset.checked_sub(1).ok_or_else(marker_overflow_error)?;
+            digits[offset] =
+                b'0' + u8::try_from(value % 10).map_err(|_| marker_overflow_error())?;
+            value /= 10;
+            if value == 0 {
+                break;
+            }
+        }
+        let end = self
+            .len
+            .checked_add(digits.len() - offset)
+            .filter(|end| *end <= Self::CAPACITY)
+            .ok_or_else(marker_overflow_error)?;
+        self.bytes[self.len..end].copy_from_slice(&digits[offset..]);
+        self.len = end;
+        Ok(())
+    }
+
+    pub(super) fn flush_to<W: ResponseWriter + ?Sized>(&mut self, writer: &mut W) -> Result<()> {
+        let text =
+            std::str::from_utf8(&self.bytes[..self.len]).map_err(|_| marker_overflow_error())?;
+        let result = writer.write(text);
+        self.len = 0;
+        result
+    }
+}
+
+/// Write `<prefix><id>-->` with a single writer call.
+pub(super) fn write_range_marker<W: ResponseWriter + ?Sized>(
+    writer: &mut W,
+    prefix: &str,
+    id: u32,
+) -> Result<()> {
+    let mut buffer = MarkerBuffer::new();
+    buffer.push_str(prefix)?;
+    buffer.push_usize(usize::try_from(id).map_err(|_| marker_overflow_error())?)?;
+    buffer.push_str("-->")?;
+    buffer.flush_to(writer)
+}
+
+#[cold]
+#[inline(never)]
+fn marker_overflow_error() -> HandlerError {
+    HandlerError::Invariant("streaming marker exceeded its fixed buffer".to_string())
+}
+
 struct StreamingSink<'w, W: FlushWriter + ?Sized> {
     transport: &'w mut W,
+    component_opening: Option<ComponentOpening>,
+    written: usize,
+    flushed: usize,
+}
+
+struct ComponentOpening {
+    bytes: String,
+    root_offset: Option<usize>,
 }
 
 impl<W: FlushWriter + ?Sized> ResponseWriter for StreamingSink<'_, W> {
     fn write(&mut self, content: &str) -> Result<()> {
+        if let Some(opening) = self.component_opening.as_mut() {
+            opening.bytes.push_str(content);
+            return Ok(());
+        }
+        self.written = self.written.wrapping_add(content.len());
         self.transport.write(content)
     }
 
@@ -77,8 +151,101 @@ impl<W: FlushWriter + ?Sized> ResponseWriter for StreamingSink<'_, W> {
     }
 
     fn stream_flush(&mut self) -> Result<()> {
+        if self.component_opening.is_some() {
+            return Err(HandlerError::Invariant(
+                "streaming flush attempted while a component opening was buffered".to_string(),
+            ));
+        }
+        // A flush at a position already delivered would cost a syscall without
+        // releasing a byte, so semantic steps that produced no output between
+        // two checkpoints collapse into the earlier flush.
+        if self.written == self.flushed {
+            return Ok(());
+        }
+        self.flushed = self.written;
         self.transport.flush()
     }
+
+    fn stream_begin_component(&mut self) -> Result<()> {
+        if self.component_opening.is_some() {
+            return Err(HandlerError::Invariant(
+                "nested component opening buffers are not valid".to_string(),
+            ));
+        }
+        self.component_opening = Some(ComponentOpening {
+            bytes: String::with_capacity(128),
+            root_offset: None,
+        });
+        Ok(())
+    }
+
+    fn stream_mark_component_root(&mut self) -> Result<()> {
+        let Some(opening) = self.component_opening.as_mut() else {
+            return Err(HandlerError::Invariant(
+                "component root marker has no buffered opening".to_string(),
+            ));
+        };
+        if opening.root_offset.replace(opening.bytes.len()).is_some() {
+            return Err(HandlerError::Invariant(
+                "component opening contains duplicate root markers".to_string(),
+            ));
+        }
+        Ok(())
+    }
+
+    fn stream_commit_component(
+        &mut self,
+        span_id: Option<u32>,
+        enclosing_span_id: Option<u32>,
+        deferred: bool,
+    ) -> Result<()> {
+        let Some(opening) = self.component_opening.take() else {
+            return Err(HandlerError::Invariant(
+                "component opening commit has no buffered bytes".to_string(),
+            ));
+        };
+        let Some(root_offset) = opening.root_offset else {
+            return Err(HandlerError::Invariant(
+                "buffered component opening has no compiler root marker".to_string(),
+            ));
+        };
+        if let Some(id) = span_id {
+            write_range_marker(self, "<!--ws:", id)?;
+        }
+        self.write(&opening.bytes[..root_offset])?;
+        if deferred {
+            self.write(" data-ws")?;
+            if let Some(id) = span_id {
+                self.write(" data-ws-span=\"")?;
+                write_u32(self, id)?;
+                self.write("\"")?;
+            }
+            if let Some(id) = enclosing_span_id {
+                self.write(" data-ws-enclosing=\"")?;
+                write_u32(self, id)?;
+                self.write("\"")?;
+            }
+        }
+        self.write(&opening.bytes[root_offset..])
+    }
+}
+
+fn write_u32<W: ResponseWriter + ?Sized>(writer: &mut W, mut value: u32) -> Result<()> {
+    if value == 0 {
+        return writer.write("0");
+    }
+    let mut digits = [0u8; 10];
+    let mut offset = digits.len();
+    while value != 0 {
+        offset -= 1;
+        let digit = u8::try_from(value % 10)
+            .map_err(|_| HandlerError::Invariant("invalid decimal digit".to_string()))?;
+        digits[offset] = b'0' + digit;
+        value /= 10;
+    }
+    let value = std::str::from_utf8(&digits[offset..])
+        .map_err(|_| HandlerError::Invariant("invalid decimal ID bytes".to_string()))?;
+    writer.write(value)
 }
 
 pub(super) fn streaming_state<'a, 'data>(
@@ -97,8 +264,6 @@ pub(super) fn flush_streaming_transport(
             "streaming flush requested outside a streaming render".to_string(),
         ));
     }
-    // The sink resets its own dirty flag as part of flushing, so there is no
-    // separate `dirty.set(false)` here.
     context.writer.stream_flush()
 }
 
@@ -115,7 +280,7 @@ impl WebUIHandler {
         {
             return Err(streaming_boundary_error(
                 value,
-                "structural signal arrived after the body_end terminal record",
+                "structural signal arrived after body_end",
             ));
         }
 
@@ -132,125 +297,30 @@ impl WebUIHandler {
             return Ok(true);
         }
 
-        if value.starts_with("streaming_root") {
-            // Compiler-owned streamed SSR root marker: inject ` data-ws` inside
-            // the component's opening tag (the parser placed this signal before
-            // `>`). The host must live inside an open boundary, otherwise it can
-            // never be activated — fail with a cold structured error.
+        if value.starts_with(root::STREAMING_ROOT_PREFIX) {
             process_streaming_root_signal(value, context)?;
             return Ok(true);
         }
-        if let Some(raw_sequence) = value.strip_prefix(BOUNDARY_START_PREFIX) {
-            require_streaming_head_start(context, "streaming boundary")?;
-            let sequence = parse_boundary_sequence(value, raw_sequence)?;
-            let streaming = streaming_state(context)?;
-            if let Some(active) = streaming.active_boundary {
-                return Err(streaming_boundary_error(
-                    value,
-                    &format!("nested boundary {sequence}; boundary {active} is still open"),
-                ));
-            }
-            if sequence != streaming.next_boundary_id {
-                return Err(streaming_boundary_error(
-                    value,
-                    &format!(
-                        "expected boundary sequence {}, received {sequence}",
-                        streaming.next_boundary_id
-                    ),
-                ));
-            }
-            context.writer.write("<!--wb:")?;
-            write_usize(context.writer, sequence)?;
-            context.writer.write("-->")?;
-            streaming_state(context)?.active_boundary = Some(sequence);
-            return Ok(true);
-        }
-        if value.starts_with("boundary_start") {
-            require_streaming_head_start(context, "streaming boundary")?;
-            return Err(streaming_boundary_error(
-                value,
-                "expected `boundary_start:<decimal sequence>`",
-            ));
-        }
-
-        if let Some(raw_sequence) = value.strip_prefix(BOUNDARY_END_PREFIX) {
-            require_streaming_head_start(context, "streaming boundary")?;
-            let sequence = parse_boundary_sequence(value, raw_sequence)?;
-            let active = streaming_state(context)?.active_boundary.ok_or_else(|| {
-                streaming_boundary_error(value, "boundary end has no matching start")
-            })?;
-            if active != sequence {
-                return Err(streaming_boundary_error(
-                    value,
-                    &format!("boundary {active} is open, but boundary {sequence} ended"),
-                ));
-            }
-
-            context.writer.write("<!--/wb:")?;
-            write_usize(context.writer, sequence)?;
-            context.writer.write("-->")?;
-            let (record_sequence, updatable) = {
-                let streaming = streaming_state(context)?;
-                (
-                    streaming.next_record_sequence,
-                    streaming.checkpoint_updatable,
-                )
-            };
-            self.emit_streaming_checkpoint(record_sequence, sequence, updatable, context)?;
-            let streaming = streaming_state(context)?;
-            streaming.active_boundary = None;
-            streaming.checkpoint_updatable = false;
-            increment_streaming_boundary_id(value, streaming)?;
-            increment_streaming_record_sequence(value, streaming)?;
-            return Ok(true);
-        }
-        if value.starts_with("boundary_end") {
-            require_streaming_head_start(context, "streaming boundary")?;
-            return Err(streaming_boundary_error(
-                value,
-                "expected `boundary_end:<decimal sequence>`",
-            ));
-        }
 
         if value == "body_end" {
             require_streaming_head_start(context, "body_end")?;
-            let (active_boundary, body_ended, next_record_sequence) = {
-                let streaming = streaming_state(context)?;
-                (
-                    streaming.active_boundary,
-                    streaming.body_ended,
-                    streaming.next_record_sequence,
-                )
-            };
-            if let Some(active) = active_boundary {
+            if context
+                .streaming
+                .as_ref()
+                .is_some_and(|streaming| streaming.active_boundary.is_some())
+            {
                 return Err(streaming_boundary_error(
                     value,
-                    &format!("body ended while boundary {active} was still open"),
+                    "body ended while a boundary body was still rendering",
                 ));
             }
-            if body_ended {
-                return Err(streaming_boundary_error(value, "duplicate body_end signal"));
-            }
             if let Some(html) = context.body_inject {
                 context.writer.write(html)?;
             }
-            // Reserved-state `bodyEnd` HTML, in the same relative position as
-            // the ordinary render path: after the host `RenderOptions` inject
-            // and before the terminal record, so both modes agree byte for
-            // byte on ordering.
             if let Some(html) = context.state_inject.body_end {
                 context.writer.write(html)?;
             }
-
-            // The terminal flush commits any raw/native tail bytes. Registered
-            // component hosts cannot appear outside an explicit boundary, so a
-            // rootless tail never needs another template or state projection.
-            // Keeping the envelope empty also prevents whitespace or a body
-            // injection from re-sending complete state on legacy protocols.
-            self.emit_streaming_terminal(next_record_sequence, context)?;
-            let streaming = streaming_state(context)?;
-            streaming.body_ended = true;
-            increment_streaming_record_sequence(value, streaming)?;
+            streaming_state(context)?.body_ended = true;
             context.body_end_emitted = true;
             return Ok(true);
         }
@@ -260,16 +330,13 @@ impl WebUIHandler {
         } else if value == "body_start" {
             require_streaming_head_start(context, "body_start")?;
         }
-
         Ok(false)
     }
 
-    /// Render an opt-in progressive hydration response.
+    /// Render every runtime boundary in document order as final.
     ///
-    /// Boundary signals are validated in document order and every committed
-    /// checkpoint is flushed through `writer`. Unlike [`Self::render`], this
-    /// mode emits boundary envelopes instead of a page-wide `#webui-data`
-    /// block and requires structural `head_start` and `body_end` signals.
+    /// Hosts that need asynchronous work between occurrences should use
+    /// [`Self::stream_response`] or [`StreamingSession`].
     pub fn render_streaming<'a, W: FlushWriter + ?Sized>(
         &self,
         protocol: &'a Protocol,
@@ -278,12 +345,15 @@ impl WebUIHandler {
         writer: &'a mut W,
     ) -> Result<()> {
         let mut response = self.stream_response(protocol, options, writer)?;
-        response.write_shell_buffered(state)?;
-        let boundary_count = response.boundary_count();
-        for boundary in 0..boundary_count {
-            let id = BoundaryId::from_index(boundary)?;
-            response.write_boundary(id, state, BoundaryMode::Final)?;
+        let mut status = response.start(state)?;
+        while !status.done {
+            let Some(boundary) = status.boundary.as_ref() else {
+                return Err(HandlerError::Invariant(
+                    "unfinished streaming step has no pending boundary".to_string(),
+                ));
+            };
+            status = response.resume(boundary.instance_id, state, BoundaryMode::Final)?;
         }
-        response.finish(state)
+        Ok(())
     }
 }
diff --git a/crates/webui-handler/src/streaming/owned.rs b/crates/webui-handler/src/streaming/owned.rs
index 180f5ecf9..6e858259f 100644
--- a/crates/webui-handler/src/streaming/owned.rs
+++ b/crates/webui-handler/src/streaming/owned.rs
@@ -1,40 +1,20 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Host-owned streaming sessions for bindings that cannot hold a Rust borrow.
-//!
-//! [`StreamingResponse`](super::StreamingResponse) borrows its handler,
-//! protocol, options, and transport for the life of one response. That is the
-//! right shape for a Rust host, which keeps the response on its own stack, but
-//! it cannot cross a foreign-function boundary: a Node class instance, a C
-//! opaque pointer, or a .NET `SafeHandle` must stay alive between calls that
-//! Rust never sees.
-//!
-//! [`StreamingSession`] closes that gap without self-referential storage. It
-//! retains the handler and protocol behind `Arc`, parks the response's owned
-//! progress between calls, and rebuilds the borrowed half for the duration of
-//! each call. Nothing borrowed ever spans a call boundary, so this is ordinary
-//! safe Rust.
-//!
-//! It also inverts transport ownership. Each method returns the bytes it
-//! produced instead of writing them, so the host writes to its own socket and
-//! applies its own backpressure — the thing a push-based chunk callback cannot
-//! express.
+//! Host-owned progressive sessions with pull-based byte delivery.
 
 use std::sync::Arc;
 
 use serde_json::Value;
 
-use super::session::{BoundaryId, BoundaryMode, ParkedResponse};
-use super::StreamingResponse;
+use super::session::{
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryMode, SessionCall, SessionCore, StreamStatus,
+};
+use super::StreamingSink;
 use crate::route_handler::Protocol;
 use crate::{FlushWriter, RenderOptions, ResponseWriter, Result, WebUIHandler};
 
-/// Collects response bytes for a host that owns its own transport.
-///
-/// `flush` is deliberately a no-op: a semantic flush means "these bytes are
-/// complete and may be sent", and for an encoder that is exactly the point at
-/// which the method returns them to the host.
+/// Reusable byte sink for host-owned sessions.
 #[derive(Default)]
 pub struct BufferSink {
     bytes: Vec<u8>,
@@ -57,23 +37,23 @@ impl FlushWriter for BufferSink {
     }
 }
 
-/// Owned per-response configuration, so a session outlives its caller's strings.
+/// Owned per-response configuration.
 #[derive(Clone, Debug)]
 pub struct SessionOptions {
     /// Entry fragment to render.
     pub entry_id: String,
     /// Request path used for route matching.
     pub request_path: String,
-    /// Optional CSP nonce for generated inline `<script>` tags.
+    /// Optional CSP nonce.
     pub nonce: Option<String>,
-    /// Optional HTML injected at the structural `head_end` boundary.
+    /// Optional trusted HTML injected at head_end.
     pub head_inject: Option<String>,
-    /// Optional HTML injected at the structural `body_end` boundary.
+    /// Optional trusted HTML injected at body_end.
     pub body_inject: Option<String>,
 }
 
 impl SessionOptions {
-    /// Create options for an entry fragment and request path.
+    /// Create options for an entry and request path.
     #[must_use]
     pub fn new(entry_id: impl Into<String>, request_path: impl Into<String>) -> Self {
         Self {
@@ -86,207 +66,141 @@ impl SessionOptions {
     }
 }
 
-/// A progressive HTML response a foreign host drives one call at a time.
-///
-/// Every method returns the bytes that call produced. The host writes them to
-/// its transport and decides when to continue, so backpressure and interleaved
-/// async work stay under host control.
-///
-/// Ordering rules match [`StreamingResponse`]: the shell first, then each
-/// boundary exactly once in declaration order, updates only after the target
-/// boundary commits, and `finish` last. Violations return an actionable error
-/// rather than corrupting the stream, and any render or transport failure
-/// permanently poisons the session because bytes may already have been sent.
+/// Bytes and continuation state returned by one owned semantic step.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct StreamStep {
+    /// Complete bytes produced by this call.
+    pub bytes: Vec<u8>,
+    /// Next runtime occurrence waiting for resume.
+    pub boundary: Option<BoundaryDescriptor>,
+    /// True after terminal emission.
+    pub done: bool,
+}
+
+/// A progressive response owned independently of any Rust borrow.
 pub struct StreamingSession {
     handler: Arc<WebUIHandler>,
     protocol: Arc<Protocol>,
     options: SessionOptions,
-    /// `None` only while a call is in flight, or once `finish` consumed the
-    /// response either successfully or fatally.
-    parked: Option<ParkedResponse>,
+    core: SessionCore,
     sink: BufferSink,
-    boundary_count: usize,
-    /// Set only when a terminal record actually reached the transport.
-    finished: bool,
 }
 
 impl StreamingSession {
-    /// Start a host-driven progressive response.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the entry is missing or its compiled streaming
-    /// structure is malformed.
+    /// Create an unstarted owned session.
     pub fn new(
         handler: Arc<WebUIHandler>,
         protocol: Arc<Protocol>,
         options: SessionOptions,
     ) -> Result<Self> {
-        let mut sink = BufferSink::default();
-        let (parked, boundary_count) = {
-            let render_options = render_options(&options);
-            let response = handler.stream_response(&protocol, &render_options, &mut sink)?;
-            let boundary_count = response.boundary_count();
-            (response.park(), boundary_count)
-        };
+        let core = SessionCore::new(&handler, &protocol, &options.entry_id)?;
         Ok(Self {
             handler,
             protocol,
             options,
-            parked: Some(parked),
-            sink,
-            boundary_count,
-            finished: false,
+            core,
+            sink: BufferSink::default(),
         })
     }
 
-    /// Resolve a free-form authored boundary name to an integer handle.
-    ///
-    /// Resolve once and reuse the handle; hot calls never hash a name.
-    ///
-    /// # Errors
-    ///
-    /// Returns an actionable error listing valid names when the entry does not
-    /// declare `name`.
-    pub fn boundary(&self, name: &str) -> Result<BoundaryId> {
-        let names = self
-            .protocol
-            .streaming_boundary_names(&self.options.entry_id);
-        names
-            .iter()
-            .position(|candidate| candidate == name)
-            .ok_or_else(|| super::error::unknown_boundary_name_error(name, names))
-            .and_then(BoundaryId::from_index)
-    }
-
-    /// Number of compile-time boundaries in this entry.
-    #[must_use]
-    pub fn boundary_count(&self) -> usize {
-        self.boundary_count
-    }
-
-    /// Whether the response has emitted its terminal record.
-    ///
-    /// Stays `false` after a rejected or failed `finish`, because no terminal
-    /// record reached the transport in either case.
-    #[must_use]
-    pub fn is_finished(&self) -> bool {
-        self.finished
-    }
-
-    /// Render the document prefix before the first boundary.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when called out of order or when rendering fails.
-    pub fn write_shell(&mut self, state: &Value) -> Result<Vec<u8>> {
-        self.run(|response| response.write_shell(state))
-    }
-
-    /// Render and commit the next compile-time boundary.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when boundaries are written out of declaration order or
-    /// when rendering fails.
-    pub fn write_boundary(
+    /// Render until the first runtime boundary occurrence or terminal.
+    pub fn start(&mut self, state: &Value) -> Result<StreamStep> {
+        self.sink.bytes.clear();
+        let options = render_options(&self.options);
+        let mut sink = StreamingSink {
+            transport: &mut self.sink,
+            component_opening: None,
+            written: 0,
+            flushed: 0,
+        };
+        let status = self.core.start(
+            SessionCall {
+                handler: &self.handler,
+                protocol: &self.protocol,
+                options: &options,
+                writer: &mut sink,
+            },
+            state,
+        );
+        self.finish_step(status)
+    }
+
+    /// Commit the pending occurrence and advance.
+    pub fn resume(
         &mut self,
-        boundary: BoundaryId,
+        instance_id: BoundaryInstanceId,
         state: &Value,
         mode: BoundaryMode,
-    ) -> Result<Vec<u8>> {
-        self.run(|response| response.write_boundary(boundary, state, mode))
-    }
-
-    /// Push a projected state patch to an already committed updatable boundary.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the boundary has not committed, was committed as
-    /// final, or when `state` is not a JSON object.
-    pub fn update(&mut self, boundary: BoundaryId, state: &Value) -> Result<Vec<u8>> {
-        self.run(|response| response.update(boundary, state))
-    }
-
-    /// Render the document tail and emit the terminal record.
-    ///
-    /// The session is finished afterwards and every later call fails.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when boundaries remain uncommitted or rendering fails.
-    pub fn finish(&mut self, state: &Value) -> Result<Vec<u8>> {
-        let parked = self.take_parked("finish")?;
-        let result = {
-            let Self {
-                handler,
-                protocol,
-                options,
-                sink,
-                parked: slot,
-                ..
-            } = self;
-            let render_options = render_options(options);
-            match StreamingResponse::unpark(parked, handler, protocol, &render_options, sink) {
-                // Ordering violations are rejected before any byte is written,
-                // so park the response again and let the host commit what is
-                // still outstanding instead of losing the open response.
-                Ok(response) => match response.ensure_finishable() {
-                    Ok(()) => response.finish(state),
-                    Err(error) => {
-                        *slot = Some(response.park());
-                        Err(error)
-                    }
-                },
-                Err(error) => Err(error),
-            }
+    ) -> Result<StreamStep> {
+        self.sink.bytes.clear();
+        let options = render_options(&self.options);
+        let mut sink = StreamingSink {
+            transport: &mut self.sink,
+            component_opening: None,
+            written: 0,
+            flushed: 0,
+        };
+        let status = self.core.resume(
+            SessionCall {
+                handler: &self.handler,
+                protocol: &self.protocol,
+                options: &options,
+                writer: &mut sink,
+            },
+            instance_id,
+            state,
+            mode,
+        );
+        self.finish_step(status)
+    }
+
+    /// Emit an update for one committed updatable runtime occurrence.
+    pub fn update(&mut self, instance_id: BoundaryInstanceId, patch: &Value) -> Result<Vec<u8>> {
+        self.sink.bytes.clear();
+        let options = render_options(&self.options);
+        let mut sink = StreamingSink {
+            transport: &mut self.sink,
+            component_opening: None,
+            written: 0,
+            flushed: 0,
         };
+        let result = self.core.update(
+            SessionCall {
+                handler: &self.handler,
+                protocol: &self.protocol,
+                options: &options,
+                writer: &mut sink,
+            },
+            instance_id,
+            patch,
+        );
         match result {
-            Ok(()) => {
-                self.finished = true;
-                Ok(std::mem::take(&mut self.sink.bytes))
-            }
+            Ok(()) => Ok(std::mem::take(&mut self.sink.bytes)),
             Err(error) => {
-                self.sink.bytes = Vec::new();
+                self.sink.bytes.clear();
                 Err(error)
             }
         }
     }
 
-    fn take_parked(&mut self, operation: &str) -> Result<ParkedResponse> {
-        if let Some(parked) = self.parked.take() {
-            return Ok(parked);
-        }
-        let reason = if self.finished {
-            "the streaming response has already finished"
-        } else {
-            "the streaming response failed while emitting its terminal record and \
-             cannot continue; bytes may already have been sent"
-        };
-        Err(super::error::boundary_order_error(operation, reason))
+    /// Whether terminal emission completed.
+    #[must_use]
+    pub fn is_done(&self) -> bool {
+        self.core.done
     }
 
-    /// Rebuild the borrowed response, run one operation, and park it again.
-    fn run(
-        &mut self,
-        operation: impl FnOnce(&mut StreamingResponse<'_, BufferSink>) -> Result<()>,
-    ) -> Result<Vec<u8>> {
-        let parked = self.take_parked("streaming operation")?;
-        let Self {
-            handler,
-            protocol,
-            options,
-            sink,
-            parked: slot,
-            ..
-        } = self;
-        let render_options = render_options(options);
-        let mut response =
-            StreamingResponse::unpark(parked, handler, protocol, &render_options, sink)?;
-        let result = operation(&mut response);
-        *slot = Some(response.park());
-        result?;
-        Ok(std::mem::take(&mut self.sink.bytes))
+    fn finish_step(&mut self, status: Result<StreamStatus>) -> Result<StreamStep> {
+        match status {
+            Ok(status) => Ok(StreamStep {
+                bytes: std::mem::take(&mut self.sink.bytes),
+                boundary: status.boundary,
+                done: status.done,
+            }),
+            Err(error) => {
+                self.sink.bytes.clear();
+                Err(error)
+            }
+        }
     }
 }
 
diff --git a/crates/webui-handler/src/streaming/plan.rs b/crates/webui-handler/src/streaming/plan.rs
deleted file mode 100644
index 91fbe9be0..000000000
--- a/crates/webui-handler/src/streaming/plan.rs
+++ /dev/null
@@ -1,181 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT license.
-
-//! Immutable segment indexes for host-driven streaming responses.
-
-use std::ops::Range;
-
-use webui_protocol::{web_ui_fragment::Fragment, StreamingBoundaryList, WebUIFragment};
-
-use super::error::{parse_boundary_sequence, streaming_boundary_error};
-use super::state::{BOUNDARY_END_PREFIX, BOUNDARY_START_PREFIX};
-use crate::{structural_signal_value, HandlerError, Result, StreamingBoundaryError};
-
-pub(crate) struct PreparedStreamingEntryPlan {
-    result: std::result::Result<StreamingEntryPlan, StreamingEntryPlanError>,
-}
-
-enum StreamingEntryPlanError {
-    Boundary { signal: String, reason: String },
-    Invariant(String),
-}
-
-impl StreamingEntryPlanError {
-    fn capture(error: HandlerError) -> Self {
-        match error {
-            HandlerError::StreamingBoundary(error) => Self::Boundary {
-                signal: error.signal,
-                reason: error.reason,
-            },
-            HandlerError::Invariant(message) => Self::Invariant(message),
-            error => Self::Invariant(error.to_string()),
-        }
-    }
-
-    #[cold]
-    #[inline(never)]
-    fn to_handler_error(&self) -> HandlerError {
-        match self {
-            Self::Boundary { signal, reason } => {
-                HandlerError::StreamingBoundary(Box::new(StreamingBoundaryError {
-                    signal: signal.clone(),
-                    reason: reason.clone(),
-                }))
-            }
-            Self::Invariant(message) => HandlerError::Invariant(message.clone()),
-        }
-    }
-}
-
-impl PreparedStreamingEntryPlan {
-    pub(crate) fn new(
-        entry_id: &str,
-        fragments: &[WebUIFragment],
-        names: Option<&StreamingBoundaryList>,
-    ) -> Self {
-        Self {
-            result: StreamingEntryPlan::new(entry_id, fragments, names)
-                .map_err(StreamingEntryPlanError::capture),
-        }
-    }
-
-    pub(crate) fn resolve(&self) -> Result<&StreamingEntryPlan> {
-        self.result
-            .as_ref()
-            .map_err(StreamingEntryPlanError::to_handler_error)
-    }
-}
-
-pub(crate) struct StreamingEntryPlan {
-    shell_end: usize,
-    boundaries: Vec<Range<usize>>,
-}
-
-impl StreamingEntryPlan {
-    pub(crate) fn new(
-        _entry_id: &str,
-        fragments: &[WebUIFragment],
-        names: Option<&StreamingBoundaryList>,
-    ) -> Result<Self> {
-        Self::try_new(fragments, names)
-    }
-
-    fn try_new(fragments: &[WebUIFragment], names: Option<&StreamingBoundaryList>) -> Result<Self> {
-        let mut boundaries = Vec::new();
-        let mut active = None;
-        let mut next_id = 0usize;
-        let mut body_ended = false;
-
-        for (index, fragment) in fragments.iter().enumerate() {
-            let Some(Fragment::Signal(signal)) = fragment.fragment.as_ref() else {
-                continue;
-            };
-            let Some(value) = structural_signal_value(signal) else {
-                continue;
-            };
-            if body_ended {
-                return Err(streaming_boundary_error(
-                    value,
-                    "structural signal arrived after the body_end terminal record",
-                ));
-            }
-            if value == "body_end" {
-                if let Some((id, _)) = active {
-                    return Err(streaming_boundary_error(
-                        value,
-                        &format!("body ended while boundary {id} was still open"),
-                    ));
-                }
-                body_ended = true;
-                continue;
-            }
-            if let Some(raw_id) = value.strip_prefix(BOUNDARY_START_PREFIX) {
-                let id = parse_boundary_sequence(value, raw_id)?;
-                if active.is_some() {
-                    return Err(streaming_boundary_error(
-                        value,
-                        "nested boundaries are not valid in a streaming entry plan",
-                    ));
-                }
-                if id != next_id {
-                    return Err(streaming_boundary_error(
-                        value,
-                        &format!("expected boundary sequence {next_id}, received {id}"),
-                    ));
-                }
-                active = Some((id, index));
-                continue;
-            }
-            if let Some(raw_id) = value.strip_prefix(BOUNDARY_END_PREFIX) {
-                let id = parse_boundary_sequence(value, raw_id)?;
-                let Some((active_id, start)) = active.take() else {
-                    return Err(streaming_boundary_error(
-                        value,
-                        "boundary end has no matching start",
-                    ));
-                };
-                if id != active_id {
-                    return Err(streaming_boundary_error(
-                        value,
-                        "boundary end does not match the active boundary",
-                    ));
-                }
-                boundaries.push(start..index + 1);
-                next_id = next_id.checked_add(1).ok_or_else(|| {
-                    streaming_boundary_error(value, "boundary count exceeds the platform limit")
-                })?;
-            }
-        }
-
-        if let Some((id, _)) = active {
-            return Err(streaming_boundary_error(
-                &format!("boundary_start:{id}"),
-                "entry fragment ended before the matching boundary end",
-            ));
-        }
-        if names.is_some_and(|list| list.names.len() != boundaries.len()) {
-            return Err(HandlerError::Invariant(
-                "streaming boundary name table does not match entry boundary count".to_string(),
-            ));
-        }
-
-        Ok(Self {
-            shell_end: boundaries
-                .first()
-                .map_or(fragments.len(), |boundary| boundary.start),
-            boundaries,
-        })
-    }
-
-    pub(crate) fn shell_end(&self) -> usize {
-        self.shell_end
-    }
-
-    pub(crate) fn boundary(&self, id: usize) -> Option<&Range<usize>> {
-        self.boundaries.get(id)
-    }
-
-    pub(crate) fn boundary_count(&self) -> usize {
-        self.boundaries.len()
-    }
-}
diff --git a/crates/webui-handler/src/streaming/root.rs b/crates/webui-handler/src/streaming/root.rs
index 786b72a4f..a989fafa4 100644
--- a/crates/webui-handler/src/streaming/root.rs
+++ b/crates/webui-handler/src/streaming/root.rs
@@ -25,6 +25,13 @@ use crate::{structural_signal_value, Result, WebUIProcessContext};
 /// ` data-ws` so the marker exists before custom-element upgrade.
 pub(super) const STREAMING_ROOT_PREFIX: &str = "streaming_root:";
 
+fn write_span_id(context: &mut WebUIProcessContext<'_, '_, '_>, id: u32) -> Result<()> {
+    let value = usize::try_from(id).map_err(|_| {
+        crate::HandlerError::Invariant("span instance ID does not fit usize".to_string())
+    })?;
+    crate::write_usize(context.writer, value)
+}
+
 #[derive(Clone, Copy)]
 pub(super) enum StreamingRootStage {
     OpeningTagClose,
@@ -200,19 +207,36 @@ pub(crate) fn prepare_generated_streaming_root(
         return Ok(());
     }
     require_streaming_head_start(context, "route component host")?;
-    let (active_boundary, generated_root_ready) = context
+    let (active_boundary, current_span, pending_span_host, generated_root_ready) = context
         .streaming
         .as_ref()
-        .map_or((None, false), |streaming| {
-            (streaming.active_boundary, streaming.generated_root_ready)
+        .map_or((None, None, None, false), |streaming| {
+            (
+                streaming.active_boundary,
+                streaming.current_span,
+                streaming.pending_span_host,
+                streaming.generated_root_ready,
+            )
         });
-    if active_boundary.is_none() {
+    if active_boundary.is_none() && current_span.is_none() && pending_span_host.is_none() {
         return Err(streaming_root_outside_boundary_error(tag));
     }
     if generated_root_ready {
         return Err(generated_streaming_root_error(tag));
     }
     context.writer.write(" data-ws")?;
+    if let Some(span_id) = pending_span_host {
+        context.writer.write(" data-ws-span=\"")?;
+        write_span_id(context, span_id)?;
+        context.writer.write("\"")?;
+    }
+    if active_boundary.is_some() {
+        if let Some(span_id) = current_span {
+            context.writer.write(" data-ws-enclosing=\"")?;
+            write_span_id(context, span_id)?;
+            context.writer.write("\"")?;
+        }
+    }
     streaming_state(context)?.generated_root_ready = true;
     Ok(())
 }
@@ -266,18 +290,20 @@ pub(super) fn process_streaming_root_signal<'data>(
         ));
     }
 
-    let (active_boundary, pending_root, generated_root_ready) =
+    let (active_boundary, current_span, pending_span_host, pending_root, generated_root_ready) =
         context
             .streaming
             .as_ref()
-            .map_or((None, None, false), |streaming| {
+            .map_or((None, None, None, None, false), |streaming| {
                 (
                     streaming.active_boundary,
+                    streaming.current_span,
+                    streaming.pending_span_host,
                     streaming.pending_root,
                     streaming.generated_root_ready,
                 )
             });
-    if active_boundary.is_none() {
+    if active_boundary.is_none() && current_span.is_none() && pending_span_host.is_none() {
         return Err(streaming_root_outside_boundary_error(tag));
     }
     if let Some(pending) = pending_root {
@@ -291,6 +317,18 @@ pub(super) fn process_streaming_root_signal<'data>(
     }
 
     context.writer.write(" data-ws")?;
+    if let Some(span_id) = pending_span_host {
+        context.writer.write(" data-ws-span=\"")?;
+        write_span_id(context, span_id)?;
+        context.writer.write("\"")?;
+    }
+    if active_boundary.is_some() {
+        if let Some(span_id) = current_span {
+            context.writer.write(" data-ws-enclosing=\"")?;
+            write_span_id(context, span_id)?;
+            context.writer.write("\"")?;
+        }
+    }
     streaming_state(context)?.pending_root = Some(PendingStreamingRoot {
         tag,
         stage: StreamingRootStage::OpeningTagClose,
diff --git a/crates/webui-handler/src/streaming/session.rs b/crates/webui-handler/src/streaming/session.rs
index d48d6865e..d686385d3 100644
--- a/crates/webui-handler/src/streaming/session.rs
+++ b/crates/webui-handler/src/streaming/session.rs
@@ -1,22 +1,21 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Host-driven lifetime for one streamed HTML response.
+//! Public borrowed session API and shared owned continuation state.
 
 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
 
-use serde_json::Value;
+use serde_json::{Number, Value};
 
-use super::error::{
-    boundary_not_updatable_error, boundary_order_error, state_update_type_error,
-    unknown_boundary_name_error,
-};
-use super::state::{increment_streaming_record_sequence, StreamingProgress};
-use super::{
-    flush_streaming_transport, validate_streaming_head_start, StreamingEntryPlan,
-    StreamingRenderState, StreamingSink,
+use super::error::{boundary_order_error, state_update_type_error};
+use super::state::{
+    increment_streaming_record_sequence, overlay_full_state, overlay_selected_state,
+    selected_state_snapshot, StreamingProgress, StreamingRenderState,
 };
+use super::vm::ContinuationVm;
+use super::StreamingSink;
 use crate::plugin::HandlerPlugin;
 use crate::route_handler::Protocol;
 use crate::{
@@ -24,119 +23,232 @@ use crate::{
     WebUIProcessContext,
 };
 
-/// Integer handle for a compile-time streaming boundary.
-///
-/// Resolve an authored boundary name once with
-/// [`StreamingResponse::boundary`], then reuse this allocation-free handle for
-/// every response operation.
+/// Maximum continuation frames retained by one response.
+pub const MAX_CONTINUATION_DEPTH: usize = 256;
+/// Maximum unfinished component spans retained by one response.
+pub const MAX_OPEN_SPANS: usize = 128;
+/// Maximum nested unfinished component spans.
+pub const MAX_SPAN_NESTING: usize = 32;
+/// Maximum runtime boundary occurrences in one response.
+pub const MAX_BOUNDARY_OCCURRENCES: usize = 512;
+/// Maximum keyed runtime occurrences tracked for uniqueness.
+pub const MAX_KEYED_INSTANCES: usize = 512;
+/// Maximum top-level state keys retained by a continuation snapshot.
+pub(crate) const MAX_FROZEN_STATE_KEYS: usize = 1_024;
+
+/// Response-local runtime boundary occurrence identity.
 #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
-pub struct BoundaryId(u32);
+pub struct BoundaryInstanceId(u32);
 
-impl BoundaryId {
-    pub(super) fn from_index(index: usize) -> Result<Self> {
-        u32::try_from(index)
-            .map(Self)
-            .map_err(|_| HandlerError::Invariant("boundary index exceeds u32".to_string()))
+impl BoundaryInstanceId {
+    /// Rebuild an ID round-tripped through a host binding.
+    #[must_use]
+    pub const fn from_raw(raw: u32) -> Self {
+        Self(raw)
     }
 
-    /// Rebuild a handle from the integer a foreign host round-tripped.
-    ///
-    /// Out-of-range values are rejected by the response, not here, so hosts
-    /// that pass an arbitrary integer get the same actionable ordering error a
-    /// Rust caller would.
+    /// Return the wire integer.
+    #[must_use]
+    pub const fn raw(self) -> u32 {
+        self.0
+    }
+
+    pub(crate) fn index(self) -> Result<usize> {
+        usize::try_from(self.0).map_err(|_| {
+            HandlerError::Invariant("boundary instance ID does not fit usize".to_string())
+        })
+    }
+}
+
+/// Response-local generated component span identity.
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+pub struct SpanInstanceId(u32);
+
+impl SpanInstanceId {
+    /// Rebuild an ID round-tripped through a host binding.
     #[must_use]
-    pub fn from_raw(raw: u32) -> Self {
+    pub const fn from_raw(raw: u32) -> Self {
         Self(raw)
     }
 
-    /// The integer a foreign host stores and passes back.
+    /// Return the wire integer.
     #[must_use]
-    pub fn raw(self) -> u32 {
+    pub const fn raw(self) -> u32 {
         self.0
     }
 
-    fn index(self) -> usize {
-        self.0 as usize
+    pub(crate) const fn new(raw: u32) -> Self {
+        Self(raw)
+    }
+}
+
+/// Valid evaluated key for a repeated boundary declaration.
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub enum BoundaryKey {
+    /// Authored key resolved to a JSON string.
+    String(String),
+    /// Authored key resolved to a finite JSON number.
+    Number(Number),
+}
+
+impl BoundaryKey {
+    pub(crate) fn diagnostic(&self) -> String {
+        match self {
+            Self::String(value) => {
+                let mut out = String::with_capacity(value.len() + 2);
+                out.push('"');
+                out.push_str(value);
+                out.push('"');
+                out
+            }
+            Self::Number(value) => value.to_string(),
+        }
     }
 }
 
-/// Whether a committed boundary may receive later state records.
+/// Runtime occurrence returned when traversal suspends.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct BoundaryDescriptor {
+    /// Gapless response-local occurrence ID.
+    pub instance_id: BoundaryInstanceId,
+    /// Stable compiler declaration ID.
+    pub declaration_id: u32,
+    /// Entry or component template that owns the declaration.
+    ///
+    /// Interned per protocol, so producing a descriptor shares the compiled
+    /// string instead of allocating a copy per occurrence.
+    pub owner: Arc<str>,
+    /// Free-form authored declaration name.
+    ///
+    /// Interned per protocol alongside [`Self::owner`].
+    pub name: Arc<str>,
+    /// Evaluated repeat key, when authored.
+    pub key: Option<BoundaryKey>,
+}
+
+/// Whether a committed occurrence may receive later state updates.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum BoundaryMode {
-    /// Hydrate once and release every boundary-local reference after activation.
+    /// Hydrate once and release boundary-local roots.
     Final,
-    /// Retain the boundary roots and compiled state projection until terminal.
+    /// Retain live roots until terminal for later [`StreamingResponse::update`].
     Updatable,
 }
 
-/// A host-controlled progressive HTML response.
-///
-/// Each method synchronously borrows only the state value supplied to that
-/// call. The host may await backend work between calls while this response
-/// retains renderer inventory, transport backpressure, and hydration metadata.
+/// Borrowed-writer result of one semantic streaming step.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct StreamStatus {
+    /// The next occurrence waiting for [`StreamingResponse::resume`].
+    pub boundary: Option<BoundaryDescriptor>,
+    /// True after the terminal record and writer end completed.
+    pub done: bool,
+}
+
+/// A progressive response that writes directly through a [`FlushWriter`].
 pub struct StreamingResponse<'a, W: FlushWriter + ?Sized> {
     handler: &'a WebUIHandler,
     protocol: &'a Protocol,
-    plan: ResponsePlan<'a>,
+    options: RenderOptions<'a>,
     sink: StreamingSink<'a, W>,
-    request_path: &'a str,
-    entry_id: &'a str,
-    nonce: Option<&'a str>,
-    head_inject: Option<&'a str>,
-    body_inject: Option<&'a str>,
-    /// Index of the next entry fragment to write.
-    cursor: usize,
-    next_boundary: usize,
-    shell_written: bool,
-    finished: bool,
-    failed: bool,
-    local_vars: HashMap<String, Value>,
-    component_attrs: HashMap<String, Value>,
-    route_base: Cow<'a, str>,
-    rendered_components: HashSet<String>,
-    plugin: Option<Box<dyn HandlerPlugin>>,
-    route_children: Vec<webui_protocol::WebUiFragmentRoute>,
-    head_end_emitted: bool,
-    body_start_emitted: bool,
-    component_asset_styles_emitted: bool,
-    body_end_emitted: bool,
-    route_chain_index: usize,
-    entry_route: Option<(String, crate::route_matcher::RouteMatch)>,
-    streaming: StreamingRenderState<'a>,
-    json_scratch: Vec<u8>,
-    scope_pool: Vec<HashMap<String, Value>>,
+    pub(crate) core: SessionCore,
 }
 
-enum ResponsePlan<'a> {
-    Shared(&'a StreamingEntryPlan),
-    Request(StreamingEntryPlan),
+impl WebUIHandler {
+    /// Create a runtime-discovered progressive response.
+    pub fn stream_response<'a, W: FlushWriter + ?Sized>(
+        &'a self,
+        protocol: &'a Protocol,
+        options: &RenderOptions<'a>,
+        writer: &'a mut W,
+    ) -> Result<StreamingResponse<'a, W>> {
+        let core = SessionCore::new(self, protocol, options.entry_id)?;
+        Ok(StreamingResponse {
+            handler: self,
+            protocol,
+            options: RenderOptions {
+                entry_id: options.entry_id,
+                request_path: options.request_path,
+                nonce: options.nonce,
+                head_inject: options.head_inject,
+                body_inject: options.body_inject,
+            },
+            sink: StreamingSink {
+                transport: writer,
+                component_opening: None,
+                written: 0,
+                flushed: 0,
+            },
+            core,
+        })
+    }
 }
 
-impl ResponsePlan<'_> {
-    fn get(&self) -> &StreamingEntryPlan {
-        match self {
-            Self::Shared(plan) => plan,
-            Self::Request(plan) => plan,
-        }
+impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
+    /// Render until the first runtime boundary occurrence or terminal.
+    pub fn start(&mut self, state: &Value) -> Result<StreamStatus> {
+        self.core.start(
+            SessionCall {
+                handler: self.handler,
+                protocol: self.protocol,
+                options: &self.options,
+                writer: &mut self.sink,
+            },
+            state,
+        )
+    }
+
+    /// Commit the pending occurrence, then advance to the next occurrence or terminal.
+    pub fn resume(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        state: &Value,
+        mode: BoundaryMode,
+    ) -> Result<StreamStatus> {
+        self.core.resume(
+            SessionCall {
+                handler: self.handler,
+                protocol: self.protocol,
+                options: &self.options,
+                writer: &mut self.sink,
+            },
+            instance_id,
+            state,
+            mode,
+        )
+    }
+
+    /// Emit one projected state update for a committed updatable occurrence.
+    pub fn update(&mut self, instance_id: BoundaryInstanceId, patch: &Value) -> Result<()> {
+        self.core.update(
+            SessionCall {
+                handler: self.handler,
+                protocol: self.protocol,
+                options: &self.options,
+                writer: &mut self.sink,
+            },
+            instance_id,
+            patch,
+        )
+    }
+
+    /// Whether the response has emitted its terminal and ended its writer.
+    #[must_use]
+    pub fn is_done(&self) -> bool {
+        self.core.done
     }
 }
 
-/// The half of a [`StreamingResponse`] that carries no borrow.
-///
-/// A host-owned session parks this between calls and rebuilds the borrowed half
-/// from its retained protocol, so a response can outlive any single `&Protocol`
-/// borrow without self-referential storage. Every field here is either owned
-/// outright or reduced to an owned form (`route_base`, the streaming progress)
-/// precisely so that this type has no lifetime parameter.
-pub(super) struct ParkedResponse {
-    cursor: usize,
-    next_boundary: usize,
-    shell_written: bool,
-    finished: bool,
+pub(crate) struct SessionCore {
+    pub(crate) vm: ContinuationVm,
+    frozen_keys: Arc<[Box<str>]>,
+    requires_full_state: bool,
+    frozen_state: Value,
+    started: bool,
+    pub(crate) done: bool,
     failed: bool,
     local_vars: HashMap<String, Value>,
     component_attrs: HashMap<String, Value>,
-    route_base: Box<str>,
+    route_base: Option<String>,
     rendered_components: HashSet<String>,
     plugin: Option<Box<dyn HandlerPlugin>>,
     route_children: Vec<webui_protocol::WebUiFragmentRoute>,
@@ -145,442 +257,213 @@ pub(super) struct ParkedResponse {
     component_asset_styles_emitted: bool,
     body_end_emitted: bool,
     route_chain_index: usize,
-    entry_route: Option<(String, crate::route_matcher::RouteMatch)>,
-    streaming: StreamingProgress,
+    streaming: Option<StreamingProgress>,
     json_scratch: Vec<u8>,
     scope_pool: Vec<HashMap<String, Value>>,
-    /// Retained only for entries with no shared precomputed plan; shared plans
-    /// are re-resolved from the protocol on every rebuild.
-    request_plan: Option<StreamingEntryPlan>,
 }
 
-impl<'a, W: FlushWriter + ?Sized> StreamingResponse<'a, W> {
-    /// Drop every borrow and keep the owned progress.
-    pub(super) fn park(self) -> ParkedResponse {
-        ParkedResponse {
-            cursor: self.cursor,
-            next_boundary: self.next_boundary,
-            shell_written: self.shell_written,
-            finished: self.finished,
-            failed: self.failed,
-            local_vars: self.local_vars,
-            component_attrs: self.component_attrs,
-            route_base: self.route_base.into_owned().into_boxed_str(),
-            rendered_components: self.rendered_components,
-            plugin: self.plugin,
-            route_children: self.route_children,
-            head_end_emitted: self.head_end_emitted,
-            body_start_emitted: self.body_start_emitted,
-            component_asset_styles_emitted: self.component_asset_styles_emitted,
-            body_end_emitted: self.body_end_emitted,
-            route_chain_index: self.route_chain_index,
-            entry_route: self.entry_route,
-            streaming: self.streaming.into_progress(),
-            json_scratch: self.json_scratch,
-            scope_pool: self.scope_pool,
-            request_plan: match self.plan {
-                ResponsePlan::Shared(_) => None,
-                ResponsePlan::Request(plan) => Some(plan),
-            },
-        }
-    }
-
-    /// Rebuild a borrowed response around parked progress.
-    pub(super) fn unpark(
-        parked: ParkedResponse,
-        handler: &'a WebUIHandler,
-        protocol: &'a Protocol,
-        options: &RenderOptions<'a>,
-        writer: &'a mut W,
-    ) -> Result<Self> {
-        let plan = match parked.request_plan {
-            Some(plan) => ResponsePlan::Request(plan),
-            None => match protocol.streaming_plan(options.entry_id)? {
-                Some(plan) => ResponsePlan::Shared(plan),
-                None => {
-                    return Err(HandlerError::Invariant(
-                        "streaming response plan disappeared between calls".to_string(),
-                    ))
-                }
-            },
-        };
-        Ok(Self {
-            handler,
-            protocol,
-            plan,
-            sink: StreamingSink { transport: writer },
-            request_path: options.request_path,
-            entry_id: options.entry_id,
-            nonce: options.nonce.filter(|nonce| !nonce.is_empty()),
-            head_inject: options.head_inject.filter(|html| !html.is_empty()),
-            body_inject: options.body_inject.filter(|html| !html.is_empty()),
-            cursor: parked.cursor,
-            next_boundary: parked.next_boundary,
-            shell_written: parked.shell_written,
-            finished: parked.finished,
-            failed: parked.failed,
-            local_vars: parked.local_vars,
-            component_attrs: parked.component_attrs,
-            route_base: Cow::Owned(parked.route_base.into_string()),
-            rendered_components: parked.rendered_components,
-            plugin: parked.plugin,
-            route_children: parked.route_children,
-            head_end_emitted: parked.head_end_emitted,
-            body_start_emitted: parked.body_start_emitted,
-            component_asset_styles_emitted: parked.component_asset_styles_emitted,
-            body_end_emitted: parked.body_end_emitted,
-            route_chain_index: parked.route_chain_index,
-            entry_route: parked.entry_route,
-            streaming: StreamingRenderState::from_progress(
-                parked.streaming,
-                protocol.component_reachability(),
-            ),
-            json_scratch: parked.json_scratch,
-            scope_pool: parked.scope_pool,
-        })
-    }
+pub(crate) struct SessionCall<'call, 'data> {
+    pub(crate) handler: &'call WebUIHandler,
+    pub(crate) protocol: &'data Protocol,
+    pub(crate) options: &'call RenderOptions<'data>,
+    pub(crate) writer: &'call mut dyn ResponseWriter,
 }
 
-impl WebUIHandler {
-    /// Start a host-driven progressive HTML response.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the entry is missing or its compiled streaming
-    /// structure is malformed.
-    pub fn stream_response<'a, W: FlushWriter + ?Sized>(
-        &'a self,
-        protocol: &'a Protocol,
-        options: &RenderOptions<'a>,
-        writer: &'a mut W,
-    ) -> Result<StreamingResponse<'a, W>> {
-        let document = protocol.protocol();
-        let fragments = document
-            .fragments
-            .get(options.entry_id)
-            .ok_or_else(|| HandlerError::MissingFragment(options.entry_id.to_string()))?;
-        validate_streaming_head_start(document, options.entry_id)?;
-        let plan = match protocol.streaming_plan(options.entry_id)? {
-            Some(plan) => ResponsePlan::Shared(plan),
-            None => ResponsePlan::Request(StreamingEntryPlan::new(
-                options.entry_id,
-                &fragments.fragments,
-                None,
-            )?),
-        };
-        let component_count = protocol.component_index().len();
-        let entry_route = crate::route_renderer::find_best_route_match(
-            &fragments.fragments,
-            options.request_path,
-            "/",
-            protocol.route_index(),
-        );
-
-        Ok(StreamingResponse {
-            handler: self,
-            protocol,
-            plan,
-            sink: StreamingSink { transport: writer },
-            request_path: options.request_path,
-            entry_id: options.entry_id,
-            nonce: options.nonce.filter(|nonce| !nonce.is_empty()),
-            head_inject: options.head_inject.filter(|html| !html.is_empty()),
-            body_inject: options.body_inject.filter(|html| !html.is_empty()),
-            cursor: 0,
-            next_boundary: 0,
-            shell_written: false,
-            finished: false,
+impl SessionCore {
+    pub(crate) fn new(handler: &WebUIHandler, protocol: &Protocol, entry_id: &str) -> Result<Self> {
+        if !protocol.protocol().fragments.contains_key(entry_id) {
+            return Err(HandlerError::MissingFragment(entry_id.to_string()));
+        }
+        let prepared = protocol.continuation_state_plan(entry_id);
+        let state_plan = prepared.resolve()?;
+        Ok(Self {
+            vm: ContinuationVm::new(entry_id, protocol)?,
+            frozen_keys: Arc::clone(&state_plan.keys),
+            requires_full_state: state_plan.requires_full_state,
+            frozen_state: Value::Object(serde_json::Map::new()),
+            started: false,
+            done: false,
             failed: false,
             local_vars: HashMap::new(),
             component_attrs: HashMap::new(),
-            route_base: Cow::Borrowed("/"),
+            route_base: None,
             rendered_components: HashSet::new(),
-            plugin: self.plugin_factory.map(|factory| factory()),
+            plugin: handler.plugin_factory.map(|factory| factory()),
             route_children: Vec::new(),
             head_end_emitted: false,
             body_start_emitted: false,
             component_asset_styles_emitted: false,
             body_end_emitted: false,
             route_chain_index: 0,
-            entry_route,
-            streaming: StreamingRenderState::from_progress(
-                StreamingProgress::new(component_count),
-                protocol.component_reachability(),
-            ),
+            streaming: Some(StreamingProgress::new(protocol.component_index().len())),
             json_scratch: Vec::new(),
             scope_pool: Vec::new(),
         })
     }
-}
-
-impl<'a, W: FlushWriter + ?Sized> StreamingResponse<'a, W> {
-    /// Resolve a free-form authored name to an integer response handle.
-    ///
-    /// # Errors
-    ///
-    /// Returns an actionable error with valid names and a typo suggestion when
-    /// the entry does not declare `name`.
-    pub fn boundary(&self, name: &str) -> Result<BoundaryId> {
-        let names = self.protocol.streaming_boundary_names(self.entry_id);
-        let Some(index) = names.iter().position(|candidate| candidate == name) else {
-            return Err(unknown_boundary_name_error(name, names));
-        };
-        BoundaryId::from_index(index)
-    }
 
-    /// Number of compile-time boundaries in this entry.
-    #[must_use]
-    pub fn boundary_count(&self) -> usize {
-        self.plan.get().boundary_count()
-    }
-
-    /// Render and flush the document prefix before the first boundary.
-    pub fn write_shell(&mut self, state: &Value) -> Result<()> {
-        self.write_shell_internal(state, true)
-    }
-
-    pub(super) fn write_shell_buffered(&mut self, state: &Value) -> Result<()> {
-        self.write_shell_internal(state, false)
-    }
-
-    fn write_shell_internal(&mut self, state: &Value, flush: bool) -> Result<()> {
-        self.require_open("write_shell")?;
-        if self.shell_written {
+    pub(crate) fn start(
+        &mut self,
+        call: SessionCall<'_, '_>,
+        state: &Value,
+    ) -> Result<StreamStatus> {
+        self.require_usable("start")?;
+        if self.started {
             return Err(boundary_order_error(
-                "write_shell",
-                "the response shell has already been written",
+                "start",
+                "the streaming response has already started",
             ));
         }
-        let shell_end = self.plan.get().shell_end();
-        let result = self.run_range(state, 0..shell_end);
-        self.poison_on_error(&result);
-        result?;
-        self.cursor = shell_end;
-        self.shell_written = true;
-        if flush && !self.body_ended() {
-            let result = self.with_context(state, |_handler, context| {
-                flush_streaming_transport(context)
-            });
-            self.poison_on_error(&result);
-            result?;
-        }
-        Ok(())
+        // The value is moved into each render context and back, so protocols
+        // requiring full projection pay for exactly one response-local clone.
+        self.frozen_state = if self.requires_full_state {
+            state.clone()
+        } else {
+            selected_state_snapshot(state, &self.frozen_keys)
+        };
+        self.started = true;
+        self.run_advance(call, None)
     }
 
-    /// Render, commit, and flush the next compile-time boundary.
-    pub fn write_boundary(
+    pub(crate) fn resume(
         &mut self,
-        boundary: BoundaryId,
+        call: SessionCall<'_, '_>,
+        instance_id: BoundaryInstanceId,
         state: &Value,
         mode: BoundaryMode,
-    ) -> Result<()> {
-        self.require_open("write_boundary")?;
-        if !self.shell_written {
-            return Err(boundary_order_error(
-                "write_boundary",
-                "write_shell must be called before the first boundary",
-            ));
-        }
-        let index = boundary.index();
-        if index != self.next_boundary {
-            return Err(boundary_order_error(
-                "write_boundary",
-                "boundaries must be written once in declaration order",
-            ));
-        }
-        let range = self
-            .plan
-            .get()
-            .boundary(index)
-            .ok_or_else(|| boundary_order_error("write_boundary", "boundary ID is out of range"))?
-            .clone();
-        if range.start < self.cursor {
-            return Err(boundary_order_error(
-                "write_boundary",
-                "boundary content has already been written",
-            ));
+    ) -> Result<StreamStatus> {
+        self.require_usable("resume")?;
+        self.require_started("resume")?;
+        self.vm.validate_resume(instance_id)?;
+        if self.requires_full_state {
+            overlay_full_state(&mut self.frozen_state, state);
+        } else {
+            overlay_selected_state(&mut self.frozen_state, state, &self.frozen_keys);
         }
-        self.streaming.checkpoint_updatable = mode == BoundaryMode::Updatable;
-        let result = self.run_range(state, self.cursor..range.end);
-        self.poison_on_error(&result);
-        result?;
-        self.cursor = range.end;
-        self.next_boundary += 1;
-        Ok(())
+        self.run_advance(call, Some((instance_id, mode)))
     }
 
-    /// Push a projected state patch to an already committed updatable boundary.
-    pub fn update(&mut self, boundary: BoundaryId, state: &Value) -> Result<()> {
-        self.require_open("update")?;
-        let target = boundary.index();
-        if target >= self.next_boundary {
+    pub(crate) fn update(
+        &mut self,
+        call: SessionCall<'_, '_>,
+        instance_id: BoundaryInstanceId,
+        patch: &Value,
+    ) -> Result<()> {
+        self.require_usable("update")?;
+        self.require_started("update")?;
+        if self.done {
             return Err(boundary_order_error(
                 "update",
-                "the target boundary has not committed yet",
+                "the streaming response has already completed",
             ));
         }
-        if !state.is_object() {
+        if !patch.is_object() {
             return Err(state_update_type_error());
         }
-        if self
-            .streaming
-            .update_plans
-            .get(target)
-            .and_then(Option::as_ref)
-            .is_none()
-        {
-            return Err(boundary_not_updatable_error(target));
-        }
-        let result = self.with_context(state, |handler, context| {
-            let record_sequence = context
-                .streaming
-                .as_ref()
-                .map_or(0, |streaming| streaming.next_record_sequence);
-            handler.emit_streaming_state_update(record_sequence, target, context)?;
-            increment_streaming_record_sequence("state_update", super::streaming_state(context)?)
+        let target = self.vm.validate_update(instance_id)?;
+        let handler = call.handler;
+        let result = self.with_context(call, patch, |_, context| {
+            let sequence = super::streaming_state(context)?.next_record_sequence;
+            handler.emit_streaming_state_update(sequence, target, context)?;
+            increment_streaming_record_sequence("update", super::streaming_state(context)?)
         });
-        self.poison_on_error(&result);
-        result
-    }
-
-    /// Render the document tail, emit the terminal record, and end the writer.
-    pub fn finish(mut self, state: &Value) -> Result<()> {
-        self.ensure_finishable()?;
-        if !self.body_ended() {
-            let fragment_count = self
-                .protocol
-                .protocol()
-                .fragments
-                .get(self.entry_id)
-                .map_or(0, |fragments| fragments.fragments.len());
-            self.run_range(state, self.cursor..fragment_count)?;
-        }
-        if !self.body_ended() {
-            return Err(HandlerError::MissingStreamingBodyEnd);
-        }
-        self.finished = true;
-        self.sink.end()
-    }
-
-    fn require_open(&self, operation: &str) -> Result<()> {
-        self.require_usable(operation)?;
-        if self.finished || self.body_ended() {
-            Err(boundary_order_error(
-                operation,
-                "the streaming response has already finished",
-            ))
-        } else {
-            Ok(())
-        }
-    }
-
-    /// Validate that [`Self::finish`] may run, without consuming the response.
-    ///
-    /// Every check here runs before any byte is written, so a caller that
-    /// violates ordering can correct the sequence and finish later. Owned
-    /// sessions rely on that to re-park a response after a rejected `finish`.
-    pub(super) fn ensure_finishable(&self) -> Result<()> {
-        self.require_usable("finish")?;
-        if self.finished {
-            return Err(boundary_order_error(
-                "finish",
-                "the streaming response has already finished",
-            ));
-        }
-        if !self.shell_written {
-            return Err(boundary_order_error(
-                "finish",
-                "write_shell must be called before finish",
-            ));
-        }
-        if self.next_boundary != self.plan.get().boundary_count() {
-            return Err(boundary_order_error(
-                "finish",
-                "every boundary must be committed before finish",
-            ));
-        }
-        Ok(())
-    }
-
-    fn require_usable(&self, operation: &str) -> Result<()> {
-        if self.failed {
-            return Err(boundary_order_error(
-                operation,
-                "the streaming response is unusable after a previous render or transport failure; \
-                 start a new response because bytes may already have been sent",
-            ));
-        }
-        Ok(())
-    }
-
-    fn poison_on_error<T>(&mut self, result: &Result<T>) {
         if result.is_err() {
             self.failed = true;
         }
+        result
     }
 
-    fn body_ended(&self) -> bool {
-        self.streaming.body_ended
-    }
-
-    fn run_range(&mut self, state: &Value, range: std::ops::Range<usize>) -> Result<()> {
-        let protocol: &'a Protocol = self.protocol;
-        let fragments = protocol
-            .protocol()
-            .fragments
-            .get(self.entry_id)
-            .ok_or_else(|| HandlerError::MissingFragment(self.entry_id.to_string()))?;
-        let entry_route = self.entry_route.take();
-        let result = self.with_context(state, |handler, context| {
-            handler.process_fragment_range(&fragments.fragments, range, &entry_route, context)
+    fn run_advance(
+        &mut self,
+        call: SessionCall<'_, '_>,
+        resume: Option<(BoundaryInstanceId, BoundaryMode)>,
+    ) -> Result<StreamStatus> {
+        let state = std::mem::replace(
+            &mut self.frozen_state,
+            Value::Object(serde_json::Map::new()),
+        );
+        let handler = call.handler;
+        let protocol = call.protocol;
+        let result = self.with_context(call, &state, |vm, context| {
+            if let Some((instance_id, mode)) = resume {
+                vm.begin_resume(instance_id, mode, context)?;
+            }
+            let status = vm.advance(handler, protocol, context)?;
+            if !status.done {
+                context.writer.stream_flush()?;
+            }
+            Ok(status)
         });
-        self.entry_route = entry_route;
-        result
+        self.frozen_state = state;
+        match result {
+            Ok(status) => {
+                self.done = status.done;
+                Ok(status)
+            }
+            Err(error) => {
+                self.failed = true;
+                Err(error)
+            }
+        }
     }
 
-    fn with_context<'state, T>(
+    fn with_context<'data, 'state, T>(
         &mut self,
+        call: SessionCall<'_, 'data>,
         state: &'state Value,
         operation: impl for<'output> FnOnce(
-            &WebUIHandler,
-            &mut WebUIProcessContext<'a, 'state, 'output>,
+            &mut ContinuationVm,
+            &mut WebUIProcessContext<'data, 'state, 'output>,
         ) -> Result<T>,
     ) -> Result<T> {
-        let component_asset_style_manifest = self.protocol.component_asset_style_manifest()?;
+        let SessionCall {
+            protocol,
+            options,
+            writer,
+            ..
+        } = call;
+        let component_asset_style_manifest = protocol.component_asset_style_manifest()?;
+        let progress = self.streaming.take().ok_or_else(missing_progress_error)?;
+        let mut streaming =
+            StreamingRenderState::from_progress(progress, protocol.component_reachability());
         let mut context = WebUIProcessContext {
-            protocol: self.protocol.protocol(),
+            protocol: protocol.protocol(),
             component_asset_style_manifest,
-            component_asset_style_links: self.protocol.component_asset_style_links(),
+            component_asset_style_links: protocol.component_asset_style_links(),
             state,
-            writer: &mut self.sink,
+            writer,
             local_vars: std::mem::take(&mut self.local_vars),
             component_attrs: std::mem::take(&mut self.component_attrs),
-            request_path: self.request_path,
-            route_base: std::mem::replace(&mut self.route_base, Cow::Borrowed("/")),
+            request_path: options.request_path,
+            route_base: self
+                .route_base
+                .take()
+                .map_or(Cow::Borrowed("/"), Cow::Owned),
             rendered_components: std::mem::take(&mut self.rendered_components),
             plugin: self.plugin.take(),
             route_children: std::mem::take(&mut self.route_children),
-            entry_id: self.entry_id,
-            nonce: self.nonce,
-            component_index: self.protocol.component_index(),
-            head_inject: self.head_inject,
-            body_inject: self.body_inject,
+            entry_id: options.entry_id,
+            nonce: options.nonce.filter(|nonce| !nonce.is_empty()),
+            component_index: protocol.component_index(),
+            head_inject: options.head_inject.filter(|html| !html.is_empty()),
+            body_inject: options.body_inject.filter(|html| !html.is_empty()),
             state_inject: crate::StateInject::resolve(state),
             head_end_emitted: self.head_end_emitted,
             body_start_emitted: self.body_start_emitted,
             component_asset_styles_emitted: self.component_asset_styles_emitted,
             body_end_emitted: self.body_end_emitted,
-            route_index: self.protocol.route_index(),
+            route_index: protocol.route_index(),
             route_chain_index: self.route_chain_index,
-            streaming: Some(&mut self.streaming),
+            streaming: Some(&mut streaming),
             json_scratch: std::mem::take(&mut self.json_scratch),
             scope_pool: std::mem::take(&mut self.scope_pool),
         };
-
-        let result = operation(self.handler, &mut context);
+        let result = operation(&mut self.vm, &mut context);
         self.local_vars = std::mem::take(&mut context.local_vars);
         self.component_attrs = std::mem::take(&mut context.component_attrs);
-        self.route_base = std::mem::replace(&mut context.route_base, Cow::Borrowed("/"));
+        self.route_base = match std::mem::replace(&mut context.route_base, Cow::Borrowed("/")) {
+            Cow::Owned(base) => Some(base),
+            Cow::Borrowed(_) => None,
+        };
         self.rendered_components = std::mem::take(&mut context.rendered_components);
         self.plugin = context.plugin.take();
         self.route_children = std::mem::take(&mut context.route_children);
@@ -591,6 +474,33 @@ impl<'a, W: FlushWriter + ?Sized> StreamingResponse<'a, W> {
         self.route_chain_index = context.route_chain_index;
         self.json_scratch = std::mem::take(&mut context.json_scratch);
         self.scope_pool = std::mem::take(&mut context.scope_pool);
+        self.streaming = Some(streaming.into_progress());
         result
     }
+
+    fn require_usable(&self, operation: &str) -> Result<()> {
+        if self.failed {
+            return Err(boundary_order_error(
+                operation,
+                "the session is poisoned by a previous render or transport failure; start a new response",
+            ));
+        }
+        Ok(())
+    }
+
+    fn require_started(&self, operation: &str) -> Result<()> {
+        if !self.started {
+            return Err(boundary_order_error(
+                operation,
+                "start must be called before this operation",
+            ));
+        }
+        Ok(())
+    }
+}
+
+#[cold]
+#[inline(never)]
+fn missing_progress_error() -> HandlerError {
+    HandlerError::Invariant("streaming progress is unavailable".to_string())
 }
diff --git a/crates/webui-handler/src/streaming/state.rs b/crates/webui-handler/src/streaming/state.rs
index dd5999eaf..f0c737148 100644
--- a/crates/webui-handler/src/streaming/state.rs
+++ b/crates/webui-handler/src/streaming/state.rs
@@ -1,89 +1,69 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-//! Request-local streaming render state and the head-start precondition.
-//!
-//! Every field here lives for exactly one response. The scratch vectors and
-//! bitsets are reused across checkpoints so a boundary commit allocates
-//! nothing on the steady-state path.
+//! Request-local state shared by the continuation VM and wire serializer.
 
-use webui_protocol::{web_ui_fragment::Fragment, WebUIProtocol};
+use webui_protocol::WebUIProtocol;
 
 use super::root::PendingStreamingRoot;
 use super::streaming_boundary_error;
-use crate::{route_handler, structural_signal_value, HandlerError, Result, WebUIProcessContext};
+use crate::{route_handler, HandlerError, Result, WebUIProcessContext};
 
-pub(super) const BOUNDARY_START_PREFIX: &str = "boundary_start:";
-pub(super) const BOUNDARY_END_PREFIX: &str = "boundary_end:";
+/// Capture buffers for one boundary or generated component span.
+///
+/// Boundary capture lives directly on [`StreamingRenderState`]. Open spans own
+/// one of these records so nested spans never leak roots into an earlier
+/// checkpoint. Buffers are swapped into the serializer and recycled after the
+/// record commits.
+pub(crate) struct RecordCapture {
+    pub(super) tags: Vec<u32>,
+    pub(super) walk_roots: Vec<(u32, Option<Box<str>>)>,
+    pub(super) seen: Vec<u8>,
+    pub(super) needs_expansion: bool,
+}
+
+impl RecordCapture {
+    pub(crate) fn new(component_count: usize) -> Self {
+        Self {
+            tags: Vec::new(),
+            walk_roots: Vec::new(),
+            seen: vec![0; component_count.div_ceil(8)],
+            needs_expansion: false,
+        }
+    }
+
+    pub(crate) fn clear(&mut self) {
+        self.tags.clear();
+        self.walk_roots.clear();
+        self.seen.fill(0);
+        self.needs_expansion = false;
+    }
+}
 
 pub(crate) struct StreamingRenderState<'data> {
-    /// Startup-built component dependency graph. Route-free checkpoints use its
-    /// integer edges instead of walking/cloning protocol fragments per request.
     pub(super) component_reachability: &'data route_handler::ComponentReachabilityIndex,
     pub(super) head_marker_emitted: bool,
-    pub(super) active_boundary: Option<usize>,
-    /// Parser-produced root signal awaiting its exact `>`/component sequence.
-    /// The tag is borrowed from the protocol signal, so validation allocates
-    /// nothing on the successful per-component path.
+    pub(super) active_boundary: Option<u32>,
+    pub(super) current_span: Option<u32>,
+    pub(super) pending_span_host: Option<u32>,
     pub(super) pending_root: Option<PendingStreamingRoot<'data>>,
-    /// Set only between a handler-generated route host's `data-ws` injection
-    /// and its immediately following component render.
     pub(super) generated_root_ready: bool,
-    /// Next compile-time boundary marker expected in the entry fragment.
-    pub(super) next_boundary_id: usize,
-    /// Next wire-record sequence. Updates consume record sequence numbers but
-    /// do not affect compile-time boundary IDs.
     pub(super) next_record_sequence: usize,
-    /// Selected by the host immediately before rendering the next boundary.
-    pub(super) checkpoint_updatable: bool,
     pub(super) bootstrap_sent: bool,
     pub(super) body_ended: bool,
     pub(super) inventory: Vec<u8>,
     pub(super) inventory_delta: Vec<u8>,
     pub(super) inventory_hex: String,
-    /// Dedup bitset for template/CSS metadata already delivered. Kept separate
-    /// from `inventory`: reachable-but-unrendered descendants receive metadata
-    /// but must not be reported as rendered DOM.
     pub(super) template_inventory: Vec<u8>,
-    /// Unique component indexes rendered since the previous checkpoint, in
-    /// render order. Storing the startup-built index rather than the tag string
-    /// keeps capture allocation-free, lets every consumer skip the
-    /// `component_index` hash lookup it would otherwise repeat, and leaves this
-    /// vector free of any borrow so a host-owned session can retain it across
-    /// calls. The vector is cleared after commit while retaining capacity for
-    /// the next checkpoint.
     pub(super) checkpoint_tags: Vec<u32>,
-    /// Source-ordered roots for the request-aware checkpoint walk. `None` marks
-    /// a route-independent root; route-dependent roots retain the base active at
-    /// render time. The vector stays empty for route-free checkpoints and is
-    /// backfilled lazily when their first route-dependent root appears. The
-    /// route base is owned because this uncommon fallback already converts every
-    /// root to an owned string, so borrowing bought nothing.
     pub(super) checkpoint_walk_roots: Vec<(u32, Option<Box<str>>)>,
-    /// Dedup bitset (one bit per component index) marking tags already recorded
-    /// into `checkpoint_tags` for the current checkpoint. Cleared and reused
-    /// alongside `checkpoint_tags`.
     pub(super) checkpoint_seen: Vec<u8>,
-    /// Set while capturing a root whose startup graph contains descendants or
-    /// authored routes. Leaf-only checkpoints retain the original zero-walk path.
     pub(super) checkpoint_needs_expansion: bool,
-    /// Reusable allowlist storage for checkpoint-local hydration state.
     pub(super) state_key_scratch: Vec<&'data str>,
-    /// Component names for the current checkpoint's capture, resolved once from
-    /// `checkpoint_tags` at commit. Borrowed from the startup reachability index
-    /// and cleared before the commit returns, so it never spans a host call.
-    pub(super) checkpoint_name_scratch: Vec<&'data str>,
-    /// Reusable first-delivery metadata tag list.
     pub(super) template_tag_scratch: Vec<&'data str>,
-    /// Reusable CSS bootstrap lists for newly delivered templates.
     pub(super) css_href_scratch: Vec<&'data str>,
     pub(super) style_spec_scratch: Vec<&'data str>,
-    /// Reusable integer DFS stack for expanding route-free checkpoint surfaces.
     pub(super) reachability_stack: Vec<u32>,
-    /// State projection retained only for boundaries explicitly committed as
-    /// updatable. Final boundaries retain no update metadata. Keys are owned so
-    /// the plan survives a host-owned session's call boundaries; the cost is one
-    /// small allocation per key per updatable commit, never per rendered root.
     pub(super) update_plans: Vec<Option<StateUpdatePlan>>,
 }
 
@@ -92,21 +72,14 @@ pub(super) struct StateUpdatePlan {
     pub(super) keys: Vec<Box<str>>,
 }
 
-/// The half of [`StreamingRenderState`] that carries no borrow.
-///
-/// A host-owned response session parks this between calls and rebuilds the
-/// borrowed half from its retained protocol. Splitting the state this way is
-/// what lets a session outlive one `&Protocol` borrow without any self-
-/// referential storage: everything that must survive a call boundary is owned,
-/// and everything borrowed is either derivable from the protocol or provably
-/// empty between calls.
+/// Owned state retained between calls by borrowed and host-owned sessions.
 pub(crate) struct StreamingProgress {
     pub(super) head_marker_emitted: bool,
-    pub(super) active_boundary: Option<usize>,
+    pub(super) active_boundary: Option<u32>,
+    pub(super) current_span: Option<u32>,
+    pub(super) pending_span_host: Option<u32>,
     pub(super) generated_root_ready: bool,
-    pub(super) next_boundary_id: usize,
     pub(super) next_record_sequence: usize,
-    pub(super) checkpoint_updatable: bool,
     pub(super) bootstrap_sent: bool,
     pub(super) body_ended: bool,
     pub(super) inventory: Vec<u8>,
@@ -122,17 +95,15 @@ pub(crate) struct StreamingProgress {
 }
 
 impl StreamingProgress {
-    /// Allocate the request-local bitsets for a protocol with `component_count`
-    /// indexed components.
     pub(crate) fn new(component_count: usize) -> Self {
         let inventory_bytes = component_count.div_ceil(8);
         Self {
             head_marker_emitted: false,
             active_boundary: None,
+            current_span: None,
+            pending_span_host: None,
             generated_root_ready: false,
-            next_boundary_id: 0,
             next_record_sequence: 0,
-            checkpoint_updatable: false,
             bootstrap_sent: false,
             body_ended: false,
             inventory: vec![0; inventory_bytes],
@@ -150,11 +121,6 @@ impl StreamingProgress {
 }
 
 impl<'data> StreamingRenderState<'data> {
-    /// Rebuild the borrowed half around parked progress.
-    ///
-    /// The scratch vectors start empty because every one of them is cleared at
-    /// the end of the commit that fills it, so no borrowed value is ever live
-    /// across a host call boundary.
     pub(crate) fn from_progress(
         progress: StreamingProgress,
         component_reachability: &'data route_handler::ComponentReachabilityIndex,
@@ -163,16 +129,15 @@ impl<'data> StreamingRenderState<'data> {
             component_reachability,
             pending_root: None,
             state_key_scratch: Vec::with_capacity(crate::INITIAL_KEY_CAPACITY),
-            checkpoint_name_scratch: Vec::new(),
             template_tag_scratch: Vec::new(),
             css_href_scratch: Vec::new(),
             style_spec_scratch: Vec::new(),
             head_marker_emitted: progress.head_marker_emitted,
             active_boundary: progress.active_boundary,
+            current_span: progress.current_span,
+            pending_span_host: progress.pending_span_host,
             generated_root_ready: progress.generated_root_ready,
-            next_boundary_id: progress.next_boundary_id,
             next_record_sequence: progress.next_record_sequence,
-            checkpoint_updatable: progress.checkpoint_updatable,
             bootstrap_sent: progress.bootstrap_sent,
             body_ended: progress.body_ended,
             inventory: progress.inventory,
@@ -188,15 +153,14 @@ impl<'data> StreamingRenderState<'data> {
         }
     }
 
-    /// Park the owned half, dropping every borrow.
     pub(crate) fn into_progress(self) -> StreamingProgress {
         StreamingProgress {
             head_marker_emitted: self.head_marker_emitted,
             active_boundary: self.active_boundary,
+            current_span: self.current_span,
+            pending_span_host: self.pending_span_host,
             generated_root_ready: self.generated_root_ready,
-            next_boundary_id: self.next_boundary_id,
             next_record_sequence: self.next_record_sequence,
-            checkpoint_updatable: self.checkpoint_updatable,
             bootstrap_sent: self.bootstrap_sent,
             body_ended: self.body_ended,
             inventory: self.inventory,
@@ -211,42 +175,16 @@ impl<'data> StreamingRenderState<'data> {
             update_plans: self.update_plans,
         }
     }
-}
 
-pub(crate) fn validate_streaming_head_start(
-    protocol: &WebUIProtocol,
-    entry_id: &str,
-) -> Result<()> {
-    let fragments = protocol
-        .fragments
-        .get(entry_id)
-        .ok_or_else(|| HandlerError::MissingFragment(entry_id.to_string()))?;
-    for fragment in &fragments.fragments {
-        let Some(Fragment::Signal(signal)) = fragment.fragment.as_ref() else {
-            continue;
-        };
-        let Some(value) = structural_signal_value(signal) else {
-            continue;
-        };
-        if value == "head_start" {
-            return Ok(());
-        }
-        let before = match value {
-            "head_end" => Some("head_end"),
-            "body_start" => Some("body_start"),
-            "body_end" => Some("body_end"),
-            value if value.starts_with("boundary_start") || value.starts_with("boundary_end") => {
-                Some("streaming boundary")
-            }
-            _ => None,
-        };
-        if let Some(before) = before {
-            return Err(HandlerError::MissingStreamingHeadStart { before });
-        }
+    pub(crate) fn swap_capture(&mut self, capture: &mut RecordCapture) {
+        std::mem::swap(&mut self.checkpoint_tags, &mut capture.tags);
+        std::mem::swap(&mut self.checkpoint_walk_roots, &mut capture.walk_roots);
+        std::mem::swap(&mut self.checkpoint_seen, &mut capture.seen);
+        std::mem::swap(
+            &mut self.checkpoint_needs_expansion,
+            &mut capture.needs_expansion,
+        );
     }
-    Err(HandlerError::MissingStreamingHeadStart {
-        before: "end of entry fragment",
-    })
 }
 
 pub(super) fn require_streaming_head_start(
@@ -264,16 +202,6 @@ pub(super) fn require_streaming_head_start(
     }
 }
 
-pub(super) fn increment_streaming_boundary_id(
-    signal: &str,
-    streaming: &mut StreamingRenderState<'_>,
-) -> Result<()> {
-    streaming.next_boundary_id = streaming.next_boundary_id.checked_add(1).ok_or_else(|| {
-        streaming_boundary_error(signal, "boundary sequence overflowed the platform limit")
-    })?;
-    Ok(())
-}
-
 pub(super) fn increment_streaming_record_sequence(
     signal: &str,
     streaming: &mut StreamingRenderState<'_>,
@@ -287,3 +215,82 @@ pub(super) fn increment_streaming_record_sequence(
             })?;
     Ok(())
 }
+
+pub(crate) fn selected_state_snapshot(
+    state: &serde_json::Value,
+    keys: &[Box<str>],
+) -> serde_json::Value {
+    let serde_json::Value::Object(source) = state else {
+        return serde_json::Value::Object(serde_json::Map::new());
+    };
+    let mut selected = serde_json::Map::with_capacity(keys.len());
+    for key in keys {
+        if let Some(value) = source.get(key.as_ref()) {
+            selected.insert(key.to_string(), value.clone());
+        }
+    }
+    serde_json::Value::Object(selected)
+}
+
+/// Merge the caller's state for this step into the retained continuation
+/// snapshot.
+///
+/// Keys already present reuse their existing entry, so a host that supplies
+/// the same surface on every step pays no key allocation and lets
+/// [`serde_json::Value::clone_from`] reuse the previous value's buffers.
+pub(crate) fn overlay_selected_state(
+    frozen: &mut serde_json::Value,
+    state: &serde_json::Value,
+    keys: &[Box<str>],
+) {
+    if !frozen.is_object() {
+        *frozen = serde_json::Value::Object(serde_json::Map::new());
+    }
+    let serde_json::Value::Object(source) = state else {
+        return;
+    };
+    let serde_json::Value::Object(target) = frozen else {
+        return;
+    };
+    for key in keys {
+        let Some(value) = source.get(key.as_ref()) else {
+            continue;
+        };
+        match target.get_mut(key.as_ref()) {
+            Some(slot) => slot.clone_from(value),
+            None => {
+                target.insert(key.to_string(), value.clone());
+            }
+        }
+    }
+}
+
+pub(crate) fn overlay_full_state(frozen: &mut serde_json::Value, state: &serde_json::Value) {
+    let serde_json::Value::Object(source) = state else {
+        return;
+    };
+    if !frozen.is_object() {
+        *frozen = serde_json::Value::Object(serde_json::Map::new());
+    }
+    let serde_json::Value::Object(target) = frozen else {
+        return;
+    };
+    for (key, value) in source {
+        match target.get_mut(key) {
+            Some(slot) => slot.clone_from(value),
+            None => {
+                target.insert(key.clone(), value.clone());
+            }
+        }
+    }
+}
+
+pub(crate) fn protocol_fragment<'a>(
+    protocol: &'a WebUIProtocol,
+    id: &str,
+) -> Result<&'a webui_protocol::FragmentList> {
+    protocol
+        .fragments
+        .get(id)
+        .ok_or_else(|| HandlerError::MissingFragment(id.to_string()))
+}
diff --git a/crates/webui-handler/src/streaming/vm.rs b/crates/webui-handler/src/streaming/vm.rs
new file mode 100644
index 000000000..974815056
--- /dev/null
+++ b/crates/webui-handler/src/streaming/vm.rs
@@ -0,0 +1,1487 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+//! Iterative continuation VM for runtime boundary discovery.
+
+use std::borrow::Cow;
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use serde_json::Value;
+use webui_protocol::{
+    condition_expr, web_ui_fragment::Fragment, BoundaryPhase, ConditionExpr, InitialStateStrategy,
+    StateProjectionMode, WebUIFragment, WebUIFragmentBoundary, WebUIFragmentComponent,
+    WebUIFragmentFor, WebUIFragmentIf, WebUIProtocol, WebUiFragmentRoute,
+};
+
+use super::checkpoint::RangeRecord;
+use super::error::{
+    boundary_limit_error, boundary_order_error, continuation_limit_error,
+    duplicate_boundary_key_error, invalid_boundary_key_error, keyed_instance_limit_error,
+    malformed_span_signal_error, span_limit_error, span_nesting_error,
+};
+use super::root::ComponentHostOrigin;
+use super::session::{
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, SpanInstanceId,
+    StreamStatus, MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH, MAX_KEYED_INSTANCES,
+    MAX_OPEN_SPANS, MAX_SPAN_NESTING,
+};
+use super::state::{increment_streaming_record_sequence, protocol_fragment, RecordCapture};
+use super::{
+    consume_streaming_component_root, prepare_generated_streaming_root, record_checkpoint_tag,
+    streaming_state,
+};
+use crate::route_matcher::RouteMatch;
+use crate::{
+    structural_signal_value, HandlerError, Result, WebUIHandler, WebUIProcessContext,
+    STATE_INJECT_KEY,
+};
+
+const SPAN_START_PREFIX: &str = "streaming_span_start:";
+const SPAN_END_PREFIX: &str = "streaming_span_end:";
+const CAPTURE_POOL_LIMIT: usize = 8;
+/// Frames retained by a typical entry before any growth.
+///
+/// Sized from the deepest continuation an ordinary page reaches (entry record,
+/// a component host, and one conditional or loop body) so the common response
+/// never reallocates its frame stack.
+const INITIAL_FRAME_CAPACITY: usize = 16;
+
+pub(crate) struct ContinuationVm {
+    frames: Vec<Frame>,
+    pending: Option<PendingBoundary>,
+    active: Option<ActiveBoundary>,
+    open_spans: Vec<OpenSpan>,
+    capture_pool: Vec<RecordCapture>,
+    next_boundary_id: u32,
+    next_span_id: u32,
+    keyed_instances: HashMap<u32, HashSet<BoundaryKey>>,
+    keyed_instance_count: usize,
+    committed_modes: Vec<BoundaryMode>,
+    component_count: usize,
+    pending_span_candidate: Option<Box<str>>,
+}
+
+/// Immutable per-entry projection surface shared by every response.
+///
+/// Built once per entry by [`crate::Protocol`] and handed to sessions as a
+/// cheap pointer clone, so no response walks the fragment graph merely to
+/// decide which top-level state keys its continuation retains.
+pub(crate) struct ContinuationStatePlan {
+    pub(crate) keys: Arc<[Box<str>]>,
+    pub(crate) requires_full_state: bool,
+}
+
+/// A memoized [`ContinuationStatePlan`], including a replayable failure.
+///
+/// Building the plan can fail on a malformed protocol. Capturing that failure
+/// keeps the memo authoritative: a bad entry is diagnosed identically on every
+/// response without re-walking a graph that is already known to be unusable.
+pub(crate) struct PreparedContinuationStatePlan {
+    result: std::result::Result<ContinuationStatePlan, ContinuationStatePlanError>,
+}
+
+enum ContinuationStatePlanError {
+    Boundary { signal: String, reason: String },
+    MissingFragment(String),
+    Invariant(String),
+}
+
+impl PreparedContinuationStatePlan {
+    pub(crate) fn new(protocol: &WebUIProtocol, entry_id: &str) -> Self {
+        Self {
+            result: ContinuationVm::collect_state_keys(
+                protocol,
+                entry_id,
+                super::session::MAX_FROZEN_STATE_KEYS,
+            )
+            .map_err(ContinuationStatePlanError::capture),
+        }
+    }
+
+    pub(crate) fn resolve(&self) -> Result<&ContinuationStatePlan> {
+        self.result
+            .as_ref()
+            .map_err(ContinuationStatePlanError::to_handler_error)
+    }
+}
+
+impl ContinuationStatePlanError {
+    #[cold]
+    #[inline(never)]
+    fn capture(error: HandlerError) -> Self {
+        match error {
+            HandlerError::StreamingBoundary(error) => Self::Boundary {
+                signal: error.signal,
+                reason: error.reason,
+            },
+            HandlerError::MissingFragment(id) => Self::MissingFragment(id),
+            HandlerError::Invariant(message) => Self::Invariant(message),
+            error => Self::Invariant(error.to_string()),
+        }
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn to_handler_error(&self) -> HandlerError {
+        match self {
+            Self::Boundary { signal, reason } => {
+                HandlerError::StreamingBoundary(Box::new(crate::StreamingBoundaryError {
+                    signal: signal.clone(),
+                    reason: reason.clone(),
+                }))
+            }
+            Self::MissingFragment(id) => HandlerError::MissingFragment(id.clone()),
+            Self::Invariant(message) => HandlerError::Invariant(message.clone()),
+        }
+    }
+}
+
+/// The suspended occurrence awaiting `resume`.
+///
+/// Only the identity is retained: the descriptor handed to the host owns its
+/// authored strings, so keeping a second copy here would allocate once more per
+/// occurrence for data the continuation never reads.
+#[derive(Clone, Copy)]
+struct PendingBoundary {
+    instance_id: BoundaryInstanceId,
+    declaration_id: u32,
+}
+
+struct ActiveBoundary {
+    instance_id: BoundaryInstanceId,
+    declaration_id: u32,
+    mode: BoundaryMode,
+}
+
+struct OpenSpan {
+    id: SpanInstanceId,
+    tag: Box<str>,
+    capture: RecordCapture,
+}
+
+enum Frame {
+    EnterFragment(u32),
+    Fragment(FragmentFrame),
+    ComponentEnd {
+        saved_local_vars: HashMap<String, Value>,
+    },
+    IfEnd {
+        slot: u32,
+    },
+    For(ForFrame),
+    RepeatEnd {
+        index: usize,
+    },
+    GeneratedComponentStart {
+        tag: Box<str>,
+    },
+    GeneratedComponentEnd {
+        tag: Box<str>,
+        spanning: bool,
+    },
+    RouteEnd {
+        saved_route_base: Box<str>,
+        saved_route_children: Vec<WebUiFragmentRoute>,
+    },
+    Outlet(OutletFrame),
+}
+
+struct FragmentFrame {
+    slot: u32,
+    index: usize,
+    best_route: Option<(String, RouteMatch)>,
+}
+
+struct ForFrame {
+    slot: u32,
+    item_name: Box<str>,
+    items: std::vec::IntoIter<Value>,
+    next_index: usize,
+    saved_value: Option<Value>,
+}
+
+struct OutletFrame {
+    routes: Vec<WebUiFragmentRoute>,
+    index: usize,
+    best: Option<(usize, RouteMatch)>,
+}
+
+impl ContinuationVm {
+    pub(crate) fn new(entry_id: &str, protocol: &crate::Protocol) -> Result<Self> {
+        protocol_fragment(protocol.protocol(), entry_id)?;
+        let entry_slot = protocol
+            .fragment_slot(entry_id)
+            .ok_or_else(|| HandlerError::MissingFragment(entry_id.to_string()))?;
+        let mut frames = Vec::with_capacity(INITIAL_FRAME_CAPACITY);
+        frames.push(Frame::EnterFragment(entry_slot));
+        Ok(Self {
+            frames,
+            pending: None,
+            active: None,
+            open_spans: Vec::new(),
+            capture_pool: Vec::new(),
+            next_boundary_id: 0,
+            next_span_id: 0,
+            keyed_instances: HashMap::new(),
+            keyed_instance_count: 0,
+            committed_modes: Vec::new(),
+            component_count: protocol.component_index().len(),
+            pending_span_candidate: None,
+        })
+    }
+
+    pub(crate) fn validate_resume(&self, instance_id: BoundaryInstanceId) -> Result<()> {
+        let Some(pending) = self.pending.as_ref() else {
+            return Err(boundary_order_error(
+                "resume",
+                "there is no pending boundary occurrence",
+            ));
+        };
+        if pending.instance_id != instance_id {
+            return Err(boundary_order_error(
+                "resume",
+                "the supplied instance ID is stale or does not match the pending occurrence",
+            ));
+        }
+        Ok(())
+    }
+
+    pub(crate) fn validate_update(&self, instance_id: BoundaryInstanceId) -> Result<usize> {
+        let index = instance_id.index()?;
+        let Some(mode) = self.committed_modes.get(index) else {
+            return Err(boundary_order_error(
+                "update",
+                "the target boundary occurrence has not committed",
+            ));
+        };
+        if *mode != BoundaryMode::Updatable {
+            return Err(super::error::boundary_not_updatable_error(index));
+        }
+        Ok(index)
+    }
+
+    pub(crate) fn begin_resume(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        mode: BoundaryMode,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        self.validate_resume(instance_id)?;
+        let Some(pending) = self.pending.take() else {
+            return Err(boundary_order_error(
+                "resume",
+                "there is no pending boundary occurrence",
+            ));
+        };
+        super::write_range_marker(context.writer, "<!--wb:", instance_id.raw())?;
+        let streaming = streaming_state(context)?;
+        streaming.active_boundary = Some(instance_id.raw());
+        streaming.checkpoint_tags.clear();
+        streaming.checkpoint_walk_roots.clear();
+        streaming.checkpoint_seen.fill(0);
+        streaming.checkpoint_needs_expansion = false;
+        self.active = Some(ActiveBoundary {
+            instance_id: pending.instance_id,
+            declaration_id: pending.declaration_id,
+            mode,
+        });
+        Ok(())
+    }
+
+    pub(crate) fn advance<'data>(
+        &mut self,
+        handler: &WebUIHandler,
+        protocol: &'data crate::Protocol,
+        context: &mut WebUIProcessContext<'data, '_, '_>,
+    ) -> Result<StreamStatus> {
+        while let Some(frame) = self.frames.pop() {
+            match frame {
+                Frame::EnterFragment(slot) => {
+                    let frame = self.open_fragment(slot, protocol, context)?;
+                    if let Some(status) = self.run_fragment(frame, handler, protocol, context)? {
+                        return Ok(status);
+                    }
+                }
+                Frame::Fragment(frame) => {
+                    if let Some(status) = self.run_fragment(frame, handler, protocol, context)? {
+                        return Ok(status);
+                    }
+                }
+                Frame::ComponentEnd { saved_local_vars } => {
+                    self.end_component(saved_local_vars, context)?;
+                }
+                Frame::IfEnd { slot } => {
+                    if let Some(plugin) = context.plugin.as_mut() {
+                        let fragment_id = protocol
+                            .fragment_id(slot)
+                            .ok_or_else(|| unknown_fragment_slot_error(slot))?;
+                        plugin.pop_scope();
+                        plugin.on_if_end(fragment_id, context.writer)?;
+                    }
+                }
+                Frame::For(frame) => self.step_for(frame, protocol, context)?,
+                Frame::RepeatEnd { index } => {
+                    if let Some(plugin) = context.plugin.as_mut() {
+                        plugin.pop_scope();
+                        plugin.on_repeat_item_end(index, context.writer)?;
+                    }
+                }
+                Frame::GeneratedComponentStart { tag } => {
+                    self.start_generated_component(tag, handler, protocol, context)?;
+                }
+                Frame::GeneratedComponentEnd { tag, spanning } => {
+                    context.writer.write("</")?;
+                    context.writer.write(&tag)?;
+                    context.writer.write(">")?;
+                    if spanning {
+                        self.finish_span(&tag, handler, context)?;
+                    }
+                }
+                Frame::RouteEnd {
+                    saved_route_base,
+                    saved_route_children,
+                } => {
+                    context.writer.write("</webui-route>")?;
+                    context.route_base = Cow::Owned(saved_route_base.into_string());
+                    context.route_children = saved_route_children;
+                }
+                Frame::Outlet(frame) => self.step_outlet(frame, handler, protocol, context)?,
+            }
+        }
+
+        if self.pending.is_some() || self.active.is_some() {
+            return Err(HandlerError::Invariant(
+                "pending boundary lost its continuation".to_string(),
+            ));
+        }
+        if !self.open_spans.is_empty() {
+            return Err(malformed_span_signal_error(
+                "component span",
+                "traversal completed before every component span closed",
+            ));
+        }
+        if self.pending_span_candidate.is_some() {
+            return Err(malformed_span_signal_error(
+                "component span",
+                "traversal completed with an unfinished component host",
+            ));
+        }
+        if !context
+            .streaming
+            .as_ref()
+            .is_some_and(|streaming| streaming.head_marker_emitted)
+        {
+            return Err(HandlerError::MissingStreamingHeadStart { before: "terminal" });
+        }
+        if !context
+            .streaming
+            .as_ref()
+            .is_some_and(|streaming| streaming.body_ended)
+        {
+            return Err(HandlerError::MissingStreamingBodyEnd);
+        }
+        let sequence = streaming_state(context)?.next_record_sequence;
+        handler.emit_streaming_terminal(sequence, context)?;
+        increment_streaming_record_sequence("terminal", streaming_state(context)?)?;
+        context.writer.end()?;
+        Ok(StreamStatus {
+            boundary: None,
+            done: true,
+        })
+    }
+
+    fn open_fragment(
+        &mut self,
+        slot: u32,
+        protocol: &crate::Protocol,
+        context: &WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<FragmentFrame> {
+        let list = slot_fragment(protocol, slot)?;
+        let best_route = crate::route_renderer::find_best_route_match(
+            &list.fragments,
+            context.request_path,
+            &context.route_base,
+            context.route_index,
+        );
+        Ok(FragmentFrame {
+            slot,
+            index: 0,
+            best_route,
+        })
+    }
+
+    /// Walk one fragment record until it descends, suspends, or ends.
+    ///
+    /// The record is resolved once per entry and inert fragments never touch
+    /// the frame stack, so a boundary body costs one map lookup rather than one
+    /// per fragment. Only a construct that owns a child record (component,
+    /// condition, loop, route, outlet) or a discovered boundary parks the frame
+    /// and returns to the caller.
+    fn run_fragment<'data>(
+        &mut self,
+        mut frame: FragmentFrame,
+        handler: &WebUIHandler,
+        protocol: &'data crate::Protocol,
+        context: &mut WebUIProcessContext<'data, '_, '_>,
+    ) -> Result<Option<StreamStatus>> {
+        let list = slot_fragment(protocol, frame.slot)?;
+        loop {
+            let index = frame.index;
+            let Some(fragment) = list.fragments.get(index) else {
+                super::ensure_no_pending_streaming_root(
+                    context,
+                    "the end of the containing fragment",
+                )?;
+                return Ok(None);
+            };
+            super::validate_pending_streaming_root(fragment, context)?;
+            super::validate_streaming_root_opening(&list.fragments[..index], fragment)?;
+            frame.index = index + 1;
+
+            match fragment.fragment.as_ref() {
+                Some(Fragment::Raw(raw)) => context.writer.write(&raw.value)?,
+                Some(Fragment::Signal(signal)) => {
+                    self.process_signal(signal, handler, context)?;
+                }
+                Some(Fragment::Attribute(attribute)) => {
+                    handler.process_attribute(attribute, context)?;
+                }
+                Some(Fragment::Plugin(plugin)) => {
+                    if let Some(active) = context.plugin.as_mut() {
+                        active.on_element_data(&plugin.data, context.writer)?;
+                    }
+                }
+                Some(Fragment::Boundary(boundary)) => {
+                    if boundary.phase() == BoundaryPhase::End {
+                        self.finish_boundary(boundary, handler, context)?;
+                        continue;
+                    }
+                    let descriptor =
+                        self.discover_boundary(boundary, handler, protocol, context)?;
+                    self.push(Frame::Fragment(frame))?;
+                    return Ok(Some(StreamStatus {
+                        boundary: Some(descriptor),
+                        done: false,
+                    }));
+                }
+                Some(Fragment::Component(component)) => {
+                    self.push(Frame::Fragment(frame))?;
+                    self.begin_component(
+                        component,
+                        ComponentHostOrigin::ParserProduced,
+                        (handler, protocol),
+                        context,
+                    )?;
+                    return Ok(None);
+                }
+                Some(Fragment::IfCond(if_cond)) => {
+                    self.push(Frame::Fragment(frame))?;
+                    self.begin_if(if_cond, handler, protocol, context)?;
+                    return Ok(None);
+                }
+                Some(Fragment::ForLoop(for_loop)) => {
+                    self.push(Frame::Fragment(frame))?;
+                    self.begin_for(for_loop, handler, protocol, context)?;
+                    return Ok(None);
+                }
+                Some(Fragment::Route(route)) => {
+                    let route_match = frame
+                        .best_route
+                        .as_ref()
+                        .filter(|(key, _)| *key == route.fragment_id)
+                        .map(|(_, route_match)| route_match.clone());
+                    self.push(Frame::Fragment(frame))?;
+                    self.render_route(route, route_match, protocol, context)?;
+                    return Ok(None);
+                }
+                Some(Fragment::Outlet(_)) => {
+                    self.push(Frame::Fragment(frame))?;
+                    self.begin_outlet(context)?;
+                    return Ok(None);
+                }
+                None => {}
+            }
+        }
+    }
+
+    fn process_signal<'data>(
+        &mut self,
+        signal: &'data webui_protocol::WebUIFragmentSignal,
+        handler: &WebUIHandler,
+        context: &mut WebUIProcessContext<'data, '_, '_>,
+    ) -> Result<()> {
+        if let Some(value) = structural_signal_value(signal) {
+            if let Some(tag) = value.strip_prefix(SPAN_START_PREFIX) {
+                if self.pending_span_candidate.is_some() {
+                    return Err(malformed_span_signal_error(
+                        tag,
+                        "a component span start arrived before the previous host opening completed",
+                    ));
+                }
+                context.writer.stream_begin_component()?;
+                self.pending_span_candidate = Some(tag.into());
+                return Ok(());
+            }
+            if let Some(tag) = value.strip_prefix(SPAN_END_PREFIX) {
+                return self.finish_span(tag, handler, context);
+            }
+            if let Some(tag) = value.strip_prefix(super::root::STREAMING_ROOT_PREFIX) {
+                if let Some(candidate) = self.pending_span_candidate.as_ref() {
+                    if candidate.as_ref() != tag {
+                        return Err(malformed_span_signal_error(
+                            tag,
+                            "component root does not match its pending span host",
+                        ));
+                    }
+                    context.writer.stream_mark_component_root()?;
+                    return Ok(());
+                }
+            }
+        }
+        handler.process_signal(signal, context)
+    }
+
+    fn begin_component<'data>(
+        &mut self,
+        component: &WebUIFragmentComponent,
+        origin: ComponentHostOrigin,
+        runtime: (&WebUIHandler, &'data crate::Protocol),
+        context: &mut WebUIProcessContext<'data, '_, '_>,
+    ) -> Result<()> {
+        let (handler, protocol) = runtime;
+        if let Some(candidate) = self.pending_span_candidate.take() {
+            if candidate.as_ref() != component.fragment_id {
+                return Err(malformed_span_signal_error(
+                    &component.fragment_id,
+                    "component fragment does not match its buffered span opening",
+                ));
+            }
+            if !protocol_fragment(protocol.protocol(), &component.fragment_id)?.contains_boundary {
+                return Err(malformed_span_signal_error(
+                    &component.fragment_id,
+                    "component span signals require a boundary-containing fragment record",
+                ));
+            }
+            let active_boundary = streaming_state(context)?.active_boundary.is_some();
+            let enclosing_span = streaming_state(context)?.current_span;
+            let span_id = self.open_span(&component.fragment_id, context, false)?;
+            context.writer.stream_commit_component(
+                Some(span_id.raw()),
+                if active_boundary {
+                    enclosing_span
+                } else {
+                    None
+                },
+                true,
+            )?;
+            streaming_state(context)?.current_span = Some(span_id.raw());
+            self.record_component(&component.fragment_id, context)?;
+        } else {
+            consume_streaming_component_root(&component.fragment_id, origin, context)?;
+            let pending_span = streaming_state(context)?.pending_span_host.take();
+            if let Some(span_id) = pending_span {
+                let Some(open) = self.open_spans.last() else {
+                    return Err(malformed_span_signal_error(
+                        &component.fragment_id,
+                        "component host references a span that is not open",
+                    ));
+                };
+                if open.id.raw() != span_id {
+                    return Err(malformed_span_signal_error(
+                        &component.fragment_id,
+                        "component host span ID does not match the open span",
+                    ));
+                }
+                streaming_state(context)?.current_span = Some(span_id);
+            }
+            self.record_component(&component.fragment_id, context)?;
+        }
+
+        if !context.rendered_components.contains(&component.fragment_id) {
+            handler.emit_css_module(component, context)?;
+            context
+                .rendered_components
+                .insert(component.fragment_id.clone());
+        }
+        let saved_local_vars = std::mem::take(&mut context.local_vars);
+        let saved_component_attrs = std::mem::replace(
+            &mut context.component_attrs,
+            crate::take_scope_map(&mut context.scope_pool),
+        );
+        context.local_vars = saved_component_attrs;
+        if let Some(plugin) = context.plugin.as_mut() {
+            plugin.push_scope();
+        }
+        self.push(Frame::ComponentEnd { saved_local_vars })?;
+        let slot = fragment_slot(protocol, &component.fragment_id)?;
+        self.push(Frame::EnterFragment(slot))?;
+        Ok(())
+    }
+
+    fn end_component(
+        &mut self,
+        saved_local_vars: HashMap<String, Value>,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        if let Some(plugin) = context.plugin.as_mut() {
+            plugin.pop_scope();
+        }
+        let used_locals = std::mem::replace(&mut context.local_vars, saved_local_vars);
+        crate::recycle_scope_map(&mut context.scope_pool, used_locals);
+        context.component_attrs.clear();
+        Ok(())
+    }
+
+    fn begin_if(
+        &mut self,
+        if_cond: &WebUIFragmentIf,
+        handler: &WebUIHandler,
+        protocol: &crate::Protocol,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        let condition = if_cond
+            .condition
+            .as_ref()
+            .ok_or_else(missing_if_condition_error)?;
+        let condition_met = handler.evaluate_condition(condition, context)?;
+        if let Some(plugin) = context.plugin.as_mut() {
+            plugin.on_if_start(&if_cond.fragment_id, context.writer)?;
+        }
+        if condition_met {
+            if let Some(plugin) = context.plugin.as_mut() {
+                plugin.push_scope();
+            }
+            let slot = fragment_slot(protocol, &if_cond.fragment_id)?;
+            self.push(Frame::IfEnd { slot })?;
+            self.push(Frame::EnterFragment(slot))?;
+        } else if let Some(plugin) = context.plugin.as_mut() {
+            plugin.on_if_end(&if_cond.fragment_id, context.writer)?;
+        }
+        Ok(())
+    }
+
+    fn begin_for(
+        &mut self,
+        for_loop: &WebUIFragmentFor,
+        handler: &WebUIHandler,
+        protocol: &crate::Protocol,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        let items = match handler.resolve_value(&for_loop.collection, context) {
+            Some(Value::Array(items)) => items,
+            Some(_) => return Err(non_array_collection_error(&for_loop.collection)),
+            None => Vec::new(),
+        };
+        if let Some(plugin) = context.plugin.as_mut() {
+            plugin.on_for_start(&for_loop.fragment_id, context.writer)?;
+        }
+        let saved_value = context.local_vars.remove(&for_loop.item);
+        if !items.is_empty() {
+            context
+                .local_vars
+                .insert(for_loop.item.clone(), Value::Null);
+        }
+        self.push(Frame::For(ForFrame {
+            slot: fragment_slot(protocol, &for_loop.fragment_id)?,
+            item_name: for_loop.item.clone().into(),
+            items: items.into_iter(),
+            next_index: 0,
+            saved_value,
+        }))
+    }
+
+    fn step_for(
+        &mut self,
+        mut frame: ForFrame,
+        protocol: &crate::Protocol,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        if let Some(item) = frame.items.next() {
+            let index = frame.next_index;
+            frame.next_index = frame
+                .next_index
+                .checked_add(1)
+                .ok_or_else(|| boundary_limit_error(MAX_BOUNDARY_OCCURRENCES))?;
+            if let Some(plugin) = context.plugin.as_mut() {
+                plugin.on_repeat_item_start(index, context.writer)?;
+                plugin.push_scope();
+            }
+            if let Some(entry) = context.local_vars.get_mut(frame.item_name.as_ref()) {
+                *entry = item;
+            }
+            let slot = frame.slot;
+            self.push(Frame::For(frame))?;
+            self.push(Frame::RepeatEnd { index })?;
+            self.push(Frame::EnterFragment(slot))?;
+            return Ok(());
+        }
+        match frame.saved_value {
+            Some(value) => {
+                context.local_vars.insert(frame.item_name.into(), value);
+            }
+            None => {
+                context.local_vars.remove(frame.item_name.as_ref());
+            }
+        }
+        if let Some(plugin) = context.plugin.as_mut() {
+            let fragment_id = protocol
+                .fragment_id(frame.slot)
+                .ok_or_else(|| unknown_fragment_slot_error(frame.slot))?;
+            plugin.on_for_end(fragment_id, context.writer)?;
+        }
+        Ok(())
+    }
+
+    fn discover_boundary(
+        &mut self,
+        boundary: &WebUIFragmentBoundary,
+        handler: &WebUIHandler,
+        protocol: &crate::Protocol,
+        context: &WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<BoundaryDescriptor> {
+        if self.pending.is_some()
+            || self.active.is_some()
+            || context
+                .streaming
+                .as_ref()
+                .is_some_and(|s| s.active_boundary.is_some())
+        {
+            return Err(boundary_order_error(
+                "boundary",
+                "a nested boundary occurrence is not valid",
+            ));
+        }
+        let index = usize::try_from(self.next_boundary_id)
+            .map_err(|_| boundary_limit_error(MAX_BOUNDARY_OCCURRENCES))?;
+        if index >= MAX_BOUNDARY_OCCURRENCES {
+            return Err(boundary_limit_error(MAX_BOUNDARY_OCCURRENCES));
+        }
+        let instance_id = BoundaryInstanceId::from_raw(self.next_boundary_id);
+        self.next_boundary_id = self
+            .next_boundary_id
+            .checked_add(1)
+            .ok_or_else(|| boundary_limit_error(MAX_BOUNDARY_OCCURRENCES))?;
+        let key = self.evaluate_boundary_key(boundary, handler, context)?;
+        if boundary.may_repeat {
+            let Some(key) = key.as_ref() else {
+                return Err(invalid_boundary_key_error(
+                    boundary.declaration_id,
+                    &boundary.name,
+                    "a declaration that may repeat has no key",
+                ));
+            };
+            if self.keyed_instance_count >= MAX_KEYED_INSTANCES {
+                return Err(keyed_instance_limit_error(MAX_KEYED_INSTANCES));
+            }
+            let keys = self
+                .keyed_instances
+                .entry(boundary.declaration_id)
+                .or_default();
+            if !keys.insert(key.clone()) {
+                return Err(duplicate_boundary_key_error(
+                    boundary.declaration_id,
+                    &boundary.name,
+                    &key.diagnostic(),
+                ));
+            }
+            self.keyed_instance_count += 1;
+        }
+        let (owner, name) = match protocol.boundary_declaration(boundary.declaration_id) {
+            Some(declaration) => (
+                Arc::clone(&declaration.owner),
+                Arc::clone(&declaration.name),
+            ),
+            None => (
+                Arc::from(boundary.owner_fragment_id.as_str()),
+                Arc::from(boundary.name.as_str()),
+            ),
+        };
+        let descriptor = BoundaryDescriptor {
+            instance_id,
+            declaration_id: boundary.declaration_id,
+            owner,
+            name,
+            key,
+        };
+        self.pending = Some(PendingBoundary {
+            instance_id,
+            declaration_id: boundary.declaration_id,
+        });
+        Ok(descriptor)
+    }
+
+    fn evaluate_boundary_key(
+        &self,
+        boundary: &WebUIFragmentBoundary,
+        handler: &WebUIHandler,
+        context: &WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<Option<BoundaryKey>> {
+        let Some(raw) = boundary.key.as_deref() else {
+            return Ok(None);
+        };
+        let trimmed = raw.trim();
+        let path = trimmed
+            .strip_prefix("{{")
+            .and_then(|value| value.strip_suffix("}}"))
+            .map_or(trimmed, str::trim);
+        let Some(value) = handler.resolve_value(path, context) else {
+            return Err(invalid_boundary_key_error(
+                boundary.declaration_id,
+                &boundary.name,
+                "the expression did not resolve",
+            ));
+        };
+        match value {
+            Value::String(value) => Ok(Some(BoundaryKey::String(value))),
+            Value::Number(value) => Ok(Some(BoundaryKey::Number(value))),
+            _ => Err(invalid_boundary_key_error(
+                boundary.declaration_id,
+                &boundary.name,
+                "the expression resolved to a non-number/non-string value",
+            )),
+        }
+    }
+
+    fn finish_boundary(
+        &mut self,
+        marker: &WebUIFragmentBoundary,
+        handler: &WebUIHandler,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        let Some(active) = self.active.take() else {
+            return Err(boundary_order_error(
+                "boundary",
+                "a boundary end marker has no active occurrence",
+            ));
+        };
+        if active.declaration_id != marker.declaration_id
+            || streaming_state(context)?.active_boundary != Some(active.instance_id.raw())
+        {
+            return Err(boundary_order_error(
+                "boundary",
+                "the active boundary occurrence changed before its body completed",
+            ));
+        }
+        super::write_range_marker(context.writer, "<!--/wb:", active.instance_id.raw())?;
+        let enclosing_span_instance_id = streaming_state(context)?.current_span;
+        handler.emit_streaming_range_record(
+            RangeRecord::Boundary {
+                instance_id: active.instance_id.raw(),
+                declaration_id: active.declaration_id,
+                enclosing_span_instance_id,
+                updatable: active.mode == BoundaryMode::Updatable,
+            },
+            context,
+        )?;
+        increment_streaming_record_sequence("boundary", streaming_state(context)?)?;
+        streaming_state(context)?.active_boundary = None;
+        let expected = self.committed_modes.len();
+        if active.instance_id.index()? != expected {
+            return Err(HandlerError::Invariant(
+                "committed boundary IDs are not gapless".to_string(),
+            ));
+        }
+        self.committed_modes.push(active.mode);
+        Ok(())
+    }
+
+    fn start_span(
+        &mut self,
+        tag: &str,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        let id = self.open_span(tag, context, true)?;
+        streaming_state(context)?.pending_span_host = Some(id.raw());
+        Ok(())
+    }
+
+    fn open_span(
+        &mut self,
+        tag: &str,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+        write_marker: bool,
+    ) -> Result<SpanInstanceId> {
+        if tag.is_empty() {
+            return Err(malformed_span_signal_error(
+                SPAN_START_PREFIX,
+                "component span start is missing its tag",
+            ));
+        }
+        if self.open_spans.len() >= MAX_OPEN_SPANS {
+            return Err(span_limit_error(MAX_OPEN_SPANS));
+        }
+        if self.open_spans.len() >= MAX_SPAN_NESTING {
+            return Err(span_nesting_error(MAX_SPAN_NESTING));
+        }
+        let id = SpanInstanceId::new(self.next_span_id);
+        self.next_span_id = self
+            .next_span_id
+            .checked_add(1)
+            .ok_or_else(|| span_limit_error(MAX_OPEN_SPANS))?;
+        if write_marker {
+            super::write_range_marker(context.writer, "<!--ws:", id.raw())?;
+        }
+        let mut capture = self
+            .capture_pool
+            .pop()
+            .unwrap_or_else(|| RecordCapture::new(self.component_count));
+        capture.clear();
+        self.open_spans.push(OpenSpan {
+            id,
+            tag: tag.into(),
+            capture,
+        });
+        Ok(id)
+    }
+
+    fn finish_span(
+        &mut self,
+        tag: &str,
+        handler: &WebUIHandler,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        let Some(mut span) = self.open_spans.pop() else {
+            return Err(malformed_span_signal_error(
+                tag,
+                "component span end has no matching start",
+            ));
+        };
+        if span.tag.as_ref() != tag {
+            return Err(malformed_span_signal_error(
+                tag,
+                "component span end does not match the innermost open host",
+            ));
+        }
+        if streaming_state(context)?.active_boundary.is_some() {
+            return Err(malformed_span_signal_error(
+                tag,
+                "component host closed before its boundary body committed",
+            ));
+        }
+        super::write_range_marker(context.writer, "<!--/ws:", span.id.raw())?;
+        streaming_state(context)?.swap_capture(&mut span.capture);
+        let result = handler.emit_streaming_range_record(
+            RangeRecord::Span {
+                instance_id: span.id.raw(),
+            },
+            context,
+        );
+        streaming_state(context)?.swap_capture(&mut span.capture);
+        result?;
+        increment_streaming_record_sequence("span completion", streaming_state(context)?)?;
+        streaming_state(context)?.current_span = self.open_spans.last().map(|open| open.id.raw());
+        streaming_state(context)?.pending_span_host = None;
+        if self.capture_pool.len() < CAPTURE_POOL_LIMIT {
+            span.capture.clear();
+            self.capture_pool.push(span.capture);
+        }
+        Ok(())
+    }
+
+    fn record_component(
+        &mut self,
+        tag: &str,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        if context
+            .streaming
+            .as_ref()
+            .is_some_and(|streaming| streaming.active_boundary.is_some())
+        {
+            record_checkpoint_tag(context, tag);
+            return Ok(());
+        }
+        let Some(span) = self.open_spans.last_mut() else {
+            return Err(super::error::streaming_root_outside_boundary_error(tag));
+        };
+        streaming_state(context)?.swap_capture(&mut span.capture);
+        record_checkpoint_tag(context, tag);
+        streaming_state(context)?.swap_capture(&mut span.capture);
+        Ok(())
+    }
+
+    fn start_generated_component<'data>(
+        &mut self,
+        tag: Box<str>,
+        handler: &WebUIHandler,
+        protocol: &'data crate::Protocol,
+        context: &mut WebUIProcessContext<'data, '_, '_>,
+    ) -> Result<()> {
+        let spanning = protocol_fragment(protocol.protocol(), &tag)?.contains_boundary;
+        let enclosed = context.streaming.as_ref().is_some_and(|streaming| {
+            streaming.active_boundary.is_some() || streaming.current_span.is_some()
+        });
+        if !spanning && !enclosed {
+            return Err(super::error::streaming_root_outside_boundary_error(&tag));
+        }
+        let component = WebUIFragmentComponent {
+            fragment_id: tag.to_string(),
+        };
+        if spanning {
+            self.start_span(&tag, context)?;
+        }
+        context.writer.write("<")?;
+        context.writer.write(&tag)?;
+        if let Some(plugin) = context.plugin.as_ref() {
+            plugin.write_route_component_state(context.state, context.writer)?;
+        }
+        prepare_generated_streaming_root(&tag, context)?;
+        context.writer.write(">")?;
+        self.push(Frame::GeneratedComponentEnd { tag, spanning })?;
+        self.begin_component(
+            &component,
+            ComponentHostOrigin::HandlerGenerated,
+            (handler, protocol),
+            context,
+        )
+    }
+
+    fn render_route(
+        &mut self,
+        route: &WebUiFragmentRoute,
+        route_match: Option<RouteMatch>,
+        protocol: &crate::Protocol,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        context.writer.write("<webui-route path=\"")?;
+        context.writer.write(&route.path)?;
+        context.writer.write("\"")?;
+        if !route.fragment_id.is_empty() {
+            context.writer.write(" component=\"")?;
+            context.writer.write(&route.fragment_id)?;
+            context.writer.write("\"")?;
+        }
+        if route.exact {
+            context.writer.write(" exact")?;
+        }
+        crate::route_renderer::write_route_navigation_attrs(context.writer, route)?;
+        let Some(route_match) = route_match else {
+            return context
+                .writer
+                .write(" style=\"display:none\"></webui-route>");
+        };
+
+        let route_index = context.route_chain_index;
+        context.route_chain_index = context
+            .route_chain_index
+            .checked_add(1)
+            .ok_or_else(route_chain_limit_error)?;
+        context.writer.write(" data-ri=\"")?;
+        crate::write_usize(context.writer, route_index)?;
+        context.writer.write("\" active>")?;
+
+        let saved_route_base = std::mem::replace(
+            &mut context.route_base,
+            Cow::Owned(crate::route_matcher::compute_route_base(
+                context.request_path,
+                route_match.consumed_segments,
+            )),
+        )
+        .into_owned()
+        .into_boxed_str();
+        let saved_route_children =
+            std::mem::replace(&mut context.route_children, route.children.clone());
+        self.push(Frame::RouteEnd {
+            saved_route_base,
+            saved_route_children,
+        })?;
+        if !route.fragment_id.is_empty() {
+            self.push(Frame::GeneratedComponentStart {
+                tag: route.fragment_id.clone().into(),
+            })?;
+        }
+        if !route.content_fragment_id.is_empty() {
+            let slot = fragment_slot(protocol, &route.content_fragment_id)?;
+            self.push(Frame::EnterFragment(slot))?;
+        }
+        Ok(())
+    }
+
+    fn begin_outlet(&mut self, context: &mut WebUIProcessContext<'_, '_, '_>) -> Result<()> {
+        let routes = std::mem::take(&mut context.route_children);
+        if routes.is_empty() {
+            return Ok(());
+        }
+        let request_segments = crate::route_matcher::split_request_path(context.request_path);
+        let mut best: Option<(usize, RouteMatch)> = None;
+        for (index, route) in routes.iter().enumerate() {
+            if let Some(route_match) = crate::route_matcher::match_route_indexed_with_segments(
+                context.route_index,
+                &route.path,
+                &context.route_base,
+                &request_segments,
+                route.exact,
+            ) {
+                if best
+                    .as_ref()
+                    .is_none_or(|(_, current)| route_match.specificity > current.specificity)
+                {
+                    best = Some((index, route_match));
+                }
+            }
+        }
+        self.push(Frame::Outlet(OutletFrame {
+            routes,
+            index: 0,
+            best,
+        }))
+    }
+
+    fn step_outlet(
+        &mut self,
+        mut frame: OutletFrame,
+        handler: &WebUIHandler,
+        protocol: &crate::Protocol,
+        context: &mut WebUIProcessContext<'_, '_, '_>,
+    ) -> Result<()> {
+        if frame.index >= frame.routes.len() {
+            return Ok(());
+        }
+        let index = frame.index;
+        frame.index += 1;
+        let route = std::mem::take(&mut frame.routes[index]);
+        let route_match = frame
+            .best
+            .as_ref()
+            .and_then(|(selected, route_match)| (*selected == index).then(|| route_match.clone()));
+        self.push(Frame::Outlet(frame))?;
+        let _ = (handler, protocol);
+        self.render_route(&route, route_match, protocol, context)
+    }
+
+    fn push(&mut self, frame: Frame) -> Result<()> {
+        if self.frames.len() >= MAX_CONTINUATION_DEPTH {
+            return Err(continuation_limit_error(MAX_CONTINUATION_DEPTH));
+        }
+        self.frames.push(frame);
+        Ok(())
+    }
+
+    /// Build the bounded frozen continuation surface.
+    ///
+    /// Exact signal/condition/attribute roots and component hydration
+    /// projections are retained. A correctness-safe full projection is recorded
+    /// once for the response when the protocol or any reachable component
+    /// explicitly requires `ALL`.
+    pub(crate) fn collect_state_keys(
+        protocol: &WebUIProtocol,
+        entry_id: &str,
+        limit: usize,
+    ) -> Result<ContinuationStatePlan> {
+        let mut keys = HashSet::new();
+        keys.insert(STATE_INJECT_KEY.to_string());
+        let mut pending = vec![entry_id];
+        let mut visited = HashSet::new();
+        let mut requires_full_state =
+            protocol.initial_state_strategy != InitialStateStrategy::Components as i32;
+        while let Some(id) = pending.pop() {
+            if !visited.insert(id) {
+                continue;
+            }
+            let list = protocol
+                .fragments
+                .get(id)
+                .ok_or_else(|| HandlerError::MissingFragment(id.to_string()))?;
+            for fragment in &list.fragments {
+                Self::collect_fragment_keys(
+                    fragment,
+                    protocol,
+                    &mut keys,
+                    &mut pending,
+                    &mut requires_full_state,
+                );
+                if keys.len() > limit {
+                    return Err(state_key_limit_error(limit));
+                }
+            }
+        }
+        let mut keys: Vec<Box<str>> = keys.into_iter().map(String::into_boxed_str).collect();
+        keys.sort_unstable();
+        Ok(ContinuationStatePlan {
+            keys: Arc::from(keys),
+            requires_full_state,
+        })
+    }
+
+    fn collect_fragment_keys<'a>(
+        fragment: &'a WebUIFragment,
+        protocol: &'a WebUIProtocol,
+        keys: &mut HashSet<String>,
+        pending: &mut Vec<&'a str>,
+        requires_full_state: &mut bool,
+    ) {
+        match fragment.fragment.as_ref() {
+            Some(Fragment::Signal(signal)) => {
+                if structural_signal_value(signal).is_none() {
+                    insert_top_level_key(keys, &signal.value);
+                }
+            }
+            Some(Fragment::Component(component)) => {
+                pending.push(&component.fragment_id);
+                collect_component_hydration_keys(
+                    &component.fragment_id,
+                    protocol,
+                    keys,
+                    requires_full_state,
+                );
+            }
+            Some(Fragment::ForLoop(for_loop)) => {
+                insert_top_level_key(keys, &for_loop.collection);
+                pending.push(&for_loop.fragment_id);
+            }
+            Some(Fragment::IfCond(if_cond)) => {
+                if let Some(condition) = if_cond.condition.as_ref() {
+                    collect_condition_keys(condition, keys);
+                }
+                pending.push(&if_cond.fragment_id);
+            }
+            Some(Fragment::Attribute(attribute)) => {
+                if !attribute.raw_value && !attribute.value.is_empty() {
+                    insert_top_level_key(keys, &attribute.value);
+                }
+                if let Some(condition) = attribute.condition_tree.as_ref() {
+                    collect_condition_keys(condition, keys);
+                }
+                if !attribute.template.is_empty() {
+                    pending.push(&attribute.template);
+                }
+            }
+            Some(Fragment::Boundary(boundary)) => {
+                if let Some(key) = boundary.key.as_deref() {
+                    insert_top_level_key(keys, key);
+                }
+            }
+            Some(Fragment::Route(route)) => {
+                collect_route_keys(route, protocol, keys, pending, requires_full_state);
+            }
+            _ => {}
+        }
+    }
+}
+
+fn collect_route_keys<'a>(
+    route: &'a WebUiFragmentRoute,
+    protocol: &WebUIProtocol,
+    keys: &mut HashSet<String>,
+    pending: &mut Vec<&'a str>,
+    requires_full_state: &mut bool,
+) {
+    let mut routes = vec![route];
+    while let Some(current) = routes.pop() {
+        if !current.content_fragment_id.is_empty() {
+            pending.push(&current.content_fragment_id);
+        }
+        for component in [
+            &current.fragment_id,
+            &current.pending_component,
+            &current.error_component,
+        ] {
+            if component.is_empty() {
+                continue;
+            }
+            pending.push(component);
+            collect_component_hydration_keys(component, protocol, keys, requires_full_state);
+        }
+        routes.extend(current.children.iter());
+    }
+}
+
+fn collect_component_hydration_keys(
+    component: &str,
+    protocol: &WebUIProtocol,
+    keys: &mut HashSet<String>,
+    requires_full_state: &mut bool,
+) {
+    if *requires_full_state {
+        return;
+    }
+    let Some(data) = protocol.components.get(component) else {
+        *requires_full_state = true;
+        return;
+    };
+    let mode = data.hydration_mode;
+    if mode == StateProjectionMode::All as i32 {
+        *requires_full_state = true;
+    } else if mode == StateProjectionMode::Keys as i32
+        || (mode == StateProjectionMode::None as i32 && !data.hydration_keys.is_empty())
+    {
+        keys.extend(data.hydration_keys.iter().cloned());
+    } else if mode != StateProjectionMode::None as i32 {
+        *requires_full_state = true;
+    }
+}
+
+fn collect_condition_keys(condition: &ConditionExpr, keys: &mut HashSet<String>) {
+    let mut pending = vec![condition];
+    while let Some(current) = pending.pop() {
+        match current.expr.as_ref() {
+            Some(condition_expr::Expr::Identifier(identifier)) => {
+                insert_top_level_key(keys, &identifier.value);
+            }
+            Some(condition_expr::Expr::Predicate(predicate)) => {
+                insert_top_level_key(keys, &predicate.left);
+                insert_top_level_key(keys, &predicate.right);
+            }
+            Some(condition_expr::Expr::Not(not)) => {
+                if let Some(inner) = not.condition.as_deref() {
+                    pending.push(inner);
+                }
+            }
+            Some(condition_expr::Expr::Compound(compound)) => {
+                if let Some(left) = compound.left.as_deref() {
+                    pending.push(left);
+                }
+                if let Some(right) = compound.right.as_deref() {
+                    pending.push(right);
+                }
+            }
+            None => {}
+        }
+    }
+}
+
+fn insert_top_level_key(keys: &mut HashSet<String>, raw: &str) {
+    let trimmed = raw.trim();
+    let path = trimmed
+        .strip_prefix("{{")
+        .and_then(|value| value.strip_suffix("}}"))
+        .map_or(trimmed, str::trim);
+    let Some(first) = path.split('.').next() else {
+        return;
+    };
+    if first.is_empty()
+        || first.bytes().all(|byte| byte.is_ascii_digit())
+        || matches!(first, "true" | "false" | "null")
+    {
+        return;
+    }
+    keys.insert(first.to_string());
+}
+
+/// Resolve a compiled record ID to its dense slot for a continuation frame.
+fn fragment_slot(protocol: &crate::Protocol, id: &str) -> Result<u32> {
+    protocol
+        .fragment_slot(id)
+        .ok_or_else(|| HandlerError::MissingFragment(id.to_string()))
+}
+
+/// Borrow the record a continuation frame is walking.
+fn slot_fragment(protocol: &crate::Protocol, slot: u32) -> Result<&webui_protocol::FragmentList> {
+    let id = protocol
+        .fragment_id(slot)
+        .ok_or_else(|| unknown_fragment_slot_error(slot))?;
+    protocol_fragment(protocol.protocol(), id)
+}
+
+#[cold]
+#[inline(never)]
+fn unknown_fragment_slot_error(slot: u32) -> HandlerError {
+    HandlerError::Invariant(format!("continuation frame references unknown slot {slot}"))
+}
+
+#[cold]
+#[inline(never)]
+fn missing_if_condition_error() -> HandlerError {
+    HandlerError::Rendering("if fragment is missing its condition".to_string())
+}
+
+#[cold]
+#[inline(never)]
+fn non_array_collection_error(collection: &str) -> HandlerError {
+    HandlerError::TypeError(format!("collection `{collection}` is not an array"))
+}
+
+#[cold]
+#[inline(never)]
+fn route_chain_limit_error() -> HandlerError {
+    HandlerError::Invariant("route chain index overflowed usize".to_string())
+}
+
+#[cold]
+#[inline(never)]
+fn state_key_limit_error(limit: usize) -> HandlerError {
+    HandlerError::StreamingBoundary(Box::new(crate::StreamingBoundaryError {
+        signal: "state snapshot".to_string(),
+        reason: format!(
+            "continuation state projection exceeds {limit} top-level keys; split the entry or tighten component hydration projections"
+        ),
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use webui_protocol::{ComponentData, FragmentList};
+
+    #[test]
+    fn route_key_collection_covers_generated_hosts_content_and_children() -> Result<()> {
+        let child = WebUiFragmentRoute {
+            path: "child".to_string(),
+            fragment_id: "child-page".to_string(),
+            ..Default::default()
+        };
+        let route = WebUiFragmentRoute {
+            path: "/".to_string(),
+            fragment_id: "route-page".to_string(),
+            content_fragment_id: "route-content".to_string(),
+            pending_component: "pending-card".to_string(),
+            error_component: "error-card".to_string(),
+            children: vec![child],
+            ..Default::default()
+        };
+        let mut fragments = HashMap::from([
+            (
+                "index.html".to_string(),
+                FragmentList {
+                    fragments: vec![WebUIFragment {
+                        fragment: Some(Fragment::Route(route)),
+                    }],
+                    contains_boundary: true,
+                },
+            ),
+            (
+                "route-content".to_string(),
+                FragmentList {
+                    fragments: vec![WebUIFragment::signal("contentState", false)],
+                    contains_boundary: true,
+                },
+            ),
+        ]);
+        for tag in ["route-page", "pending-card", "error-card", "child-page"] {
+            fragments.insert(tag.to_string(), FragmentList::default());
+        }
+        let mut protocol = WebUIProtocol::new(fragments);
+        protocol.initial_state_strategy = InitialStateStrategy::Components as i32;
+        for (tag, key) in [
+            ("route-page", "routeHydration"),
+            ("pending-card", "pendingHydration"),
+            ("error-card", "errorHydration"),
+            ("child-page", "childHydration"),
+        ] {
+            protocol.components.insert(
+                tag.to_string(),
+                ComponentData {
+                    hydration_mode: StateProjectionMode::Keys as i32,
+                    hydration_keys: vec![key.to_string()],
+                    ..Default::default()
+                },
+            );
+        }
+
+        let plan = ContinuationVm::collect_state_keys(&protocol, "index.html", 16)?;
+        assert!(!plan.requires_full_state);
+        assert_eq!(
+            plan.keys.iter().map(Box::as_ref).collect::<Vec<_>>(),
+            [
+                "$webui",
+                "childHydration",
+                "contentState",
+                "errorHydration",
+                "pendingHydration",
+                "routeHydration",
+            ]
+        );
+        Ok(())
+    }
+}
diff --git a/crates/webui-handler/tests/streaming_v2.rs b/crates/webui-handler/tests/streaming_v2.rs
new file mode 100644
index 000000000..7e844d093
--- /dev/null
+++ b/crates/webui-handler/tests/streaming_v2.rs
@@ -0,0 +1,781 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+#![allow(clippy::disallowed_methods)]
+
+use std::sync::Arc;
+
+use webui_handler::{
+    BoundaryInstanceId, BoundaryKey, BoundaryMode, FlushWriter, HandlerError, Protocol,
+    RenderOptions, ResponseWriter, SessionOptions, StreamingSession, WebUIHandler,
+};
+use webui_parser::{ComponentRegistration, HtmlParser};
+use webui_protocol::{ComponentData, InitialStateStrategy, StateProjectionMode, WebUIProtocol};
+use webui_test_utils::test_json;
+
+fn parsed_protocol(entry: &str, components: &[(&str, &str)]) -> Arc<Protocol> {
+    Arc::new(Protocol::new(parsed_protocol_data(entry, components)))
+}
+
+fn parsed_protocol_data(entry: &str, components: &[(&str, &str)]) -> WebUIProtocol {
+    let mut parser = HtmlParser::new();
+    for (tag, template) in components {
+        parser
+            .component_registry_mut()
+            .register_component(ComponentRegistration::new(tag, template, None, true))
+            .unwrap();
+    }
+    parser.parse("index.html", entry).unwrap();
+    WebUIProtocol::new(parser.into_fragment_records())
+}
+
+fn new_session(protocol: Arc<Protocol>, path: &str) -> StreamingSession {
+    StreamingSession::new(
+        Arc::new(WebUIHandler::new()),
+        protocol,
+        SessionOptions::new("index.html", path),
+    )
+    .unwrap()
+}
+
+fn document(body: &str) -> String {
+    format!("<html><head></head><body>{body}</body></html>")
+}
+
+#[test]
+fn component_local_boundary_suspends_and_emits_v2_span_contract() {
+    let protocol = parsed_protocol(
+        &document(r#"<shell-card title="frozen"></shell-card>"#),
+        &[
+            (
+                "shell-card",
+                concat!(
+                    "<section>",
+                    r#"<boundary name="inside"><child-box label="{{title}}"></child-box></boundary>"#,
+                    "<footer>tail</footer></section>",
+                ),
+            ),
+            ("child-box", "<span>{{label}}</span>"),
+        ],
+    );
+    let mut session = new_session(protocol, "/");
+
+    let start = session.start(&test_json!({})).unwrap();
+    let boundary = start.boundary.unwrap();
+    assert_eq!(boundary.name.as_ref(), "inside");
+    assert_eq!(boundary.owner.as_ref(), "shell-card");
+    let shell = String::from_utf8(start.bytes).unwrap();
+    assert!(shell.contains(r#"<!--ws:0--><shell-card title="frozen" data-ws data-ws-span="0">"#));
+    assert!(!shell.contains("<!--wb:0-->"));
+
+    let end = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(end.done);
+    let html = String::from_utf8(end.bytes).unwrap();
+    assert!(html.contains(r#"<!--wb:0--><child-box label="frozen" data-ws data-ws-enclosing="0">"#));
+    assert!(html.contains(r#"<!--/wb:0--><script type="application/json" data-webui-boundary>[2,0,0,0,{"declarationId":0,"enclosingSpanInstanceId":0"#));
+    assert!(html.contains(
+        r#"</shell-card><!--/ws:0--><script type="application/json" data-webui-boundary>[2,1,3,0,"#
+    ));
+    assert!(html.contains("[2,2,4,0,{}]"));
+    assert!(html.contains("</script><webui-hydrate></webui-hydrate>"));
+}
+
+#[test]
+fn false_if_discovers_no_occurrence_and_boundary_free_start_completes() {
+    let protocol = parsed_protocol(
+        &document(
+            r#"<if condition="show"><boundary name="hidden"><p>no</p></boundary></if><p>done</p>"#,
+        ),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let step = session.start(&test_json!({ "show": false })).unwrap();
+
+    assert!(step.done);
+    assert!(step.boundary.is_none());
+    let html = String::from_utf8(step.bytes).unwrap();
+    assert!(!html.contains("<!--wb:"));
+    assert!(html.contains("<p>done</p>"));
+    assert!(html.contains("[2,0,4,0,{}]"));
+}
+
+#[test]
+fn component_false_if_emits_generated_span_without_occurrence() {
+    let protocol = parsed_protocol(
+        &document(r#"<conditional-card show="{{show}}"></conditional-card>"#),
+        &[(
+            "conditional-card",
+            r#"<if condition="show"><boundary name="ready"><p>yes</p></boundary></if>"#,
+        )],
+    );
+    let mut hidden = new_session(Arc::clone(&protocol), "/");
+    let hidden = hidden.start(&test_json!({ "show": false })).unwrap();
+    assert!(hidden.done);
+    let hidden_html = String::from_utf8(hidden.bytes).unwrap();
+    assert!(!hidden_html.contains("<!--wb:"));
+    assert!(hidden_html.contains("<!--ws:0--><conditional-card"));
+    assert!(hidden_html.contains(r#"data-ws data-ws-span="0">"#));
+    assert!(hidden_html.contains(
+        r#"</conditional-card><!--/ws:0--><script type="application/json" data-webui-boundary>[2,0,3,0,"#
+    ));
+    assert!(hidden_html.contains("[2,1,4,0,{}]"));
+
+    let mut shown = new_session(protocol, "/");
+    let shown = shown.start(&test_json!({ "show": true })).unwrap();
+    assert!(shown.boundary.is_some());
+    assert!(String::from_utf8(shown.bytes)
+        .unwrap()
+        .contains("<!--ws:0--><conditional-card"));
+}
+
+#[test]
+fn keyed_repeat_returns_gapless_descriptors_and_rejects_duplicates() {
+    let protocol = parsed_protocol(
+        &document(
+            r#"<for each="item in items"><boundary name="row" key="{{item.id}}"><p>{{item.label}}</p></boundary></for>"#,
+        ),
+        &[],
+    );
+    let mut session = new_session(Arc::clone(&protocol), "/");
+    let state = test_json!({
+        "items": [
+            { "id": 10, "label": "a" },
+            { "id": 20, "label": "b" }
+        ]
+    });
+    let first = session.start(&state).unwrap().boundary.unwrap();
+    assert_eq!(first.instance_id.raw(), 0);
+    assert_eq!(first.key, Some(BoundaryKey::Number(10.into())));
+    let second = session
+        .resume(first.instance_id, &state, BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .unwrap();
+    assert_eq!(second.instance_id.raw(), 1);
+    assert_eq!(second.key, Some(BoundaryKey::Number(20.into())));
+    assert!(
+        session
+            .resume(second.instance_id, &state, BoundaryMode::Final)
+            .unwrap()
+            .done
+    );
+
+    let mut duplicate = new_session(protocol, "/");
+    let duplicate_state = test_json!({
+        "items": [
+            { "id": 7, "label": "a" },
+            { "id": 7, "label": "b" }
+        ]
+    });
+    let first = duplicate.start(&duplicate_state).unwrap().boundary.unwrap();
+    let error = duplicate
+        .resume(first.instance_id, &duplicate_state, BoundaryMode::Final)
+        .unwrap_err();
+    assert!(error.to_string().contains("duplicate key"));
+    assert!(duplicate
+        .resume(
+            BoundaryInstanceId::from_raw(1),
+            &duplicate_state,
+            BoundaryMode::Final,
+        )
+        .unwrap_err()
+        .to_string()
+        .contains("poisoned"));
+}
+
+#[test]
+fn resume_overlays_boundary_state_on_frozen_parent_and_lexical_locals() {
+    let protocol = parsed_protocol(
+        &document(
+            r#"<for each="item in items"><boundary name="row" key="{{item.id}}"><p>{{item.label}}/{{global}}</p></boundary></for>"#,
+        ),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let first = session
+        .start(&test_json!({
+            "items": [{ "id": "a", "label": "local" }],
+            "global": "frozen"
+        }))
+        .unwrap()
+        .boundary
+        .unwrap();
+    let end = session
+        .resume(
+            first.instance_id,
+            &test_json!({ "global": "boundary" }),
+            BoundaryMode::Final,
+        )
+        .unwrap();
+    assert!(end.done);
+    assert!(String::from_utf8(end.bytes)
+        .unwrap()
+        .contains("<p>local/boundary</p>"));
+}
+
+#[test]
+fn route_content_boundary_occurs_only_for_selected_route() {
+    let entry = document(concat!(
+        r#"<route path="/home" component="home-page"><boundary name="home-ready"><p>home</p></boundary></route>"#,
+        r#"<route path="/about" component="about-page"><boundary name="about-ready"><p>about</p></boundary></route>"#,
+    ));
+    let protocol = parsed_protocol(
+        &entry,
+        &[
+            ("home-page", "<h1>Home</h1>"),
+            ("about-page", "<h1>About</h1>"),
+        ],
+    );
+
+    let home = new_session(Arc::clone(&protocol), "/home")
+        .start(&test_json!({}))
+        .unwrap()
+        .boundary
+        .unwrap();
+    assert_eq!(home.name.as_ref(), "home-ready");
+    let about = new_session(Arc::clone(&protocol), "/about")
+        .start(&test_json!({}))
+        .unwrap()
+        .boundary
+        .unwrap();
+    assert_eq!(about.name.as_ref(), "about-ready");
+
+    let mut ordinary = StringWriter::default();
+    WebUIHandler::new()
+        .render(
+            &protocol,
+            &test_json!({}),
+            &RenderOptions::new("index.html", "/home"),
+            &mut ordinary,
+        )
+        .unwrap();
+    assert!(ordinary.output.contains("<p>home</p>"));
+    assert!(!ordinary.output.contains("<p>about</p>"));
+}
+
+#[test]
+fn selected_route_component_can_suspend_inside_generated_host() {
+    let protocol = parsed_protocol(
+        &document(r#"<route path="/" component="route-page"></route>"#),
+        &[(
+            "route-page",
+            r#"<boundary name="route-body"><p>ready</p></boundary>"#,
+        )],
+    );
+    let mut session = new_session(protocol, "/");
+    let start = session.start(&test_json!({})).unwrap();
+    assert_eq!(start.boundary.as_ref().unwrap().name.as_ref(), "route-body");
+    assert!(String::from_utf8(start.bytes)
+        .unwrap()
+        .contains(r#"<!--ws:0--><route-page data-ws data-ws-span="0">"#));
+}
+
+#[test]
+fn selected_route_component_hydration_keys_survive_frozen_state() {
+    let entry = document(concat!(
+        r#"<route path="/selected" component="selected-page"></route>"#,
+        r#"<route path="/inactive" component="inactive-page"></route>"#,
+    ));
+    let mut protocol = parsed_protocol_data(
+        &entry,
+        &[
+            (
+                "selected-page",
+                r#"<boundary name="selected-ready"><p>selected</p></boundary>"#,
+            ),
+            ("inactive-page", "<p>inactive</p>"),
+        ],
+    );
+    protocol.initial_state_strategy = InitialStateStrategy::Components as i32;
+    protocol.components.insert(
+        "selected-page".to_string(),
+        ComponentData {
+            hydration_mode: StateProjectionMode::Keys as i32,
+            hydration_keys: vec!["selectedHydration".to_string()],
+            ..Default::default()
+        },
+    );
+    protocol.components.insert(
+        "inactive-page".to_string(),
+        ComponentData {
+            hydration_mode: StateProjectionMode::Keys as i32,
+            hydration_keys: vec!["inactiveHydration".to_string()],
+            ..Default::default()
+        },
+    );
+
+    let mut session = new_session(Arc::new(Protocol::new(protocol)), "/selected");
+    let start = session
+        .start(&test_json!({
+            "selectedHydration": "frozen",
+            "inactiveHydration": "do-not-send"
+        }))
+        .unwrap();
+    let boundary = start.boundary.unwrap();
+    let completed = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(completed.done);
+    let html = String::from_utf8(completed.bytes).unwrap();
+    assert!(html.contains(r#""state":{"selectedHydration":"frozen"}"#));
+    assert!(!html.contains("inactiveHydration"));
+}
+
+#[test]
+fn route_component_all_projection_keeps_full_state_for_resume() {
+    let mut protocol = parsed_protocol_data(
+        &document(r#"<route path="/" component="route-page"></route>"#),
+        &[(
+            "route-page",
+            r#"<boundary name="route-ready"><p>ready</p></boundary>"#,
+        )],
+    );
+    protocol.initial_state_strategy = InitialStateStrategy::Components as i32;
+    protocol.components.insert(
+        "route-page".to_string(),
+        ComponentData {
+            hydration_mode: StateProjectionMode::All as i32,
+            ..Default::default()
+        },
+    );
+
+    let mut session = new_session(Arc::new(Protocol::new(protocol)), "/");
+    let start = session
+        .start(&test_json!({ "opaqueRuntimeState": "frozen" }))
+        .unwrap();
+    let boundary = start.boundary.unwrap();
+    let completed = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(completed.done);
+    assert!(String::from_utf8(completed.bytes)
+        .unwrap()
+        .contains(r#""opaqueRuntimeState":"frozen""#));
+}
+
+#[test]
+fn route_component_full_strategy_keeps_fast_state_for_resume() {
+    let protocol = parsed_protocol(
+        &document(r#"<route path="/" component="route-page"></route>"#),
+        &[(
+            "route-page",
+            r#"<boundary name="route-ready"><p>ready</p></boundary>"#,
+        )],
+    );
+    let mut session = new_session(protocol, "/");
+    let start = session
+        .start(&test_json!({ "fastRuntimeState": "frozen" }))
+        .unwrap();
+    let boundary = start.boundary.unwrap();
+    let completed = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(completed.done);
+    assert!(String::from_utf8(completed.bytes)
+        .unwrap()
+        .contains(r#""fastRuntimeState":"frozen""#));
+}
+
+#[test]
+fn generated_route_false_if_emits_span_without_boundary_occurrence() {
+    let protocol = parsed_protocol(
+        &document(r#"<route path="/" component="route-page"></route>"#),
+        &[(
+            "route-page",
+            r#"<if condition="show"><boundary name="route-ready"><p>ready</p></boundary></if>"#,
+        )],
+    );
+    let mut session = new_session(protocol, "/");
+    let completed = session.start(&test_json!({ "show": false })).unwrap();
+    assert!(completed.done);
+    assert!(completed.boundary.is_none());
+    let html = String::from_utf8(completed.bytes).unwrap();
+    assert!(!html.contains("<!--wb:"));
+    assert!(html.contains(r#"<!--ws:0--><route-page data-ws data-ws-span="0">"#));
+    assert!(html.contains("</route-page><!--/ws:0-->"));
+    assert!(html.contains(r#"<script type="application/json" data-webui-boundary>[2,0,3,0,"#));
+    assert!(html.contains("[2,1,4,0,{}]"));
+}
+
+#[test]
+fn generated_route_without_boundary_or_enclosing_range_is_rejected() {
+    let protocol = parsed_protocol(
+        &document(r#"<route path="/" component="plain-page"></route>"#),
+        &[("plain-page", "<p>plain</p>")],
+    );
+    let error = new_session(protocol, "/")
+        .start(&test_json!({}))
+        .unwrap_err();
+    assert!(matches!(error, HandlerError::StreamingBoundary(_)));
+    assert!(error
+        .to_string()
+        .contains("component host has no boundary or generated component span"));
+}
+
+#[test]
+fn nested_component_spans_are_outer_first_and_complete_inner_first() {
+    let protocol = parsed_protocol(
+        &document("<outer-card></outer-card>"),
+        &[
+            ("outer-card", "<main><inner-card></inner-card></main>"),
+            (
+                "inner-card",
+                r#"<boundary name="ready"><leaf-card></leaf-card></boundary>"#,
+            ),
+            ("leaf-card", "<span>leaf</span>"),
+        ],
+    );
+    let mut session = new_session(protocol, "/");
+    let start = session.start(&test_json!({})).unwrap();
+    let shell = String::from_utf8(start.bytes).unwrap();
+    let outer = shell.find("<!--ws:0-->").unwrap();
+    let inner = shell.find("<!--ws:1-->").unwrap();
+    assert!(outer < inner);
+
+    let boundary = start.boundary.unwrap();
+    let end = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    let html = String::from_utf8(end.bytes).unwrap();
+    assert!(html.contains(r#""enclosingSpanInstanceId":1"#));
+    let inner_end = html.find("<!--/ws:1-->").unwrap();
+    let outer_end = html.find("<!--/ws:0-->").unwrap();
+    assert!(inner_end < outer_end);
+    assert!(html[inner_end..].contains("[2,1,3,1,"));
+    assert!(html[outer_end..].contains("[2,2,3,0,"));
+}
+
+#[test]
+fn update_targets_one_runtime_instance() {
+    let protocol = parsed_protocol(
+        &document(r#"<boundary name="live"><p>{{count}}</p></boundary>"#),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let boundary = session
+        .start(&test_json!({ "count": 1 }))
+        .unwrap()
+        .boundary
+        .unwrap();
+    let committed = session
+        .resume(
+            boundary.instance_id,
+            &test_json!({ "count": 1 }),
+            BoundaryMode::Updatable,
+        )
+        .unwrap();
+    assert!(committed.done);
+    assert!(session
+        .update(boundary.instance_id, &test_json!({ "count": 2 }))
+        .unwrap_err()
+        .to_string()
+        .contains("already completed"));
+}
+
+#[test]
+fn update_before_terminal_targets_the_runtime_occurrence() {
+    let protocol = parsed_protocol(
+        &document(concat!(
+            r#"<boundary name="live"><p>{{count}}</p></boundary>"#,
+            r#"<boundary name="later"><p>later</p></boundary>"#,
+        )),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let first = session
+        .start(&test_json!({ "count": 1 }))
+        .unwrap()
+        .boundary
+        .unwrap();
+    let second = session
+        .resume(
+            first.instance_id,
+            &test_json!({ "count": 1 }),
+            BoundaryMode::Updatable,
+        )
+        .unwrap()
+        .boundary
+        .unwrap();
+    let update = String::from_utf8(
+        session
+            .update(first.instance_id, &test_json!({ "count": 2 }))
+            .unwrap(),
+    )
+    .unwrap();
+    assert!(update.contains("[2,1,2,0,{\"count\":2}]"));
+    assert!(
+        session
+            .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+            .unwrap()
+            .done
+    );
+}
+
+#[test]
+fn update_rejects_final_and_uncommitted_occurrences_without_poisoning() {
+    let protocol = parsed_protocol(
+        &document(concat!(
+            r#"<boundary name="first"><p>first</p></boundary>"#,
+            r#"<boundary name="second"><p>second</p></boundary>"#,
+        )),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let first = session.start(&test_json!({})).unwrap().boundary.unwrap();
+    let second = session
+        .resume(first.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .unwrap();
+    assert!(session
+        .update(first.instance_id, &test_json!({}))
+        .unwrap_err()
+        .to_string()
+        .contains("committed as final"));
+    assert!(session
+        .update(second.instance_id, &test_json!({}))
+        .unwrap_err()
+        .to_string()
+        .contains("has not committed"));
+    assert!(
+        session
+            .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+            .unwrap()
+            .done
+    );
+}
+
+#[test]
+fn wrong_resume_id_is_recoverable_but_render_failure_poisons() {
+    let protocol = parsed_protocol(
+        &document(r#"<boundary name="ready"><p>ok</p></boundary>"#),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let pending = session.start(&test_json!({})).unwrap().boundary.unwrap();
+    assert!(session
+        .resume(
+            BoundaryInstanceId::from_raw(99),
+            &test_json!({}),
+            BoundaryMode::Final,
+        )
+        .unwrap_err()
+        .to_string()
+        .contains("stale"));
+    assert!(
+        session
+            .resume(pending.instance_id, &test_json!({}), BoundaryMode::Final)
+            .unwrap()
+            .done
+    );
+
+    let protocol = parsed_protocol(
+        &document(
+            r#"<boundary name="broken"><for each="item in bad"><p>{{item}}</p></for></boundary>"#,
+        ),
+        &[],
+    );
+    let mut broken = new_session(protocol, "/");
+    let pending = broken
+        .start(&test_json!({ "bad": {} }))
+        .unwrap()
+        .boundary
+        .unwrap();
+    assert!(matches!(
+        broken.resume(
+            pending.instance_id,
+            &test_json!({ "bad": {} }),
+            BoundaryMode::Final
+        ),
+        Err(HandlerError::TypeError(_))
+    ));
+    assert!(broken
+        .resume(pending.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap_err()
+        .to_string()
+        .contains("poisoned"));
+}
+
+#[test]
+fn ordinary_render_transparently_renders_boundary_body() {
+    let protocol = parsed_protocol(
+        &document(r#"<boundary name="ready"><strong>{{label}}</strong></boundary>"#),
+        &[],
+    );
+    let mut writer = StringWriter::default();
+    WebUIHandler::new()
+        .render(
+            &protocol,
+            &test_json!({ "label": "ordinary" }),
+            &RenderOptions::new("index.html", "/"),
+            &mut writer,
+        )
+        .unwrap();
+    // The body is inline between the tape markers, so ordinary rendering must
+    // emit it exactly once and skip both markers.
+    assert_eq!(
+        writer.output.matches("<strong>ordinary</strong>").count(),
+        1
+    );
+    assert!(!writer.output.contains("<!--wb:"));
+    assert!(!writer.output.contains("<!--/wb:"));
+}
+
+#[test]
+fn adjacent_boundaries_do_not_flush_the_same_position_twice() {
+    let protocol = parsed_protocol(
+        &document(
+            r#"<boundary name="first"><p>1</p></boundary><boundary name="second"><p>2</p></boundary>"#,
+        ),
+        &[],
+    );
+    let handler = WebUIHandler::new();
+    let mut writer = FlushStringWriter::default();
+    handler
+        .render_streaming(
+            &protocol,
+            &test_json!({}),
+            &RenderOptions::new("index.html", "/"),
+            &mut writer,
+        )
+        .unwrap();
+    assert!(
+        writer
+            .flush_positions
+            .windows(2)
+            .all(|pair| pair[0] < pair[1]),
+        "every flush must release bytes the previous flush did not: {:?}",
+        writer.flush_positions
+    );
+    // Shell prefix, one checkpoint per boundary, terminal. The step that
+    // returns immediately at the second boundary produced no bytes, so it
+    // collapses into the first checkpoint's flush.
+    assert_eq!(writer.flushes, 4);
+}
+
+#[test]
+fn borrowed_api_flushes_each_returned_semantic_step() {
+    let protocol = parsed_protocol(
+        &document(r#"<boundary name="ready"><p>ok</p></boundary>"#),
+        &[],
+    );
+    let handler = WebUIHandler::new();
+    let mut writer = FlushStringWriter::default();
+    let mut response = handler
+        .stream_response(
+            &protocol,
+            &RenderOptions::new("index.html", "/"),
+            &mut writer,
+        )
+        .unwrap();
+    let first = response.start(&test_json!({})).unwrap();
+    let boundary = first.boundary.unwrap();
+    assert!(
+        response
+            .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+            .unwrap()
+            .done
+    );
+    drop(response);
+    assert!(writer.flushes >= 3);
+    assert!(writer.ended);
+}
+
+#[test]
+fn borrowed_disconnect_poisons_the_response() {
+    let protocol = parsed_protocol(
+        &document(r#"<boundary name="ready"><p>ok</p></boundary>"#),
+        &[],
+    );
+    let handler = WebUIHandler::new();
+    let mut writer = DisconnectWriter;
+    let mut response = handler
+        .stream_response(
+            &protocol,
+            &RenderOptions::new("index.html", "/"),
+            &mut writer,
+        )
+        .unwrap();
+    assert!(matches!(
+        response.start(&test_json!({})),
+        Err(HandlerError::ClientDisconnected)
+    ));
+    assert!(response
+        .start(&test_json!({}))
+        .unwrap_err()
+        .to_string()
+        .contains("poisoned"));
+}
+
+#[test]
+fn fixed_entry_plan_and_name_table_are_absent() {
+    let route_handler = include_str!("../src/route_handler.rs");
+    let streaming_module = include_str!("../src/streaming/mod.rs");
+    assert!(!route_handler.contains("streaming_boundaries"));
+    assert!(!route_handler.contains("StreamingEntryPlan"));
+    assert!(!streaming_module.contains("StreamingEntryPlan"));
+}
+
+#[derive(Default)]
+struct StringWriter {
+    output: String,
+}
+
+impl ResponseWriter for StringWriter {
+    fn write(&mut self, content: &str) -> webui_handler::Result<()> {
+        self.output.push_str(content);
+        Ok(())
+    }
+
+    fn end(&mut self) -> webui_handler::Result<()> {
+        Ok(())
+    }
+}
+
+#[derive(Default)]
+struct FlushStringWriter {
+    output: String,
+    flushes: usize,
+    flush_positions: Vec<usize>,
+    ended: bool,
+}
+
+impl ResponseWriter for FlushStringWriter {
+    fn write(&mut self, content: &str) -> webui_handler::Result<()> {
+        self.output.push_str(content);
+        Ok(())
+    }
+
+    fn end(&mut self) -> webui_handler::Result<()> {
+        self.ended = true;
+        Ok(())
+    }
+}
+
+impl FlushWriter for FlushStringWriter {
+    fn flush(&mut self) -> webui_handler::Result<()> {
+        self.flushes += 1;
+        self.flush_positions.push(self.output.len());
+        Ok(())
+    }
+}
+
+struct DisconnectWriter;
+
+impl ResponseWriter for DisconnectWriter {
+    fn write(&mut self, _content: &str) -> webui_handler::Result<()> {
+        Ok(())
+    }
+
+    fn end(&mut self) -> webui_handler::Result<()> {
+        Ok(())
+    }
+}
+
+impl FlushWriter for DisconnectWriter {
+    fn flush(&mut self) -> webui_handler::Result<()> {
+        Err(HandlerError::ClientDisconnected)
+    }
+}
diff --git a/crates/webui-node/README.md b/crates/webui-node/README.md
index b0e5b803b..f3aa73c70 100644
--- a/crates/webui-node/README.md
+++ b/crates/webui-node/README.md
@@ -6,6 +6,28 @@ Node.js native addon for the [WebUI](https://github.com/microsoft/webui) framewo
 
 `microsoft-webui-node` compiles to a platform-specific `.node` addon that exposes WebUI's rendering API to Node.js hosts (e.g. Express, Fastify) without spawning a subprocess.
 
+## Host-driven streaming
+
+`Protocol.streamResponse(entry, requestPath, options)` returns a
+`StreamingSession`. Call `start(stateJson)` once, then call
+`resume(instanceId, stateJson, mode)` for each discovered boundary. State and
+patch arguments are JSON strings. Both step methods return:
+
+```js
+{
+  bytes: Buffer,
+  done: boolean,
+  boundary?: { instanceId, declarationId, owner, name, key }
+}
+```
+
+`mode` is `"final"` (the default) or `"updatable"`. A committed updatable
+occurrence accepts `update(instanceId, patch)`, which returns a `Buffer`.
+Boundary keys preserve JSON identity: string keys are JavaScript strings and
+finite numeric keys are JavaScript numbers. Boundaries are discovered through
+entries, reusable components, runtime branches, loops, and selected routes.
+The step with `done: true` already contains terminal and document-tail bytes.
+
 ## Benchmark
 
 The runtime benchmark in
diff --git a/crates/webui-node/src/lib.rs b/crates/webui-node/src/lib.rs
index 0baee6749..308dba8dd 100644
--- a/crates/webui-node/src/lib.rs
+++ b/crates/webui-node/src/lib.rs
@@ -29,7 +29,7 @@
 
 use std::sync::Arc;
 
-use napi::bindgen_prelude::{Buffer, Function};
+use napi::bindgen_prelude::{Buffer, Either, Function};
 use napi::Error as NapiError;
 use napi_derive::napi;
 use serde_json::Value;
@@ -37,8 +37,9 @@ use webui_handler::plugin::fast_v2::FastV2HydrationPlugin;
 use webui_handler::plugin::fast_v3::FastV3HydrationPlugin;
 use webui_handler::plugin::webui::WebUIHydrationPlugin;
 use webui_handler::{
-    BoundaryId, BoundaryMode, HandlerError, Protocol as HandlerProtocol, RenderOptions,
-    ResponseWriter, SessionOptions, StreamingSession as HandlerStreamingSession, WebUIHandler,
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, HandlerError,
+    Protocol as HandlerProtocol, RenderOptions, ResponseWriter, SessionOptions,
+    StreamStep as HandlerStreamStep, StreamingSession as HandlerStreamingSession, WebUIHandler,
 };
 #[cfg(test)]
 use webui_protocol::WebUIProtocol;
@@ -372,99 +373,124 @@ pub struct JsStreamOptions {
     pub body_inject: Option<String>,
 }
 
-/// A progressive HTML response driven one chunk at a time from Node.
+/// A progressive HTML response driven one semantic step at a time from Node.
 ///
-/// Every method returns the bytes it produced. Write them to the response and
-/// await `drain` whenever `write()` returns `false`; the session holds no
-/// transport and never blocks on one.
+/// `start()` and `resume()` return bytes, completion state, and the next runtime
+/// boundary occurrence (if any). Boundary keys retain their authored JSON type:
+/// strings are JavaScript strings and finite numbers are JavaScript numbers.
 ///
 /// ```js
 /// const session = protocol.streamResponse('index.html', '/');
-/// const weather = session.boundary('weather-shell');
-/// res.write(session.writeShell(shellState));
-/// res.write(session.writeBoundary(weather, weatherState, 'updatable'));
-/// res.write(session.update(weather, forecast));
-/// res.end(session.finish(tailState));
+/// let step = session.start(JSON.stringify(shellState));
+/// res.write(step.bytes);
+/// while (!step.done) {
+///   const { instanceId, name, key } = step.boundary;
+///   const state = await loadBoundary(name, key);
+///   step = session.resume(instanceId, JSON.stringify(state), 'updatable');
+///   res.write(step.bytes);
+/// }
 /// ```
 #[napi]
 pub struct StreamingSession {
     inner: HandlerStreamingSession,
 }
 
-#[napi]
-impl StreamingSession {
-    /// Resolve an authored boundary name to a stable integer handle.
-    ///
-    /// Resolve once outside the write loop; the handle costs nothing to reuse.
-    #[napi]
-    pub fn boundary(&self, name: String) -> napi::Result<u32> {
-        self.inner
-            .boundary(&name)
-            .map(BoundaryId::raw)
-            .map_err(streaming_error)
-    }
-
-    /// Number of compile-time boundaries declared by this entry.
-    #[napi(getter)]
-    pub fn boundary_count(&self) -> u32 {
-        // Boundary counts are bounded by the compiled entry, so this cannot
-        // exceed u32 in any protocol the build can produce.
-        u32::try_from(self.inner.boundary_count()).unwrap_or(u32::MAX)
-    }
+/// Runtime boundary occurrence returned by a streaming step.
+#[napi(object)]
+pub struct JsBoundaryDescriptor {
+    /// Gapless response-local occurrence ID passed to `resume()` and `update()`.
+    pub instance_id: u32,
+    /// Stable compiler declaration ID.
+    pub declaration_id: u32,
+    /// Entry or component template that owns this declaration.
+    pub owner: String,
+    /// Free-form authored boundary name.
+    pub name: String,
+    /// Evaluated repeat key, preserving string-versus-number identity.
+    pub key: Option<Either<String, f64>>,
+}
 
-    /// Whether the terminal record has been written.
-    #[napi(getter)]
-    pub fn finished(&self) -> bool {
-        self.inner.is_finished()
-    }
+/// Bytes and continuation state returned by `start()` and `resume()`.
+#[napi(object)]
+pub struct JsStreamStep {
+    /// Complete bytes produced by this semantic step.
+    pub bytes: Buffer,
+    /// Whether the terminal record was emitted.
+    pub done: bool,
+    /// Next runtime boundary occurrence waiting for `resume()`.
+    pub boundary: Option<JsBoundaryDescriptor>,
+}
 
-    /// Render everything before the first boundary.
+#[napi]
+impl StreamingSession {
+    /// Render until the first runtime boundary occurrence or terminal.
     #[napi]
-    pub fn write_shell(&mut self, state_json: String) -> napi::Result<Buffer> {
+    pub fn start(&mut self, state_json: String) -> napi::Result<JsStreamStep> {
         let state = parse_state_json(&state_json)?;
         self.inner
-            .write_shell(&state)
-            .map(Buffer::from)
+            .start(&state)
+            .and_then(stream_step)
             .map_err(streaming_error)
     }
 
-    /// Render and commit the next boundary in declaration order.
+    /// Commit the pending occurrence and advance to the next one or terminal.
     ///
     /// `mode` is `"final"` (default) or `"updatable"`. Only updatable
     /// boundaries accept later `update()` calls.
     #[napi]
-    pub fn write_boundary(
+    pub fn resume(
         &mut self,
-        boundary: u32,
+        instance_id: u32,
         state_json: String,
         mode: Option<String>,
-    ) -> napi::Result<Buffer> {
+    ) -> napi::Result<JsStreamStep> {
         let state = parse_state_json(&state_json)?;
         let mode = parse_boundary_mode(mode.as_deref())?;
         self.inner
-            .write_boundary(BoundaryId::from_raw(boundary), &state, mode)
-            .map(Buffer::from)
+            .resume(BoundaryInstanceId::from_raw(instance_id), &state, mode)
+            .and_then(stream_step)
             .map_err(streaming_error)
     }
 
     /// Push a projected state patch to a committed updatable boundary.
     #[napi]
-    pub fn update(&mut self, boundary: u32, state_json: String) -> napi::Result<Buffer> {
-        let state = parse_state_json(&state_json)?;
+    pub fn update(&mut self, instance_id: u32, patch_json: String) -> napi::Result<Buffer> {
+        let patch = parse_state_json(&patch_json)?;
         self.inner
-            .update(BoundaryId::from_raw(boundary), &state)
+            .update(BoundaryInstanceId::from_raw(instance_id), &patch)
             .map(Buffer::from)
             .map_err(streaming_error)
     }
+}
 
-    /// Render the document tail and emit the terminal record.
-    #[napi]
-    pub fn finish(&mut self, state_json: String) -> napi::Result<Buffer> {
-        let state = parse_state_json(&state_json)?;
-        self.inner
-            .finish(&state)
-            .map(Buffer::from)
-            .map_err(streaming_error)
+fn stream_step(step: HandlerStreamStep) -> webui_handler::Result<JsStreamStep> {
+    Ok(JsStreamStep {
+        bytes: Buffer::from(step.bytes),
+        done: step.done,
+        boundary: step.boundary.map(boundary_descriptor).transpose()?,
+    })
+}
+
+fn boundary_descriptor(
+    boundary: BoundaryDescriptor,
+) -> webui_handler::Result<JsBoundaryDescriptor> {
+    Ok(JsBoundaryDescriptor {
+        instance_id: boundary.instance_id.raw(),
+        declaration_id: boundary.declaration_id,
+        owner: boundary.owner.to_string(),
+        name: boundary.name.to_string(),
+        key: boundary.key.map(boundary_key).transpose()?,
+    })
+}
+
+fn boundary_key(key: BoundaryKey) -> webui_handler::Result<Either<String, f64>> {
+    match key {
+        BoundaryKey::String(value) => Ok(Either::A(value)),
+        BoundaryKey::Number(value) => value.as_f64().map(Either::B).ok_or_else(|| {
+            HandlerError::Invariant(
+                "boundary key cannot be represented as a JavaScript number".into(),
+            )
+        }),
     }
 }
 
@@ -716,6 +742,116 @@ mod tests {
         assert_eq!(second.as_ref(), "Hello, 世界!".as_bytes());
     }
 
+    #[test]
+    fn streaming_start_and_resume_preserve_repeat_key_types() {
+        let proto = build_protocol(concat!(
+            "<html><head></head><body>",
+            r#"<for each="item in items"><boundary name="row" key="{{item.id}}">"#,
+            "<p>{{item.label}}</p></boundary></for>",
+            "</body></html>",
+        ));
+        let protocol = Protocol::new(Buffer::from(proto), None).expect("protocol should load");
+        let mut session = protocol
+            .stream_response("index.html".to_string(), "/".to_string(), None)
+            .expect("session should open");
+        let state = r#"{"items":[{"id":"alpha","label":"a"},{"id":20,"label":"b"}]}"#;
+
+        let first = session
+            .start(state.to_string())
+            .expect("start should discover first boundary");
+        assert!(!first.done);
+        assert!(!first.bytes.is_empty());
+        let first_boundary = first.boundary.expect("first boundary should be returned");
+        assert_eq!(first_boundary.instance_id, 0);
+        assert_eq!(first_boundary.declaration_id, 0);
+        assert_eq!(first_boundary.owner, "index.html");
+        assert_eq!(first_boundary.name, "row");
+        assert!(matches!(
+            first_boundary.key,
+            Some(Either::A(value)) if value == "alpha"
+        ));
+
+        let second = session
+            .resume(
+                first_boundary.instance_id,
+                state.to_string(),
+                Some("final".to_string()),
+            )
+            .expect("resume should discover second boundary");
+        assert!(!second.done);
+        let second_boundary = second.boundary.expect("second boundary should be returned");
+        assert_eq!(second_boundary.instance_id, 1);
+        assert!(matches!(
+            second_boundary.key,
+            Some(Either::B(value)) if value == 20.0
+        ));
+
+        let done = session
+            .resume(second_boundary.instance_id, state.to_string(), None)
+            .expect("final resume should complete");
+        assert!(done.done);
+        assert!(done.boundary.is_none());
+        assert!(!done.bytes.is_empty());
+    }
+
+    #[test]
+    fn streaming_update_returns_buffer_for_updatable_occurrence() {
+        let proto = build_protocol(concat!(
+            "<html><head></head><body>",
+            r#"<boundary name="first"><p>{{count}}</p></boundary>"#,
+            r#"<boundary name="second"><p>done</p></boundary>"#,
+            "</body></html>",
+        ));
+        let protocol = Protocol::new(Buffer::from(proto), None).expect("protocol should load");
+        let mut session = protocol
+            .stream_response("index.html".to_string(), "/".to_string(), None)
+            .expect("session should open");
+        let first = session
+            .start(r#"{"count":1}"#.to_string())
+            .expect("start should discover first boundary")
+            .boundary
+            .expect("first boundary should be returned");
+        let second = session
+            .resume(
+                first.instance_id,
+                r#"{"count":1}"#.to_string(),
+                Some("updatable".to_string()),
+            )
+            .expect("resume should commit updatable boundary")
+            .boundary
+            .expect("second boundary should be returned");
+
+        let update = session
+            .update(first.instance_id, r#"{"count":2}"#.to_string())
+            .expect("update should render");
+        assert!(!update.is_empty());
+        let update_text = std::str::from_utf8(&update).expect("update should be UTF-8");
+        assert!(update_text.contains(r#""count":2"#));
+
+        let done = session
+            .resume(second.instance_id, "{}".to_string(), None)
+            .expect("second resume should complete");
+        assert!(done.done);
+    }
+
+    #[test]
+    fn streaming_start_returns_done_for_boundary_free_document() {
+        let proto = build_protocol("<html><head></head><body><p>done</p></body></html>");
+        let protocol = Protocol::new(Buffer::from(proto), None).expect("protocol should load");
+        let mut session = protocol
+            .stream_response("index.html".to_string(), "/".to_string(), None)
+            .expect("session should open");
+
+        let step = session
+            .start("{}".to_string())
+            .expect("boundary-free start should complete");
+        assert!(step.done);
+        assert!(step.boundary.is_none());
+        assert!(std::str::from_utf8(&step.bytes)
+            .expect("output should be UTF-8")
+            .contains("<p>done</p>"));
+    }
+
     #[test]
     fn test_for_loop() {
         let proto = build_protocol("<ul><for each=\"item in items\"><li>{{item}}</li></for></ul>");
@@ -793,6 +929,7 @@ mod tests {
             "client-card".to_string(),
             webui_protocol::FragmentList {
                 fragments: vec![webui_protocol::WebUIFragment::raw("<p>client</p>")],
+                contains_boundary: false,
             },
         );
         protocol
diff --git a/crates/webui-parser/src/diagnostic.rs b/crates/webui-parser/src/diagnostic.rs
index 10e2224db..105cac26b 100644
--- a/crates/webui-parser/src/diagnostic.rs
+++ b/crates/webui-parser/src/diagnostic.rs
@@ -107,14 +107,18 @@ pub mod codes {
     /// `<boundary name>` is not a static string literal (e.g. it
     /// contains a `{{binding}}`).
     pub const INVALID_BOUNDARY_NAME: &str = "invalid-boundary-name";
-    /// Two `<boundary>` directives in the same entry template share a
-    /// `name`.
+    /// Two `<boundary>` directives in the same owning template share a `name`.
     pub const DUPLICATE_BOUNDARY_NAME: &str = "duplicate-boundary-name";
+    /// A `<boundary>` lexically nested in `<for>` has no stable occurrence key.
+    pub const MISSING_BOUNDARY_KEY: &str = "missing-boundary-key";
+    /// A `<boundary key>` is empty or has malformed binding delimiters.
+    pub const INVALID_BOUNDARY_KEY: &str = "invalid-boundary-key";
+    /// The protocol-wide boundary declaration identity space was exhausted.
+    pub const TOO_MANY_BOUNDARIES: &str = "too-many-boundaries";
     /// A `<boundary>` is nested inside another `<boundary>`.
     pub const NESTED_BOUNDARY: &str = "nested-boundary";
-    /// A `<boundary>` would cut through component host content, a reusable
-    /// component template, an inert/raw-text HTML element, `<if>`, `<for>`, or
-    /// `<route>` instead of independently wrapping it.
+    /// A `<boundary>` would cut through component host content or an
+    /// inert/raw-text HTML element instead of independently wrapping it.
     pub const BOUNDARY_CROSSES_SCOPE: &str = "boundary-crosses-scope";
     /// A `<boundary>` appears before `<body>` opens or after it closes.
     pub const BOUNDARY_OUTSIDE_BODY: &str = "boundary-outside-body";
@@ -123,12 +127,15 @@ pub mod codes {
     /// `<select>`, …), which would separate the generated `<webui-hydrate>`
     /// sentinel from its payload script.
     pub const BOUNDARY_IN_FOSTER_CONTEXT: &str = "boundary-in-foster-context";
+    /// A route-local `<boundary>` is nested in ignored route markup instead of
+    /// being a direct child of the `<route>`.
+    pub const INVALID_ROUTE_BOUNDARY_PLACEMENT: &str = "invalid-route-boundary-placement";
     /// `<webui-hydrate>` was written by an application author. It is reserved
     /// for the compiler/handler-generated runtime hydration sentinel.
     pub const AUTHORED_WEBUI_HYDRATE: &str = "authored-webui-hydrate";
-    /// An entry declares `<boundary>` streaming checkpoints but the
-    /// build has no state-projection manifest, so every checkpoint serializes
-    /// the whole state object instead of its own components' keys.
+    /// A build declares `<boundary>` streaming checkpoints but has no
+    /// state-projection manifest, so every checkpoint serializes the whole
+    /// state object instead of its own components' keys.
     /// Severity: warning.
     pub const STREAMING_WITHOUT_PROJECTION: &str = "streaming-without-projection";
     /// More than one build output shares the file name of an authored
diff --git a/crates/webui-parser/src/lib.rs b/crates/webui-parser/src/lib.rs
index 40fa6ecff..f032f5857 100644
--- a/crates/webui-parser/src/lib.rs
+++ b/crates/webui-parser/src/lib.rs
@@ -41,8 +41,9 @@ use crate::plugin::{AttributeAction, ParserPlugin, ParserPluginArtifacts};
 use std::collections::{HashMap, HashSet};
 use std::ops::Range;
 use webui_protocol::{
-    web_ui_fragment, web_ui_fragment::Fragment, ConditionExpr, FragmentList, WebUIFragment,
-    WebUIFragmentAttribute, WebUIFragmentRecords, WebUiFragmentRoute,
+    web_ui_fragment, web_ui_fragment::Fragment, BoundaryPhase, ConditionExpr, FragmentList,
+    WebUIFragment, WebUIFragmentAttribute, WebUIFragmentRecords, WebUiFragmentBoundary,
+    WebUiFragmentRoute,
 };
 
 /// Maximum template size accepted by the parser.
@@ -412,6 +413,15 @@ struct ParseContext {
     raw_buffer: String,
 }
 
+struct PendingBoundary {
+    declaration_id: u32,
+}
+
+struct BoundaryGraphEdge {
+    target: String,
+    repeats: bool,
+}
+
 #[derive(Default)]
 struct FragmentCssTokens {
     definitions: Vec<String>,
@@ -450,12 +460,12 @@ enum ParseOp<'a> {
         depth: usize,
     },
     EmitClose(&'a str),
+    EndComponent(&'a str),
     EndHead(&'a str),
     EndBody(&'a str),
-    /// Close a `<boundary>` opened with response-local sequence
-    /// number `seq`: emits the `boundary_end:<seq>` raw signal and clears
-    /// [`HtmlParser::in_boundary`].
-    EndBoundary(u32),
+    CompleteBoundary {
+        boundary: PendingBoundary,
+    },
     /// Restore [`HtmlParser::foster_context_depth`] to the saved value when
     /// leaving an element that changed it.
     ///
@@ -471,6 +481,7 @@ enum ParseOp<'a> {
         collection: String,
         fragment_id: String,
         keep_empty: bool,
+        previous_for_depth: usize,
     },
     CompleteIf {
         parent: ParseContext,
@@ -537,32 +548,33 @@ pub struct HtmlParser {
     /// Used to name the owning template in authoring [`Diagnostic`]s.
     current_fragment_id: String,
 
-    /// Next `<boundary>` response-local sequence number
-    /// (`boundary_start:<seq>` / `boundary_end:<seq>`). Reset to `0` at the
-    /// start of each top-level [`HtmlParser::parse`] call.
-    boundary_sequence: u32,
-
-    /// `<boundary name>` values already used in the current top-level
-    /// parse, so a duplicate name can be rejected.
-    boundary_names: HashSet<String>,
+    /// Next protocol-wide compile-time boundary declaration identity.
+    next_boundary_declaration_id: u32,
 
-    /// `<boundary name>` values in declaration order for the current entry.
-    /// The build stores this table in `protocol.bin` for one cold host lookup.
-    boundary_names_in_order: Vec<String>,
+    /// Authored boundary names keyed by their owning entry/component template.
+    boundary_names_by_owner: HashMap<String, HashSet<String>>,
 
     /// `true` while parsing is inside an open `<boundary>`, used to
     /// reject a nested boundary.
     in_boundary: bool,
 
+    /// Number of boundary scopes surrounding the current reusable-template
+    /// callsite. Kept separate from lexical `in_boundary` so component syntax
+    /// is analyzed independently while island-owned module entries stay
+    /// excluded from critical preloads.
+    boundary_ancestor_depth: usize,
+
     /// Number of currently open native `<body>` elements. A depth rather than
     /// a boolean preserves the parent state while recursively parsing a
     /// component template.
     body_depth: usize,
 
-    /// Stack of open `<if>`/`<for>` scope descriptions, used to reject a
-    /// `<boundary>` that would cut through a conditionally-rendered or
-    /// repeated scope instead of independently wrapping it.
-    structural_scopes: Vec<&'static str>,
+    /// Number of lexical `<for>` scopes in the current template. Boundaries in
+    /// such scopes can occur repeatedly and therefore require an authored key.
+    for_depth: usize,
+
+    /// Number of runtime route-content scopes currently being parsed.
+    route_depth: usize,
 
     /// Number of enclosing elements whose HTML insertion mode would
     /// foster-parent an unknown element such as the generated
@@ -902,12 +914,13 @@ impl HtmlParser {
             fragment_css_tokens: HashMap::new(),
             in_progress_fragments: HashSet::new(),
             current_fragment_id: String::new(),
-            boundary_sequence: 0,
-            boundary_names: HashSet::new(),
-            boundary_names_in_order: Vec::new(),
+            next_boundary_declaration_id: 0,
+            boundary_names_by_owner: HashMap::new(),
             in_boundary: false,
+            boundary_ancestor_depth: 0,
             body_depth: 0,
-            structural_scopes: Vec::new(),
+            for_depth: 0,
+            route_depth: 0,
             foster_context_depth: 0,
             boundary_parent_scope: None,
             module_entry_srcs: Vec::new(),
@@ -958,21 +971,343 @@ impl HtmlParser {
         self.fragment_records.contains_key(fragment_id)
     }
 
-    /// Number of `<boundary>` streaming checkpoints compiled by the most
-    /// recent top-level [`HtmlParser::parse`] call.
+    /// Compute transitive boundary presence and conservative declaration
+    /// repeatability for the complete parsed fragment graph.
     ///
-    /// Returns `0` for an ordinary, non-streaming entry. Callers use this to
-    /// decide whether streaming-specific build advisories apply.
-    #[must_use]
-    pub fn boundary_count(&self) -> usize {
-        self.boundary_sequence as usize
+    /// This runs only after a top-level parse succeeds. Both analyses are
+    /// iterative: presence propagates through reverse edges, while occurrence
+    /// counts use a two-value (once/many) fixed point. Cycles therefore converge
+    /// without recursion and are conservatively classified as repeatable.
+    #[cold]
+    #[inline(never)]
+    fn finalize_boundary_metadata(&mut self) -> Result<()> {
+        if self.next_boundary_declaration_id != 0 {
+            let (outgoing, direct_boundary_records) = self.boundary_graph();
+            self.mark_boundary_records(&outgoing, direct_boundary_records);
+            let occurrence_counts = self.boundary_occurrence_counts(&outgoing);
+
+            for (fragment_id, list) in &mut self.fragment_records {
+                let repeated = occurrence_counts
+                    .get(fragment_id)
+                    .is_some_and(|count| *count > 1);
+                if !repeated {
+                    continue;
+                }
+                for fragment in &mut list.fragments {
+                    if let Some(Fragment::Boundary(boundary)) = fragment.fragment.as_mut() {
+                        if boundary.phase() == BoundaryPhase::Start {
+                            boundary.may_repeat = true;
+                        }
+                    }
+                }
+            }
+
+            if let Some((owner, name)) = self.find_transitively_nested_boundary() {
+                return Err(Self::transitively_nested_boundary_error(&owner, &name));
+            }
+        }
+        self.finalize_component_span_signals();
+        Ok(())
     }
 
-    /// Free-form `<boundary name>` values in declaration order from the most
-    /// recent top-level [`HtmlParser::parse`] call.
-    #[must_use]
-    pub fn boundary_names(&self) -> &[String] {
-        &self.boundary_names_in_order
+    fn finalize_component_span_signals(&mut self) {
+        const START: &str = "streaming_span_start:";
+        const END: &str = "streaming_span_end:";
+
+        let spanning: HashSet<String> = self
+            .fragment_records
+            .iter()
+            .filter_map(|(id, list)| list.contains_boundary.then_some(id.clone()))
+            .collect();
+        for list in self.fragment_records.values_mut() {
+            let mut normalized = Vec::with_capacity(list.fragments.len());
+            for fragment in list.fragments.drain(..) {
+                let remove = match fragment.fragment.as_ref() {
+                    Some(Fragment::Signal(signal)) => signal
+                        .value
+                        .strip_prefix(STRUCTURAL_SIGNAL_PREFIX)
+                        .and_then(|value| {
+                            value
+                                .strip_prefix(START)
+                                .or_else(|| value.strip_prefix(END))
+                        })
+                        .is_some_and(|tag| !spanning.contains(tag)),
+                    _ => false,
+                };
+                if remove {
+                    continue;
+                }
+                if let Some(Fragment::Raw(raw)) = fragment.fragment.as_ref() {
+                    if let Some(WebUIFragment {
+                        fragment: Some(Fragment::Raw(previous)),
+                    }) = normalized.last_mut()
+                    {
+                        previous.value.push_str(&raw.value);
+                        continue;
+                    }
+                }
+                normalized.push(fragment);
+            }
+            list.fragments = normalized;
+        }
+    }
+
+    fn boundary_graph(&self) -> (HashMap<String, Vec<BoundaryGraphEdge>>, Vec<String>) {
+        let mut outgoing: HashMap<String, Vec<BoundaryGraphEdge>> =
+            HashMap::with_capacity(self.fragment_records.len());
+        let mut direct_boundary_records = Vec::new();
+
+        for (fragment_id, list) in &self.fragment_records {
+            let edges = outgoing.entry(fragment_id.clone()).or_default();
+            for fragment in &list.fragments {
+                match fragment.fragment.as_ref() {
+                    Some(Fragment::Component(component)) => {
+                        Self::push_boundary_edge(edges, &component.fragment_id, false);
+                    }
+                    Some(Fragment::ForLoop(for_loop)) => {
+                        Self::push_boundary_edge(edges, &for_loop.fragment_id, true);
+                    }
+                    Some(Fragment::IfCond(if_cond)) => {
+                        Self::push_boundary_edge(edges, &if_cond.fragment_id, false);
+                    }
+                    Some(Fragment::Boundary(boundary)) => {
+                        if boundary.phase() == BoundaryPhase::Start {
+                            direct_boundary_records.push(fragment_id.clone());
+                        }
+                    }
+                    Some(Fragment::Route(route)) => {
+                        Self::push_route_boundary_edges(edges, route);
+                    }
+                    _ => {}
+                }
+            }
+        }
+        (outgoing, direct_boundary_records)
+    }
+
+    fn push_boundary_edge(edges: &mut Vec<BoundaryGraphEdge>, target: &str, repeats: bool) {
+        if !target.is_empty() {
+            edges.push(BoundaryGraphEdge {
+                target: target.to_string(),
+                repeats,
+            });
+        }
+    }
+
+    fn push_route_boundary_edges(edges: &mut Vec<BoundaryGraphEdge>, root: &WebUiFragmentRoute) {
+        let mut pending = vec![root];
+        while let Some(route) = pending.pop() {
+            Self::push_boundary_edge(edges, &route.fragment_id, false);
+            Self::push_boundary_edge(edges, &route.content_fragment_id, false);
+            Self::push_boundary_edge(edges, &route.pending_component, false);
+            Self::push_boundary_edge(edges, &route.error_component, false);
+            pending.extend(route.children.iter());
+        }
+    }
+
+    fn mark_boundary_records(
+        &mut self,
+        outgoing: &HashMap<String, Vec<BoundaryGraphEdge>>,
+        direct_boundary_records: Vec<String>,
+    ) {
+        for list in self.fragment_records.values_mut() {
+            list.contains_boundary = false;
+        }
+
+        let mut reverse: HashMap<&str, Vec<&str>> = HashMap::new();
+        for (parent, edges) in outgoing {
+            for edge in edges {
+                reverse
+                    .entry(edge.target.as_str())
+                    .or_default()
+                    .push(parent.as_str());
+            }
+        }
+
+        let mut marked = HashSet::with_capacity(self.fragment_records.len());
+        let mut pending = direct_boundary_records;
+        while let Some(fragment_id) = pending.pop() {
+            if !marked.insert(fragment_id.clone()) {
+                continue;
+            }
+            if let Some(list) = self.fragment_records.get_mut(&fragment_id) {
+                list.contains_boundary = true;
+            }
+            if let Some(parents) = reverse.get(fragment_id.as_str()) {
+                pending.extend(parents.iter().map(|parent| (*parent).to_string()));
+            }
+        }
+    }
+
+    fn boundary_occurrence_counts(
+        &self,
+        outgoing: &HashMap<String, Vec<BoundaryGraphEdge>>,
+    ) -> HashMap<String, u8> {
+        let mut incoming: HashMap<&str, Vec<(&str, bool)>> = HashMap::new();
+        for (parent, edges) in outgoing {
+            for edge in edges {
+                incoming
+                    .entry(edge.target.as_str())
+                    .or_default()
+                    .push((parent.as_str(), edge.repeats));
+            }
+        }
+
+        let mut aggregate = HashMap::with_capacity(self.fragment_records.len());
+        for root in &self.token_roots {
+            if !self.fragment_records.contains_key(root) {
+                continue;
+            }
+            let counts = self.boundary_occurrences_from_root(root.as_str(), outgoing, &incoming);
+            for (fragment_id, count) in counts {
+                let current = aggregate.entry(fragment_id).or_insert(0);
+                *current = (*current).max(count);
+            }
+        }
+        aggregate
+    }
+
+    fn boundary_occurrences_from_root(
+        &self,
+        root: &str,
+        outgoing: &HashMap<String, Vec<BoundaryGraphEdge>>,
+        incoming: &HashMap<&str, Vec<(&str, bool)>>,
+    ) -> HashMap<String, u8> {
+        let mut counts: HashMap<String, u8> = HashMap::with_capacity(self.fragment_records.len());
+        counts.insert(root.to_string(), 1);
+        let mut pending = vec![root.to_string()];
+        while let Some(parent) = pending.pop() {
+            let Some(edges) = outgoing.get(&parent) else {
+                continue;
+            };
+            for edge in edges {
+                let next = Self::recompute_boundary_occurrences(
+                    edge.target.as_str(),
+                    root,
+                    incoming,
+                    &counts,
+                );
+                let current = counts.get(&edge.target).copied().unwrap_or(0);
+                if next > current {
+                    counts.insert(edge.target.clone(), next);
+                    pending.push(edge.target.clone());
+                }
+            }
+        }
+        counts
+    }
+
+    fn recompute_boundary_occurrences(
+        fragment_id: &str,
+        root: &str,
+        incoming: &HashMap<&str, Vec<(&str, bool)>>,
+        counts: &HashMap<String, u8>,
+    ) -> u8 {
+        let mut count = u8::from(fragment_id == root);
+        let Some(parents) = incoming.get(fragment_id) else {
+            return count;
+        };
+        for (parent, repeats) in parents {
+            let parent_count = counts.get(*parent).copied().unwrap_or(0);
+            let contribution = if *repeats && parent_count != 0 {
+                2
+            } else {
+                parent_count
+            };
+            count = count.saturating_add(contribution).min(2);
+            if count == 2 {
+                break;
+            }
+        }
+        count
+    }
+
+    /// Locate the lowest-numbered declaration whose inline body reaches another
+    /// boundary through a component, condition, loop, or route record.
+    ///
+    /// Lexical nesting is already rejected while parsing, so this only has to
+    /// look at the child records referenced between a start and end marker.
+    fn find_transitively_nested_boundary(&self) -> Option<(String, String)> {
+        let mut nested: Option<(u32, &str, &str)> = None;
+        for list in self.fragment_records.values() {
+            let mut active: Option<&WebUiFragmentBoundary> = None;
+            for fragment in &list.fragments {
+                let Some(boundary) = active else {
+                    if let Some(Fragment::Boundary(boundary)) = fragment.fragment.as_ref() {
+                        if boundary.phase() == BoundaryPhase::Start {
+                            active = Some(boundary);
+                        }
+                    }
+                    continue;
+                };
+                if let Some(Fragment::Boundary(marker)) = fragment.fragment.as_ref() {
+                    if marker.phase() == BoundaryPhase::End {
+                        active = None;
+                    }
+                    continue;
+                }
+                if !self.fragment_reaches_boundary(fragment) {
+                    continue;
+                }
+                if nested
+                    .as_ref()
+                    .is_none_or(|(id, _, _)| boundary.declaration_id < *id)
+                {
+                    nested = Some((
+                        boundary.declaration_id,
+                        boundary.owner_fragment_id.as_str(),
+                        boundary.name.as_str(),
+                    ));
+                }
+            }
+        }
+        nested.map(|(_, owner, name)| (owner.to_string(), name.to_string()))
+    }
+
+    /// Whether a fragment inside a boundary body reaches a nested declaration
+    /// through one of its child records.
+    fn fragment_reaches_boundary(&self, fragment: &WebUIFragment) -> bool {
+        let reaches = |id: &str| {
+            !id.is_empty()
+                && self
+                    .fragment_records
+                    .get(id)
+                    .is_some_and(|list| list.contains_boundary)
+        };
+        match fragment.fragment.as_ref() {
+            Some(Fragment::Component(component)) => reaches(&component.fragment_id),
+            Some(Fragment::ForLoop(for_loop)) => reaches(&for_loop.fragment_id),
+            Some(Fragment::IfCond(if_cond)) => reaches(&if_cond.fragment_id),
+            Some(Fragment::Route(route)) => {
+                let mut pending = vec![route];
+                while let Some(current) = pending.pop() {
+                    if reaches(&current.fragment_id)
+                        || reaches(&current.content_fragment_id)
+                        || reaches(&current.pending_component)
+                        || reaches(&current.error_component)
+                    {
+                        return true;
+                    }
+                    pending.extend(current.children.iter());
+                }
+                false
+            }
+            _ => false,
+        }
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn transitively_nested_boundary_error(owner: &str, name: &str) -> ParserError {
+        Diagnostic::error(format!(
+            "boundary \"{name}\" transitively contains another boundary"
+        ))
+        .code(codes::NESTED_BOUNDARY)
+        .component(owner)
+        .element("boundary")
+        .snippet(format!("name=\"{name}\""))
+        .help("remove the inner declaration or move it outside the enclosing boundary, including declarations reached through components and runtime branches")
+        .into()
     }
 
     /// `src` of every authored `<script type="module">` outside any
@@ -1144,6 +1479,11 @@ impl HtmlParser {
         out: &mut UnresolvedTokens,
         ops: &mut Vec<TokenGraphOp<'a>>,
     ) {
+        if !route.content_fragment_id.is_empty() {
+            ops.push(TokenGraphOp::EnterFragment(
+                route.content_fragment_id.as_str(),
+            ));
+        }
         let Some(component) = self.component_registry.get(&route.fragment_id) else {
             return;
         };
@@ -1190,23 +1530,9 @@ impl HtmlParser {
         let fragment_key = fragment_id.to_string();
         let is_token_root = self.in_progress_fragments.is_empty();
         if is_token_root {
-            // A new top-level entry template starts a fresh boundary
-            // namespace: sequence numbers are response-local (spec: "0, 1,
-            // …") and names are only required to be unique per entry. Also
-            // reset `in_boundary`/`structural_scopes`, which should already
-            // be empty/false here but could be left dirty if a *previous*
-            // top-level parse on this same `HtmlParser` errored out midway
-            // through an open boundary or `<if>`/`<for>` scope.
-            self.boundary_sequence = 0;
-            self.boundary_names.clear();
-            self.boundary_names_in_order.clear();
-            self.in_boundary = false;
-            self.body_depth = 0;
-            self.structural_scopes.clear();
-            self.foster_context_depth = 0;
-            self.boundary_parent_scope = None;
             self.module_entry_srcs.clear();
         }
+        self.boundary_names_by_owner.remove(&fragment_key);
         // Save the caller's fragment id and restore it before returning. A
         // component parse recurses through `enter_component_directive`
         // (`self.parse(child, …)`); without restoring, the parent would keep
@@ -1232,7 +1558,34 @@ impl HtmlParser {
             self.token_roots.push(fragment_key.clone());
         }
 
-        let result = self.parse_inner(fragment_id, html_content);
+        // Lexical directive/HTML context belongs to one authored template.
+        // Component parsing may recurse while its callsite is inside a loop or
+        // boundary, but those callsite properties are computed later by the
+        // fragment graph analysis rather than leaking into the component's
+        // authored syntax.
+        let previous_in_boundary = std::mem::replace(&mut self.in_boundary, false);
+        let previous_boundary_ancestor_depth = self.boundary_ancestor_depth;
+        if previous_in_boundary {
+            self.boundary_ancestor_depth += 1;
+        }
+        let previous_body_depth = std::mem::replace(&mut self.body_depth, 0);
+        let previous_for_depth = std::mem::replace(&mut self.for_depth, 0);
+        let previous_route_depth = std::mem::replace(&mut self.route_depth, 0);
+        let previous_foster_depth = std::mem::replace(&mut self.foster_context_depth, 0);
+        let previous_parent_scope = self.boundary_parent_scope.take();
+
+        let mut result = self.parse_inner(fragment_id, html_content);
+        if is_token_root && result.is_ok() {
+            result = self.finalize_boundary_metadata();
+        }
+
+        self.in_boundary = previous_in_boundary;
+        self.boundary_ancestor_depth = previous_boundary_ancestor_depth;
+        self.body_depth = previous_body_depth;
+        self.for_depth = previous_for_depth;
+        self.route_depth = previous_route_depth;
+        self.foster_context_depth = previous_foster_depth;
+        self.boundary_parent_scope = previous_parent_scope;
         self.in_progress_fragments.remove(&fragment_key);
         self.current_fragment_id = previous_fragment_id;
         result
@@ -1261,6 +1614,7 @@ impl HtmlParser {
             fragment_id.to_string(),
             FragmentList {
                 fragments: entry_fragment,
+                contains_boundary: false,
             },
         );
 
@@ -1468,7 +1822,7 @@ impl HtmlParser {
                                     self.enter_if_directive(&element, fragments, depth, &mut ops)?;
                                 }
                                 "route" => {
-                                    self.process_route_directive(&element, fragments)?;
+                                    self.process_route_directive(&element, fragments, depth)?;
                                 }
                                 "outlet" => {
                                     self.flush_raw_buffer(fragments);
@@ -1525,6 +1879,13 @@ impl HtmlParser {
                     self.add_raw_fragment(name);
                     self.add_raw_fragment(">");
                 }
+                ParseOp::EndComponent(name) => {
+                    self.add_raw_fragment("</");
+                    self.add_raw_fragment(name);
+                    self.add_raw_fragment(">");
+                    self.flush_raw_buffer(fragments);
+                    fragments.push(structural_signal(format!("streaming_span_end:{name}")));
+                }
                 ParseOp::EndHead(name) => {
                     self.flush_raw_buffer(fragments);
                     fragments.push(structural_signal("head_end"));
@@ -1540,9 +1901,9 @@ impl HtmlParser {
                     self.add_raw_fragment(">");
                     self.body_depth = self.body_depth.saturating_sub(1);
                 }
-                ParseOp::EndBoundary(sequence) => {
+                ParseOp::CompleteBoundary { boundary } => {
                     self.flush_raw_buffer(fragments);
-                    fragments.push(structural_signal(format!("boundary_end:{sequence}")));
+                    fragments.push(WebUIFragment::boundary_end(boundary.declaration_id));
                     self.in_boundary = false;
                 }
                 ParseOp::RestoreFosterDepth(previous) => {
@@ -1557,8 +1918,9 @@ impl HtmlParser {
                     collection,
                     fragment_id,
                     keep_empty,
+                    previous_for_depth,
                 } => {
-                    self.structural_scopes.pop();
+                    self.for_depth = previous_for_depth;
                     self.flush_raw_buffer(fragments);
                     let for_fragment = std::mem::take(fragments);
                     *fragments = parent.fragments;
@@ -1569,6 +1931,7 @@ impl HtmlParser {
                             fragment_id.clone(),
                             FragmentList {
                                 fragments: for_fragment,
+                                contains_boundary: false,
                             },
                         );
                     } else if !keep_empty {
@@ -1582,7 +1945,6 @@ impl HtmlParser {
                     condition,
                     fragment_id,
                 } => {
-                    self.structural_scopes.pop();
                     self.flush_raw_buffer(fragments);
                     let if_fragment = std::mem::take(fragments);
                     *fragments = parent.fragments;
@@ -1592,6 +1954,7 @@ impl HtmlParser {
                         fragment_id.clone(),
                         FragmentList {
                             fragments: if_fragment,
+                            contains_boundary: false,
                         },
                     );
                     self.add_if_fragment(condition, fragment_id, fragments);
@@ -1609,7 +1972,10 @@ impl HtmlParser {
         depth: usize,
         ops: &mut Vec<ParseOp<'a>>,
     ) -> Result<()> {
-        if !self.in_boundary && element.name().eq_ignore_ascii_case("script") {
+        if !self.in_boundary
+            && self.boundary_ancestor_depth == 0
+            && element.name().eq_ignore_ascii_case("script")
+        {
             self.record_module_entry(element);
         }
         self.add_raw_fragment("<");
@@ -1633,7 +1999,7 @@ impl HtmlParser {
                 ops.push(ParseOp::EmitClose(element.name()));
             }
             self.enter_foster_context(element.name(), ops);
-            self.enter_boundary_parent_scope(element.name(), ops);
+            self.enter_boundary_parent_scope(element, ops);
             ops.push(ParseOp::Parse {
                 range: element.inner(),
                 depth: depth + 1,
@@ -1959,13 +2325,15 @@ impl HtmlParser {
             raw_buffer: std::mem::take(&mut self.raw_buffer),
         };
 
-        self.structural_scopes.push("a <for> loop");
+        let previous_for_depth = self.for_depth;
+        self.for_depth += 1;
         ops.push(ParseOp::CompleteFor {
             parent,
             item: item.to_string(),
             collection: collection.to_string(),
             fragment_id,
             keep_empty,
+            previous_for_depth,
         });
         ops.push(ParseOp::Parse {
             range: element.inner(),
@@ -2034,7 +2402,6 @@ impl HtmlParser {
         };
         let fragment_id = self.id_counter.next_id("if");
 
-        self.structural_scopes.push("an <if> block");
         ops.push(ParseOp::CompleteIf {
             parent,
             condition,
@@ -2072,8 +2439,15 @@ impl HtmlParser {
     }
 
     #[inline]
-    fn enter_boundary_parent_scope<'a>(&mut self, name: &str, ops: &mut Vec<ParseOp<'a>>) {
-        let Some(scope) = boundary_parent_scope(name) else {
+    fn enter_boundary_parent_scope<'a>(
+        &mut self,
+        element: &Element<'a>,
+        ops: &mut Vec<ParseOp<'a>>,
+    ) {
+        if element.name().eq_ignore_ascii_case("template") && element.has_attr("shadowrootmode") {
+            return;
+        }
+        let Some(scope) = boundary_parent_scope(element.name()) else {
             return;
         };
         ops.push(ParseOp::RestoreBoundaryParentScope(
@@ -2093,11 +2467,9 @@ impl HtmlParser {
     /// Enter a `<boundary name="…">` directive.
     ///
     /// `<boundary>` is a reserved, compile-time-only directive (see
-    /// "Progressive Streaming Hydration" in `DESIGN.md`): it emits
-    /// no wrapper element, only `boundary_start:<seq>` /
-    /// `boundary_end:<seq>` raw signal fragments around its children, mirroring
-    /// how [`Self::enter_body_element`] brackets its children with
-    /// `body_start`/`body_end`.
+    /// "Progressive Streaming Hydration" in `DESIGN.md`): it emits no wrapper
+    /// element. Its children stay inline in the owner's record, bracketed by a
+    /// [`BoundaryPhase::Start`]/[`BoundaryPhase::End`] fragment pair.
     ///
     /// # Errors
     ///
@@ -2109,13 +2481,14 @@ impl HtmlParser {
     /// - the boundary sits in an HTML foster-parenting context such as
     ///   `<table>`/`<tbody>`/`<tr>`/`<select>`
     ///   ([`codes::BOUNDARY_IN_FOSTER_CONTEXT`]);
-    /// - the boundary would cut through a reusable component template, an
-    ///   `<if>`, a `<for>`, or a `<route>` scope instead of independently
-    ///   wrapping it ([`codes::BOUNDARY_CROSSES_SCOPE`] — see the "Known
-    ///   limitation" note on [`Self::boundary_scope_error`]);
+    /// - the boundary would cut through component host content or native
+    ///   raw/inert content ([`codes::BOUNDARY_CROSSES_SCOPE`]);
     /// - `name` is missing/empty ([`codes::MISSING_BOUNDARY_NAME`]), dynamic
-    ///   ([`codes::INVALID_BOUNDARY_NAME`]), or a duplicate within the entry
+    ///   ([`codes::INVALID_BOUNDARY_NAME`]), or a duplicate within its owner
     ///   ([`codes::DUPLICATE_BOUNDARY_NAME`]).
+    /// - a boundary lexically inside `<for>` omits `key`
+    ///   ([`codes::MISSING_BOUNDARY_KEY`]), or an authored key is malformed
+    ///   ([`codes::INVALID_BOUNDARY_KEY`]).
     fn enter_boundary_directive<'a>(
         &mut self,
         element: &Element<'a>,
@@ -2123,24 +2496,15 @@ impl HtmlParser {
         depth: usize,
         ops: &mut Vec<ParseOp<'a>>,
     ) -> Result<()> {
-        // `in_progress_fragments.len() > 1` means parsing has recursed into a
-        // reusable template (a component usage or a route-referenced
-        // component) via `self.parse(..)`, as opposed to the outermost entry
-        // template. The design intentionally permits boundaries only in that
-        // outermost entry.
-        if self.in_progress_fragments.len() > 1 {
-            return Err(self.boundary_scope_error(element, "a reusable component template"));
-        }
-        if let Some(scope) = self.structural_scopes.last() {
-            return Err(self.boundary_scope_error(element, scope));
-        }
         if let Some(scope) = self.boundary_parent_scope {
             return Err(self.boundary_scope_error(element, scope));
         }
         if self.in_boundary {
             return Err(self.nested_boundary_error(element));
         }
-        if self.body_depth == 0 {
+        let owner_fragment_id = self.current_fragment_id.clone();
+        let owner_is_component = self.component_registry.contains(&owner_fragment_id);
+        if !owner_is_component && self.body_depth == 0 && self.route_depth == 0 {
             return Err(self.boundary_outside_body_error(element));
         }
         if self.foster_context_depth != 0 {
@@ -2148,19 +2512,38 @@ impl HtmlParser {
         }
 
         let name = self.validate_boundary_name(element)?;
-        if !self.boundary_names.insert(name.clone()) {
+        let inserted = self
+            .boundary_names_by_owner
+            .entry(owner_fragment_id.clone())
+            .or_default()
+            .insert(name.clone());
+        if !inserted {
             return Err(self.duplicate_boundary_name_error(element, &name));
         }
-        self.boundary_names_in_order.push(name);
-
-        let sequence = self.boundary_sequence;
-        self.boundary_sequence += 1;
+        let key = self.validate_boundary_key(element)?;
+        if self.for_depth != 0 && key.is_none() {
+            return Err(self.missing_boundary_key_error(element));
+        }
+        let declaration_id = self.allocate_boundary_declaration_id(element)?;
+        let may_repeat = self.for_depth != 0;
         self.in_boundary = true;
+        self.add_fragment(
+            WebUIFragment {
+                fragment: Some(Fragment::Boundary(WebUiFragmentBoundary {
+                    declaration_id,
+                    owner_fragment_id,
+                    name,
+                    key,
+                    may_repeat,
+                    phase: BoundaryPhase::Start as i32,
+                })),
+            },
+            fragments,
+        );
 
-        self.flush_raw_buffer(fragments);
-        fragments.push(structural_signal(format!("boundary_start:{sequence}")));
-
-        ops.push(ParseOp::EndBoundary(sequence));
+        ops.push(ParseOp::CompleteBoundary {
+            boundary: PendingBoundary { declaration_id },
+        });
         ops.push(ParseOp::Parse {
             range: element.inner(),
             depth: depth + 1,
@@ -2172,7 +2555,7 @@ impl HtmlParser {
     /// `{{binding}}`).
     fn validate_boundary_name(&self, element: &Element<'_>) -> Result<String> {
         let name = element.attr("name").unwrap_or_default();
-        if name.is_empty() {
+        if name.trim().is_empty() {
             return Err(self.missing_boundary_name_error(element));
         }
         if name.contains("{{") {
@@ -2181,6 +2564,39 @@ impl HtmlParser {
         Ok(name.to_string())
     }
 
+    fn validate_boundary_key(&self, element: &Element<'_>) -> Result<Option<String>> {
+        if !element.has_attr("key") {
+            return Ok(None);
+        }
+        let Some(raw) = element.attr("key") else {
+            return Err(self.invalid_boundary_key_error(element, ""));
+        };
+        let trimmed = raw.trim();
+        let braced = trimmed.starts_with("{{") || trimmed.ends_with("}}");
+        let valid = if braced {
+            trimmed
+                .strip_prefix("{{")
+                .and_then(|value| value.strip_suffix("}}"))
+                .filter(|value| !value.starts_with('{') && !value.ends_with('}'))
+                .is_some_and(|value| !value.trim().is_empty())
+        } else {
+            !trimmed.is_empty()
+        };
+        if !valid {
+            return Err(self.invalid_boundary_key_error(element, raw));
+        }
+        Ok(Some(raw.to_string()))
+    }
+
+    fn allocate_boundary_declaration_id(&mut self, element: &Element<'_>) -> Result<u32> {
+        let declaration_id = self.next_boundary_declaration_id;
+        let Some(next) = declaration_id.checked_add(1) else {
+            return Err(self.too_many_boundaries_error(element));
+        };
+        self.next_boundary_declaration_id = next;
+        Ok(declaration_id)
+    }
+
     /// Build the error for a `<boundary>` missing its `name` attribute
     /// (cold path).
     #[cold]
@@ -2212,8 +2628,7 @@ impl HtmlParser {
         .into()
     }
 
-    /// Build the error for a duplicate `<boundary name>` within the
-    /// same entry template (cold path).
+    /// Build the error for a duplicate `<boundary name>` within one owner.
     #[cold]
     #[inline(never)]
     fn duplicate_boundary_name_error(&self, element: &Element<'_>, name: &str) -> ParserError {
@@ -2223,7 +2638,47 @@ impl HtmlParser {
             element,
         )
         .element("boundary")
-        .help("boundary names must be unique within the page; rename one of the boundaries")
+        .help("boundary names must be unique within their entry or component template; rename one of the declarations")
+        .into()
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn missing_boundary_key_error(&self, element: &Element<'_>) -> ParserError {
+        self.authoring_error_at(
+            codes::MISSING_BOUNDARY_KEY,
+            "<boundary> inside <for> requires a key",
+            element,
+        )
+        .element("boundary")
+        .help("add a stable item-relative key, e.g. <boundary name=\"row\" key=\"item.id\">")
+        .into()
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn invalid_boundary_key_error(&self, element: &Element<'_>, key: &str) -> ParserError {
+        self.authoring_error_at(
+            codes::INVALID_BOUNDARY_KEY,
+            "invalid key expression on <boundary>",
+            element,
+        )
+        .element("boundary")
+        .snippet(format!("key=\"{key}\""))
+        .help("use a non-empty expression such as key=\"item.id\" or key=\"{{item.id}}\"")
+        .into()
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn too_many_boundaries_error(&self, element: &Element<'_>) -> ParserError {
+        self.authoring_error_at(
+            codes::TOO_MANY_BOUNDARIES,
+            "too many boundary declarations",
+            element,
+        )
+        .element("boundary")
+        .help("split this build into smaller protocols so each declaration has a unique u32 ID")
         .into()
     }
 
@@ -2242,13 +2697,8 @@ impl HtmlParser {
         .into()
     }
 
-    /// Build the error for a `<boundary>` that would cut through
-    /// `scope` (a reusable component template, an `<if>`/`<for>` block, or a
-    /// `<route>` element) instead of independently wrapping it (cold path).
-    ///
-    /// The parser rejects boundaries in every recursively parsed template,
-    /// including route shells: only the outermost entry passed to
-    /// [`Self::parse`] may contain one.
+    /// Build the error for a `<boundary>` that would cut through a native
+    /// raw/inert scope or component host content.
     #[cold]
     #[inline(never)]
     fn boundary_scope_error(&self, element: &Element<'_>, scope: &str) -> ParserError {
@@ -2258,7 +2708,7 @@ impl HtmlParser {
             element,
         )
         .element("boundary")
-        .help("move the <boundary> so it fully wraps this scope from the entry template, instead of appearing inside it")
+        .help("move the <boundary> outside this raw, inert, or component-host content scope")
         .into()
     }
 
@@ -2298,6 +2748,19 @@ impl HtmlParser {
         .into()
     }
 
+    #[cold]
+    #[inline(never)]
+    fn route_boundary_placement_error(&self, element: &Element<'_>) -> ParserError {
+        self.authoring_error_at(
+            codes::INVALID_ROUTE_BOUNDARY_PLACEMENT,
+            "route boundary must be a direct <route> child",
+            element,
+        )
+        .element("boundary")
+        .help("move the <boundary> directly under <route>, or place it in the route component template")
+        .into()
+    }
+
     /// Build the error for an authored `<webui-hydrate>` (cold path).
     /// `<webui-hydrate>` is reserved for the compiler/handler-generated
     /// runtime hydration sentinel and must never appear in authored markup.
@@ -2321,6 +2784,11 @@ impl HtmlParser {
         depth: usize,
         ops: &mut Vec<ParseOp<'a>>,
     ) -> Result<()> {
+        self.flush_raw_buffer(fragments);
+        fragments.push(structural_signal(format!(
+            "streaming_span_start:{}",
+            element.name()
+        )));
         self.add_raw_fragment("<");
         self.add_raw_fragment(element.name());
 
@@ -2380,8 +2848,13 @@ impl HtmlParser {
 
         fragments.push(WebUIFragment::component(element.name().to_string()));
 
-        if !element.self_closing() {
-            ops.push(ParseOp::EmitClose(element.name()));
+        if element.self_closing() {
+            fragments.push(structural_signal(format!(
+                "streaming_span_end:{}",
+                element.name()
+            )));
+        } else {
+            ops.push(ParseOp::EndComponent(element.name()));
             self.enter_component_content_scope(ops);
             ops.push(ParseOp::Parse {
                 range: element.inner(),
@@ -2542,8 +3015,13 @@ impl HtmlParser {
                     } else if Self::contains_handlebars(val) {
                         let template_id = self.id_counter.next_id("attr");
                         let parsed = self.handlebars_parser.parse(val)?;
-                        self.fragment_records
-                            .insert(template_id.clone(), FragmentList { fragments: parsed });
+                        self.fragment_records.insert(
+                            template_id.clone(),
+                            FragmentList {
+                                fragments: parsed,
+                                contains_boundary: false,
+                            },
+                        );
                         let frag = WebUIFragment {
                             fragment: Some(web_ui_fragment::Fragment::Attribute(
                                 WebUIFragmentAttribute {
@@ -2584,8 +3062,13 @@ impl HtmlParser {
                         } else {
                             let template_id = self.id_counter.next_id("attr");
                             let parsed = self.handlebars_parser.parse(val)?;
-                            self.fragment_records
-                                .insert(template_id.clone(), FragmentList { fragments: parsed });
+                            self.fragment_records.insert(
+                                template_id.clone(),
+                                FragmentList {
+                                    fragments: parsed,
+                                    contains_boundary: false,
+                                },
+                            );
                             let frag = Self::maybe_mark_attr_start(
                                 WebUIFragment::attribute_template(attr_name, template_id),
                                 &mut first_dynamic_emitted,
@@ -2684,8 +3167,13 @@ impl HtmlParser {
             let template_id = self.id_counter.next_id("attr");
             let parsed = self.handlebars_parser.parse(value)?;
 
-            self.fragment_records
-                .insert(template_id.clone(), FragmentList { fragments: parsed });
+            self.fragment_records.insert(
+                template_id.clone(),
+                FragmentList {
+                    fragments: parsed,
+                    contains_boundary: false,
+                },
+            );
 
             self.add_fragment(
                 WebUIFragment::attribute_template(name, template_id),
@@ -2732,6 +3220,7 @@ impl HtmlParser {
         &mut self,
         element: &Element<'_>,
         fragments: &mut Vec<WebUIFragment>,
+        depth: usize,
     ) -> Result<()> {
         let attrs = Self::route_attrs_from_element(element);
         let path = attrs.path.clone();
@@ -2764,6 +3253,8 @@ impl HtmlParser {
             self.ensure_route_component_parsed(&attrs.error_component)?;
         }
         self.ensure_route_component_parsed(&component)?;
+        self.flush_raw_buffer(fragments);
+        let content_fragment_id = self.parse_route_boundary_content(element, depth)?;
 
         let mut all_params = std::collections::HashSet::new();
         all_params.extend(route_params);
@@ -2771,14 +3262,61 @@ impl HtmlParser {
         let children =
             self.parse_child_routes(element.source(), element.inner(), &all_params, 1)?;
 
-        self.flush_raw_buffer(fragments);
-        let route_fragment =
+        let mut route_fragment =
             route_parser::build_route_fragment(&attrs, component.clone(), children);
+        route_fragment.content_fragment_id = content_fragment_id;
         fragments.push(WebUIFragment::route_from(route_fragment));
 
         Ok(())
     }
 
+    fn parse_route_boundary_content(
+        &mut self,
+        route: &Element<'_>,
+        depth: usize,
+    ) -> Result<String> {
+        let inner = route.inner();
+        if !route.source()[inner.clone()].contains("<boundary") {
+            return Ok(String::new());
+        }
+        let saved_buffer = std::mem::take(&mut self.raw_buffer);
+        let previous_route_depth = self.route_depth;
+        self.route_depth += 1;
+        let mut content = Vec::new();
+        let parse_result: Result<()> = (|| {
+            for event in Walker::new_range(route.source(), inner.start, inner.end) {
+                if let Event::Element(element) = event {
+                    if element.name() == "boundary" {
+                        self.parse_range(
+                            element.source(),
+                            element.start..element.close_end(),
+                            &mut content,
+                            depth + 1,
+                        )?;
+                    }
+                }
+            }
+            self.flush_raw_buffer(&mut content);
+            Ok(())
+        })();
+        self.route_depth = previous_route_depth;
+        self.raw_buffer = saved_buffer;
+        parse_result?;
+
+        if content.is_empty() {
+            return Ok(String::new());
+        }
+        let fragment_id = self.id_counter.next_id("route-content");
+        self.fragment_records.insert(
+            fragment_id.clone(),
+            FragmentList {
+                fragments: content,
+                contains_boundary: false,
+            },
+        );
+        Ok(fragment_id)
+    }
+
     /// Parse nested `<route>` children into route fragments.
     ///
     /// `depth` is the nesting level of the routes produced here (top-level
@@ -2809,7 +3347,7 @@ impl HtmlParser {
             match event {
                 Event::Element(element) => {
                     self.validate_closed_element(&element)?;
-                    self.reject_boundary_or_hydrate_in_route(&element)?;
+                    self.reject_boundary_or_hydrate_in_route(&element, true)?;
                     if element.name() == "route" {
                         children.push(self.parse_route_as_fragment(
                             &element,
@@ -2904,7 +3442,7 @@ impl HtmlParser {
                 match event {
                     Event::Element(element) => {
                         self.validate_closed_element(&element)?;
-                        self.reject_boundary_or_hydrate_in_route(&element)?;
+                        self.reject_boundary_or_hydrate_in_route(&element, false)?;
                         if element.name().eq_ignore_ascii_case("style") {
                             self.validate_style_element(&element)?;
                         } else if !element.self_closing() && !element.is_void() {
@@ -2937,8 +3475,8 @@ impl HtmlParser {
         Ok(())
     }
 
-    /// Reject `<boundary>`/`<webui-hydrate>` written inside `<route>`
-    /// markup.
+    /// Reject `<webui-hydrate>` in route markup and boundaries that are not
+    /// direct route children.
     ///
     /// `<route>` children are validated by a separate well-formedness walker
     /// ([`Self::parse_child_routes`]/[`Self::validate_ignored_route_html`]),
@@ -2946,9 +3484,13 @@ impl HtmlParser {
     /// reserved directives need an explicit check here to produce the same
     /// structured diagnostics as everywhere else instead of silently passing
     /// through as ignored HTML.
-    fn reject_boundary_or_hydrate_in_route(&self, element: &Element<'_>) -> Result<()> {
-        if element.name() == "boundary" {
-            Err(self.boundary_scope_error(element, "a <route> element"))
+    fn reject_boundary_or_hydrate_in_route(
+        &self,
+        element: &Element<'_>,
+        allow_boundary: bool,
+    ) -> Result<()> {
+        if element.name() == "boundary" && !allow_boundary {
+            Err(self.route_boundary_placement_error(element))
         } else if element.name().eq_ignore_ascii_case("webui-hydrate") {
             Err(self.authored_webui_hydrate_error(element))
         } else {
@@ -3093,12 +3635,13 @@ impl HtmlParser {
         }
 
         self.ensure_route_component_parsed(&component)?;
+        let content_fragment_id = self.parse_route_boundary_content(element, depth)?;
         let children =
             self.parse_child_routes(element.source(), element.inner(), &all_params, depth + 1)?;
 
-        Ok(route_parser::build_route_fragment(
-            &attrs, component, children,
-        ))
+        let mut route = route_parser::build_route_fragment(&attrs, component, children);
+        route.content_fragment_id = content_fragment_id;
+        Ok(route)
     }
 
     /// Ensure a route-referenced component is parsed and registered.
@@ -3580,6 +4123,14 @@ mod tests {
         signal_raw(&format!("{STRUCTURAL_SIGNAL_PREFIX}{value}"))
     }
 
+    fn boundary_matcher(name: &str, declaration: u32) -> FragmentMatcher {
+        webui_test_utils::boundary(name, declaration)
+    }
+
+    fn boundary_end_matcher(declaration: u32) -> FragmentMatcher {
+        webui_test_utils::boundary_end(declaration)
+    }
+
     #[test]
     fn test_plugin_display_names() {
         assert_eq!(Plugin::Fast.to_string(), "fast");
@@ -6307,58 +6858,46 @@ mod tests {
     // Hydration) ───────────────────────────────────────────────────────────
 
     #[test]
-    fn boundary_emits_no_wrapper_and_brackets_children_with_signals() {
+    fn entry_boundary_is_an_inline_start_end_tape() {
         let html = r#"<body><div><boundary name="counter-ready"><my-counter></my-counter></boundary></div></body>"#;
-        let (fragments, _) = parse_and_get_fragments(html);
+        let (fragments, records) = parse_and_get_fragments(html);
 
-        // No `<boundary>`/`</boundary>` markup is emitted at
-        // all — only the raw boundary_start/boundary_end signals bracket
-        // the untouched children.
-        assert_fragments!(
-            fragments,
+        let boundary = match fragments[3].fragment.as_ref() {
+            Some(Fragment::Boundary(boundary)) => boundary,
+            other => panic!("expected typed boundary start, got {other:?}"),
+        };
+        assert_eq!(boundary.phase(), BoundaryPhase::Start);
+        assert_eq!(boundary.declaration_id, 0);
+        assert_eq!(boundary.owner_fragment_id, "index.html");
+        assert_eq!(boundary.name, "counter-ready");
+        assert_eq!(boundary.key, None);
+        assert!(!boundary.may_repeat);
+        // The body stays inline in the owner record, closed by an end marker,
+        // so ordinary rendering never looks up a second record.
+        assert_stream!(
+            records,
+            "index.html",
             [
                 raw("<body>"),
                 structural_matcher("body_start"),
                 raw("<div>"),
-                structural_matcher("boundary_start:0"),
+                boundary_matcher("counter-ready", 0),
                 raw("<my-counter></my-counter>"),
-                structural_matcher("boundary_end:0"),
+                boundary_end_matcher(0),
                 raw("</div>"),
                 structural_matcher("body_end"),
                 raw("</body>"),
             ]
         );
+        assert!(records["index.html"].contains_boundary);
+        assert!(
+            !records.contains_key("boundary-1"),
+            "an inline tape must not create a body record"
+        );
     }
 
     #[test]
-    fn boundary_sequence_increments_in_document_order_and_resets_per_entry() {
-        let html = concat!(
-            "<body>",
-            r#"<boundary name="a"><p>1</p></boundary>"#,
-            r#"<boundary name="b"><p>2</p></boundary>"#,
-            "</body>",
-        );
-        let (fragments, _) = parse_and_get_fragments(html);
-
-        assert_fragments!(
-            fragments,
-            [
-                raw("<body>"),
-                structural_matcher("body_start"),
-                structural_matcher("boundary_start:0"),
-                raw("<p>1</p>"),
-                structural_matcher("boundary_end:0"),
-                structural_matcher("boundary_start:1"),
-                raw("<p>2</p>"),
-                structural_matcher("boundary_end:1"),
-                structural_matcher("body_end"),
-                raw("</body>"),
-            ]
-        );
-
-        // A separate top-level entry parsed on the same `HtmlParser` starts
-        // its own boundary sequence back at 0 and does not reject "a" as a
-        // duplicate name — sequence/name state is per top-level entry.
+    fn boundary_names_are_scoped_per_owner_and_declaration_ids_are_protocol_wide() {
         let mut parser = HtmlParser::new();
         parser
             .parse(
@@ -6371,33 +6910,44 @@ mod tests {
                 "second.html",
                 r#"<body><boundary name="a"><p>2</p></boundary></body>"#,
             )
-            .expect("second entry reuses the name and sequence 0");
+            .expect("a second owner may reuse the name");
         let records = parser.into_fragment_records();
-        assert_stream!(
-            records,
-            "second.html",
-            [
-                raw("<body>"),
-                structural_matcher("body_start"),
-                structural_matcher("boundary_start:0"),
-                raw("<p>2</p>"),
-                structural_matcher("boundary_end:0"),
-                structural_matcher("body_end"),
-                raw("</body>"),
-            ]
-        );
+        let first = records["first.html"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("first boundary");
+        let second = records["second.html"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("second boundary");
+        assert_eq!((first.declaration_id, first.name.as_str()), (0, "a"));
+        assert_eq!((second.declaration_id, second.name.as_str()), (1, "a"));
     }
 
     #[test]
     fn boundary_missing_name_errors() {
-        let mut parser = HtmlParser::new();
-        let err = parser
-            .parse("index.html", "<body><boundary><p>x</p></boundary></body>")
-            .expect_err("a boundary without a name must error");
-        let ParserError::Template(diag) = err else {
-            panic!("expected ParserError::Template, got {err:?}");
-        };
-        assert_eq!(diag.error_code(), Some(codes::MISSING_BOUNDARY_NAME));
+        for html in [
+            "<body><boundary><p>x</p></boundary></body>",
+            r#"<body><boundary name=""><p>x</p></boundary></body>"#,
+            r#"<body><boundary name="   "><p>x</p></boundary></body>"#,
+        ] {
+            let mut parser = HtmlParser::new();
+            let err = parser
+                .parse("index.html", html)
+                .expect_err("a boundary without a non-empty name must error");
+            let ParserError::Template(diag) = err else {
+                panic!("expected ParserError::Template, got {err:?}");
+            };
+            assert_eq!(diag.error_code(), Some(codes::MISSING_BOUNDARY_NAME));
+        }
     }
 
     #[test]
@@ -6415,11 +6965,8 @@ mod tests {
         assert_eq!(diag.error_code(), Some(codes::INVALID_BOUNDARY_NAME));
     }
 
-    /// Boundary names stay free-form and are exposed separately for the
-    /// protocol's cold name-to-handle table. Render fragments still carry only
-    /// integer IDs, so response bytes never repeat author names.
     #[test]
-    fn boundary_names_are_free_form_ordered_and_absent_from_fragments() {
+    fn boundary_names_are_free_form_and_live_on_typed_fragments() {
         let mut parser = HtmlParser::new();
         let html = concat!(
             "<body>",
@@ -6431,47 +6978,32 @@ mod tests {
         parser
             .parse("index.html", html)
             .expect("free-form boundary names must be accepted");
-        assert_eq!(parser.boundary_count(), 3);
-        assert_eq!(
-            parser.boundary_names(),
-            ["above the fold", "feed/items #2", "ダッシュボード"]
-        );
-
         let records = parser.into_fragment_records();
-        let fragments = &records
-            .get("index.html")
-            .expect("index.html fragment record")
-            .fragments;
-
-        let mut starts = Vec::new();
-        for fragment in fragments {
-            let Some(Fragment::Signal(signal)) = fragment.fragment.as_ref() else {
-                continue;
-            };
-            let value = signal.value.as_str();
-            assert!(
-                !value.contains("above the fold")
-                    && !value.contains("feed/items")
-                    && !value.contains("ダッシュボード"),
-                "boundary names must never reach a fragment: {value}"
-            );
-            if let Some(sequence) = value
-                .strip_prefix(STRUCTURAL_SIGNAL_PREFIX)
-                .and_then(|signal| signal.strip_prefix("boundary_start:"))
-            {
-                starts.push(sequence.to_string());
-            }
-        }
-        assert_eq!(
-            starts,
-            ["0", "1", "2"],
-            "only integer sequences are emitted"
-        );
+        let names: Vec<&str> = records["index.html"]
+            .fragments
+            .iter()
+            .filter_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) if boundary.phase() == BoundaryPhase::Start => {
+                    Some(boundary.name.as_str())
+                }
+                _ => None,
+            })
+            .collect();
+        assert_eq!(names, ["above the fold", "feed/items #2", "ダッシュボード"]);
     }
 
     #[test]
     fn module_entry_srcs_records_only_preloadable_critical_entries() {
         let mut parser = HtmlParser::new();
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "weather-island",
+                r#"<script type="module" src="/nested-weather.js"></script>"#,
+                None,
+                true,
+            ))
+            .expect("register");
         let html = concat!(
             "<head>",
             // Recorded: a static, module-typed, non-boundary entry.
@@ -6491,6 +7023,7 @@ mod tests {
             // Skipped: an island loader is deferred on purpose.
             r#"<boundary name="weather">"#,
             r#"<script type="module" async src="/weather-panel.js"></script>"#,
+            "<weather-island></weather-island>",
             "</boundary>",
             // Recorded once: a bottom-of-body entry is still critical, and a
             // repeat of an already-seen src must not duplicate a hint.
@@ -6562,40 +7095,119 @@ mod tests {
     }
 
     #[test]
-    fn boundary_inside_if_errors() {
+    fn boundary_transitively_nested_through_component_errors() {
         let mut parser = HtmlParser::new();
-        let html =
-            r#"<body><if condition="ready"><boundary name="x"><p>x</p></boundary></if></body>"#;
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "inner-panel",
+                r#"<boundary name="inner"><p>x</p></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
         let err = parser
-            .parse("index.html", html)
-            .expect_err("a boundary inside <if> must error");
+            .parse(
+                "index.html",
+                r#"<body><boundary name="outer"><inner-panel></inner-panel></boundary></body>"#,
+            )
+            .expect_err("transitively nested boundaries must error");
         let ParserError::Template(diag) = err else {
             panic!("expected ParserError::Template, got {err:?}");
         };
-        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_CROSSES_SCOPE));
-        assert!(diag.to_string().contains("<if>"), "{diag}");
+        assert_eq!(diag.error_code(), Some(codes::NESTED_BOUNDARY));
+        assert!(diag
+            .help_text()
+            .is_some_and(|help| help.contains("runtime branches")));
+    }
+
+    #[test]
+    fn boundary_inside_if_preserves_false_branch_structure() {
+        let mut parser = HtmlParser::new();
+        let html =
+            r#"<body><if condition="ready"><boundary name="x"><p>x</p></boundary></if></body>"#;
+        parser.parse("index.html", html).expect("parse");
+        let records = parser.into_fragment_records();
+        let if_fragment_id = records["index.html"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::IfCond(if_cond)) => Some(if_cond.fragment_id.as_str()),
+                _ => None,
+            })
+            .expect("if reference");
+        let boundary = records[if_fragment_id]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("boundary remains behind the runtime if");
+        assert_eq!(boundary.owner_fragment_id, "index.html");
+        assert!(!boundary.may_repeat);
+        assert!(records["index.html"].contains_boundary);
+        assert!(records[if_fragment_id].contains_boundary);
+        assert_stream!(
+            records,
+            if_fragment_id,
+            [
+                boundary_matcher("x", 0),
+                raw("<p>x</p>"),
+                boundary_end_matcher(0),
+            ]
+        );
     }
 
     #[test]
-    fn boundary_inside_for_errors() {
+    fn boundary_inside_for_requires_and_preserves_key() {
         let mut parser = HtmlParser::new();
-        let html = r#"<body><for each="item in items"><boundary name="x"><p>x</p></boundary></for></body>"#;
         let err = parser
-            .parse("index.html", html)
-            .expect_err("a boundary inside <for> must error");
+            .parse(
+                "missing.html",
+                r#"<body><for each="item in items"><boundary name="x"><p>x</p></boundary></for></body>"#,
+            )
+            .expect_err("a repeated boundary without a key must error");
         let ParserError::Template(diag) = err else {
             panic!("expected ParserError::Template, got {err:?}");
         };
-        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_CROSSES_SCOPE));
-        assert!(diag.to_string().contains("<for>"), "{diag}");
+        assert_eq!(diag.error_code(), Some(codes::MISSING_BOUNDARY_KEY));
+
+        let mut parser = HtmlParser::new();
+        parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><boundary name="x" key="{{item.id}}"><p>{{item.name}}</p></boundary></for></body>"#,
+            )
+            .expect("a keyed repeated boundary parses");
+        let records = parser.into_fragment_records();
+        let boundary = records["for-1"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("boundary in for body");
+        assert_eq!(boundary.key.as_deref(), Some("{{item.id}}"));
+        assert!(boundary.may_repeat);
+
+        let mut parser = HtmlParser::new();
+        let err = parser
+            .parse(
+                "invalid.html",
+                r#"<body><boundary name="x" key=""><p>x</p></boundary></body>"#,
+            )
+            .expect_err("an empty key must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::INVALID_BOUNDARY_KEY));
     }
 
     #[test]
-    fn boundary_inside_reusable_component_template_errors() {
-        // The boundary lives inside the component's own `.html` template, not
-        // the entry template — disallowed even though the entry's usage of
-        // `<my-widget>` looks unremarkable.
-        let mut parser = HtmlParser::with_options(DomStrategy::Light);
+    fn boundary_inside_reusable_component_is_component_local() {
+        let mut parser = HtmlParser::new();
         parser
             .component_registry
             .register_component(ComponentRegistration::new(
@@ -6606,13 +7218,95 @@ mod tests {
             ))
             .expect("register");
 
-        let err = parser
-            .parse("index.html", "<body><my-widget></my-widget></body>")
-            .expect_err("a boundary inside a component template must error");
-        let ParserError::Template(diag) = err else {
-            panic!("expected ParserError::Template, got {err:?}");
-        };
-        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_CROSSES_SCOPE));
+        parser
+            .parse(
+                "index.html",
+                r#"<body><my-widget></my-widget><boundary name="x"><p>entry</p></boundary></body>"#,
+            )
+            .expect("component-local boundary parses");
+        let records = parser.into_fragment_records();
+        let boundary = records["my-widget"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("component boundary");
+        assert_eq!(boundary.owner_fragment_id, "my-widget");
+        assert_eq!(boundary.name, "x");
+        assert!(records["my-widget"].contains_boundary);
+        assert!(records["index.html"].contains_boundary);
+        let owners: HashSet<&str> = records
+            .values()
+            .flat_map(|list| list.fragments.iter())
+            .filter_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) if boundary.name == "x" => {
+                    Some(boundary.owner_fragment_id.as_str())
+                }
+                _ => None,
+            })
+            .collect();
+        assert_eq!(owners, HashSet::from(["index.html", "my-widget"]));
+    }
+
+    #[test]
+    fn component_boundary_is_marked_repeatable_from_for_callsite() {
+        let mut parser = HtmlParser::new();
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "row-item",
+                r#"<boundary name="row-ready"><span>{{label}}</span></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
+        parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><row-item></row-item></for></body>"#,
+            )
+            .expect("component callsite parses");
+        let records = parser.into_fragment_records();
+        let boundary = records["row-item"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("component boundary");
+        assert!(boundary.may_repeat);
+    }
+
+    #[test]
+    fn component_boundary_once_per_independent_entry_is_not_repeatable() {
+        let mut parser = HtmlParser::new();
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "shared-panel",
+                r#"<boundary name="ready"><span>x</span></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
+        for entry in ["first.html", "second.html"] {
+            parser
+                .parse(entry, "<body><shared-panel></shared-panel></body>")
+                .expect("entry parses");
+        }
+        let records = parser.into_fragment_records();
+        let boundary = records["shared-panel"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("component boundary");
+        assert!(!boundary.may_repeat);
     }
 
     #[test]
@@ -6681,32 +7375,71 @@ mod tests {
     }
 
     #[test]
-    fn boundary_inside_route_element_errors() {
-        let mut parser = HtmlParser::new();
-        // Directly inside <route> children.
-        let err = parser
+    fn route_contained_boundary_has_runtime_content_fragment() {
+        let mut parser = HtmlParser::with_options(DomStrategy::Light);
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "home-page",
+                "<h1>Home</h1>",
+                None,
+                true,
+            ))
+            .expect("register");
+        parser
             .parse(
                 "index.html",
-                r#"<body><route path="/" component="home"><boundary name="x"><p>x</p></boundary></route></body>"#,
+                r#"<route path="/" component="home-page"><boundary name="route-ready"><aside>Ready</aside></boundary></route>"#,
             )
-            .expect_err("a boundary directly inside <route> must error");
-        let ParserError::Template(diag) = err else {
-            panic!("expected ParserError::Template, got {err:?}");
-        };
-        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_CROSSES_SCOPE));
+            .expect("route-contained boundary parses");
+        let records = parser.into_fragment_records();
+        assert!(records["index.html"].contains_boundary);
+        let route = records["index.html"]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Route(route)) => Some(route),
+                _ => None,
+            })
+            .expect("route");
+        assert!(!route.content_fragment_id.is_empty());
+        let boundary = records[&route.content_fragment_id]
+            .fragments
+            .iter()
+            .find_map(|fragment| match fragment.fragment.as_ref() {
+                Some(Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .expect("route boundary");
+        assert_eq!(boundary.owner_fragment_id, "index.html");
+        assert_eq!(boundary.name, "route-ready");
+        assert_stream!(
+            records,
+            route.content_fragment_id.as_str(),
+            [
+                boundary_matcher("route-ready", 0),
+                raw("<aside>Ready</aside>"),
+                boundary_end_matcher(0),
+            ]
+        );
+    }
 
-        // Nested deeper inside <route> ignored markup.
+    #[test]
+    fn route_boundary_nested_in_ignored_markup_errors() {
         let mut parser = HtmlParser::new();
         let err = parser
             .parse(
                 "index.html",
-                r#"<body><route path="/" component="home"><div><boundary name="x"><p>x</p></boundary></div></route></body>"#,
+                r#"<route path="/" component="home-page"><div><boundary name="late"><p>x</p></boundary></div></route>"#,
             )
-            .expect_err("a boundary nested inside <route> markup must error");
+            .expect_err("route boundaries must be direct children");
         let ParserError::Template(diag) = err else {
             panic!("expected ParserError::Template, got {err:?}");
         };
-        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_CROSSES_SCOPE));
+        assert_eq!(
+            diag.error_code(),
+            Some(codes::INVALID_ROUTE_BOUNDARY_PLACEMENT)
+        );
     }
 
     #[test]
diff --git a/crates/webui-parser/src/plugin/webui.rs b/crates/webui-parser/src/plugin/webui.rs
index 1be8e15cc..21d6e734c 100644
--- a/crates/webui-parser/src/plugin/webui.rs
+++ b/crates/webui-parser/src/plugin/webui.rs
@@ -72,6 +72,7 @@ use crate::html_parser::{
     style_element_bounds,
 };
 use crate::{ConditionParser, DomStrategy, ParserOptions, Result};
+use std::borrow::Cow;
 use std::cell::Cell;
 use std::fmt::Write;
 use std::ops::Range;
@@ -213,11 +214,12 @@ impl WebUIParserPlugin {
         template_html: &str,
         component: &Component,
     ) -> Result<()> {
+        let template_html = Self::strip_boundary_directive_tags(template_html);
         let client_module = ClientModule::from_component(component);
         let render_policy = parse_component_render_policy(tag_name, &component.html_content)?;
         if let Some(tracked) = self.components.iter_mut().find(|c| c.tag_name == tag_name) {
             tracked.template_html.clear();
-            tracked.template_html.push_str(template_html);
+            tracked.template_html.push_str(&template_html);
             tracked.root_event_source.clear();
             tracked.root_event_source.push_str(&component.html_content);
             tracked.client_module = client_module;
@@ -226,13 +228,39 @@ impl WebUIParserPlugin {
         }
         self.components.push(TrackedComponent {
             tag_name: tag_name.to_string(),
-            template_html: template_html.to_string(),
+            template_html: template_html.into_owned(),
             root_event_source: component.html_content.clone(),
             client_module,
             render_policy,
         });
         Ok(())
     }
+
+    fn strip_boundary_directive_tags(template: &str) -> Cow<'_, str> {
+        if !template.contains("<boundary") && !template.contains("</boundary") {
+            return Cow::Borrowed(template);
+        }
+
+        let mut output = String::with_capacity(template.len());
+        let mut index = 0usize;
+        while index < template.len() {
+            let remaining = &template[index..];
+            if remaining.starts_with('<') {
+                if let Some(tag) = parse_tag(remaining) {
+                    if tag.name == "boundary" {
+                        index += tag.close + 1;
+                        continue;
+                    }
+                }
+            }
+            let Some(ch) = remaining.chars().next() else {
+                break;
+            };
+            output.push(ch);
+            index += ch.len_utf8();
+        }
+        Cow::Owned(output)
+    }
 }
 
 impl Default for WebUIParserPlugin {
@@ -3332,6 +3360,23 @@ fn extract_adopted_stylesheet_specifier(html: &str) -> Option<String> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn component_metadata_erases_boundary_directive_tags() {
+        let source = concat!(
+            "<template shadowrootmode=\"open\">",
+            "<boundary name=\"ready\" key=\"item.id\"><span>{{label}}</span></boundary>",
+            "</template>",
+        );
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+        assert_eq!(
+            stripped,
+            "<template shadowrootmode=\"open\"><span>{{label}}</span></template>"
+        );
+        let metadata = generate_compiled_template("my-card", &stripped);
+        assert!(!metadata.contains("<boundary"));
+        assert!(!metadata.contains("</boundary>"));
+    }
+
     /// Test helper: compile a template and unwrap. The vast majority of tests
     /// exercise valid templates; tests that assert on authoring errors call
     /// [`super::generate_compiled_template`] directly and inspect the `Result`.
diff --git a/crates/webui-parser/src/route_parser.rs b/crates/webui-parser/src/route_parser.rs
index e9c10504e..77d370561 100644
--- a/crates/webui-parser/src/route_parser.rs
+++ b/crates/webui-parser/src/route_parser.rs
@@ -218,6 +218,7 @@ pub(crate) fn build_route_fragment(
         invalidates: attrs.invalidates.clone(),
         pending_component: attrs.pending_component.clone(),
         error_component: attrs.error_component.clone(),
+        content_fragment_id: String::new(),
     }
 }
 
diff --git a/crates/webui-protocol/benches/protocol_bench.rs b/crates/webui-protocol/benches/protocol_bench.rs
index 5d1c85e46..247c5600e 100644
--- a/crates/webui-protocol/benches/protocol_bench.rs
+++ b/crates/webui-protocol/benches/protocol_bench.rs
@@ -14,6 +14,7 @@ fn create_test_protocol() -> WebUIProtocol {
     fragments.insert(
         "index.html".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("Hello, WebUI!\n"),
                 WebUIFragment::for_loop("person", "people", "for-1"),
@@ -26,6 +27,7 @@ fn create_test_protocol() -> WebUIProtocol {
     fragments.insert(
         "for-1".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::signal("person.name", false)],
         },
     );
@@ -33,6 +35,7 @@ fn create_test_protocol() -> WebUIProtocol {
     fragments.insert(
         "if-1".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::component("contact-card")],
         },
     );
@@ -40,6 +43,7 @@ fn create_test_protocol() -> WebUIProtocol {
     fragments.insert(
         "contact-card".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("Hello, "),
                 WebUIFragment::signal("name", false),
@@ -56,6 +60,7 @@ fn create_simple_protocol() -> WebUIProtocol {
     fragments.insert(
         "index.html".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("Hello, WebUI!\n"),
                 WebUIFragment::for_loop("person", "people", "for-1"),
@@ -66,6 +71,7 @@ fn create_simple_protocol() -> WebUIProtocol {
     fragments.insert(
         "for-1".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::signal("person.name", false)],
         },
     );
@@ -105,12 +111,14 @@ fn complex_condition_benchmark(c: &mut Criterion) {
     fragments.insert(
         "main".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::if_cond(nested, "then")],
         },
     );
     fragments.insert(
         "then".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::raw("ok")],
         },
     );
@@ -129,6 +137,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "index.html".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("<!DOCTYPE html><html><head><meta charset=\"UTF-8\"><title>"),
                 WebUIFragment::signal("title", false),
@@ -143,6 +152,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "app".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("<div class=\"app\"><header><h1>"),
                 WebUIFragment::signal("title", false),
@@ -161,6 +171,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "item-frag".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("<li"),
                 WebUIFragment::attribute("data-id", "item.id"),
@@ -182,6 +193,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "item-class-tmpl".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("todo-item "),
                 WebUIFragment::signal("item.state", false),
@@ -193,6 +205,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "done-badge".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![WebUIFragment::raw("<span class=\"badge done\">✓</span>")],
         },
     );
@@ -201,6 +214,7 @@ fn create_medium_protocol() -> WebUIProtocol {
     fragments.insert(
         "footer-frag".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("<footer><p>"),
                 WebUIFragment::signal("footerText", false),
@@ -233,6 +247,7 @@ fn create_large_protocol(component_count: usize) -> WebUIProtocol {
     fragments.insert(
         "index.html".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: root_frags,
         },
     );
@@ -241,6 +256,7 @@ fn create_large_protocol(component_count: usize) -> WebUIProtocol {
     fragments.insert(
         "nav-link-frag".to_string(),
         FragmentList {
+            contains_boundary: false,
             fragments: vec![
                 WebUIFragment::raw("<a"),
                 WebUIFragment::attribute("href", "link.url"),
@@ -264,6 +280,7 @@ fn create_large_protocol(component_count: usize) -> WebUIProtocol {
         fragments.insert(
             panel_id,
             FragmentList {
+                contains_boundary: false,
                 fragments: vec![
                     WebUIFragment::raw(format!("<section class=\"panel\" data-idx=\"{idx}\">")),
                     WebUIFragment::raw("<h3>"),
@@ -279,6 +296,7 @@ fn create_large_protocol(component_count: usize) -> WebUIProtocol {
         fragments.insert(
             body_id,
             FragmentList {
+                contains_boundary: false,
                 fragments: vec![
                     WebUIFragment::raw("<div class=\"panel-body\"><p>"),
                     WebUIFragment::signal("description", false),
@@ -292,6 +310,7 @@ fn create_large_protocol(component_count: usize) -> WebUIProtocol {
         fragments.insert(
             cond_id,
             FragmentList {
+                contains_boundary: false,
                 fragments: vec![
                     WebUIFragment::raw("<details><summary>More</summary><p>"),
                     WebUIFragment::signal("details", false),
diff --git a/crates/webui-protocol/proto/webui.proto b/crates/webui-protocol/proto/webui.proto
index 49ec2ddbd..b4cab5751 100644
--- a/crates/webui-protocol/proto/webui.proto
+++ b/crates/webui-protocol/proto/webui.proto
@@ -125,10 +125,6 @@ message WebUIProtocol {
   // The compiler resolves and sorts these at build time so the handler writes
   // them verbatim with no per-request work.
   repeated string module_preloads = 7;
-  // Free-form <boundary name> values keyed by entry fragment and stored in
-  // declaration order. Hosts resolve a name once to its zero-based BoundaryId;
-  // names never reach the rendered HTML response.
-  map<string, StreamingBoundaryList> streaming_boundaries = 8;
   // Build-generated document-level rules for component rendering policies.
   // Empty when no component opts into lazy rendering.
   string component_render_css = 9;
@@ -139,14 +135,13 @@ message WebUIProtocol {
   repeated ComponentAssetStylePreload component_asset_style_preloads = 10;
 }
 
-// Ordered compile-time boundary names for one entry fragment.
-message StreamingBoundaryList {
-  repeated string names = 1;
-}
-
 // A list of fragments (needed because protobuf maps cannot have repeated values directly).
 message FragmentList {
   repeated WebUIFragment fragments = 1;
+  // True when this record directly or transitively reaches a boundary
+  // declaration. Computed once at build time so handlers never graph-walk a
+  // request merely to decide whether rendering can suspend.
+  bool contains_boundary = 2;
 }
 
 // A single fragment — one of several types.
@@ -161,9 +156,49 @@ message WebUIFragment {
     WebUIFragmentPlugin plugin = 7;
     WebUIFragmentRoute route = 8;
     WebUIFragmentOutlet outlet = 9;
+    WebUIFragmentBoundary boundary = 10;
   }
 }
 
+// Which end of an inline boundary tape a fragment marks.
+enum BoundaryPhase {
+  // Opens a boundary body. Carries the full declaration metadata.
+  BOUNDARY_PHASE_START = 0;
+  // Closes the body opened by the matching start in the same record. Only
+  // declaration_id is meaningful.
+  BOUNDARY_PHASE_END = 1;
+}
+
+// Compile-time streaming boundary declaration, written as an inline tape.
+//
+// A declaration emits a start marker and an end marker into its owner's
+// fragment record, with the body fragments in between. Ordinary rendering
+// therefore walks the body without any extra record lookup, and streaming
+// suspends and resumes inside the record it is already traversing.
+//
+// A declaration can produce multiple response-local occurrences through
+// components, conditions, loops, and routes. Runtime occurrence IDs are
+// therefore assigned later by the handler and are not stored here.
+message WebUIFragmentBoundary {
+  // Stable build-local declaration identity. Shared by the start/end pair.
+  uint32 declaration_id = 1;
+  // Entry or reusable component template that authored this declaration.
+  string owner_fragment_id = 2;
+  // Free-form authored name, unique only within owner_fragment_id.
+  string name = 3;
+  // Optional authored key expression preserved verbatim for handler evaluation.
+  optional string key = 4;
+  // Field 5 previously held the separately parsed boundary body record. Bodies
+  // are now inline between the start and end markers.
+  reserved 5;
+  reserved "fragment_id";
+  // Conservative graph result: this declaration may produce multiple runtime
+  // occurrences through a loop or repeated component callsite.
+  bool may_repeat = 6;
+  // Whether this fragment opens or closes the declaration's body.
+  BoundaryPhase phase = 7;
+}
+
 // Declarative route definition linking a URL path template to a component.
 // Nested routes are expressed via repeated children.
 message WebUIFragmentRoute {
@@ -191,6 +226,10 @@ message WebUIFragmentRoute {
   // Component tag name for the error boundary UI (e.g. "error-page").
   // Validated at build time — build fails if the component does not exist.
   string error_component = 10;
+  // Optional runtime content authored directly inside this route. The record
+  // contains typed boundary references and is rendered only for this route
+  // path; nested route declarations remain in children.
+  string content_fragment_id = 11;
 }
 
 // Outlet placeholder — marks where matched child route content renders.
diff --git a/crates/webui-protocol/src/gen_webui.rs b/crates/webui-protocol/src/gen_webui.rs
index 1e84389b9..ab8aea6ab 100644
--- a/crates/webui-protocol/src/gen_webui.rs
+++ b/crates/webui-protocol/src/gen_webui.rs
@@ -121,14 +121,6 @@ pub struct WebUiProtocol {
     /// them verbatim with no per-request work.
     #[prost(string, repeated, tag = "7")]
     pub module_preloads: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
-    /// Free-form <boundary name> values keyed by entry fragment and stored in
-    /// declaration order. Hosts resolve a name once to its zero-based BoundaryId;
-    /// names never reach the rendered HTML response.
-    #[prost(map = "string, message", tag = "8")]
-    pub streaming_boundaries: ::std::collections::HashMap<
-        ::prost::alloc::string::String,
-        StreamingBoundaryList,
-    >,
     /// Build-generated document-level rules for component rendering policies.
     /// Empty when no component opts into lazy rendering.
     #[prost(string, tag = "9")]
@@ -142,25 +134,23 @@ pub struct WebUiProtocol {
         ComponentAssetStylePreload,
     >,
 }
-/// Ordered compile-time boundary names for one entry fragment.
-#[derive(serde::Serialize, serde::Deserialize)]
-#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
-pub struct StreamingBoundaryList {
-    #[prost(string, repeated, tag = "1")]
-    pub names: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
-}
 /// A list of fragments (needed because protobuf maps cannot have repeated values directly).
 #[derive(serde::Serialize, serde::Deserialize)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct FragmentList {
     #[prost(message, repeated, tag = "1")]
     pub fragments: ::prost::alloc::vec::Vec<WebUiFragment>,
+    /// True when this record directly or transitively reaches a boundary
+    /// declaration. Computed once at build time so handlers never graph-walk a
+    /// request merely to decide whether rendering can suspend.
+    #[prost(bool, tag = "2")]
+    pub contains_boundary: bool,
 }
 /// A single fragment — one of several types.
 #[derive(serde::Serialize, serde::Deserialize)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct WebUiFragment {
-    #[prost(oneof = "web_ui_fragment::Fragment", tags = "1, 2, 3, 4, 5, 6, 7, 8, 9")]
+    #[prost(oneof = "web_ui_fragment::Fragment", tags = "1, 2, 3, 4, 5, 6, 7, 8, 9, 10")]
     pub fragment: ::core::option::Option<web_ui_fragment::Fragment>,
 }
 /// Nested message and enum types in `WebUIFragment`.
@@ -186,8 +176,43 @@ pub mod web_ui_fragment {
         Route(super::WebUiFragmentRoute),
         #[prost(message, tag = "9")]
         Outlet(super::WebUiFragmentOutlet),
+        #[prost(message, tag = "10")]
+        Boundary(super::WebUiFragmentBoundary),
     }
 }
+/// Compile-time streaming boundary declaration, written as an inline tape.
+///
+/// A declaration emits a start marker and an end marker into its owner's
+/// fragment record, with the body fragments in between. Ordinary rendering
+/// therefore walks the body without any extra record lookup, and streaming
+/// suspends and resumes inside the record it is already traversing.
+///
+/// A declaration can produce multiple response-local occurrences through
+/// components, conditions, loops, and routes. Runtime occurrence IDs are
+/// therefore assigned later by the handler and are not stored here.
+#[derive(serde::Serialize, serde::Deserialize)]
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct WebUiFragmentBoundary {
+    /// Stable build-local declaration identity. Shared by the start/end pair.
+    #[prost(uint32, tag = "1")]
+    pub declaration_id: u32,
+    /// Entry or reusable component template that authored this declaration.
+    #[prost(string, tag = "2")]
+    pub owner_fragment_id: ::prost::alloc::string::String,
+    /// Free-form authored name, unique only within owner_fragment_id.
+    #[prost(string, tag = "3")]
+    pub name: ::prost::alloc::string::String,
+    /// Optional authored key expression preserved verbatim for handler evaluation.
+    #[prost(string, optional, tag = "4")]
+    pub key: ::core::option::Option<::prost::alloc::string::String>,
+    /// Conservative graph result: this declaration may produce multiple runtime
+    /// occurrences through a loop or repeated component callsite.
+    #[prost(bool, tag = "6")]
+    pub may_repeat: bool,
+    /// Whether this fragment opens or closes the declaration's body.
+    #[prost(enumeration = "BoundaryPhase", tag = "7")]
+    pub phase: i32,
+}
 /// Declarative route definition linking a URL path template to a component.
 /// Nested routes are expressed via repeated children.
 #[derive(serde::Serialize, serde::Deserialize)]
@@ -227,6 +252,11 @@ pub struct WebUiFragmentRoute {
     /// Validated at build time — build fails if the component does not exist.
     #[prost(string, tag = "10")]
     pub error_component: ::prost::alloc::string::String,
+    /// Optional runtime content authored directly inside this route. The record
+    /// contains typed boundary references and is rendered only for this route
+    /// path; nested route declarations remain in children.
+    #[prost(string, tag = "11")]
+    pub content_fragment_id: ::prost::alloc::string::String,
 }
 /// Outlet placeholder — marks where matched child route content renders.
 /// Components use this to indicate where nested route children are rendered.
@@ -494,6 +524,37 @@ impl DomStrategy {
         }
     }
 }
+/// Which end of an inline boundary tape a fragment marks.
+#[derive(serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum BoundaryPhase {
+    /// Opens a boundary body. Carries the full declaration metadata.
+    Start = 0,
+    /// Closes the body opened by the matching start in the same record. Only
+    /// declaration_id is meaningful.
+    End = 1,
+}
+impl BoundaryPhase {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            Self::Start => "BOUNDARY_PHASE_START",
+            Self::End => "BOUNDARY_PHASE_END",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "BOUNDARY_PHASE_START" => Some(Self::Start),
+            "BOUNDARY_PHASE_END" => Some(Self::End),
+            _ => None,
+        }
+    }
+}
 #[derive(serde::Serialize, serde::Deserialize)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
 #[repr(i32)]
diff --git a/crates/webui-protocol/src/lib.rs b/crates/webui-protocol/src/lib.rs
index dc46f173b..d498eebe7 100644
--- a/crates/webui-protocol/src/lib.rs
+++ b/crates/webui-protocol/src/lib.rs
@@ -9,7 +9,7 @@
 //! no conversion layer between domain types and protobuf types.
 
 use prost::Message;
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::fmt;
 use std::io;
 use thiserror::Error;
@@ -47,8 +47,8 @@ pub type WebUIFragmentAttribute = WebUiFragmentAttribute;
 pub type WebUIFragmentPlugin = WebUiFragmentPlugin;
 pub type WebUIFragmentRoute = WebUiFragmentRoute;
 pub type WebUIFragmentOutlet = WebUiFragmentOutlet;
+pub type WebUIFragmentBoundary = WebUiFragmentBoundary;
 pub type ComponentData = proto::ComponentData;
-pub type StreamingBoundaryList = proto::StreamingBoundaryList;
 
 /// A mapping of unique fragment identifiers to their corresponding fragment lists.
 pub type WebUIFragmentRecords = HashMap<String, FragmentList>;
@@ -181,6 +181,40 @@ impl WebUiFragment {
         }
     }
 
+    /// Create the start marker of an inline streaming boundary tape.
+    ///
+    /// The body fragments follow this marker in the same record and are closed
+    /// by [`Self::boundary_end`] carrying the same `declaration_id`.
+    pub fn boundary(
+        declaration_id: u32,
+        owner_fragment_id: impl Into<String>,
+        name: impl Into<String>,
+        key: Option<String>,
+    ) -> Self {
+        Self {
+            fragment: Some(web_ui_fragment::Fragment::Boundary(WebUiFragmentBoundary {
+                declaration_id,
+                owner_fragment_id: owner_fragment_id.into(),
+                name: name.into(),
+                key,
+                may_repeat: false,
+                phase: BoundaryPhase::Start as i32,
+            })),
+        }
+    }
+
+    /// Create the end marker that closes an inline streaming boundary tape.
+    #[must_use]
+    pub fn boundary_end(declaration_id: u32) -> Self {
+        Self {
+            fragment: Some(web_ui_fragment::Fragment::Boundary(WebUiFragmentBoundary {
+                declaration_id,
+                phase: BoundaryPhase::End as i32,
+                ..Default::default()
+            })),
+        }
+    }
+
     /// Create a simple dynamic attribute fragment (value is a single signal name).
     pub fn attribute(name: impl Into<String>, value: impl Into<String>) -> Self {
         Self {
@@ -332,7 +366,6 @@ impl WebUiProtocol {
             dom_strategy: 0,
             initial_state_strategy: InitialStateStrategy::Full as i32,
             module_preloads: Vec::new(),
-            streaming_boundaries: HashMap::new(),
             component_render_css: String::new(),
             component_asset_style_preloads: Vec::new(),
         }
@@ -348,7 +381,6 @@ impl WebUiProtocol {
             dom_strategy: 0,
             initial_state_strategy: InitialStateStrategy::Full as i32,
             module_preloads: Vec::new(),
-            streaming_boundaries: HashMap::new(),
             component_render_css: String::new(),
             component_asset_style_preloads: Vec::new(),
         }
@@ -399,16 +431,14 @@ impl WebUiProtocol {
                             attr.template
                         )))
                     }
+                    Some(web_ui_fragment::Fragment::Boundary(boundary))
+                        if boundary.phase() == BoundaryPhase::Start
+                            && !fragments.contains_key(&boundary.owner_fragment_id) =>
+                    {
+                        Some(Self::missing_boundary_owner_error(boundary))
+                    }
                     Some(web_ui_fragment::Fragment::Route(route)) => {
-                        if !route.fragment_id.is_empty()
-                            && !fragments.contains_key(&route.fragment_id)
-                        {
-                            return Some(ProtocolError::Validation(format!(
-                                "Route references non-existent fragment ID: {}",
-                                route.fragment_id
-                            )));
-                        }
-                        None
+                        Self::validate_route_references(route, fragments)
                     }
                     _ => None,
                 })
@@ -418,9 +448,141 @@ impl WebUiProtocol {
             return Err(err);
         }
 
+        let mut declaration_ids = HashSet::new();
+        let mut owner_names = HashSet::new();
+        for fragment_list in fragments.values() {
+            let mut open: Option<u32> = None;
+            for fragment in &fragment_list.fragments {
+                let Some(web_ui_fragment::Fragment::Boundary(boundary)) =
+                    fragment.fragment.as_ref()
+                else {
+                    continue;
+                };
+                if boundary.phase() == BoundaryPhase::End {
+                    match open.take() {
+                        Some(declaration_id) if declaration_id == boundary.declaration_id => {}
+                        _ => return Err(Self::unbalanced_boundary_tape_error(boundary)),
+                    }
+                    continue;
+                }
+                if open.is_some() {
+                    return Err(Self::unbalanced_boundary_tape_error(boundary));
+                }
+                open = Some(boundary.declaration_id);
+                if boundary.name.trim().is_empty() {
+                    return Err(Self::empty_boundary_name_error(boundary));
+                }
+                if boundary
+                    .key
+                    .as_ref()
+                    .is_some_and(|key| key.trim().is_empty())
+                {
+                    return Err(Self::empty_boundary_key_error(boundary));
+                }
+                if !declaration_ids.insert(boundary.declaration_id) {
+                    return Err(Self::duplicate_boundary_id_error(boundary));
+                }
+                if !owner_names.insert((&boundary.owner_fragment_id, &boundary.name)) {
+                    return Err(Self::duplicate_boundary_name_error(boundary));
+                }
+            }
+            if let Some(declaration_id) = open {
+                return Err(Self::unterminated_boundary_tape_error(declaration_id));
+            }
+        }
+
         Ok(protocol)
     }
 
+    fn validate_route_references(
+        root: &WebUiFragmentRoute,
+        fragments: &WebUIFragmentRecords,
+    ) -> Option<ProtocolError> {
+        let mut pending = vec![root];
+        while let Some(route) = pending.pop() {
+            for (kind, fragment_id) in [
+                ("component", route.fragment_id.as_str()),
+                ("content", route.content_fragment_id.as_str()),
+            ] {
+                if !fragment_id.is_empty() && !fragments.contains_key(fragment_id) {
+                    return Some(Self::missing_route_reference_error(kind, fragment_id));
+                }
+            }
+            pending.extend(route.children.iter());
+        }
+        None
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn unbalanced_boundary_tape_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Boundary declaration {} has an unbalanced inline tape marker",
+            boundary.declaration_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn unterminated_boundary_tape_error(declaration_id: u32) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Boundary declaration {declaration_id} is missing its end marker"
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn missing_boundary_owner_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Boundary declaration {} references non-existent owner fragment ID: {}",
+            boundary.declaration_id, boundary.owner_fragment_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn empty_boundary_name_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Boundary declaration {} has an empty authored name",
+            boundary.declaration_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn empty_boundary_key_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Boundary declaration {} has an empty key expression",
+            boundary.declaration_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn duplicate_boundary_id_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Duplicate boundary declaration ID: {}",
+            boundary.declaration_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn duplicate_boundary_name_error(boundary: &WebUiFragmentBoundary) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Duplicate boundary name '{}' in owner fragment '{}'",
+            boundary.name, boundary.owner_fragment_id
+        ))
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn missing_route_reference_error(kind: &str, fragment_id: &str) -> ProtocolError {
+        ProtocolError::Validation(format!(
+            "Route {kind} references non-existent fragment ID: {fragment_id}"
+        ))
+    }
+
     /// Serialize protocol to pretty JSON (for debug/inspect output only).
     pub fn to_json_pretty(&self) -> std::result::Result<String, serde_json::Error> {
         serde_json::to_string_pretty(self)
@@ -471,18 +633,21 @@ mod tests {
                     WebUIFragment::signal("description", true),
                     WebUIFragment::if_cond(ConditionExpr::identifier("contact"), "if-1"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "for-1".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("person.name", false)],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "if-1".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("contact-card")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
@@ -492,6 +657,7 @@ mod tests {
                     WebUIFragment::raw("Hello, "),
                     WebUIFragment::signal("name", false),
                 ],
+                contains_boundary: false,
             },
         );
         WebUIProtocol::new(fragments)
@@ -560,29 +726,90 @@ mod tests {
     }
 
     #[test]
-    fn test_protobuf_streaming_boundary_names_roundtrip_in_declaration_order() {
+    fn test_protobuf_boundary_fragment_roundtrip() {
         let mut protocol = sample_protocol();
-        protocol.streaming_boundaries.insert(
-            "main".to_string(),
-            StreamingBoundaryList {
-                names: vec![
-                    "weather shell".to_string(),
-                    "composer/ready".to_string(),
-                    "feed:batch".to_string(),
-                ],
-            },
-        );
+        let main = protocol
+            .fragments
+            .get_mut("index.html")
+            .expect("sample entry exists");
+        main.fragments.push(WebUIFragment::boundary(
+            7,
+            "index.html",
+            "weather shell",
+            Some("forecast.id".to_string()),
+        ));
+        main.fragments
+            .push(WebUIFragment::raw("<weather-panel></weather-panel>"));
+        main.fragments.push(WebUIFragment::boundary_end(7));
+        main.contains_boundary = true;
 
         let bytes = protocol.to_protobuf().expect("encode failed");
         let decoded = WebUIProtocol::from_protobuf(&bytes).expect("decode failed");
 
-        assert_eq!(
-            decoded.streaming_boundaries["main"].names,
-            protocol.streaming_boundaries["main"].names
-        );
+        let markers: Vec<&WebUiFragmentBoundary> = decoded.fragments["index.html"]
+            .fragments
+            .iter()
+            .filter_map(|fragment| match fragment.fragment.as_ref() {
+                Some(web_ui_fragment::Fragment::Boundary(boundary)) => Some(boundary),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(markers.len(), 2, "the tape survives roundtrip as a pair");
+        let boundary = markers[0];
+        assert_eq!(boundary.phase(), BoundaryPhase::Start);
+        assert_eq!(boundary.declaration_id, 7);
+        assert_eq!(boundary.owner_fragment_id, "index.html");
+        assert_eq!(boundary.name, "weather shell");
+        assert_eq!(boundary.key.as_deref(), Some("forecast.id"));
+        assert_eq!(markers[1].phase(), BoundaryPhase::End);
+        assert_eq!(markers[1].declaration_id, 7);
+        assert!(decoded.fragments["index.html"].contains_boundary);
         assert_eq!(protocol, decoded);
     }
 
+    #[test]
+    fn test_protocol_rejects_unbalanced_boundary_tape() {
+        let tape_cases: [(&str, Vec<WebUIFragment>); 3] = [
+            (
+                "start without end",
+                vec![WebUIFragment::boundary(0, "index.html", "ready", None)],
+            ),
+            ("end without start", vec![WebUIFragment::boundary_end(0)]),
+            (
+                "nested start",
+                vec![
+                    WebUIFragment::boundary(0, "index.html", "outer", None),
+                    WebUIFragment::boundary(1, "index.html", "inner", None),
+                    WebUIFragment::boundary_end(1),
+                    WebUIFragment::boundary_end(0),
+                ],
+            ),
+        ];
+        for (label, fragments) in tape_cases {
+            let protocol = WebUIProtocol::new(HashMap::from([(
+                "index.html".to_string(),
+                FragmentList {
+                    fragments,
+                    contains_boundary: true,
+                },
+            )]));
+            let bytes = protocol.to_protobuf().expect("encode failed");
+            let error =
+                WebUIProtocol::from_protobuf(&bytes).expect_err("unbalanced tape must be rejected");
+            assert!(
+                error.to_string().contains("Boundary"),
+                "{label}: unexpected error {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn test_protocol_has_no_fixed_streaming_boundary_table() {
+        let json = sample_protocol().to_json_pretty().expect("serialize JSON");
+        assert!(!json.contains("streaming_boundaries"));
+        assert!(!json.contains("StreamingBoundaryList"));
+    }
+
     #[test]
     fn test_protobuf_all_fragment_types() {
         let mut fragments = HashMap::new();
@@ -598,25 +825,38 @@ mod tests {
                         ConditionExpr::predicate("a", ComparisonOperator::GreaterThan, "1"),
                         "cond",
                     ),
+                    WebUIFragment::boundary(0, "main", "ready", None),
+                    WebUIFragment::boundary_end(0),
                 ],
+                contains_boundary: true,
             },
         );
         fragments.insert(
             "comp".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("c")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "loop".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("l")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "cond".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("i")],
+                contains_boundary: false,
+            },
+        );
+        fragments.insert(
+            "boundary".to_string(),
+            FragmentList {
+                fragments: vec![WebUIFragment::raw("b")],
+                contains_boundary: false,
             },
         );
 
@@ -645,12 +885,14 @@ mod tests {
                         ConditionExpr::predicate("a", *op, "b"),
                         "then",
                     )],
+                    contains_boundary: false,
                 },
             );
             fragments.insert(
                 "then".to_string(),
                 FragmentList {
                     fragments: vec![WebUIFragment::raw("ok")],
+                    contains_boundary: false,
                 },
             );
             let p = WebUIProtocol::new(fragments);
@@ -677,12 +919,14 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::if_cond(nested, "then")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "then".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("ok")],
+                contains_boundary: false,
             },
         );
         let p = WebUIProtocol::new(fragments);
@@ -704,12 +948,14 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::if_cond(compound, "body")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "body".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("yes")],
+                contains_boundary: false,
             },
         );
         let p = WebUIProtocol::new(fragments);
@@ -752,6 +998,7 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("does-not-exist")],
+                contains_boundary: false,
             },
         );
 
@@ -769,6 +1016,7 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::for_loop("item", "items", "missing-for")],
+                contains_boundary: false,
             },
         );
 
@@ -792,6 +1040,7 @@ mod tests {
                     ConditionExpr::identifier("flag"),
                     "missing-if",
                 )],
+                contains_boundary: false,
             },
         );
 
@@ -812,6 +1061,7 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("name", false)],
+                contains_boundary: false,
             },
         );
         let p = WebUIProtocol::new(fragments);
@@ -886,12 +1136,14 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route("/profile/:id", "profile-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "profile-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<h1>Profile</h1>")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -924,18 +1176,21 @@ mod tests {
                 invalidates: vec!["posts".to_string(), "counts".to_string()],
                 pending_component: "loading-skeleton".to_string(),
                 error_component: "error-page".to_string(),
+                content_fragment_id: String::new(),
             })),
         };
         fragments.insert(
             "main".to_string(),
             FragmentList {
                 fragments: vec![route_frag],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "user-posts".into(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("posts")],
+                contains_boundary: false,
             },
         );
 
@@ -952,6 +1207,7 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::route("/test", "missing-fragment")],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -977,6 +1233,7 @@ mod tests {
             "main".to_string(),
             FragmentList {
                 fragments: vec![route_frag],
+                contains_boundary: false,
             },
         );
         let protocol = WebUIProtocol::new(fragments);
@@ -1001,6 +1258,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("Hello")],
+                contains_boundary: false,
             },
         );
         let tokens = vec!["border-radius-m".to_string(), "color-primary".to_string()];
diff --git a/crates/webui-python/README.md b/crates/webui-python/README.md
index ee1d57c1a..1445480f6 100644
--- a/crates/webui-python/README.md
+++ b/crates/webui-python/README.md
@@ -25,9 +25,32 @@ serialization. Use `render_text()` only when an application specifically needs
 a Python string.
 
 `render_component_templates()` accepts either one component tag as a string or
-an iterable of tags. Streaming calls require state explicitly, including
-`finish(final_state)`, so the document tail cannot accidentally render against
-an empty state.
+an iterable of tags.
+
+Host-driven streaming discovers runtime occurrences instead of resolving
+compile-time names:
+
+```python
+from microsoft_webui import BoundaryMode
+
+session = renderer.stream_response()
+step = session.start({"title": "Home", "items": [{"id": 7}]})
+while not step.done:
+    boundary = step.boundary
+    assert boundary is not None
+    send(step.bytes)
+    step = session.resume(
+        boundary.instance_id,
+        {"title": "Home"},
+        mode=BoundaryMode.FINAL,
+    )
+send(step.bytes)
+```
+
+`start()` and `resume()` return immutable `StreamStep` values containing the
+bytes produced by that call, a `done` flag, and the optional next
+`BoundaryDescriptor`. Repeated boundary keys remain Python strings, integers,
+or floats. `update(instance_id, patch)` returns the update record as `bytes`.
 
 The first release targets regular CPython 3.11+ builds on Windows, macOS, and
 manylinux, on x64 and ARM64. PyPy, free-threaded CPython, and Alpine/musllinux
diff --git a/crates/webui-python/benchmarks/benchmark_renderer.py b/crates/webui-python/benchmarks/benchmark_renderer.py
index f2a7a90d4..acd6235fc 100644
--- a/crates/webui-python/benchmarks/benchmark_renderer.py
+++ b/crates/webui-python/benchmarks/benchmark_renderer.py
@@ -19,8 +19,15 @@
 FIXTURES = Path(__file__).parents[1] / "tests" / "fixtures"
 PROTOCOL_PATH = FIXTURES / "protocol.bin"
 PROTOCOL_BYTES = PROTOCOL_PATH.read_bytes()
+STREAMING_PROTOCOL_BYTES = (FIXTURES / "streaming_protocol.bin").read_bytes()
 STATE = {"title": "Benchmark", "name": "Ada", "status": "ready"}
+STREAMING_STATE = {
+    **STATE,
+    "show": True,
+    "items": [{"id": 1, "label": "one"}, {"id": 2, "label": "two"}],
+}
 STATE_BYTES = json.dumps(STATE, separators=(",", ":")).encode()
+STREAMING_STATE_BYTES = json.dumps(STREAMING_STATE, separators=(",", ":")).encode()
 
 
 @pytest.fixture(scope="module")
@@ -28,6 +35,11 @@ def renderer() -> Renderer:
     return Renderer(PROTOCOL_BYTES, plugin=Plugin.WEBUI)
 
 
+@pytest.fixture(scope="module")
+def streaming_renderer() -> Renderer:
+    return Renderer(STREAMING_PROTOCOL_BYTES, plugin=Plugin.WEBUI)
+
+
 @pytest.fixture(scope="module")
 def ffi_renderer() -> Generator[CtypesRenderer, None, None]:
     path = os.environ.get("WEBUI_FFI_LIBRARY")
@@ -80,26 +92,29 @@ def test_render_component_templates(benchmark: Any, renderer: Renderer) -> None:
 
 def _stream_once(renderer: Renderer) -> bytes:
     session = renderer.stream_response()
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
-    return b"".join(
-        (
-            session.write_shell(STATE_BYTES),
-            session.write_boundary(
-                greeting,
-                STATE_BYTES,
-                mode=BoundaryMode.UPDATABLE,
-            ),
-            session.update(greeting, STATE_BYTES),
-            session.write_boundary(status, STATE_BYTES),
-            session.finish(STATE_BYTES),
+    chunks: list[bytes] = []
+    step = session.start(STREAMING_STATE_BYTES)
+    first = True
+    while not step.done:
+        chunks.append(step.bytes)
+        boundary = step.boundary
+        assert boundary is not None
+        mode = BoundaryMode.UPDATABLE if first else BoundaryMode.FINAL
+        step = session.resume(
+            boundary.instance_id,
+            STREAMING_STATE_BYTES,
+            mode=mode,
         )
-    )
+        if first:
+            chunks.append(session.update(boundary.instance_id, STREAMING_STATE_BYTES))
+            first = False
+    chunks.append(step.bytes)
+    return b"".join(chunks)
 
 
-def test_streaming_session(benchmark: Any, renderer: Renderer) -> None:
+def test_streaming_session(benchmark: Any, streaming_renderer: Renderer) -> None:
     benchmark.group = "streaming"
-    benchmark(_stream_once, renderer)
+    benchmark(_stream_once, streaming_renderer)
 
 
 @pytest.mark.parametrize("workers", [1, 2, 4])
diff --git a/crates/webui-python/python/microsoft_webui/__init__.py b/crates/webui-python/python/microsoft_webui/__init__.py
index 3ba37f970..70d42ac5f 100644
--- a/crates/webui-python/python/microsoft_webui/__init__.py
+++ b/crates/webui-python/python/microsoft_webui/__init__.py
@@ -3,7 +3,15 @@
 
 """High-performance Python renderer for compiled WebUI applications."""
 
-from ._api import BoundaryMode, Plugin, Renderer, StateInput, StreamingSession
+from ._api import (
+    BoundaryDescriptor,
+    BoundaryMode,
+    Plugin,
+    Renderer,
+    StateInput,
+    StreamingSession,
+    StreamStep,
+)
 from ._native import (
     ProtocolError,
     RenderError,
@@ -14,6 +22,7 @@
 )
 
 __all__ = [
+    "BoundaryDescriptor",
     "BoundaryMode",
     "Plugin",
     "ProtocolError",
@@ -21,6 +30,7 @@
     "Renderer",
     "StateError",
     "StateInput",
+    "StreamStep",
     "StreamingError",
     "StreamingSession",
     "WebUIError",
diff --git a/crates/webui-python/python/microsoft_webui/_api.py b/crates/webui-python/python/microsoft_webui/_api.py
index c5c8c049c..bd671325a 100644
--- a/crates/webui-python/python/microsoft_webui/_api.py
+++ b/crates/webui-python/python/microsoft_webui/_api.py
@@ -8,6 +8,7 @@
 import json
 import os
 from collections.abc import Iterable, Mapping
+from dataclasses import dataclass
 from enum import StrEnum
 from typing import Any, TypeAlias
 
@@ -33,6 +34,26 @@ class BoundaryMode(StrEnum):
     UPDATABLE = "updatable"
 
 
+@dataclass(frozen=True, slots=True)
+class BoundaryDescriptor:
+    """One runtime boundary occurrence discovered during streaming."""
+
+    instance_id: int
+    declaration_id: int
+    owner: str
+    name: str
+    key: str | int | float | None
+
+
+@dataclass(frozen=True, slots=True)
+class StreamStep:
+    """Immutable bytes and continuation state produced by one streaming call."""
+
+    bytes: bytes
+    done: bool
+    boundary: BoundaryDescriptor | None = None
+
+
 def _plugin_value(plugin: Plugin | str | None) -> str | None:
     if plugin is None:
         return None
@@ -182,50 +203,57 @@ def stream_response(
 
 
 class StreamingSession:
-    """A mutable, host-driven progressive HTML response."""
+    """A mutable, single-driver progressive HTML response.
+
+    Each call returns immutable output while the session retains its continuation.
+    """
 
     __slots__ = ("_inner",)
 
     def __init__(self, inner: _native._StreamingSession) -> None:
         self._inner = inner
 
-    def boundary(self, name: str) -> int:
-        """Resolve an authored boundary name once and reuse its integer ID."""
-        return self._inner.boundary(name)
-
-    @property
-    def boundary_count(self) -> int:
-        """Number of compile-time boundaries in the entry."""
-        return self._inner.boundary_count
+    def start(self, state: StateInput) -> StreamStep:
+        """Render until the first runtime boundary occurrence or completion."""
+        return _stream_step(self._inner.start(_state_json(state)))
 
-    @property
-    def finished(self) -> bool:
-        """Whether the terminal record has been emitted."""
-        return self._inner.finished
-
-    def write_shell(self, state: StateInput) -> bytes:
-        """Render everything before the first boundary."""
-        return self._inner.write_shell(_state_json(state))
-
-    def write_boundary(
+    def resume(
         self,
-        boundary: int,
+        instance_id: int,
         state: StateInput,
         *,
         mode: BoundaryMode | str = BoundaryMode.FINAL,
-    ) -> bytes:
-        """Render and commit the next boundary in declaration order."""
+    ) -> StreamStep:
+        """Commit the pending occurrence and advance to the next step."""
         parsed_mode = BoundaryMode(mode)
-        return self._inner.write_boundary(
-            _state_json(state),
-            boundary,
-            parsed_mode is BoundaryMode.UPDATABLE,
+        return _stream_step(
+            self._inner.resume(
+                _state_json(state),
+                instance_id,
+                parsed_mode is BoundaryMode.UPDATABLE,
+            )
         )
 
-    def update(self, boundary: int, state: StateInput) -> bytes:
-        """Push a projected state patch to an updatable boundary."""
-        return self._inner.update(_state_json(state), boundary)
-
-    def finish(self, state: StateInput) -> bytes:
-        """Render the document tail and terminal record from the final state."""
-        return self._inner.finish(_state_json(state))
+    def update(self, instance_id: int, patch: StateInput) -> bytes:
+        """Push a projected state patch to an updatable occurrence."""
+        return self._inner.update(_state_json(patch), instance_id)
+
+
+def _stream_step(value: _native._StreamStep) -> StreamStep:
+    boundary = value["boundary"]
+    descriptor = (
+        None
+        if boundary is None
+        else BoundaryDescriptor(
+            instance_id=boundary["instance_id"],
+            declaration_id=boundary["declaration_id"],
+            owner=boundary["owner"],
+            name=boundary["name"],
+            key=boundary["key"],
+        )
+    )
+    return StreamStep(
+        bytes=value["bytes"],
+        done=value["done"],
+        boundary=descriptor,
+    )
diff --git a/crates/webui-python/python/microsoft_webui/_native.pyi b/crates/webui-python/python/microsoft_webui/_native.pyi
index c4418b2c8..73229cdd4 100644
--- a/crates/webui-python/python/microsoft_webui/_native.pyi
+++ b/crates/webui-python/python/microsoft_webui/_native.pyi
@@ -2,7 +2,7 @@
 # Licensed under the MIT license.
 
 from os import PathLike
-from typing import Self, TypeAlias, final
+from typing import Self, TypeAlias, TypedDict, final
 
 _JsonInput: TypeAlias = str | bytes | bytearray
 _RenderOptions: TypeAlias = tuple[
@@ -19,6 +19,18 @@ class StateError(WebUIError): ...
 class RenderError(WebUIError): ...
 class StreamingError(WebUIError): ...
 
+class _BoundaryDescriptor(TypedDict):
+    instance_id: int
+    declaration_id: int
+    owner: str
+    name: str
+    key: str | int | float | None
+
+class _StreamStep(TypedDict):
+    bytes: bytes
+    done: bool
+    boundary: _BoundaryDescriptor | None
+
 @final
 class _Renderer:
     def __new__(
@@ -49,20 +61,14 @@ class _Renderer:
 
 @final
 class _StreamingSession:
-    def boundary(self, name: str) -> int: ...
-    @property
-    def boundary_count(self) -> int: ...
-    @property
-    def finished(self) -> bool: ...
-    def write_shell(self, state_json: _JsonInput) -> bytes: ...
-    def write_boundary(
+    def start(self, state_json: _JsonInput) -> _StreamStep: ...
+    def resume(
         self,
         state_json: _JsonInput,
-        boundary: int,
+        instance_id: int,
         updatable: bool,
-    ) -> bytes: ...
-    def update(self, state_json: _JsonInput, boundary: int) -> bytes: ...
-    def finish(self, state_json: _JsonInput) -> bytes: ...
+    ) -> _StreamStep: ...
+    def update(self, state_json: _JsonInput, instance_id: int) -> bytes: ...
 
 __version__: str
 __all__ = [
diff --git a/crates/webui-python/src/lib.rs b/crates/webui-python/src/lib.rs
index 2e2910260..d245ee39e 100644
--- a/crates/webui-python/src/lib.rs
+++ b/crates/webui-python/src/lib.rs
@@ -8,14 +8,15 @@ use std::sync::{Arc, Mutex, MutexGuard};
 use pyo3::exceptions::{PyTypeError, PyValueError};
 use pyo3::prelude::*;
 use pyo3::pybacked::{PyBackedBytes, PyBackedStr};
-use pyo3::types::{PyAny, PyByteArray, PyBytes, PyModule, PyString, PyType};
+use pyo3::types::{PyAny, PyByteArray, PyBytes, PyDict, PyModule, PyString, PyType};
 use serde_json::Value;
 use webui_handler::plugin::fast_v2::FastV2HydrationPlugin;
 use webui_handler::plugin::fast_v3::FastV3HydrationPlugin;
 use webui_handler::plugin::webui::WebUIHydrationPlugin;
 use webui_handler::{
-    BoundaryId, BoundaryMode, HandlerError, Protocol, RenderOptions, ResponseWriter,
-    SessionOptions, StreamingSession as HandlerStreamingSession, WebUIHandler,
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, HandlerError, Protocol,
+    RenderOptions, ResponseWriter, SessionOptions, StreamStep as HandlerStreamStep,
+    StreamingSession as HandlerStreamingSession, WebUIHandler,
 };
 
 // PyO3's exception macro uses `Result::expect` inside its one-time type initializer.
@@ -352,57 +353,32 @@ struct NativeStreamingSession {
 
 #[pymethods]
 impl NativeStreamingSession {
-    fn boundary(&self, py: Python<'_>, name: &str) -> PyResult<u32> {
-        py.detach(|| {
-            self.session_binding()?
-                .boundary(name)
-                .map(BoundaryId::raw)
-                .map_err(streaming_binding_error)
-        })
-        .map_err(BindingError::into_py_error)
-    }
-
-    #[getter]
-    fn boundary_count(&self, py: Python<'_>) -> PyResult<usize> {
-        py.detach(|| {
-            self.session_binding()
-                .map(|session| session.boundary_count())
-        })
-        .map_err(BindingError::into_py_error)
-    }
-
-    #[getter]
-    fn finished(&self, py: Python<'_>) -> PyResult<bool> {
-        py.detach(|| self.session_binding().map(|session| session.is_finished()))
-            .map_err(BindingError::into_py_error)
-    }
-
-    fn write_shell<'py>(
+    fn start<'py>(
         &self,
         py: Python<'py>,
         state_json: &Bound<'py, PyAny>,
-    ) -> PyResult<Bound<'py, PyBytes>> {
+    ) -> PyResult<Bound<'py, PyDict>> {
         let input = JsonInput::extract(state_json)?;
-        let result = py
+        let step = py
             .detach(|| {
                 let state = parse_state(&input)?;
                 self.session_binding()?
-                    .write_shell(&state)
+                    .start(&state)
                     .map_err(streaming_binding_error)
             })
             .map_err(BindingError::into_py_error)?;
-        Ok(PyBytes::new(py, &result))
+        stream_step_dict(py, step)
     }
 
-    fn write_boundary<'py>(
+    fn resume<'py>(
         &self,
         py: Python<'py>,
         state_json: &Bound<'py, PyAny>,
-        boundary: u32,
+        instance_id: u32,
         updatable: bool,
-    ) -> PyResult<Bound<'py, PyBytes>> {
+    ) -> PyResult<Bound<'py, PyDict>> {
         let input = JsonInput::extract(state_json)?;
-        let result = py
+        let step = py
             .detach(|| {
                 let state = parse_state(&input)?;
                 let mode = if updatable {
@@ -411,42 +387,25 @@ impl NativeStreamingSession {
                     BoundaryMode::Final
                 };
                 self.session_binding()?
-                    .write_boundary(BoundaryId::from_raw(boundary), &state, mode)
+                    .resume(BoundaryInstanceId::from_raw(instance_id), &state, mode)
                     .map_err(streaming_binding_error)
             })
             .map_err(BindingError::into_py_error)?;
-        Ok(PyBytes::new(py, &result))
+        stream_step_dict(py, step)
     }
 
     fn update<'py>(
         &self,
         py: Python<'py>,
         state_json: &Bound<'py, PyAny>,
-        boundary: u32,
+        instance_id: u32,
     ) -> PyResult<Bound<'py, PyBytes>> {
         let input = JsonInput::extract(state_json)?;
         let result = py
             .detach(|| {
                 let state = parse_state(&input)?;
                 self.session_binding()?
-                    .update(BoundaryId::from_raw(boundary), &state)
-                    .map_err(streaming_binding_error)
-            })
-            .map_err(BindingError::into_py_error)?;
-        Ok(PyBytes::new(py, &result))
-    }
-
-    fn finish<'py>(
-        &self,
-        py: Python<'py>,
-        state_json: &Bound<'py, PyAny>,
-    ) -> PyResult<Bound<'py, PyBytes>> {
-        let input = JsonInput::extract(state_json)?;
-        let result = py
-            .detach(|| {
-                let state = parse_state(&input)?;
-                self.session_binding()?
-                    .finish(&state)
+                    .update(BoundaryInstanceId::from_raw(instance_id), &state)
                     .map_err(streaming_binding_error)
             })
             .map_err(BindingError::into_py_error)?;
@@ -464,6 +423,62 @@ impl NativeStreamingSession {
     }
 }
 
+fn stream_step_dict(py: Python<'_>, step: HandlerStreamStep) -> PyResult<Bound<'_, PyDict>> {
+    let result = PyDict::new(py);
+    result.set_item("bytes", PyBytes::new(py, &step.bytes))?;
+    result.set_item("done", step.done)?;
+    match step.boundary {
+        Some(boundary) => result.set_item("boundary", boundary_descriptor_dict(py, boundary)?)?,
+        None => result.set_item("boundary", py.None())?,
+    }
+    Ok(result)
+}
+
+fn boundary_descriptor_dict(
+    py: Python<'_>,
+    descriptor: BoundaryDescriptor,
+) -> PyResult<Bound<'_, PyDict>> {
+    let result = PyDict::new(py);
+    result.set_item("instance_id", descriptor.instance_id.raw())?;
+    result.set_item("declaration_id", descriptor.declaration_id)?;
+    result.set_item("owner", &*descriptor.owner)?;
+    result.set_item("name", &*descriptor.name)?;
+    match descriptor.key {
+        Some(BoundaryKey::String(key)) => result.set_item("key", key)?,
+        Some(BoundaryKey::Number(key)) if key.is_i64() => {
+            let value = key
+                .as_i64()
+                .ok_or_else(|| impossible_boundary_key_error(&key))?;
+            result.set_item("key", value)?;
+        }
+        Some(BoundaryKey::Number(key)) if key.is_u64() => {
+            let value = key
+                .as_u64()
+                .ok_or_else(|| impossible_boundary_key_error(&key))?;
+            result.set_item("key", value)?;
+        }
+        Some(BoundaryKey::Number(key)) if key.is_f64() => {
+            let value = key
+                .as_f64()
+                .filter(|value| value.is_finite())
+                .ok_or_else(|| impossible_boundary_key_error(&key))?;
+            result.set_item("key", value)?;
+        }
+        Some(BoundaryKey::Number(key)) => return Err(impossible_boundary_key_error(&key)),
+        None => result.set_item("key", py.None())?,
+    }
+    Ok(result)
+}
+
+#[cold]
+#[inline(never)]
+fn impossible_boundary_key_error(key: &serde_json::Number) -> PyErr {
+    BindingError::streaming(format!(
+        "WebUI returned an unsupported boundary key number `{key}`"
+    ))
+    .into_py_error()
+}
+
 fn parse_state(input: &JsonInput) -> Result<Value, BindingError> {
     serde_json::from_slice(input.as_bytes())
         .map_err(|error| BindingError::state(format!("failed to parse state JSON: {error}")))
diff --git a/crates/webui-python/tests/compare_fixture.py b/crates/webui-python/tests/compare_fixture.py
index 57ab925dc..6033f2196 100644
--- a/crates/webui-python/tests/compare_fixture.py
+++ b/crates/webui-python/tests/compare_fixture.py
@@ -1,11 +1,11 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-"""Compare two `webui inspect` JSON dumps semantically.
+"""Compare two ``webui inspect`` JSON dumps semantically.
 
-The committed `protocol.bin` fixture is a build output, so CI rebuilds it and
-checks for drift. Bytes cannot be compared directly because protobuf map field
-ordering is not stable, so compare the decoded JSON instead.
+Committed protocol fixtures are build outputs, so CI rebuilds them and checks
+for drift. Bytes cannot be compared directly because protobuf map field ordering
+is not stable, so compare the decoded JSON instead.
 """
 
 from __future__ import annotations
@@ -15,11 +15,20 @@
 import sys
 from pathlib import Path
 
+DEFAULT_FIXTURE = Path("crates/webui-python/tests/fixtures/protocol.bin")
+
 
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("committed", type=Path)
     parser.add_argument("generated", type=Path)
+    parser.add_argument(
+        "fixture",
+        nargs="?",
+        type=Path,
+        default=DEFAULT_FIXTURE,
+        help="committed binary to name when the semantic comparison fails",
+    )
     args = parser.parse_args()
 
     try:
@@ -31,8 +40,7 @@ def main() -> int:
 
     if committed != generated:
         print(
-            "error: the Python protocol fixture is stale; regenerate "
-            "crates/webui-python/tests/fixtures/protocol.bin",
+            f"error: the Python protocol fixture is stale; regenerate {args.fixture}",
             file=sys.stderr,
         )
         return 1
diff --git a/crates/webui-python/tests/conftest.py b/crates/webui-python/tests/conftest.py
index aca8c5c06..93ab71112 100644
--- a/crates/webui-python/tests/conftest.py
+++ b/crates/webui-python/tests/conftest.py
@@ -8,6 +8,7 @@
 
 FIXTURES = Path(__file__).parent / "fixtures"
 PROTOCOL_PATH = FIXTURES / "protocol.bin"
+STREAMING_PROTOCOL_PATH = FIXTURES / "streaming_protocol.bin"
 
 STATE = {
     "title": "Python renderer",
@@ -15,6 +16,16 @@
     "status": "ready",
 }
 
+STREAMING_STATE = {
+    **STATE,
+    "show": True,
+    "items": [
+        {"id": 10, "label": "ten"},
+        {"id": 2.5, "label": "two-point-five"},
+        {"id": "last", "label": "last"},
+    ],
+}
+
 
 @pytest.fixture(scope="session")
 def protocol_bytes() -> bytes:
@@ -24,3 +35,8 @@ def protocol_bytes() -> bytes:
 @pytest.fixture
 def renderer(protocol_bytes: bytes) -> Renderer:
     return Renderer(protocol_bytes, plugin=Plugin.WEBUI)
+
+
+@pytest.fixture
+def streaming_renderer() -> Renderer:
+    return Renderer(STREAMING_PROTOCOL_PATH.read_bytes(), plugin=Plugin.WEBUI)
diff --git a/crates/webui-python/tests/fixtures/protocol.bin b/crates/webui-python/tests/fixtures/protocol.bin
index d99e8619442848cc70b6023f4a08a5ec60f2ae6c..1b21ea40854133c97e84d9b7bb015078a71efae0 100644
GIT binary patch
delta 112
zcmey#KAT;LtBZw;D>E-8wL&kWBsWLsH}k~przItV#DtJUr8v@yQd3JZ^U^0TVw@(=
w62xS|$OTlx!HA-Yt+*tyq_lW)Ig<_>TM!Eeqs8O{OnOWLj1!hle#i6@0KVlSq5uE@

delta 207
zcmbQu{*!$&FVj*Xu461*T$y<(sTFz|CAm35+gT<GomP-nlI4=Dt*tFjO)AZ_O3E+I
zOGzxMj4v)pEGn@w5MZ46ZJNETk~Eh%rkd2e6p#uoyha!bFiu|0s3VKV3`2p*cNz62
fZ(@3><fMS&L?JGY^rF<%lFYnxE;gW(N=l0XN>oL-

diff --git a/crates/webui-python/tests/fixtures/streaming-app/index.html b/crates/webui-python/tests/fixtures/streaming-app/index.html
new file mode 100644
index 000000000..22ea7cc4e
--- /dev/null
+++ b/crates/webui-python/tests/fixtures/streaming-app/index.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>{{title}}</title>
+  </head>
+  <body>
+    <if condition="show">
+      <boundary name="greeting">
+        <p class="greeting">Hello, {{name}}!</p>
+      </boundary>
+      <boundary name="status">
+        <p id="status">{{status}}</p>
+      </boundary>
+      <for each="item in items">
+        <boundary name="row" key="{{item.id}}">
+          <p class="row">{{item.label}}</p>
+        </boundary>
+      </for>
+    </if>
+  </body>
+</html>
diff --git a/crates/webui-python/tests/fixtures/streaming_protocol.bin b/crates/webui-python/tests/fixtures/streaming_protocol.bin
new file mode 100644
index 000000000..8732e800a
--- /dev/null
+++ b/crates/webui-python/tests/fixtures/streaming_protocol.bin
@@ -0,0 +1,74 @@
+
+�
+
+index.html�
+)
+'
+%<!DOCTYPE html><html lang="en"><head>
+"
+}}}webui:head_start

+"
+ 
+<meta charset="UTF-8"/><title>
+	"
+title
+
+
+
+</title>
+"
+}}}webui:head_end

+
+
+
</head><body>
+"
+}}}webui:body_start

+*
+"
+showif-1
+"
+}}}webui:body_end

+
+
+</body></html>

+�

+if-1�

+R
+index.htmlgreeting
+
+
+<p class="greeting">Hello, 
+"
+name
+	
+
+!</p>
+R8

+R

+index.htmlstatus
+
+
+<p id="status">
+
+"
+status
+
+
+</p>
+R
8

+
+itemitemsfor-1

+h
+for-1_
+$R"
+index.htmlrow"{{item.id}}0

+
+
+<p class="row">
+"
+
+item.label
+
+
+</p>
+R8


\ No newline at end of file
diff --git a/crates/webui-python/tests/test_compare_fixture.py b/crates/webui-python/tests/test_compare_fixture.py
new file mode 100644
index 000000000..8d3adca05
--- /dev/null
+++ b/crates/webui-python/tests/test_compare_fixture.py
@@ -0,0 +1,49 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import compare_fixture
+import pytest
+
+
+def test_reports_requested_stale_fixture(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    committed = tmp_path / "committed.json"
+    generated = tmp_path / "generated.json"
+    fixture = Path("fixtures/streaming_protocol.bin")
+    committed.write_text('{"value": 1}', encoding="utf-8")
+    generated.write_text('{"value": 2}', encoding="utf-8")
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["compare_fixture.py", str(committed), str(generated), str(fixture)],
+    )
+
+    assert compare_fixture.main() == 1
+    assert str(fixture) in capsys.readouterr().err
+
+
+def test_default_fixture_path_remains_compatible(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    committed = tmp_path / "committed.json"
+    generated = tmp_path / "generated.json"
+    committed.write_text('{"value": 1}', encoding="utf-8")
+    generated.write_text('{"value": 2}', encoding="utf-8")
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["compare_fixture.py", str(committed), str(generated)],
+    )
+
+    assert compare_fixture.main() == 1
+    assert str(compare_fixture.DEFAULT_FIXTURE) in capsys.readouterr().err
diff --git a/crates/webui-python/tests/test_package.py b/crates/webui-python/tests/test_package.py
index 4da50e17d..744dc3540 100644
--- a/crates/webui-python/tests/test_package.py
+++ b/crates/webui-python/tests/test_package.py
@@ -16,6 +16,7 @@
 import pytest
 import validate_release_targets
 from microsoft_webui import (
+    BoundaryDescriptor,
     BoundaryMode,
     Plugin,
     ProtocolError,
@@ -24,6 +25,7 @@
     StateError,
     StreamingError,
     StreamingSession,
+    StreamStep,
     WebUIError,
 )
 
@@ -35,6 +37,7 @@ def _raise_state_error() -> NoReturn:
 def test_public_surface_and_version() -> None:
     assert microsoft_webui.__version__ == importlib.metadata.version("microsoft-webui")
     assert set(microsoft_webui.__all__) == {
+        "BoundaryDescriptor",
         "BoundaryMode",
         "Plugin",
         "ProtocolError",
@@ -42,6 +45,7 @@ def test_public_surface_and_version() -> None:
         "Renderer",
         "StateError",
         "StateInput",
+        "StreamStep",
         "StreamingError",
         "StreamingSession",
         "WebUIError",
@@ -52,6 +56,8 @@ def test_public_surface_and_version() -> None:
     assert issubclass(RenderError, WebUIError)
     assert issubclass(StreamingError, WebUIError)
     assert Renderer is not None
+    assert BoundaryDescriptor is not None
+    assert StreamStep is not None
     assert StreamingSession is not None
 
 
diff --git a/crates/webui-python/tests/test_streaming.py b/crates/webui-python/tests/test_streaming.py
index 45a139ad5..b57aa16f0 100644
--- a/crates/webui-python/tests/test_streaming.py
+++ b/crates/webui-python/tests/test_streaming.py
@@ -4,138 +4,174 @@
 from __future__ import annotations
 
 import gc
+from dataclasses import FrozenInstanceError
 
 import pytest
-from conftest import STATE
-from microsoft_webui import BoundaryMode, Plugin, Renderer, StateError, StreamingError
-
-
-def test_host_driven_streaming_lifecycle(renderer: Renderer) -> None:
-    session = renderer.stream_response(nonce="stream-nonce")
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
-
-    assert session.boundary_count == 2
-    assert greeting == 0
-    assert status == 1
-    assert not session.finished
-
-    chunks = [
-        session.write_shell(STATE),
-        session.write_boundary(greeting, STATE, mode=BoundaryMode.UPDATABLE),
-        session.update(greeting, {**STATE, "name": "Grace"}),
-        session.write_boundary(status, STATE),
-        session.finish(STATE),
-    ]
-
-    assert all(isinstance(chunk, bytes) for chunk in chunks)
-    assert all(chunks)
-    assert b"Hello, Ada!" in chunks[1]
-    assert b"Grace" in chunks[2]
-    assert b"ready" in chunks[3]
-    assert b"</html>" in chunks[4]
+from conftest import STREAMING_STATE
+from microsoft_webui import (
+    BoundaryDescriptor,
+    BoundaryMode,
+    Renderer,
+    StateError,
+    StreamingError,
+    StreamStep,
+)
+
+
+def require_boundary(step: StreamStep) -> BoundaryDescriptor:
+    assert not step.done
+    assert step.boundary is not None
+    return step.boundary
+
+
+def test_legacy_streaming_surface_is_removed(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
+
+    for name in (
+        "boundary",
+        "boundary_count",
+        "finished",
+        "write_shell",
+        "write_boundary",
+        "finish",
+    ):
+        assert not hasattr(session, name)
+
+
+def test_discovers_resumes_updates_and_completes(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response(nonce="stream-nonce")
+
+    start = session.start(STREAMING_STATE)
+    greeting = require_boundary(start)
+    assert isinstance(start, StreamStep)
+    assert isinstance(start.bytes, bytes)
+    assert greeting == BoundaryDescriptor(
+        instance_id=0,
+        declaration_id=0,
+        owner="index.html",
+        name="greeting",
+        key=None,
+    )
+
+    greeting_step = session.resume(
+        greeting.instance_id,
+        STREAMING_STATE,
+        mode=BoundaryMode.UPDATABLE,
+    )
+    assert b"Hello, Ada!" in greeting_step.bytes
+    assert require_boundary(greeting_step).name == "status"
+
+    update = session.update(greeting.instance_id, {"name": "Grace"})
+    assert isinstance(update, bytes)
+    assert b"Grace" in update
+
+    chunks = [start.bytes, greeting_step.bytes, update]
+    step = greeting_step
+    while not step.done:
+        boundary = require_boundary(step)
+        step = session.resume(boundary.instance_id, STREAMING_STATE)
+        chunks.append(step.bytes)
+
+    assert step.done
+    assert step.boundary is None
+    assert b"</html>" in step.bytes
     assert b'nonce="stream-nonce"' in b"".join(chunks)
-    assert session.finished
 
 
-def test_unknown_boundary_is_actionable(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    with pytest.raises(StreamingError, match="missing"):
-        session.boundary("missing")
+def test_repeated_boundary_keys_preserve_python_types(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
+    step = session.start(STREAMING_STATE)
+    keys: list[str | int | float] = []
 
+    while not step.done:
+        boundary = require_boundary(step)
+        if boundary.name == "row":
+            assert boundary.key is not None
+            keys.append(boundary.key)
+        step = session.resume(boundary.instance_id, STREAMING_STATE)
 
-def test_ordering_error_is_recoverable(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
+    assert keys == [10, 2.5, "last"]
+    assert type(keys[0]) is int
+    assert type(keys[1]) is float
+    assert type(keys[2]) is str
 
-    with pytest.raises(StreamingError, match="shell"):
-        session.write_boundary(greeting, STATE)
 
-    assert session.write_shell(STATE)
-    with pytest.raises(StreamingError, match="declaration order"):
-        session.write_boundary(status, STATE)
+def test_boundary_free_start_completes(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
+    step = session.start({**STREAMING_STATE, "show": False})
 
-    assert session.write_boundary(greeting, STATE)
-    assert session.write_boundary(status, STATE)
-    assert session.finish(STATE)
+    assert step.done
+    assert step.boundary is None
+    assert b"</html>" in step.bytes
 
 
-def test_finish_error_preserves_open_session(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
+def test_stream_values_are_immutable(streaming_renderer: Renderer) -> None:
+    step = streaming_renderer.stream_response().start(STREAMING_STATE)
+    boundary = require_boundary(step)
 
-    session.write_shell(STATE)
-    with pytest.raises(StreamingError, match="every boundary must be committed"):
-        session.finish(STATE)
+    with pytest.raises(FrozenInstanceError):
+        step.done = True  # type: ignore[misc]
+    with pytest.raises(FrozenInstanceError):
+        boundary.name = "changed"  # type: ignore[misc]
 
-    session.write_boundary(greeting, STATE)
-    session.write_boundary(status, STATE)
-    assert session.finish(STATE)
 
+def test_invalid_state_does_not_advance_session(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
 
-def test_updates_require_committed_updatable_boundary(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
-    session.write_shell(STATE)
+    with pytest.raises(StateError, match="parse state JSON"):
+        session.start(b"{not-json")
+
+    assert require_boundary(session.start(STREAMING_STATE)).name == "greeting"
+
+
+def test_updates_require_committed_updatable_occurrence(
+    streaming_renderer: Renderer,
+) -> None:
+    session = streaming_renderer.stream_response()
+    greeting = require_boundary(session.start(STREAMING_STATE))
 
     with pytest.raises(StreamingError, match=r"not.*committed"):
-        session.update(greeting, STATE)
+        session.update(greeting.instance_id, {"name": "Grace"})
 
-    session.write_boundary(greeting, STATE, mode=BoundaryMode.FINAL)
+    step = session.resume(greeting.instance_id, STREAMING_STATE)
     with pytest.raises(StreamingError, match="final"):
-        session.update(greeting, STATE)
+        session.update(greeting.instance_id, {"name": "Grace"})
 
-    session.write_boundary(status, STATE)
-    session.finish(STATE)
+    while not step.done:
+        boundary = require_boundary(step)
+        step = session.resume(boundary.instance_id, STREAMING_STATE)
 
 
-def test_invalid_state_does_not_advance_session(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    greeting = session.boundary("greeting")
+def test_resume_rejects_wrong_instance_without_advancing(
+    streaming_renderer: Renderer,
+) -> None:
+    session = streaming_renderer.stream_response()
+    greeting = require_boundary(session.start(STREAMING_STATE))
 
-    with pytest.raises(StateError, match="parse state JSON"):
-        session.write_shell(b"{not-json")
+    with pytest.raises(StreamingError, match="pending"):
+        session.resume(greeting.instance_id + 1, STREAMING_STATE)
 
-    assert session.write_shell(STATE)
-    assert session.write_boundary(greeting, STATE)
+    assert require_boundary(session.resume(greeting.instance_id, STREAMING_STATE)).name == "status"
 
 
-def test_session_outlives_renderer_reference(protocol_bytes: bytes) -> None:
-    renderer = Renderer(protocol_bytes, plugin=Plugin.WEBUI)
+def test_session_outlives_renderer_reference(streaming_renderer: Renderer) -> None:
+    renderer = streaming_renderer
     session = renderer.stream_response()
     del renderer
     gc.collect()
 
-    greeting = session.boundary("greeting")
-    status = session.boundary("status")
-    assert session.write_shell(STATE)
-    assert session.write_boundary(greeting, STATE)
-    assert session.write_boundary(status, STATE)
-    assert session.finish(STATE)
+    step = session.start(STREAMING_STATE)
+    while not step.done:
+        boundary = require_boundary(step)
+        step = session.resume(boundary.instance_id, STREAMING_STATE)
 
+    assert b"</html>" in step.bytes
 
-def test_finished_session_rejects_further_work(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    session.write_shell(STATE)
-    session.write_boundary(session.boundary("greeting"), STATE)
-    session.write_boundary(session.boundary("status"), STATE)
-    session.finish(STATE)
-
-    with pytest.raises(StreamingError, match="already finished"):
-        session.finish(STATE)
-
-
-def test_finish_requires_final_state(renderer: Renderer) -> None:
-    session = renderer.stream_response()
-    session.write_shell(STATE)
-    session.write_boundary(session.boundary("greeting"), STATE)
-    session.write_boundary(session.boundary("status"), STATE)
 
-    with pytest.raises(TypeError, match=r"required positional argument.*state"):
-        session.finish()  # type: ignore[call-arg]
+def test_completed_session_rejects_further_work(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
+    step = session.start({**STREAMING_STATE, "show": False})
+    assert step.done
 
-    assert not session.finished
-    assert session.finish(STATE)
+    with pytest.raises(StreamingError, match="already started"):
+        session.start(STREAMING_STATE)
diff --git a/crates/webui-test-utils/src/lib.rs b/crates/webui-test-utils/src/lib.rs
index 208b1289c..4bca396c3 100644
--- a/crates/webui-test-utils/src/lib.rs
+++ b/crates/webui-test-utils/src/lib.rs
@@ -38,6 +38,7 @@ macro_rules! test_json {
 /// - `component("id")` — Component fragment
 /// - `for_loop("item", "collection", "template")` — For loop
 /// - `if_cond("template")` — If condition
+/// - `boundary("name", "template")` — Streaming boundary declaration
 #[macro_export]
 macro_rules! assert_fragments {
     ($fragments:expr, [ $($matcher:expr),* $(,)? ]) => {{
@@ -77,6 +78,13 @@ pub enum FragmentMatcher {
     IfCond {
         template: String,
     },
+    Boundary {
+        name: String,
+        declaration: u32,
+    },
+    BoundaryEnd {
+        declaration: u32,
+    },
 }
 
 /// Describes expected attribute properties.
@@ -278,6 +286,20 @@ pub fn if_cond(template: &str) -> FragmentMatcher {
     }
 }
 
+/// Match the start marker of an inline streaming boundary tape.
+pub fn boundary(name: &str, declaration: u32) -> FragmentMatcher {
+    FragmentMatcher::Boundary {
+        name: name.to_string(),
+        declaration,
+    }
+}
+
+/// Match the end marker that closes an inline streaming boundary tape.
+#[must_use]
+pub fn boundary_end(declaration: u32) -> FragmentMatcher {
+    FragmentMatcher::BoundaryEnd { declaration }
+}
+
 // ── Assertion implementation ────────────────────────────────────────
 
 /// Assert that a fragment list matches the expected matchers.
@@ -439,6 +461,40 @@ pub fn assert_fragment_list(
                     i
                 );
             }
+            (
+                Some(Fragment::Boundary(boundary)),
+                FragmentMatcher::Boundary { name, declaration },
+            ) => {
+                assert_eq!(
+                    boundary.phase(),
+                    webui_protocol::BoundaryPhase::Start,
+                    "Fragment[{}]: expected a boundary start marker",
+                    i
+                );
+                assert_eq!(
+                    boundary.name, *name,
+                    "Fragment[{}]: boundary name mismatch",
+                    i
+                );
+                assert_eq!(
+                    boundary.declaration_id, *declaration,
+                    "Fragment[{}]: boundary declaration mismatch",
+                    i
+                );
+            }
+            (Some(Fragment::Boundary(boundary)), FragmentMatcher::BoundaryEnd { declaration }) => {
+                assert_eq!(
+                    boundary.phase(),
+                    webui_protocol::BoundaryPhase::End,
+                    "Fragment[{}]: expected a boundary end marker",
+                    i
+                );
+                assert_eq!(
+                    boundary.declaration_id, *declaration,
+                    "Fragment[{}]: boundary declaration mismatch",
+                    i
+                );
+            }
             (_actual, expected) => {
                 panic!(
                     "Fragment[{}]: type mismatch\n  expected: {:?}\n  actual: {}",
@@ -471,6 +527,12 @@ fn format_fragment(frag: &webui_protocol::WebUIFragment) -> String {
             format!("route(path={:?}, fragment={:?})", r.path, r.fragment_id)
         }
         Some(Fragment::Outlet(_)) => "outlet".to_string(),
+        Some(Fragment::Boundary(boundary)) => format!(
+            "boundary(name={:?}, phase={:?}, declaration={})",
+            boundary.name,
+            boundary.phase(),
+            boundary.declaration_id
+        ),
         None => "None".to_string(),
     }
 }
diff --git a/crates/webui-wasm/README.md b/crates/webui-wasm/README.md
index 19c5508bf..373aab20e 100644
--- a/crates/webui-wasm/README.md
+++ b/crates/webui-wasm/README.md
@@ -15,10 +15,31 @@ WebAssembly bindings for the [WebUI](https://github.com/microsoft/webui) framewo
 The default feature is `all`, which powers the online playground. Consumers that only need to render prebuilt protobuf protocol bytes should use the handler bundle to avoid shipping parser code.
 
 Construct `Protocol` once from protocol bytes. It exposes `render`,
-`renderStream`, `renderPartial`, `renderComponentTemplates`, and `tokens`.
+`renderStream`, `renderPartial`, `renderComponentTemplates`, `tokens`, and
+`streamResponse`.
 Streaming callbacks are coalesced around a 16 KiB target before crossing into
 JavaScript.
 
+`Protocol.streamResponse(entry, requestPath, options)` returns a host-driven
+`StreamingSession`. Call `start(stateJson)` once, then
+`resume(instanceId, stateJson, mode)` for every discovered occurrence. State
+and patch arguments are JSON strings. Both step methods return:
+
+```js
+{
+  bytes: Uint8Array,
+  done: boolean,
+  boundary?: { instanceId, declarationId, owner, name, key }
+}
+```
+
+`mode` is `"final"` (the default) or `"updatable"`. A committed updatable
+occurrence accepts `update(instanceId, patch)`, which returns a `Uint8Array`.
+Boundary keys preserve JSON identity: string keys are JavaScript strings and
+finite numeric keys are JavaScript numbers. Boundaries are discovered through
+entries, reusable components, runtime branches, loops, and selected routes.
+The step with `done: true` already contains terminal and document-tail bytes.
+
 ## Building
 
 ```bash
diff --git a/crates/webui-wasm/src/handler.rs b/crates/webui-wasm/src/handler.rs
index 85ca5848c..5f748a1f6 100644
--- a/crates/webui-wasm/src/handler.rs
+++ b/crates/webui-wasm/src/handler.rs
@@ -4,7 +4,7 @@
 //! Handler-only WASM exports.
 
 use crate::error::WasmError;
-use js_sys::{Function, Object, Reflect};
+use js_sys::{Function, Object, Reflect, Uint8Array};
 use serde_json::Value;
 use std::sync::Arc;
 use wasm_bindgen::prelude::*;
@@ -12,8 +12,9 @@ use webui_handler::plugin::fast_v2::FastV2HydrationPlugin;
 use webui_handler::plugin::fast_v3::FastV3HydrationPlugin;
 use webui_handler::plugin::webui::WebUIHydrationPlugin;
 use webui_handler::{
-    BoundaryId, BoundaryMode, HandlerError, Protocol as HandlerProtocol, RenderOptions,
-    ResponseWriter, SessionOptions, StreamingSession as HandlerStreamingSession, WebUIHandler,
+    BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, HandlerError,
+    Protocol as HandlerProtocol, RenderOptions, ResponseWriter, SessionOptions,
+    StreamStep as HandlerStreamStep, StreamingSession as HandlerStreamingSession, WebUIHandler,
 };
 #[cfg(test)]
 use webui_protocol::WebUIProtocol;
@@ -236,19 +237,24 @@ impl Protocol {
     }
 }
 
-/// A progressive HTML response driven one chunk at a time from JavaScript.
+/// A progressive HTML response driven one semantic step at a time from JavaScript.
 ///
-/// Every method returns the UTF-8 bytes it produced. Write them to the
-/// response and apply the host's own backpressure; the session holds no
-/// transport and never blocks on one.
+/// `start()` and `resume()` return `{ bytes, done, boundary? }`, where `bytes`
+/// is a `Uint8Array` and a boundary is
+/// `{ instanceId, declarationId, owner, name, key }`. Boundary keys retain
+/// their authored JSON type: strings are JavaScript strings and finite numbers
+/// are JavaScript numbers.
 ///
 /// ```js
 /// const session = protocol.streamResponse('index.html', '/');
-/// const weather = session.boundary('weather-shell');
-/// controller.enqueue(session.writeShell(shellState));
-/// controller.enqueue(session.writeBoundary(weather, weatherState, 'updatable'));
-/// controller.enqueue(session.update(weather, forecast));
-/// controller.enqueue(session.finish(tailState));
+/// let step = session.start(JSON.stringify(shellState));
+/// controller.enqueue(step.bytes);
+/// while (!step.done) {
+///   const { instanceId, name, key } = step.boundary;
+///   const state = await loadBoundary(name, key);
+///   step = session.resume(instanceId, JSON.stringify(state), 'updatable');
+///   controller.enqueue(step.bytes);
+/// }
 /// ```
 #[wasm_bindgen]
 pub struct StreamingSession {
@@ -257,74 +263,95 @@ pub struct StreamingSession {
 
 #[wasm_bindgen]
 impl StreamingSession {
-    /// Resolve an authored boundary name to a stable integer handle.
-    ///
-    /// Resolve once outside the write loop; the handle costs nothing to reuse.
-    #[wasm_bindgen(js_name = boundary)]
-    pub fn boundary(&self, name: &str) -> Result<u32, JsValue> {
-        self.inner
-            .boundary(name)
-            .map(BoundaryId::raw)
-            .map_err(streaming_error)
-    }
-
-    /// Number of compile-time boundaries declared by this entry.
-    #[wasm_bindgen(getter, js_name = boundaryCount)]
-    pub fn boundary_count(&self) -> u32 {
-        // Boundary counts are bounded by the compiled entry, so this cannot
-        // exceed u32 in any protocol the build can produce.
-        u32::try_from(self.inner.boundary_count()).unwrap_or(u32::MAX)
-    }
-
-    /// Whether the terminal record has been written.
-    #[wasm_bindgen(getter, js_name = finished)]
-    pub fn finished(&self) -> bool {
-        self.inner.is_finished()
-    }
-
-    /// Render everything before the first boundary.
-    #[wasm_bindgen(js_name = writeShell)]
-    pub fn write_shell(&mut self, state_json: &str) -> Result<Vec<u8>, JsValue> {
+    /// Render until the first runtime boundary occurrence or terminal.
+    #[wasm_bindgen(js_name = start)]
+    pub fn start(&mut self, state_json: &str) -> Result<Object, JsValue> {
         let state = session_state(state_json)?;
-
-        self.inner.write_shell(&state).map_err(streaming_error)
+        let step = self.inner.start(&state).map_err(streaming_error)?;
+        stream_step_object(step)
     }
 
-    /// Render and commit the next boundary in declaration order.
+    /// Commit the pending occurrence and advance to the next one or terminal.
     ///
     /// `mode` is `"final"` (default) or `"updatable"`. Only updatable
     /// boundaries accept later `update()` calls.
-    #[wasm_bindgen(js_name = writeBoundary)]
-    pub fn write_boundary(
+    #[wasm_bindgen(js_name = resume)]
+    pub fn resume(
         &mut self,
-        boundary: u32,
+        instance_id: u32,
         state_json: &str,
         mode: Option<String>,
-    ) -> Result<Vec<u8>, JsValue> {
+    ) -> Result<Object, JsValue> {
         let state = session_state(state_json)?;
-
         let mode = parse_boundary_mode(mode.as_deref())?;
-        self.inner
-            .write_boundary(BoundaryId::from_raw(boundary), &state, mode)
-            .map_err(streaming_error)
+        let step = self
+            .inner
+            .resume(BoundaryInstanceId::from_raw(instance_id), &state, mode)
+            .map_err(streaming_error)?;
+        stream_step_object(step)
     }
 
     /// Push a projected state patch to a committed updatable boundary.
     #[wasm_bindgen(js_name = update)]
-    pub fn update(&mut self, boundary: u32, state_json: &str) -> Result<Vec<u8>, JsValue> {
-        let state = session_state(state_json)?;
+    pub fn update(&mut self, instance_id: u32, patch_json: &str) -> Result<Vec<u8>, JsValue> {
+        let patch = session_state(patch_json)?;
 
         self.inner
-            .update(BoundaryId::from_raw(boundary), &state)
+            .update(BoundaryInstanceId::from_raw(instance_id), &patch)
             .map_err(streaming_error)
     }
+}
 
-    /// Render the document tail and emit the terminal record.
-    #[wasm_bindgen(js_name = finish)]
-    pub fn finish(&mut self, state_json: &str) -> Result<Vec<u8>, JsValue> {
-        let state = session_state(state_json)?;
+fn stream_step_object(step: HandlerStreamStep) -> Result<Object, JsValue> {
+    let result = Object::new();
+    let bytes = Uint8Array::from(step.bytes.as_slice());
+    set_object_property(&result, "bytes", bytes.as_ref())?;
+    set_object_property(&result, "done", &JsValue::from_bool(step.done))?;
+    if let Some(boundary) = step.boundary {
+        let boundary = boundary_object(boundary)?;
+        set_object_property(&result, "boundary", boundary.as_ref())?;
+    }
+    Ok(result)
+}
 
-        self.inner.finish(&state).map_err(streaming_error)
+fn boundary_object(boundary: BoundaryDescriptor) -> Result<Object, JsValue> {
+    let result = Object::new();
+    set_object_property(
+        &result,
+        "instanceId",
+        &JsValue::from_f64(f64::from(boundary.instance_id.raw())),
+    )?;
+    set_object_property(
+        &result,
+        "declarationId",
+        &JsValue::from_f64(f64::from(boundary.declaration_id)),
+    )?;
+    set_object_property(&result, "owner", &JsValue::from_str(&boundary.owner))?;
+    set_object_property(&result, "name", &JsValue::from_str(&boundary.name))?;
+    if let Some(key) = boundary.key {
+        set_object_property(&result, "key", &boundary_key_value(key)?)?;
+    }
+    Ok(result)
+}
+
+fn boundary_key_value(key: BoundaryKey) -> Result<JsValue, JsValue> {
+    match key {
+        BoundaryKey::String(value) => Ok(JsValue::from_str(&value)),
+        BoundaryKey::Number(value) => value.as_f64().map(JsValue::from_f64).ok_or_else(|| {
+            JsValue::from_str("boundary key cannot be represented as a JavaScript number")
+        }),
+    }
+}
+
+fn set_object_property(object: &Object, key: &str, value: &JsValue) -> Result<(), JsValue> {
+    let written = Reflect::set(object.as_ref(), &JsValue::from_str(key), value)
+        .map_err(|_| JsValue::from_str(&format!("failed to set StreamStep '{key}' property")))?;
+    if written {
+        Ok(())
+    } else {
+        Err(JsValue::from_str(&format!(
+            "failed to set StreamStep '{key}' property"
+        )))
     }
 }
 
@@ -512,6 +539,7 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::signal("name".to_string(), true)],
+                contains_boundary: false,
             },
         );
         let bytes = WebUIProtocol::new(fragments)
@@ -549,12 +577,14 @@ mod tests {
                     structural_fragment("body_end"),
                     WebUIFragment::raw("</body></html>"),
                 ],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "client-card".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>client</p>")],
+                contains_boundary: false,
             },
         );
         let mut protocol = WebUIProtocol::new(fragments);
@@ -592,4 +622,116 @@ mod tests {
             "server-only key name leaked into render:\n{rendered}"
         );
     }
+
+    #[cfg(feature = "parser")]
+    mod streaming_tests {
+        use std::collections::HashMap;
+
+        use super::*;
+
+        fn session(html: &str) -> HandlerStreamingSession {
+            let files = HashMap::from([("index.html".to_string(), html.to_string())]);
+            let protocol = crate::parser::parse_to_protocol(&files, "index.html", &[])
+                .expect("protocol should parse");
+            HandlerStreamingSession::new(
+                Arc::new(WebUIHandler::new()),
+                Arc::new(HandlerProtocol::new(protocol)),
+                SessionOptions::new("index.html", "/"),
+            )
+            .expect("session should open")
+        }
+
+        fn state(json: &str) -> Value {
+            parse_state_json(json).expect("state should parse")
+        }
+
+        #[test]
+        fn streaming_start_and_resume_preserve_repeat_key_types() {
+            let mut session = session(concat!(
+                "<html><head></head><body>",
+                r#"<for each="item in items"><boundary name="row" key="{{item.id}}">"#,
+                "<p>{{item.label}}</p></boundary></for>",
+                "</body></html>",
+            ));
+            let state = state(r#"{"items":[{"id":"alpha","label":"a"},{"id":20,"label":"b"}]}"#);
+
+            let first = session
+                .start(&state)
+                .expect("start should discover first boundary");
+            assert!(!first.done);
+            assert!(!first.bytes.is_empty());
+            let first_boundary = first.boundary.expect("first boundary should be returned");
+            assert_eq!(first_boundary.instance_id.raw(), 0);
+            assert_eq!(first_boundary.declaration_id, 0);
+            assert_eq!(first_boundary.owner.as_ref(), "index.html");
+            assert_eq!(first_boundary.name.as_ref(), "row");
+            assert_eq!(
+                first_boundary.key,
+                Some(BoundaryKey::String("alpha".to_string()))
+            );
+
+            let second = session
+                .resume(first_boundary.instance_id, &state, BoundaryMode::Final)
+                .expect("resume should discover second boundary");
+            assert!(!second.done);
+            let second_boundary = second.boundary.expect("second boundary should be returned");
+            assert_eq!(second_boundary.instance_id.raw(), 1);
+            assert_eq!(second_boundary.key, Some(BoundaryKey::Number(20.into())));
+
+            let done = session
+                .resume(second_boundary.instance_id, &state, BoundaryMode::Final)
+                .expect("final resume should complete");
+            assert!(done.done);
+            assert!(done.boundary.is_none());
+            assert!(!done.bytes.is_empty());
+        }
+
+        #[test]
+        fn streaming_update_returns_bytes_for_updatable_occurrence() {
+            let mut session = session(concat!(
+                "<html><head></head><body>",
+                r#"<boundary name="first"><p>{{count}}</p></boundary>"#,
+                r#"<boundary name="second"><p>done</p></boundary>"#,
+                "</body></html>",
+            ));
+            let initial = state(r#"{"count":1}"#);
+            let first = session
+                .start(&initial)
+                .expect("start should discover first boundary")
+                .boundary
+                .expect("first boundary should be returned");
+            let second = session
+                .resume(first.instance_id, &initial, BoundaryMode::Updatable)
+                .expect("resume should commit updatable boundary")
+                .boundary
+                .expect("second boundary should be returned");
+
+            let update = session
+                .update(first.instance_id, &state(r#"{"count":2}"#))
+                .expect("update should render");
+            assert!(!update.is_empty());
+            assert!(std::str::from_utf8(&update)
+                .expect("update should be UTF-8")
+                .contains(r#""count":2"#));
+
+            let done = session
+                .resume(second.instance_id, &state("{}"), BoundaryMode::Final)
+                .expect("second resume should complete");
+            assert!(done.done);
+        }
+
+        #[test]
+        fn streaming_start_returns_done_for_boundary_free_document() {
+            let mut session = session("<html><head></head><body><p>done</p></body></html>");
+
+            let step = session
+                .start(&state("{}"))
+                .expect("boundary-free start should complete");
+            assert!(step.done);
+            assert!(step.boundary.is_none());
+            assert!(std::str::from_utf8(&step.bytes)
+                .expect("output should be UTF-8")
+                .contains("<p>done</p>"));
+        }
+    }
 }
diff --git a/crates/webui/benches/component_assets_bench.rs b/crates/webui/benches/component_assets_bench.rs
index 8f31d91e2..51f10fc24 100644
--- a/crates/webui/benches/component_assets_bench.rs
+++ b/crates/webui/benches/component_assets_bench.rs
@@ -51,12 +51,14 @@ fn setup() -> Fixture {
             root.clone(),
             FragmentList {
                 fragments: root_fragments,
+                contains_boundary: false,
             },
         );
         fragments.insert(
             unique,
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>unique</p>")],
+                contains_boundary: false,
             },
         );
         roots.push(root);
@@ -67,6 +69,7 @@ fn setup() -> Fixture {
             component_tag("shared-child", shared_index),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>shared</p>")],
+                contains_boundary: false,
             },
         );
     }
@@ -76,6 +79,7 @@ fn setup() -> Fixture {
         "index.html".to_string(),
         FragmentList {
             fragments: vec![WebUIFragment::raw("<main></main>")],
+            contains_boundary: false,
         },
     );
     let tags: Vec<String> = protocol.fragments.keys().cloned().collect();
diff --git a/crates/webui/src/lib.rs b/crates/webui/src/lib.rs
index e7740464c..e411e6fc0 100644
--- a/crates/webui/src/lib.rs
+++ b/crates/webui/src/lib.rs
@@ -34,8 +34,9 @@ pub use error::WebUIError;
 pub use webui_handler::route_handler::{encode_inventory, get_needed_components, parse_inventory};
 pub use webui_handler::Result as HandlerResult;
 pub use webui_handler::{
-    plugin::HandlerPlugin, BoundaryId, BoundaryMode, FlushWriter, HandlerError, Protocol,
-    RenderOptions, ResponseWriter, StreamingResponse, WebUIHandler,
+    plugin::HandlerPlugin, BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode,
+    FlushWriter, HandlerError, Protocol, RenderOptions, ResponseWriter, SessionOptions,
+    SpanInstanceId, StreamStatus, StreamStep, StreamingResponse, StreamingSession, WebUIHandler,
 };
 pub use webui_parser::plugin::{ComponentTemplateArtifact, StateSurface};
 pub use webui_parser::CssStrategy;
@@ -588,13 +589,8 @@ fn build_protocol_inner(options: &BuildOptions) -> Result<RawBuildOutput, WebUIE
             source,
         })?;
 
-    // Read before anything else parses. Both accessors describe the *entry*
-    // template, and every top-level `parse()` starts a fresh namespace, so a
-    // later synthetic parse (asset roots, below) would silently zero them.
-    // They are also copied out because `token_analysis()` borrows the parser
-    // and the parser is consumed before the projection manifest is known.
-    let boundary_count = parser.boundary_count();
-    let boundary_names = parser.boundary_names().to_vec();
+    // Read before synthetic asset roots parse because module entry sources are
+    // entry-local. Boundary declarations live in the fragment graph itself.
     let module_entry_srcs = parser.module_entry_srcs().to_vec();
 
     let synthetic_asset_fragments =
@@ -655,19 +651,22 @@ fn build_protocol_inner(options: &BuildOptions) -> Result<RawBuildOutput, WebUIE
     for fragment_id in synthetic_asset_fragments {
         fragment_records.remove(&fragment_id);
     }
+    let boundary_count = fragment_records
+        .values()
+        .flat_map(|list| list.fragments.iter())
+        .filter(|fragment| {
+            matches!(
+                fragment.fragment.as_ref(),
+                Some(webui_protocol::web_ui_fragment::Fragment::Boundary(boundary))
+                    if boundary.phase() == webui_protocol::BoundaryPhase::Start
+            )
+        })
+        .count();
     // Resolve projection only after template compilation. Ordinary path/inline
     // builds pay the same validation cost, while orchestrators can overlap
     // parser work with an in-flight client bundle through a pending source.
     let merged_manifest = projection::load_and_merge(&options.projection_manifests)?;
     let mut protocol = WebUIProtocol::with_tokens(fragment_records, token_analysis.protocol_tokens);
-    if !boundary_names.is_empty() {
-        protocol.streaming_boundaries.insert(
-            options.entry.clone(),
-            webui_protocol::StreamingBoundaryList {
-                names: boundary_names,
-            },
-        );
-    }
     protocol.initial_state_strategy = if merged_manifest.is_some() {
         webui_protocol::InitialStateStrategy::Components as i32
     } else {
@@ -1007,12 +1006,23 @@ mod tests {
             result.protocol.initial_state_strategy,
             webui_protocol::InitialStateStrategy::Full as i32
         );
-        assert_eq!(
-            result.protocol.streaming_boundaries["index.html"].names,
-            ["a", "b"]
-        );
+        let boundary_names = |protocol: &WebUIProtocol| {
+            protocol.fragments["index.html"]
+                .fragments
+                .iter()
+                .filter_map(|fragment| match fragment.fragment.as_ref() {
+                    Some(webui_protocol::web_ui_fragment::Fragment::Boundary(boundary))
+                        if boundary.phase() == webui_protocol::BoundaryPhase::Start =>
+                    {
+                        Some(boundary.name.clone())
+                    }
+                    _ => None,
+                })
+                .collect::<Vec<_>>()
+        };
+        assert_eq!(boundary_names(&result.protocol), ["a", "b"]);
         let decoded = WebUIProtocol::from_protobuf(&result.protocol_bytes).unwrap();
-        assert_eq!(decoded.streaming_boundaries["index.html"].names, ["a", "b"]);
+        assert_eq!(boundary_names(&decoded), ["a", "b"]);
         let warning = result
             .warnings
             .iter()
diff --git a/crates/webui/src/server.rs b/crates/webui/src/server.rs
index 2d6d118d2..a1a058e77 100644
--- a/crates/webui/src/server.rs
+++ b/crates/webui/src/server.rs
@@ -154,12 +154,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -207,12 +209,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
@@ -257,12 +261,14 @@ mod tests {
             "index.html".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::component("my-page")],
+                contains_boundary: false,
             },
         );
         fragments.insert(
             "my-page".to_string(),
             FragmentList {
                 fragments: vec![WebUIFragment::raw("<p>page</p>")],
+                contains_boundary: false,
             },
         );
 
diff --git a/docs/.webui-press/config.json b/docs/.webui-press/config.json
index 252838dbc..0b7c20dfd 100644
--- a/docs/.webui-press/config.json
+++ b/docs/.webui-press/config.json
@@ -161,7 +161,11 @@
             "link": "/guide/integrations/electron"
           },
           {
-            "text": "C / C# / FFI",
+            "text": ".NET",
+            "link": "/guide/integrations/dotnet"
+          },
+          {
+            "text": "C / FFI",
             "link": "/guide/integrations/ffi"
           },
           {
diff --git a/docs/ai/SKILL.md b/docs/ai/SKILL.md
index ab38bf423..58d0ed589 100644
--- a/docs/ai/SKILL.md
+++ b/docs/ai/SKILL.md
@@ -720,54 +720,58 @@ removal, or reordering shifts compiled element indices.
 
 ### Progressive streaming hydration
 
-Use `<boundary>` only when the Rust server calls
-`WebUIHandler::render_streaming` / `WebUIHandler::stream_response` with a
-`FlushWriter`, or when an API backend returns the versioned
-`application/x-webui-stream` control format to `webui serve --api-port`. The
-directive is removed at compile time and emits no application DOM wrapper.
+`<boundary>` is a compile-time checkpoint directive for progressive sessions.
+It is valid in entries and reusable components, including runtime conditions,
+loops, outlets, and selected route content.
 
 ```html
+<!-- index.html -->
 <head>
   <script type="module" async src="/index.js"></script>
 </head>
 <body>
-  <boundary name="weather-shell">
-    <weather-panel status="loading"></weather-panel>
-  </boundary>
+  <ntp-page></ntp-page>
+</body>
+```
 
-  <boundary name="critical-composer">
-    <message-composer></message-composer>
+```html
+<!-- ntp-page.html -->
+<main>
+  <boundary name="search-ready">
+    <search-box query="{{query}}"></search-box>
   </boundary>
-</body>
+  <section>{{slowFeed}}</section>
+</main>
 ```
 
-- `name` is required, non-empty, static, and unique in the entry template. It
+- `name` is required, non-empty, static, and unique within its entry or
+  component owner. It
   cannot contain a <code v-pre>{{binding}}</code>.
-- Author boundaries only in the outermost entry template. They cannot appear
-  inside reusable components, route-shell components, `<if>`, `<for>`,
-  `<route>`, or another boundary. An entry-level boundary can fully wrap those
-  complete scopes.
-- Every registered WebUI component rendered in streaming mode must be inside
-  an explicit boundary. Native HTML and unregistered static tail markup may
-  remain outside.
+- Boundaries may appear inside reusable components, true `<if>` paths, each
+  `<for>` iteration, and selected route content. Authored boundaries may not
+  contain another authored boundary directly or transitively.
+- A declaration that can repeat requires `key`; it must resolve to a unique live
+  string or finite number.
 - Never author `<webui-hydrate>`. It is reserved generated runtime output.
 - Put the async application module in `<head>` before boundary content and
   import `@microsoft/webui-framework/streaming.js` before component
   registration modules.
-- Boundary HTML commits strictly in document order. For slow backend state,
-  commit a complete component shell as `BoundaryMode::Updatable`, then call
-  `StreamingResponse::update` when data resolves. Updates interleave on the
-  original response and call `setState()` without rerunning hydration or
-  `hydratedCallback()`.
-- Resolve free-form names once with `StreamingResponse::boundary`; hot writes
-  use integer `BoundaryId` handles. Call `write_shell`, ordered
-  `write_boundary`, interleavable `update`, then `finish`.
+- `start(state)` and `resume(instanceId, state, mode)` return the next runtime
+  descriptor `{ instanceId, declarationId, owner, name, key }` plus `done`.
+  The done step already includes terminal and parent tail bytes.
+- `update(instanceId, patch)` accepts only a committed updatable occurrence.
+  It calls `setState()` without inserting markup, rerunning hydration, or
+  rerunning `hydratedCallback()`.
+- State resolution across a suspension is lexical locals, resume state, then
+  the frozen projected parent state.
+- A component-local boundary uses generated parent spans. Its early marked child
+  may hydrate before the opaque parent tail in light or shadow DOM.
 - `webui:boundary-hydrated` is emitted only when
   `window.__WEBUI_STREAMING_DEBUG__ === true`; its `detail.kind` is
-  `checkpoint`, `update`, or `terminal`. Every commit also emits an
+  `checkpoint`, `span`, `update`, or `terminal`. Every commit also emits an
   unconditional `performance.mark()` (`webui:boundary:<id>`,
-  `webui:boundary:<id>:update`, `webui:streaming:terminal`) that tooling can
-  read retroactively without a listener.
+  `webui:boundary:<id>:update`, `webui:span:<id>`,
+  `webui:streaming:terminal`) that tooling can read retroactively.
   `webui:hydration-complete` fires only after the terminal record and eager
   pending hydration work complete. Visibility-deferred lazy roots do not keep
   this one-shot startup event open.
@@ -779,13 +783,10 @@ directive is removed at compile time and emits no application DOM wrapper.
 
 Malformed directives use stable diagnostics:
 `missing-boundary-name`, `invalid-boundary-name`,
-`duplicate-boundary-name`, `nested-boundary`, `boundary-crosses-scope`, and
-`authored-webui-hydrate`.
-
-Dynamic append streams, out-of-order replacement, router-stream reuse, direct
-Node/FFI/WASM response sessions, and declarative partial updates are not part of
-this contract. Node can drive the CLI bridge, but the CLI remains the Rust
-session and transport owner.
+`duplicate-boundary-name`, `missing-boundary-key`,
+`invalid-boundary-key`, `nested-boundary`, `boundary-crosses-scope`, and
+`authored-webui-hydrate`. Malformed browser records fail closed and release
+discoverable deferred state within fixed bounds.
 
 ### Lazy component mounting
 
@@ -1205,31 +1206,36 @@ renders before spawning it, and configure the transport's flush timeout.
 
 ```rust
 let mut page = handler.stream_response(&protocol, &options, &mut writer)?;
-let critical = page.boundary("critical-composer")?;
-page.write_shell(&state)?;
-page.write_boundary(critical, &state, BoundaryMode::Final)?;
-page.finish(&state)?;
+let mut step = page.start(&initial_state)?;
+while !step.done {
+    let boundary = step.boundary.as_ref().ok_or_else(missing_boundary)?;
+    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+    step = page.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+}
 ```
 
 With `webui serve --api-port`, a Node or other HTTP backend can return
 newline-delimited control records instead:
 
 ```text
-{"type":"shell","version":1,"state":{...}}
-{"type":"boundary","name":"critical-composer"}
-{"type":"finish"}
+{"type":"start","version":2,"state":{"query":""}}
+{"type":"resume","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":""},"mode":"updatable"}
+{"type":"update","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":"webui"}}
 ```
 
 Honor HTTP write backpressure and cap concurrent streams. The CLI uses a
-capacity-one command channel, resolves boundary names once, and keeps the
-compiled protocol plus browser-facing bytes in Rust. Returning JSON keeps the
-buffered state path.
+capacity-one command channel and matches each nested `boundary` target by
+descriptor `owner`, `name`, and optional `key` (plus optional
+`declarationId`). It keeps response-local instance IDs, the compiled protocol,
+and browser-facing bytes in Rust. The control stream ends after the start or
+resume that completes the response. Returning JSON keeps the buffered state
+path.
 
 If the backend refuses a stream request (non-success status such as a `503`
-from its own concurrency cap), no boundary was ever sent, so `webui serve` logs
+from its own concurrency cap), no response bytes were sent, so `webui serve` logs
 one warning and renders the page from fallback state rather than replacing the
 app with the upstream error body. A failure *after* the stream is live still
-fails the response, because boundaries already flushed cannot be rewound.
+fails the response, because bytes already flushed cannot be rewound.
 
 Equivalent APIs exist for WebAssembly, Python (native `microsoft-webui`
 package), Go (cgo), and C#. For `Router.ensureLoaded()`, expose
diff --git a/docs/guide/cli/index.md b/docs/guide/cli/index.md
index e25562d23..a5139629b 100644
--- a/docs/guide/cli/index.md
+++ b/docs/guide/cli/index.md
@@ -299,21 +299,29 @@ For progressive HTML, the server sends
 backend can return a versioned NDJSON control stream:
 
 ```text
-{"type":"shell","version":1,"state":{"feedBatch1":[]}}
-{"type":"boundary","name":"weather-shell","mode":"updatable"}
-{"type":"boundary","name":"composer-ready"}
-{"type":"update","name":"weather-shell","state":{"status":"ready"}}
-{"type":"finish"}
+{"type":"start","version":2,"state":{"query":""}}
+{"type":"resume","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":""},"mode":"updatable"}
+{"type":"update","boundary":{"owner":"ntp-page","name":"search-ready"},"state":{"query":"webui"}}
 ```
 
-The CLI keeps the compiled protocol and browser transport. Boundary names
-resolve once to integer handles, a capacity-one command channel preserves
-backpressure, and each record is capped at 2,000,000 bytes. Omitted boundary or
-finish state reuses the shell state. Before HTTP 200, initial shell chunks are
-staged without copying up to a 4,000,000-byte limit; larger shells return an
-error. Dropping the browser response cancels the backend stream. The backend
-must honor its HTTP writer's backpressure signal and cap concurrent streams.
-Returning JSON retains the ordinary buffered behavior. See
+`start` appears once. It renders until the first runtime occurrence or terminal.
+Each `resume.boundary` must match the descriptor currently returned by WebUI
+using `owner`, `name`, and `key`; omit `key` only when that descriptor has none.
+An optional `declarationId` can tighten the match. Resume `state` is passed to
+that occurrence and `mode` is `final` by default or `updatable`.
+`update.boundary` uses the same identity to target one previously committed
+updatable occurrence and requires object-valued `state`.
+
+The stream ends after the `start` or `resume` that completes the response. The
+final bytes already contain the terminal record, so there is no separate end
+command.
+
+The CLI owns response-local instance IDs and the browser transport. A
+capacity-one command channel preserves backpressure, and each record is capped
+at 2,000,000 bytes. Before HTTP 200, bytes from `start` are staged without
+copying up to a 4,000,000-byte limit. Dropping the browser response cancels the
+backend stream. The backend must honor its HTTP writer's backpressure signal and
+cap concurrent streams. Returning JSON retains ordinary buffered behavior. See
 [`<boundary>`](/guide/concepts/directives/boundary) and
 `examples/app/streaming`.
 
@@ -323,7 +331,7 @@ cap, `webui serve` logs one warning and still renders the page from fallback
 state. A refused request never started a stream, so it degrades the same way an
 unreachable backend does instead of replacing your app with the upstream error
 body. A failure that occurs *after* the stream is live still fails the response,
-because boundaries already sent to the browser cannot be rewound.
+because bytes already sent to the browser cannot be rewound.
 
 After generated assets and `--servedir` files miss, route fallback is based on
 the `Accept` header. Requests that explicitly accept `text/html` or
diff --git a/docs/guide/concepts/directives/boundary.md b/docs/guide/concepts/directives/boundary.md
index 3bc0266c1..483c733b2 100644
--- a/docs/guide/concepts/directives/boundary.md
+++ b/docs/guide/concepts/directives/boundary.md
@@ -1,171 +1,173 @@
 # Streaming Boundaries
 
-`<boundary>` splits an entry page into complete regions that WebUI can flush
-and hydrate before the full response arrives.
+`<boundary>` marks a complete region that WebUI can render, flush, and hydrate
+before the rest of the response arrives. It is a compile-time directive and
+does not create a DOM wrapper.
 
-A boundary is a compile-time directive, not a DOM element. WebUI removes it
-from the rendered HTML and streams its children in normal document order.
+## Put boundaries where readiness changes
 
-## 1. Author the checkpoints
+An entry can contain one component while that component owns the useful
+checkpoint:
 
-Put boundaries around independently useful page regions, ordered by priority:
+```html
+<!-- index.html -->
+<html>
+  <head>
+    <script type="module" async src="/index.js"></script>
+  </head>
+  <body>
+    <ntp-page></ntp-page>
+  </body>
+</html>
+```
 
 ```html
-<head>
-  <script type="module" async src="/index.js"></script>
-</head>
-<body>
-  <boundary name="weather-shell">
-    <weather-panel status="loading"></weather-panel>
-  </boundary>
+<!-- ntp-page.html -->
+<main>
+  <h1>{{title}}</h1>
 
-  <boundary name="composer-ready">
-    <message-composer></message-composer>
+  <boundary name="search-ready">
+    <search-box query="{{query}}"></search-box>
   </boundary>
 
-  <boundary name="feed">
-    <activity-feed></activity-feed>
-  </boundary>
-</body>
+  <section class="feed">{{slowFeed}}</section>
+</main>
 ```
 
-Import the streaming coordinator before component registration modules:
+The server discovers `search-ready` while rendering `<ntp-page>`. It can commit
+and hydrate `<search-box>` before the remaining parent content arrives. WebUI
+creates the required parent span automatically. Do not add an outer boundary
+around `<ntp-page>`.
+
+Load the coordinator before component registrations:
 
 ```typescript
 import '@microsoft/webui-framework/streaming.js';
-import './weather-panel/weather-panel.js';
-import './message-composer/message-composer.js';
-import './activity-feed/activity-feed.js';
+import './ntp-page.js';
+import './search-box.js';
 ```
 
-The application module must be `async` and appear in `<head>` before boundary
-content so early checkpoints can hydrate while the document is still parsing.
+The application entry must load early with `async`, or an equivalent
+non-blocking strategy, in `<head>`.
 
-## 2. Choose how the server drives the response
+## Runtime occurrences
 
-| Need | Use |
-|---|---|
-| Render all boundaries immediately with one state value | Rust `WebUIHandler::render_streaming` |
-| Control when each boundary commits or send later state | Rust `WebUIHandler::stream_response` |
-| Let an API backend control readiness while `webui serve` owns rendering | `webui serve --api-port` |
-| Stream directly from Node, WASM, .NET, or C | That handler's streaming session API |
+A declaration becomes an occurrence only when rendering reaches it. Boundaries
+are allowed in:
 
-All paths produce the same ordered browser protocol.
+- entry templates
+- reusable component templates
+- true `<if>` branches
+- each `<for>` iteration
+- selected route content and outlets
 
-## 3. Drive a host-controlled response
+False conditions, empty loops, and unselected routes produce no occurrence.
+The host receives the next occurrence as:
 
-Resolve authored names once to integer boundary handles. Then use these four
-operations:
+```text
+{ instanceId, declarationId, owner, name, key }
+```
 
-| Operation | Purpose |
-|---|---|
-| `write_shell(state)` | Flush everything before the first boundary |
-| `write_boundary(id, state, mode)` | Render and flush the next boundary |
-| `update(id, state)` | Patch an earlier boundary committed as `Updatable` |
-| `finish(state)` | Render the tail, emit the terminal record, and end the response |
+- `instanceId` identifies this occurrence in one response.
+- `declarationId` identifies the compiled declaration.
+- `owner` is the entry or component template that authored it.
+- `name` is unique only within that owner.
+- `key` identifies a repeated occurrence.
 
-The required order is:
+Use `owner`, `name`, and `key` to decide what state to load. Pass `instanceId`
+back to the session.
 
-```text
-write_shell -> write_boundary* -> finish
+### Repeated boundaries need keys
+
+```html
+<for each="result in results">
+  <boundary name="result-actions" key="{{result.id}}">
+    <result-actions result-id="{{result.id}}"></result-actions>
+  </boundary>
+</for>
 ```
 
-`update` may run between boundary writes, but only after its target has
-committed as updatable.
+A repeated declaration must have a key. At runtime the key must resolve to a
+string or finite JSON number, and live occurrences of that declaration must
+have unique keys. This also applies when a component containing a boundary is
+rendered more than once.
 
-```rust
-use webui::{BoundaryMode, RenderOptions, WebUIHandler};
+## Drive the response
+
+Every host binding exposes the same three operations:
+
+| Operation | Result |
+|---|---|
+| `start(state)` | Bytes through the first occurrence, or a completed step |
+| `resume(instanceId, state, mode)` | Commit that pending occurrence and continue |
+| `update(instanceId, patch)` | State-only bytes for a committed updatable occurrence |
+
+`start` and `resume` return bytes, `done`, and the next optional descriptor.
+When `done` is true, those bytes already include the parent tail, terminal
+record, and document close.
 
-let options = RenderOptions::new("index.html", "/");
+```rust
 let mut response =
     handler.stream_response(&protocol, &options, &mut writer)?;
-
-let weather = response.boundary("weather-shell")?;
-let composer = response.boundary("composer-ready")?;
-let feed = response.boundary("feed")?;
-
-response.write_shell(&page_state)?;
-response.write_boundary(
-    weather,
-    &loading_weather,
-    BoundaryMode::Updatable,
-)?;
-response.write_boundary(
-    composer,
-    &composer_state,
-    BoundaryMode::Final,
-)?;
-
-response.update(weather, &ready_weather)?;
-response.write_boundary(feed, &feed_state, BoundaryMode::Final)?;
-response.finish(&tail_state)?;
+let mut step = response.start(&initial_state)?;
+
+while !step.done {
+    let boundary = step.boundary.as_ref().expect("pending descriptor");
+    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref());
+    step = response.resume(
+        boundary.instance_id,
+        &state,
+        BoundaryMode::Final,
+    )?;
+}
 ```
 
-Boundary HTML always commits once in declaration order. Backend work may run
-concurrently, but a later boundary cannot overtake an earlier one.
+The example uses `expect` only for brevity. Production code should return an
+error if an unfinished step has no descriptor.
 
-### Final or updatable?
+### Final or updatable
 
-| Mode | Use it when | Browser retention |
-|---|---|---|
-| `Final` | The boundary needs no later server state | Releases boundary roots after hydration |
-| `Updatable` | A complete shell should hydrate now and receive state later | Retains only successfully activated roots until `finish` |
+| Mode | Use when |
+|---|---|
+| `Final` | No later server state is needed |
+| `Updatable` | Complete HTML should hydrate now and accept state later |
 
-Use `Final` by default. An update calls the component's normal `setState()`
-path and never re-runs hydration or `hydratedCallback()`. If the component
-module is still loading, WebUI hydrates the server-rendered DOM first, then
-replays the latest queued patch through `setState()`.
+An update is a shallow projected state patch. It uses the component's normal
+reactive `setState()` path. It does not insert markup, replace DOM, or rerun
+hydration or `hydratedCallback()`.
 
-## 4. Drive streaming through `webui serve`
+## State at a suspension
 
-With `webui serve --api-port`, the API backend can return newline-delimited
-control records:
+WebUI freezes only the projected parent keys needed to continue, plus lexical
+locals such as the current loop item and component attributes. Resume state
+overlays that frozen parent state. Resolution order remains:
 
-```text
-{"type":"shell","version":1,"state":{"feed":[]}}
-{"type":"boundary","name":"weather-shell","mode":"updatable"}
-{"type":"boundary","name":"composer-ready"}
-{"type":"update","name":"weather-shell","state":{"status":"ready"}}
-{"type":"boundary","name":"feed"}
-{"type":"finish"}
-```
+1. lexical locals
+2. state supplied to `resume`
+3. frozen parent state
 
-These records go from the backend to the CLI, not to the browser. The CLI
-resolves names, renders the compiled template in Rust, and streams the resulting
-HTML. See [`webui serve --api-port`](/guide/cli/) for limits and fallback
-behavior.
+This lets a loop body keep `item` while a host supplies fresh boundary data.
 
 ## Authoring rules
 
-- `name` is required, static, non-empty, and unique in the entry template.
-- Author boundaries only in the outermost entry template.
-- Boundaries cannot nest or appear inside `<if>`, `<for>`, or `<route>`.
-  They may wrap a complete directive scope.
-- Do not place a boundary inside registered component host content, raw or
-  inert elements such as `<script>` or `<template>`, or table/select parser
-  contexts. Wrap the complete host, element, or table instead.
-- Every registered WebUI component rendered in streaming mode must be inside
-  an explicit boundary. Native static HTML may remain outside.
-- Never author `<webui-hydrate>`; it is generated runtime output.
+- `name` is required, static, non-empty, and unique within its owner.
+- Authored boundaries cannot contain another boundary, directly or through a
+  component or runtime branch.
+- A repeated declaration requires `key`.
+- Do not place a boundary in component host children, raw or inert elements,
+  authored `<template>`, or table/select foster-parenting contexts.
+- Never author `<webui-hydrate>` or the `data-ws*` attributes. WebUI owns them.
 
-Invalid placement fails the build with an actionable diagnostic.
+Invalid authoring fails the build with a stable diagnostic and actionable help.
 
 ## Production checklist
 
-- Pass the generated `webui-projection.json` to `BuildOptions` in custom Rust
-  builds. Without it, every checkpoint falls back to serializing full state.
-- Preserve HTTP backpressure and cap concurrent streaming renders.
-- Disable reverse-proxy response buffering for the streaming route, for example
-  with `X-Accel-Buffering: no` in nginx.
-- Use an updatable boundary for slow data instead of blocking later
-  checkpoints.
-- Use `examples/app/streaming` as the complete reference application.
-
-## More detail
-
-- [Rust streaming integration](/guide/integrations/rust#streaming-ssr)
-- [Node streaming sessions](/guide/integrations/node#progressive-streaming)
-- [WASM streaming sessions](/guide/integrations/wasm#streamingsession)
-- [C and FFI streaming sessions](/guide/integrations/ffi)
-- [Hydration lifecycle and diagnostics](/guide/concepts/hydration#progressive-streaming-hydration)
-- [Performance model](/guide/concepts/performance)
+- Preserve HTTP backpressure and cap concurrent rendering sessions.
+- Disable response buffering in proxies and CDNs where appropriate.
+- Pass the request CSP nonce so generated record scripts are allowed.
+- Supply a projection manifest to keep checkpoint state local and small.
+- Use `Final` unless later state is required.
+
+See [Hydration](/guide/concepts/hydration#progressive-streaming-hydration),
+[Performance](/guide/concepts/performance), and the
+[integration guides](/guide/integrations/) for host-specific examples.
diff --git a/docs/guide/concepts/directives/index.md b/docs/guide/concepts/directives/index.md
index 0665278a3..6a22198f8 100644
--- a/docs/guide/concepts/directives/index.md
+++ b/docs/guide/concepts/directives/index.md
@@ -11,7 +11,7 @@ WebUI Framework provides the following core directives:
 - [**`<if>` Conditional Rendering**](./if) - Conditionally render content based on expressions
 - [**`<for>` Loop Iteration**](./for) - Iterate over collections to generate repeated content
 - [**`<route>` Routing**](./route) - Define client-side routes that map URL paths to components
-- [**`<boundary>` Streaming Boundary**](./boundary) - Flush and hydrate complete entry-page regions in document order
+- [**`<boundary>` Streaming Boundary**](./boundary) - Discover and hydrate complete regions inside entries and reusable components
 - [**Lazy Component Policy**](./lazy) - Defer offscreen rendering and hydration with root-template attributes
 - [**`{{}}` Signal Binding**](./signals) - Insert dynamic values with automatic HTML escaping
 - [**`{{{}}}` Raw Signal Binding**](./signals#raw-signals) - Insert unescaped HTML content
diff --git a/docs/guide/concepts/hydration.md b/docs/guide/concepts/hydration.md
index c5a4806d0..130cadfa6 100644
--- a/docs/guide/concepts/hydration.md
+++ b/docs/guide/concepts/hydration.md
@@ -176,85 +176,57 @@ Call the same idempotent method from `@load` and `@error`.
 
 ## Progressive Streaming Hydration
 
-WebUI can hydrate an explicit, complete entry-page region while the document
-is still loading. Author a
-[`<boundary>`](/guide/concepts/directives/boundary), then serve the page
-with the Rust `WebUIHandler::render_streaming` API or a versioned backend
-control stream through `webui serve --api-port`.
+WebUI can hydrate a complete child region while its reusable parent component
+is still rendering. Author a
+[`<boundary>`](/guide/concepts/directives/boundary) where readiness changes:
 
 ```html
+<!-- index.html -->
 <head>
-  <!-- Must be ahead of boundary content and able to run during parsing. -->
   <script type="module" async src="/index.js"></script>
 </head>
 <body>
-  <header>
-    <boundary name="weather-shell">
-      <weather-panel status="loading"></weather-panel>
-    </boundary>
-  </header>
-
-  <boundary name="critical-composer">
-    <message-composer></message-composer>
-  </boundary>
+  <ntp-page></ntp-page>
+</body>
+```
 
-  <boundary name="low-priority-feed">
-    <activity-feed></activity-feed>
+```html
+<!-- ntp-page.html -->
+<main>
+  <h1>{{title}}</h1>
+  <boundary name="search-ready">
+    <search-box query="{{query}}"></search-box>
   </boundary>
-</body>
+  <section>{{slowFeed}}</section>
+</main>
 ```
 
-Import the streaming entry before component registration modules:
+Import the coordinator before registrations:
 
 ```typescript
 import '@microsoft/webui-framework/streaming.js';
-import './weather-panel/weather-panel.js';
-import './message-composer/message-composer.js';
-import './activity-feed/activity-feed.js';
+import './ntp-page.js';
+import './search-box.js';
 ```
 
-The streaming entry installs the coordinator synchronously. It is separate from
-the default framework entry so non-streaming applications do not download,
-parse, or initialize streaming code. The application module must use `async`,
-or an equivalent non-blocking loading strategy, in `<head>` before the first
-boundary. A normal module script is deferred until parsing completes and
-defeats early hydration. The parser currently validates boundary syntax and
-placement, but does not validate this script loading order.
-
-The server commits boundary HTML in document order. In this example the weather
-shell commits first as an updatable boundary, so it never delays the critical
-composer. The host starts forecast work concurrently and sends a projected state
-record to the weather boundary whenever it resolves, including between feed
-checkpoints.
-
-The state record uses the original open HTML response. It invokes component
-reactivity without rerunning hydration or `hydratedCallback()`, and it does not
-replace or relocate server markup. If the weather class is still downloading,
-WebUI merges the patch into its pending activation state and activates once with
-the newest values. This keeps the critical island's time to interactive
-independent of the slow surface without a client fetch.
-
-See `examples/app/streaming` for a complete working version of this pattern.
-
-Every registered WebUI component rendered through `render_streaming` must be
-inside an explicit boundary. Native HTML and unregistered static tail markup can
-remain outside. This lets the handler mark each streamed SSR component before
-custom-element upgrade and guarantees that a later checkpoint can activate it.
-The checkpoint also includes metadata and projected state for descendants that
-are reachable inside those roots but initially hidden by a false condition or
-empty repeat. It does not include unrelated components rooted in later
-boundaries, and its inventory marks only SSR roots that actually rendered.
+The entry uses one `<ntp-page>`. When traversal reaches its internal boundary,
+WebUI pauses and returns a runtime descriptor to the host. Resuming that
+occurrence commits `<search-box>`, which can become interactive before the
+remaining parent section arrives. Boundaries can also occur in true
+conditions, loop iterations, and selected route content.
 
 ### Timing and lifecycle
 
-When a component calls `.define()` before its streamed template metadata
-arrives, WebUI delays the native custom-element definition. Browsers snapshot
-`observedAttributes` at definition time, so defining early would permanently
-lose template-derived attribute observation. When a boundary arrives before its
-component module, it waits on one custom-element definition reaction per tag.
-An undefined outer root is an activation barrier for its descendants. Once the
-outer definition and metadata are ready, WebUI hydrates parent first, then
-descendants, without waiting for `DOMContentLoaded`.
+When a boundary pauses inside a component, WebUI generates a span around the
+unfinished parent. The early child is compiler-marked to bypass exactly that
+nearest parent barrier. Other descendants stay opaque until the parent span
+completes. The same bounded traversal works in light DOM and across open shadow
+roots and slots.
+
+When a component calls `.define()` before streamed template metadata arrives,
+WebUI delays native definition because browsers snapshot `observedAttributes`
+at definition time. When a checkpoint arrives first, undefined roots share one
+definition waiter per tag. Parents hydrate before ordinary descendants.
 
 Use `hydratedCallback()` for setup that needs bindings, events, or `w-ref`
 references. It runs synchronously exactly once after the first successful
@@ -268,17 +240,12 @@ WebUI dispatches these events on `window`:
 
 - `webui:boundary-hydrated` after each commit, only when
   `window.__WEBUI_STREAMING_DEBUG__ === true`. Its `CustomEvent.detail` contains
-  `{ sequence, terminal, kind }`, where `kind` is `"checkpoint"`, `"update"`, or
-  `"terminal"`. Sequence numbers are response order, not authored boundary
-  names. Keep this diagnostics flag off in production to avoid one event
-  allocation per commit.
+  `{ sequence, terminal, kind }`. Sequence numbers are response order, not
+  authored names. Keep this diagnostics flag off in production.
 - `webui:hydration-complete` once the empty terminal record has arrived and no
-  eager component or boundary remains pending. On a streaming page, it means the
-  complete response hydration lifecycle is done, not merely that the first
-  interactive boundary is ready. On ordinary parser startup, WebUI waits through
-  `DOMContentLoaded` and the first intersection result for each lazy root.
-  Initially visible roots finish before the event; roots classified as dormant
-  do not keep it open and do not redispatch it when they activate later.
+  eager component, checkpoint, generated span, definition waiter, or ancestor
+  barrier remains pending. It means the complete response lifecycle is done,
+  not merely that the first interactive child is ready.
 
 ### Measuring commits in production
 
@@ -292,6 +259,7 @@ no listener:
 | --- | --- |
 | `webui:boundary:<id>` | A checkpoint commits |
 | `webui:boundary:<id>:update` | A projected state update is applied |
+| `webui:span:<id>` | A generated parent span completes |
 | `webui:streaming:terminal` | The terminal record settles |
 
 Because marks sit in the performance timeline, they can be read at any later
@@ -303,16 +271,15 @@ const commits = performance
   .filter((entry) => entry.name.startsWith("webui:"));
 ```
 
-`<id>` is the integer boundary ID, not the authored name — name strings never
-reach the response. The ID is the boundary's declaration index, so your build
-manifest maps it back to the authored name offline.
+Boundary `<id>` values are response-local occurrence IDs, not declaration IDs
+or authored names. Span IDs use a separate response-local namespace.
 
 ### Hydrating across several tasks
 
 By default the coordinator drains its queue in one pass, which reaches
 interactivity soonest. That assumes boundaries arrive spread across the
-response. If an intermediary buffers and coalesces the response, they can all
-arrive at once and hydrate in a single long task — exactly what streaming is
+response. If an intermediary buffers and coalesces the response, records can all
+arrive at once and hydrate in a single long task - exactly what streaming is
 meant to avoid.
 
 Set a millisecond budget to make the coordinator yield to the browser between
@@ -327,30 +294,16 @@ the last boundary's interactivity for responsiveness during hydration, so leave
 it unset unless you have measured a long task. Record order and every
 correctness guarantee are unchanged.
 
-After a checkpoint commits, WebUI removes its generated payload, sentinel, and
-marker nodes, plus the temporary streamed-host identity. Final boundaries
-release their root list immediately. Updatable boundaries retain only their root
-references and latest shallow patch until the terminal record. Boundary-local
-state is never copied into `window.__webui.state`. Applications should not query
-or depend on generated scaffolding.
-
-At `body_end`, the handler emits one markerless empty terminal envelope:
-`[1,nextSequence,3,0,{}]`. Its flush also commits any preceding native or static
-tail HTML, but terminal records never repeat template metadata or state. A
-truncated or malformed stream, or one exceeding a client work bound such as the
-queued-boundary or marker-scan limit, logs an error, suppresses
-`webui:hydration-complete`, and releases discoverable deferred state within
-fixed bounds. Valid commits perform no document-wide scan; a bounded sweep is a
-fatal-cleanup fallback only.
-
-The client trusts records past three checks, because the same WebUI version
-wrote them: `JSON.parse` (which alone detects any truncation, since a cut-off
-record is never valid JSON), a five-element array, and the envelope `version`.
-Everything else is enforced where it is actually knowable — a sequence or
-boundary-target mismatch halts the stream, and a defective payload fails the
-commit closed. Unrecognized *additive* payload fields are ignored rather than
-fatal, so a cached older bundle keeps working against a newer server; anything
-incompatible bumps `version` instead.
+After a checkpoint commits, WebUI removes its generated payload, sentinel,
+markers, and temporary attributes. Final occurrences release roots immediately.
+Updatable occurrences retain only live roots and a pending shallow patch until
+terminal.
+
+The browser protocol is `[2, sequence, kind, target, payload]`. Kinds are final
+checkpoint, updatable checkpoint, update, generated span completion, and
+terminal. A malformed, truncated, out-of-order, or over-limit stream fails
+closed, suppresses successful completion, and releases discoverable deferred
+state within fixed bounds.
 
 ### CSP and delivery
 
@@ -363,18 +316,13 @@ HTTP transport. A server adapter, compression layer, CDN, or reverse proxy can
 still buffer those bytes. Disable response buffering where appropriate and
 verify early delivery through the production path.
 
-### Current limits
-
-Progressive streaming hydration is exposed by the Rust handler and browser
-coordinator. Boundary markup is strictly in authored order, while markerless
-state records can interleave. The following are not implemented APIs:
+### Updates
 
-- Dynamic `<webui-stream>`, `page.append()`, or
-  `begin_append()` / `commit()` APIs
-- Out-of-order same-response replacement
-- Streaming reuse by router partial navigations
-- Node, FFI/.NET, WASM, or other host-language response sessions
-- Declarative partial-update APIs
+Commit an occurrence as updatable only when complete SSR markup should become
+interactive before its slow state resolves. `update(instanceId, patch)` applies
+projected state through normal reactivity. It never inserts or replaces markup
+and never reruns hydration. If the class or parent barrier is still pending,
+WebUI queues one shallow patch and applies it after successful activation.
 
 ## Build-Time State Projection
 
diff --git a/docs/guide/concepts/interactivity.md b/docs/guide/concepts/interactivity.md
index 0fa2954f6..ab3d333be 100644
--- a/docs/guide/concepts/interactivity.md
+++ b/docs/guide/concepts/interactivity.md
@@ -653,8 +653,8 @@ Follow these rules to stay correct:
 
 On a normal buffered page or client-created mount,
 `super.connectedCallback()` hydrates synchronously. A progressive streaming host
-can connect while its `data-ws` boundary is incomplete, however, so the same call
-returns while hydration is still deferred. `hydratedCallback()` is the
+can connect while its checkpoint or generated parent span is incomplete, so the
+same call returns while hydration is still deferred. `hydratedCallback()` is the
 cross-mode lifecycle: WebUI invokes it synchronously exactly once after the
 first successful hydration or mount. Its once-latch is set before author code,
 so reconnecting the element or throwing from the callback does not retry it.
@@ -664,7 +664,7 @@ non-async ES module script or a classic `defer` script. If a classic script
 blocks parsing, place it after every SSR instance it may upgrade. An opt-in
 [progressive streaming page](/guide/concepts/hydration#progressive-streaming-hydration)
 instead loads an early async module and gates each component until its complete
-streaming boundary commits.
+streaming occurrence or generated span commits.
 
 Descendants must not structurally mutate a containing WebUI component's SSR
 subtree before that component hydrates. Inserting, removing, or reordering nodes
diff --git a/docs/guide/concepts/performance.md b/docs/guide/concepts/performance.md
index f5402d910..33cf7a9a3 100644
--- a/docs/guide/concepts/performance.md
+++ b/docs/guide/concepts/performance.md
@@ -194,30 +194,29 @@ Each layer of the architecture contributes to the overall performance profile:
   build deterministic indices once at startup rather than repeating that work
   per request.
 
-- **Streaming output with explicit checkpoints.** The Rust
-  `webui::streaming::StreamingWriter` coalesces writes into chunks and uses a
-  bounded `tokio::mpsc` channel for backpressure. A shared `ChunkPool` can
-  recycle buffers across requests, and a configurable flush deadline bounds
-  how long a render thread waits on a slow consumer. With
-  `WebUIHandler::render_streaming`, authored `<boundary>` checkpoints
-  request a semantic transport flush and can hydrate in document order before
-  the response completes. Each checkpoint emits state and newly needed metadata
-  only for the local component surface reachable from its rendered roots,
-  including initially hidden descendants; inventory still records only actual
-  SSR roots. The runtime protocol lazily indexes route-free component
-  dependencies once, on its first streaming render; ordinary rendering never
-  allocates this index. Checkpoints reuse an integer DFS stack, and leaf-only
-  boundaries need no graph walk. Request-local buffers retain capacity for
-  reuse. The separately imported streaming coordinator passes this ephemeral
-  state directly to components and removes checkpoint scaffolding after commit.
-  `webui serve --api-port` can translate a capacity-one, versioned backend
-  control stream into the same Rust session, preserving browser-to-backend
-  backpressure without exposing a callback-heavy Node renderer session.
+- **Runtime-discovered streaming.** The continuation VM walks only the selected
+  entry, component, condition, loop, and route path. It is iterative and keeps
+  bounded frames, projected parent keys, lexical locals, occurrence keys, and
+  generated component spans instead of cloning the full state or prebuilding a
+  request plan. Boundary-free fragment records are skipped through a build-time
+  `contains_boundary` bit. Capture and projection scratch buffers retain
+  capacity across checkpoints.
+- **Bounded browser activation.** Each checkpoint or generated span completion
+  walks one root-local marker range, including open shadow roots, and removes
+  its scaffolding after commit. Final occurrences retain no root list.
+  Updatable occurrences retain only successfully activated roots until
+  terminal. The valid path has no `MutationObserver`, polling loop, or
+  document-wide selector; only fatal cleanup may perform one bounded sweep.
+- **Host-owned backpressure.** `StreamingWriter` uses a bounded `tokio::mpsc`
+  channel, reusable `ChunkPool`, and configurable flush deadline. Owned
+  `StreamingSession` calls return one byte chunk for `start`, `resume`, or
+  `update`, so Node, WASM, Python, C, and .NET hosts write through their native
+  backpressure APIs. `webui serve --api-port` uses a capacity-one version-2
+  control channel over the same session.
   Hosts must also bound concurrent blocking renders before calling
   `spawn_blocking`; channel backpressure bounds bytes after a task starts, not
   the runtime's queued blocking-task count. Reject saturation before spawning
-  (for example, with `Semaphore::try_acquire_owned`) so retained request state
-  stays bounded.
+  so retained request state stays bounded.
   Intermediaries can still buffer the response, so production deployments must
   configure and verify their full delivery path.
 
diff --git a/docs/guide/installation.md b/docs/guide/installation.md
index e23cd6ec7..257ac6408 100644
--- a/docs/guide/installation.md
+++ b/docs/guide/installation.md
@@ -88,6 +88,9 @@ dotnet add package Microsoft.WebUI
 
 It targets .NET 8 and .NET 9. The package restores platform-specific `Microsoft.WebUI.Runtime.*` packages transitively, and .NET selects the matching native asset. Release builds stage `.nupkg` and `.snupkg` artifacts with Source Link and repository metadata for downstream signing and publishing. NuGet.org publishing is not automatic until an approved Microsoft-certificate signing path is available for `.nupkg` packages.
 
+See the [.NET integration guide](/guide/integrations/dotnet) for buffered and
+progressive ASP.NET response examples.
+
 Prepare `protocol.bin` once for repeated rendering:
 
 ```csharp
diff --git a/docs/guide/integrations/dotnet.md b/docs/guide/integrations/dotnet.md
new file mode 100644
index 000000000..b2f5cce0a
--- /dev/null
+++ b/docs/guide/integrations/dotnet.md
@@ -0,0 +1,90 @@
+# .NET
+
+`Microsoft.WebUI` wraps the native C ABI with safe handles and managed result
+types. It targets .NET 8 and .NET 9.
+
+## Installation
+
+```bash
+dotnet add package Microsoft.WebUI
+```
+
+Load the protocol once and reuse it:
+
+```csharp
+using var protocol = new Protocol(
+    await File.ReadAllBytesAsync("dist/protocol.bin"));
+using var handler = new WebUIHandler("webui");
+
+string html = handler.Render(
+    protocol,
+    """{"title":"Home"}""",
+    "index.html",
+    "/");
+```
+
+## Progressive streaming
+
+`StreamResponse` creates a single-driver session. `Start` and `Resume` return a
+`StreamingStep` containing `Bytes`, `Done`, and an optional `Boundary`
+descriptor.
+
+```csharp
+using var session = handler.StreamResponse(protocol, "index.html", "/");
+
+Response.ContentType = "text/html; charset=utf-8";
+StreamingStep step = session.Start(initialStateJson);
+
+while (true)
+{
+    await Response.Body.WriteAsync(step.Bytes);
+    await Response.Body.FlushAsync();
+    if (step.Done) break;
+
+    BoundaryDescriptor boundary = step.Boundary
+        ?? throw new InvalidOperationException("Missing boundary descriptor");
+    string state = await LoadBoundaryStateAsync(
+        boundary.Owner,
+        boundary.Name,
+        boundary.Key);
+    step = session.Resume(
+        boundary.InstanceId,
+        state,
+        BoundaryMode.Final);
+}
+```
+
+The descriptor contains:
+
+- `InstanceId`, unique within this response
+- `DeclarationId`, stable within the compiled protocol
+- `Owner`, the entry or component template that authored the declaration
+- `Name`, local to that owner
+- `Key`, a `BoundaryKey` with `Type`, `StringValue`, and `NumberValue`
+
+Commit an occurrence as `BoundaryMode.Updatable` to send later state:
+
+```csharp
+byte[] chunk = session.Update(
+    searchInstanceId,
+    """{"query":"webui"}""");
+await Response.Body.WriteAsync(chunk);
+await Response.Body.FlushAsync();
+```
+
+Updates apply projected state to existing roots. They do not insert markup or
+rerun hydration. The step that reports `Done` already includes the response
+tail and terminal record.
+
+Drive one session from one request flow at a time. Independent sessions may run
+concurrently against the same handler and protocol. `WebUIException` carries
+the native diagnostic for invalid state, ordering, keys, or rendering.
+
+## Native assets
+
+The managed package restores the matching `Microsoft.WebUI.Runtime.<rid>`
+package transitively. Use `WEBUI_LIB_PATH` only when testing a custom local
+native build.
+
+See [Streaming Boundaries](/guide/concepts/directives/boundary) and the
+[C ABI](./ffi) for the shared contract.
diff --git a/docs/guide/integrations/ffi.md b/docs/guide/integrations/ffi.md
index 20d0d8e75..20c97a788 100644
--- a/docs/guide/integrations/ffi.md
+++ b/docs/guide/integrations/ffi.md
@@ -206,30 +206,46 @@ erase the startup-only performance model.
 ### Progressive streaming sessions
 
 A streaming session lets a C host render one response in chunks it writes
-itself. Every chunk function returns a heap byte pointer plus its length; WebUI
-never touches your socket, so backpressure and cancellation stay yours.
+itself. Start and resume return owned step handles with borrowed byte slices;
+update returns an owned byte buffer. WebUI never touches your socket, so
+backpressure and cancellation stay yours.
 
 ```c
 webui_streaming_session_t *session = webui_streaming_session_create(
     handler, protocol, "index.html", "/");
 
-uint32_t rows = 0;
-if (!webui_streaming_session_boundary(session, "rows", &rows)) {
-    fprintf(stderr, "%s\n", webui_last_error());  /* lists the valid names */
+webui_streaming_step_t *step =
+    webui_streaming_session_start(session, initial_state_json);
+if (step == NULL) {
+    fprintf(stderr, "%s\n", webui_last_error());
 }
 
-size_t len = 0;
-uint8_t *chunk = webui_streaming_session_write_shell(session, "{}", &len);
-if (chunk == NULL) {
-    fprintf(stderr, "%s\n", webui_last_error());
-} else {
-    send_all(socket, chunk, len);
-    webui_free(chunk);
+while (step != NULL) {
+    uintptr_t bytes_len = 0;
+    const uint8_t *bytes = webui_streaming_step_bytes(step, &bytes_len);
+    send_all(socket, bytes, bytes_len);
+    if (webui_streaming_step_done(step)) {
+        webui_streaming_step_destroy(step);
+        break;
+    }
+
+    /* Copies owner, name, typed key, and IDs from the step accessors. */
+    struct app_boundary target = copy_boundary_descriptor(step);
+    webui_streaming_step_destroy(step);
+
+    const char *state_json = load_state(&target);
+    step = webui_streaming_session_resume(
+        session,
+        target.instance_id,
+        state_json,
+        WEBUI_BOUNDARY_MODE_FINAL);
+    free_boundary_descriptor(&target);
+    if (step == NULL) {
+        fprintf(stderr, "%s\n", webui_last_error());
+        break;
+    }
 }
 
-/* ... write_boundary / update ... then: */
-chunk = webui_streaming_session_finish(session, "{}", &len);
-/* send + free */
 webui_streaming_session_destroy(session);
 ```
 
@@ -237,23 +253,24 @@ webui_streaming_session_destroy(session);
 |----------|--------|
 | `webui_streaming_session_create(handler, protocol, entry_id, request_path)` | Session handle, or `NULL`. Inherits the handler's nonce (set with `webui_handler_set_nonce`); head/body injection travels through the reserved `$webui` state key on `state_json`, not through this call. |
 | `webui_streaming_session_destroy(session)` | Releases the session. `NULL` is a safe no-op. |
-| `webui_streaming_session_boundary(session, name, out_id)` | `true` plus the integer handle, or `false` and an error listing the valid names |
-| `webui_streaming_session_boundary_count(session)` | Boundaries declared by the entry |
-| `webui_streaming_session_is_finished(session)` | Whether the terminal record was written |
-| `webui_streaming_session_write_shell(session, state_json, out_len)` | Document prefix through the first semantic flush |
-| `webui_streaming_session_write_boundary(session, id, state_json, mode, out_len)` | One boundary's markup and checkpoint. `mode` is `0` final, `1` updatable. |
-| `webui_streaming_session_update(session, id, state_json, out_len)` | Projected state patch for an updatable boundary |
-| `webui_streaming_session_finish(session, state_json, out_len)` | Tail checkpoint, terminal record, and document suffix |
-
-**Chunks are binary-safe.** Always use `*out_len`. Chunks are **not**
-NUL-terminated, and a checkpoint payload may legitimately contain a zero byte.
-Free every non-`NULL` chunk with `webui_free`.
+| `webui_streaming_session_start(session, state_json)` | Owned step through the first runtime occurrence or terminal, or `NULL` |
+| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Commit the pending occurrence, then return the next owned step |
+| `webui_streaming_session_update(session, instance_id, patch_json, out_len)` | Projected state bytes for a committed updatable occurrence |
+| `webui_streaming_step_bytes(step, out_len)` | Borrow binary-safe step bytes until destroy |
+| `webui_streaming_step_done(step)` / `webui_streaming_step_has_boundary(step)` | Read completion and descriptor presence |
+| `webui_streaming_step_boundary_*` | Read IDs, owner/name slices, key type, and typed key |
+| `webui_streaming_step_destroy(step)` | Release the opaque step and all borrowed pointers |
+
+`webui_streaming_step_t` is opaque. Step bytes, owner, name, and string keys are
+borrowed slices with explicit lengths and are not NUL-terminated. Key type is
+none, string, or number; numeric keys are returned as `double`. Copy any
+descriptor values needed after destroying the step. Free update bytes with
+`webui_free`.
 
 The session clones its own references to the handler and protocol, so you may
-destroy them in any order. A rejected call returns `NULL` but leaves the session
-usable, so bad state input does not cost you the response. See
+destroy them in any order. Drive a session from one thread at a time. See
 [Streaming Boundaries](/guide/concepts/directives/boundary) for the authoring
-side and the ordering rules.
+and occurrence rules.
 
 ## Error Handling
 
@@ -287,7 +304,8 @@ Two rules to remember:
 |---|---|---|
 | `webui_handler_render` | Caller | `webui_free(ptr)` |
 | Partial, component-template, and token strings | Caller | `webui_free(ptr)` |
-| Streaming session chunks | Caller | `webui_free(ptr)` |
+| Streaming update bytes | Caller | `webui_free(ptr)` |
+| Streaming step handle and borrowed fields | Caller | `webui_streaming_step_destroy(step)` |
 | `webui_last_error` | Library (do **not** free) | Replaced on next call |
 | `webui_handler_create` | Caller | `webui_handler_destroy(ptr)` |
 | `webui_handler_create_with_plugin` | Caller | `webui_handler_destroy(ptr)` |
@@ -462,19 +480,27 @@ progressive response without touching the native ABI:
 
 ```csharp
 using var session = handler.StreamResponse(protocol, "index.html", "/");
-uint rows = session.Boundary("rows");
-
 Response.ContentType = "text/html; charset=utf-8";
-await Response.Body.WriteAsync(session.WriteShell("{}"));
-await Response.Body.FlushAsync();
-
-await Response.Body.WriteAsync(session.WriteBoundary(rows, await LoadRowsAsync()));
-await Response.Body.WriteAsync(session.Finish("{}"));
+StreamingStep step = session.Start(initialState);
+while (true)
+{
+    await Response.Body.WriteAsync(step.Bytes);
+    await Response.Body.FlushAsync();
+    if (step.Done) break;
+
+    BoundaryDescriptor boundary = step.Boundary
+        ?? throw new InvalidOperationException("Missing boundary descriptor");
+    string state = await LoadStateAsync(
+        boundary.Owner,
+        boundary.Name,
+        boundary.Key);
+    step = session.Resume(boundary.InstanceId, state, BoundaryMode.Final);
+}
 ```
 
 Each call returns a `byte[]`, so `HttpResponse.Body` keeps its own write and
 flush semantics. Failures throw `WebUIException` carrying the same diagnostic
-`webui_last_error()` would report.
+`webui_last_error()` would report. See the [.NET integration](./dotnet).
 
 ## Other Languages
 
diff --git a/docs/guide/integrations/index.md b/docs/guide/integrations/index.md
index 0e140e089..749ea9be7 100644
--- a/docs/guide/integrations/index.md
+++ b/docs/guide/integrations/index.md
@@ -6,7 +6,7 @@ Pick the handler that matches your stack:
 
 - [**Rust**](./rust), High-performance native rendering with the Rust programming language
 - [**Node**](./node), Buffered and streaming SSR via a native addon built with napi-rs for Node, Bun, and Deno
-- [**.NET**](/guide/installation#net), Managed `Microsoft.WebUI` NuGet bindings with transitive native runtime packages
+- [**.NET**](./dotnet), Managed `Microsoft.WebUI` NuGet bindings with progressive ASP.NET streaming
 - [**Python**](./python), Native `microsoft-webui` package (PyO3) with buffered, partial, and host-driven streaming rendering
 - [**Electron**](./electron), Desktop apps via Electron with custom `webui://` protocol
 - [**WebAssembly**](./wasm), Split parser, handler, and combined browser bundles
diff --git a/docs/guide/integrations/node.md b/docs/guide/integrations/node.md
index caf017140..1759f257b 100644
--- a/docs/guide/integrations/node.md
+++ b/docs/guide/integrations/node.md
@@ -219,30 +219,35 @@ runs, so a `false` result from `response.write()` cannot pause it. That is fine
 for whole-document rendering, but it cannot express a response your server paces.
 
 `protocol.streamResponse()` inverts that. It opens a **session** whose methods
-return the bytes they produced, so your server owns the socket, the write order,
-and the backpressure contract:
+return bytes, so your server owns the socket and backpressure:
 
 ```js
-import { once } from 'node:events';
-
-const session = protocol.streamResponse({ entry: 'index.html', requestPath: '/' });
-
-// Authored boundary names resolve to integer handles once, outside the loop.
-const status = session.boundary('job-status');
-const rows = session.boundary('rows');
+const session = protocol.streamResponse({
+  entry: 'index.html',
+  requestPath: '/',
+});
 
 res.writeHead(200, {
   'Content-Type': 'text/html; charset=utf-8',
   'X-Accel-Buffering': 'no',
 });
 
-await write(res, session.writeShell(baseState));
-await write(res, session.writeBoundary(status, statusState, 'updatable'));
-await write(res, session.writeBoundary(rows, await loadRows()));
+let step = session.start(initialState);
+await write(res, step.bytes);
 
-// Patches an already-hydrated island on this same response.
-await write(res, session.update(status, { jobState: 'succeeded' }));
-res.end(session.finish({}));
+while (!step.done) {
+  const boundary = step.boundary;
+  if (!boundary) throw new Error('unfinished step has no boundary');
+
+  const state = await loadBoundaryState(
+    boundary.owner,
+    boundary.name,
+    boundary.key,
+  );
+  step = session.resume(boundary.instanceId, state, 'final');
+  await write(res, step.bytes);
+}
+res.end();
 
 async function write(res, chunk) {
   if (res.write(chunk)) return;
@@ -263,29 +268,29 @@ async function write(res, chunk) {
 }
 ```
 
-That `write` helper is the entire transport integration, which is why
-the same session drops into Express, Fastify, Hapi, or a raw socket unchanged.
-
-The page's entry template must declare
-[`<boundary>` directives](/guide/concepts/directives/boundary); `boundaryCount`
-reports how many it has.
+The same shape works behind Express, Fastify, Hapi, or a raw socket. Boundaries
+are discovered at runtime through entries, reusable components, conditions,
+loops, and the selected route.
 
 ### StreamingSession
 
 | Member | Description |
 |--------|-------------|
-| `boundary(name)` | Resolve an authored boundary name to its integer handle. Throws with the valid names and a "did you mean …?" suggestion on a typo. |
-| `boundaryCount` | Number of boundaries the entry declares |
-| `finished` | Whether `finish()` has been called |
-| `writeShell(state)` | Bytes for the document prefix through the first semantic flush |
-| `writeBoundary(id, state, mode?)` | Bytes for one boundary's markup, metadata delta, and checkpoint. `mode` is `"final"` (default) or `"updatable"` |
-| `update(id, state)` | Bytes for a projected state patch to a boundary committed as `"updatable"` |
-| `finish(state)` | Bytes for the tail checkpoint, terminal record, and document suffix |
-
-Ordering is enforced: the shell first, boundaries in declaration order, updates
-only to updatable boundaries already committed, and `finish()` last. A rejected
-call throws and leaves the session usable, so invalid state does not cost you the
-response. Sessions are independent, so hold one per in-flight request.
-
-**Runnable example.** `examples/integration/node/streaming-server.js` is a
-complete `node:http` server built on this API, with no sidecar process.
+| `start(state)` | Return `{ bytes, done, boundary? }` through the first occurrence or terminal |
+| `resume(instanceId, state, mode?)` | Commit the pending occurrence, then return the next step |
+| `update(instanceId, patch)` | Return projected state bytes for a committed updatable occurrence |
+
+A descriptor contains `instanceId`, `declarationId`, `owner`, `name`, and an
+optional string or numeric `key`. Use those fields to load state, then pass
+`instanceId` back to `resume`. The final step already contains tail and terminal
+bytes. `mode` is `"final"` by default or `"updatable"`.
+
+An update never inserts markup or reruns hydration:
+
+```js
+const patch = session.update(searchInstanceId, { query: 'webui' });
+await write(res, patch);
+```
+
+Sessions are single-driver and independent. Hold one per in-flight request and
+stop driving it after a rendering or transport failure.
diff --git a/docs/guide/integrations/python.md b/docs/guide/integrations/python.md
index a7caccfe7..ad6691890 100644
--- a/docs/guide/integrations/python.md
+++ b/docs/guide/integrations/python.md
@@ -123,9 +123,9 @@ Both return `bytes`; write them directly as the response body for
 
 `renderer.stream_response()` opens a `StreamingSession` whose methods return
 the bytes they produced instead of writing anywhere themselves. **WebUI never
-touches your socket, so your server owns the write order and backpressure —
+touches your socket, so your server owns the write order and backpressure -
 the same contract as every other host binding** (see
-[Streaming Boundaries](/guide/concepts/directives/boundary#3-drive-a-host-controlled-response)
+[Streaming Boundaries](/guide/concepts/directives/boundary#drive-the-response)
 for the authoring side and full ordering rules).
 
 ### WSGI
@@ -136,13 +136,25 @@ directly onto the session:
 ```python
 def app(environ, start_response):
     session = renderer.stream_response(request_path=environ.get("PATH_INFO", "/"))
-    rows = session.boundary("rows")  # resolved once, outside the write loop
 
     def body():
-        yield session.write_shell({"title": "Home"})
-        yield session.write_boundary(rows, {"rows": []}, mode="updatable")
-        yield session.update(rows, {"rows": load_rows()})
-        yield session.finish({})
+        step = session.start(initial_state)
+        yield step.bytes
+        while not step.done:
+            boundary = step.boundary
+            if boundary is None:
+                raise RuntimeError("unfinished step has no boundary")
+            state = load_boundary_state(
+                boundary.owner,
+                boundary.name,
+                boundary.key,
+            )
+            step = session.resume(
+                boundary.instance_id,
+                state,
+                mode="final",
+            )
+            yield step.bytes
 
     start_response("200 OK", [
         ("Content-Type", "text/html; charset=utf-8"),
@@ -162,25 +174,37 @@ from starlette.responses import StreamingResponse
 
 async def index(request):
     session = renderer.stream_response(request_path=request.url.path)
-    rows = session.boundary("rows")
 
     async def body():
-        yield await anyio.to_thread.run_sync(session.write_shell, {"title": "Home"})
-        yield await anyio.to_thread.run_sync(
-            lambda: session.write_boundary(rows, {"rows": []}, mode="updatable"),
-        )
-        rows_data = await load_rows()  # your own async backend call
-        yield await anyio.to_thread.run_sync(session.update, rows, {"rows": rows_data})
-        yield await anyio.to_thread.run_sync(session.finish, {})
+        step = await anyio.to_thread.run_sync(session.start, initial_state)
+        yield step.bytes
+        while not step.done:
+            boundary = step.boundary
+            if boundary is None:
+                raise RuntimeError("unfinished step has no boundary")
+            state = await load_boundary_state(
+                boundary.owner,
+                boundary.name,
+                boundary.key,
+            )
+            step = await anyio.to_thread.run_sync(
+                lambda: session.resume(
+                    boundary.instance_id,
+                    state,
+                    mode="final",
+                ),
+            )
+            yield step.bytes
 
     return StreamingResponse(body(), media_type="text/html; charset=utf-8")
 ```
 
-Ordering is enforced by the session itself: the shell first, boundaries in
-declaration order, `update()` only on boundaries already committed
-`"updatable"`, and `finish()` last. A rejected call raises and leaves the
-session usable, so bad state input doesn't cost you the response. Sessions
-are **not** thread-safe — drive one session from one thread at a time;
+`start()` and `resume()` return a `StreamStep` with `bytes`, `done`, and an
+optional descriptor. The descriptor provides `instance_id`, `declaration_id`,
+`owner`, `name`, and `key`. The completed step already includes the tail and
+terminal bytes.
+
+Sessions are **not** multi-driver - drive one session from one thread at a time;
 independent sessions on the same `Renderer` may run concurrently.
 
 ## API reference
@@ -200,13 +224,9 @@ independent sessions on the same `Renderer` may run concurrently.
 
 | Member | Description |
 |--------|-------------|
-| `boundary(name) -> int` | Resolve an authored boundary name to its integer handle. Raises with the valid names and a "did you mean …?" suggestion on a typo |
-| `boundary_count` | Number of boundaries the entry declares |
-| `finished` | Whether `finish()` successfully emitted the terminal record |
-| `write_shell(state) -> bytes` | Document prefix through the first semantic flush |
-| `write_boundary(id, state, mode=BoundaryMode.FINAL) -> bytes` | One boundary's markup, metadata delta, and checkpoint |
-| `update(id, state) -> bytes` | Projected state patch for a boundary already committed `updatable` |
-| `finish(state) -> bytes` | Tail checkpoint, terminal record, and document suffix |
+| `start(state) -> StreamStep` | Bytes through the first runtime occurrence or terminal |
+| `resume(instance_id, state, mode=BoundaryMode.FINAL) -> StreamStep` | Commit the pending occurrence and continue |
+| `update(instance_id, patch) -> bytes` | Projected state for a committed updatable occurrence |
 
 ### `Plugin` and `BoundaryMode`
 
@@ -217,8 +237,8 @@ typo-checked by static analysis:
 ```python
 from microsoft_webui import BoundaryMode
 
-session.write_boundary(rows, state, mode=BoundaryMode.UPDATABLE)
-session.write_boundary(rows, state, mode="updatable")  # equivalent
+session.resume(boundary.instance_id, state, mode=BoundaryMode.UPDATABLE)
+session.resume(boundary.instance_id, state, mode="updatable")  # equivalent
 ```
 
 ## Fast path: pre-serialized state
diff --git a/docs/guide/integrations/rust.md b/docs/guide/integrations/rust.md
index 7f78917b9..570fb1ce7 100644
--- a/docs/guide/integrations/rust.md
+++ b/docs/guide/integrations/rust.md
@@ -217,33 +217,54 @@ HttpResponse::Ok()
 
 ### Host-driven boundaries and state updates
 
-`stream_response` returns a synchronous response session. Resolve authored names
-once, then use integer handles for every write:
+`stream_response` returns a synchronous session that discovers runtime
+occurrences as it renders:
 
 ```rust
-use webui::{BoundaryMode, RenderOptions, WebUIHandler};
+use webui::{BoundaryMode, HandlerError, RenderOptions, WebUIHandler};
 
 let options = RenderOptions::new("index.html", "/");
 let mut response = handler.stream_response(&protocol, &options, &mut writer)?;
-let weather = response.boundary("weather-shell")?;
-let composer = response.boundary("composer-ready")?;
-let feed_1 = response.boundary("feed-batch-1")?;
-
-response.write_shell(&page_state)?;
-response.write_boundary(weather, &loading_weather, BoundaryMode::Updatable)?;
-response.write_boundary(composer, &composer_state, BoundaryMode::Final)?;
-
-// Await or receive backend work between these synchronous calls.
-response.update(weather, &ready_weather)?;
-response.write_boundary(feed_1, &feed_state, BoundaryMode::Final)?;
-response.finish(&tail_state)?;
+let mut step = response.start(&initial_state)?;
+
+while !step.done {
+    let boundary = step.boundary.as_ref().ok_or_else(|| {
+        HandlerError::Invariant(
+            "unfinished streaming step has no descriptor".to_string(),
+        )
+    })?;
+    let state = load_state(
+        &boundary.owner,
+        &boundary.name,
+        boundary.key.as_ref(),
+    )?;
+    step = response.resume(
+        boundary.instance_id,
+        &state,
+        BoundaryMode::Final,
+    )?;
+}
 ```
 
-Boundary HTML must be written once in declaration order. `update` can be called
-between any two boundary writes, but only for a committed `Updatable` boundary.
-It applies the same compiled state projection as that boundary's initial
-checkpoint, requires a JSON object, emits no marker range, and flushes
-immediately. `finish` requires all compiled boundaries to be committed.
+`start` writes through the first occurrence, or completes immediately when the
+selected path has none. `resume` must use the currently pending
+`BoundaryInstanceId`, commits that occurrence, and continues to the next one or
+terminal. The final returned status has `done == true`, no descriptor, and the
+writer already contains the tail and terminal.
+
+Every descriptor contains `instance_id`, `declaration_id`, `owner`, `name`, and
+an optional string or numeric `key`. A declaration inside a repeated path
+requires a key, and live keys must be unique.
+
+To send later state, resume the occurrence as `BoundaryMode::Updatable`, retain
+its instance ID, then call:
+
+```rust
+response.update(search_instance, &json!({ "query": "webui" }))?;
+```
+
+`update` accepts an object patch, emits a projected markerless state record, and
+flushes immediately. It inserts no markup and does not rerun hydration.
 
 The session borrows each state value only for its call. It does not await,
 allocate a task, or synchronize concurrent callers. An async server should use a
@@ -259,12 +280,10 @@ pub trait FlushWriter: ResponseWriter {
 ```
 
 `render_streaming` and `stream_response` accept a `FlushWriter`;
-`StreamingWriter` implements that trait. Each explicit boundary is completed,
-followed by its hydration checkpoint and a semantic flush. At `body_end`, any
-native or scriptless tail HTML is followed by one empty markerless terminal
-record and one final flush. The terminal record never repeats state or template
-metadata. The normal `render` method still accepts any `ResponseWriter` and does
-not progressively hydrate authored boundaries.
+`StreamingWriter` implements that trait. Each resumed occurrence is followed by
+its hydration checkpoint and a semantic flush. Generated component span
+completions, state updates, and terminal records also flush. The normal
+`render` method still accepts any `ResponseWriter`.
 
 The entry template must load its application module with an early
 `<script type="module" async>` in `<head>`, before boundary content. See
@@ -275,17 +294,16 @@ authoring and lifecycle contract. That application entry must import
 `@microsoft/webui-framework/streaming.js` before component registration
 modules. The default framework entry does not include the streaming coordinator.
 
-Each checkpoint carries state and templates for the component surface reachable
-from roots rendered since the previous checkpoint, including descendants behind
-initially false conditions or empty repeats. Unrelated later boundaries remain
-excluded. Template metadata is sent only when first reachable, inventory still
-tracks only rendered SSR roots, and repeated instances receive checkpoint-local
-state without duplicate metadata. The final terminal envelope is always
-`[1,nextSequence,3,0,{}]`; its flush also commits preceding static tail bytes.
+At `start`, WebUI freezes only projected top-level keys required to continue,
+plus lexical locals and route/component scope. Resume state overlays that frozen
+parent surface. Resolution order is lexical locals, resume state, then frozen
+parent state.
 
-Host-driven sessions are currently Rust-only. Node and WASM `renderStream`
-callbacks are synchronous whole-render APIs without writable backpressure, and
-the C ABI returns buffered strings. They do not expose this session contract.
+When a boundary occurs inside a reusable component, WebUI emits a generated
+span for the unfinished parent. The early child checkpoint can hydrate across
+light or open shadow DOM before the parent tail. A later span-completion record
+activates the parent exactly once. The terminal envelope is
+`[2,nextSequence,4,0,{}]`.
 
 The bounded channel limits bytes retained by a running render, but it does not
 bound how many requests can queue in Tokio's blocking pool. Acquire a
@@ -435,21 +453,19 @@ component.
 
 | API | Description |
 |---|---|
-| `WebUIHandler::stream_response(protocol, options, writer)` | Starts one progressive response session |
-| `StreamingResponse::boundary(name)` | Resolves a compiled name once to `BoundaryId` |
-| `StreamingResponse::boundary_count()` | Returns the fixed compile-time boundary count |
-| `StreamingResponse::write_shell(state)` | Renders and flushes the document prefix |
-| `StreamingResponse::write_boundary(id, state, mode)` | Commits the next authored boundary as `Final` or `Updatable` |
-| `StreamingResponse::update(id, state)` | Sends projected object state to a committed updatable boundary |
-| `StreamingResponse::finish(state)` | Renders the tail, emits terminal, and ends the writer |
+| `WebUIHandler::stream_response(protocol, options, writer)` | Create one progressive response session |
+| `StreamingResponse::start(state)` | Render and flush through the first runtime occurrence or terminal |
+| `StreamingResponse::resume(instance_id, state, mode)` | Commit the pending occurrence and continue |
+| `StreamingResponse::update(instance_id, patch)` | Send projected object state to a committed updatable occurrence |
+| `StreamingResponse::is_done()` | Report whether terminal and writer end completed |
 
 `StreamingResponse` borrows a `ResponseWriter` for the life of the response,
 which is the cheapest shape when the transport lives in the same process and the
 same language.
 
-When you would rather own the bytes — for example to feed a channel, a test
+When you would rather own the bytes - for example to feed a channel, a test
 harness, or a transport whose writer cannot be borrowed for that long —
-`StreamingSession` offers the same six operations and returns a `Vec<u8>` per
+`StreamingSession` offers the same three operations and returns a `Vec<u8>` per
 call instead:
 
 ```rust
@@ -458,11 +474,13 @@ let mut session = StreamingSession::new(
     Arc::clone(&protocol),
     SessionOptions::new("index.html", "/"),
 )?;
-let rows = session.boundary("rows")?;
-
-sink.send(session.write_shell(&shell_state)?)?;
-sink.send(session.write_boundary(rows, &rows_state, BoundaryMode::Final)?)?;
-sink.send(session.finish(&tail_state)?)?;
+let mut step = session.start(&initial_state)?;
+sink.send(step.bytes)?;
+while let Some(boundary) = step.boundary {
+    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+    step = session.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+    sink.send(step.bytes)?;
+}
 ```
 
 The session holds its own `Arc` clones, so it may outlive the bindings you
diff --git a/docs/guide/integrations/wasm.md b/docs/guide/integrations/wasm.md
index 54c4fc803..bfc36a9b0 100644
--- a/docs/guide/integrations/wasm.md
+++ b/docs/guide/integrations/wasm.md
@@ -46,7 +46,7 @@ deterministic indices, and binds the plugin once.
 |--------|-------------|
 | `render(stateJson, options?)` | Return complete rendered HTML as a string |
 | `renderStream(stateJson, onChunk, options?)` | Invoke callbacks coalesced around a 16 KiB target |
-| `streamResponse(options?)` | Open a progressive [`StreamingSession`](#streamingsession) returning one `Uint8Array` per call |
+| `streamResponse(entry, requestPath, options?)` | Open a progressive [`StreamingSession`](#streamingsession) returning one `Uint8Array` per call |
 | `renderPartial(stateJson, entry, requestPath, inventoryHex)` | Return a complete JSON partial response with active-route projected state |
 | `renderComponentTemplates(componentTags, inventoryHex)` | Return requested template payloads and updated inventory |
 | `tokens()` | Return CSS token names in build order |
@@ -57,19 +57,31 @@ For a complete static/CDN service worker example using this callback to write a
 
 ### `StreamingSession`
 
-When the entry declares [`<boundary>` directives](/guide/concepts/directives/boundary),
-`streamResponse()` opens a session that returns bytes instead of writing them,
-which maps directly onto a `ReadableStream` controller in a service worker:
+`streamResponse()` opens a runtime-discovered session that maps directly onto a
+`ReadableStream` controller:
 
 ```js
-const session = protocol.streamResponse({ entry: 'index.html', requestPath: '/' });
-const rows = session.boundary('rows');
+const session = protocol.streamResponse('index.html', '/');
 
 const body = new ReadableStream({
   async start(controller) {
-    controller.enqueue(session.writeShell(baseState));
-    controller.enqueue(session.writeBoundary(rows, await loadRows()));
-    controller.enqueue(session.finish({}));
+    let step = session.start(JSON.stringify(initialState));
+    controller.enqueue(step.bytes);
+    while (!step.done) {
+      const boundary = step.boundary;
+      if (!boundary) throw new Error('unfinished step has no boundary');
+      const state = await loadBoundaryState(
+        boundary.owner,
+        boundary.name,
+        boundary.key,
+      );
+      step = session.resume(
+        boundary.instanceId,
+        JSON.stringify(state),
+        'final',
+      );
+      controller.enqueue(step.bytes);
+    }
     controller.close();
   },
 });
@@ -77,15 +89,13 @@ const body = new ReadableStream({
 
 | Member | Description |
 |--------|-------------|
-| `boundary(name)` | Resolve an authored boundary name to its integer handle |
-| `boundaryCount` / `finished` | Declared boundary count; whether `finish()` ran |
-| `writeShell(state)` | Document prefix through the first semantic flush |
-| `writeBoundary(id, state, mode?)` | One boundary's markup and checkpoint (`"final"` or `"updatable"`) |
-| `update(id, state)` | Projected state patch to an updatable boundary |
-| `finish(state)` | Tail checkpoint, terminal record, and document suffix |
-
-The API and its ordering rules are identical on Node, C, and C#, so the same
-server logic ports between them unchanged.
+| `start(stateJson)` | Return `{ bytes, done, boundary? }` through the first occurrence or terminal |
+| `resume(instanceId, stateJson, mode?)` | Commit the pending occurrence and return the next step |
+| `update(instanceId, patchJson)` | Return projected state bytes for an updatable occurrence |
+
+Descriptors contain `instanceId`, `declarationId`, `owner`, `name`, and an
+optional string or numeric `key`. The final step's `Uint8Array` includes tail
+and terminal bytes. The contract is identical on Node, Python, C, and .NET.
 
 ## Parser-only API
 
diff --git a/dotnet/src/Microsoft.WebUI/NativeBindings.cs b/dotnet/src/Microsoft.WebUI/NativeBindings.cs
index c2d91ecf9..57b42e077 100644
--- a/dotnet/src/Microsoft.WebUI/NativeBindings.cs
+++ b/dotnet/src/Microsoft.WebUI/NativeBindings.cs
@@ -89,6 +89,31 @@ protected override bool ReleaseHandle()
         }
     }
 
+    /// <summary>
+    /// SafeHandle wrapper for one owned native streaming step.
+    /// </summary>
+    internal sealed class WebUIStreamingStepSafeHandle : SafeHandle
+    {
+        internal WebUIStreamingStepSafeHandle()
+            : base(IntPtr.Zero, ownsHandle: true)
+        {
+        }
+
+        internal WebUIStreamingStepSafeHandle(IntPtr handle)
+            : this()
+        {
+            SetHandle(handle);
+        }
+
+        public override bool IsInvalid => handle == IntPtr.Zero;
+
+        protected override bool ReleaseHandle()
+        {
+            webui_streaming_step_destroy_raw(handle);
+            return true;
+        }
+    }
+
     static NativeBindings()
     {
         NativeLibrary.SetDllImportResolver(
@@ -177,49 +202,82 @@ private static extern IntPtr webui_streaming_session_create_raw(
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl, EntryPoint = "webui_streaming_session_destroy")]
     private static extern void webui_streaming_session_destroy_raw(IntPtr sessionPtr);
 
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl, EntryPoint = "webui_streaming_session_start")]
+    private static extern IntPtr webui_streaming_session_start_raw(
+        WebUIStreamingSessionSafeHandle sessionPtr,
+        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson);
+
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl, EntryPoint = "webui_streaming_session_resume")]
+    private static extern IntPtr webui_streaming_session_resume_raw(
+        WebUIStreamingSessionSafeHandle sessionPtr,
+        uint instanceId,
+        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
+        uint mode);
+
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    [return: MarshalAs(UnmanagedType.U1)]
-    internal static extern bool webui_streaming_session_boundary(
+    internal static extern IntPtr webui_streaming_session_update(
         WebUIStreamingSessionSafeHandle sessionPtr,
-        [MarshalAs(UnmanagedType.LPUTF8Str)] string name,
-        out uint boundary);
+        uint instanceId,
+        [MarshalAs(UnmanagedType.LPUTF8Str)] string patchJson,
+        out nuint outLen);
+
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl, EntryPoint = "webui_streaming_step_destroy")]
+    private static extern void webui_streaming_step_destroy_raw(IntPtr stepPtr);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    internal static extern uint webui_streaming_session_boundary_count(
-        WebUIStreamingSessionSafeHandle sessionPtr);
+    internal static extern IntPtr webui_streaming_step_bytes(
+        WebUIStreamingStepSafeHandle stepPtr,
+        out nuint outLen);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
     [return: MarshalAs(UnmanagedType.U1)]
-    internal static extern bool webui_streaming_session_is_finished(
-        WebUIStreamingSessionSafeHandle sessionPtr);
+    internal static extern bool webui_streaming_step_done(
+        WebUIStreamingStepSafeHandle stepPtr);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    internal static extern IntPtr webui_streaming_session_write_shell(
-        WebUIStreamingSessionSafeHandle sessionPtr,
-        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
-        out nuint outLen);
+    [return: MarshalAs(UnmanagedType.U1)]
+    internal static extern bool webui_streaming_step_has_boundary(
+        WebUIStreamingStepSafeHandle stepPtr);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    internal static extern IntPtr webui_streaming_session_write_boundary(
-        WebUIStreamingSessionSafeHandle sessionPtr,
-        uint boundary,
-        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
-        [MarshalAs(UnmanagedType.U1)] bool updatable,
+    [return: MarshalAs(UnmanagedType.U1)]
+    internal static extern bool webui_streaming_step_boundary_instance_id(
+        WebUIStreamingStepSafeHandle stepPtr,
+        out uint instanceId);
+
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
+    [return: MarshalAs(UnmanagedType.U1)]
+    internal static extern bool webui_streaming_step_boundary_declaration_id(
+        WebUIStreamingStepSafeHandle stepPtr,
+        out uint declarationId);
+
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
+    internal static extern IntPtr webui_streaming_step_boundary_owner(
+        WebUIStreamingStepSafeHandle stepPtr,
         out nuint outLen);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    internal static extern IntPtr webui_streaming_session_update(
-        WebUIStreamingSessionSafeHandle sessionPtr,
-        uint boundary,
-        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
+    internal static extern IntPtr webui_streaming_step_boundary_name(
+        WebUIStreamingStepSafeHandle stepPtr,
         out nuint outLen);
 
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
-    internal static extern IntPtr webui_streaming_session_finish(
-        WebUIStreamingSessionSafeHandle sessionPtr,
-        [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
+    [return: MarshalAs(UnmanagedType.U1)]
+    internal static extern bool webui_streaming_step_boundary_key_type(
+        WebUIStreamingStepSafeHandle stepPtr,
+        out uint keyType);
+
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
+    internal static extern IntPtr webui_streaming_step_boundary_key_string(
+        WebUIStreamingStepSafeHandle stepPtr,
         out nuint outLen);
 
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
+    [return: MarshalAs(UnmanagedType.U1)]
+    internal static extern bool webui_streaming_step_boundary_key_number(
+        WebUIStreamingStepSafeHandle stepPtr,
+        out double value);
+
     internal static WebUIStreamingSessionSafeHandle CreateStreamingSession(
         WebUIHandlerSafeHandle handler,
         WebUIProtocolSafeHandle protocol,
@@ -234,6 +292,28 @@ internal static WebUIStreamingSessionSafeHandle CreateStreamingSession(
         return new WebUIStreamingSessionSafeHandle(handle);
     }
 
+    internal static WebUIStreamingStepSafeHandle StartStreamingSession(
+        WebUIStreamingSessionSafeHandle session,
+        string stateJson)
+    {
+        IntPtr handle = webui_streaming_session_start_raw(session, stateJson);
+        return new WebUIStreamingStepSafeHandle(handle);
+    }
+
+    internal static WebUIStreamingStepSafeHandle ResumeStreamingSession(
+        WebUIStreamingSessionSafeHandle session,
+        uint instanceId,
+        string stateJson,
+        uint mode)
+    {
+        IntPtr handle = webui_streaming_session_resume_raw(
+            session,
+            instanceId,
+            stateJson,
+            mode);
+        return new WebUIStreamingStepSafeHandle(handle);
+    }
+
     internal static WebUIHandlerSafeHandle CreateHandler(string? pluginId)
     {
         IntPtr handle = pluginId is null
@@ -293,14 +373,7 @@ internal static WebUIProtocolSafeHandle CreateProtocol(byte[] protocolData)
 
         try
         {
-            if (length == 0)
-            {
-                return Array.Empty<byte>();
-            }
-
-            byte[] bytes = new byte[length];
-            Marshal.Copy(ptr, bytes, 0, (int)length);
-            return bytes;
+            return CopyBytes(ptr, length);
         }
         finally
         {
@@ -308,6 +381,34 @@ internal static WebUIProtocolSafeHandle CreateProtocol(byte[] protocolData)
         }
     }
 
+    /// <summary>
+    /// Copies bytes borrowed from a live native owner without freeing the pointer.
+    /// </summary>
+    internal static byte[]? ReadBorrowedBytes(IntPtr ptr, nuint length)
+    {
+        return ptr == IntPtr.Zero ? null : CopyBytes(ptr, length);
+    }
+
+    /// <summary>
+    /// Copies a length-delimited UTF-8 string borrowed from a live native owner.
+    /// </summary>
+    internal static string? ReadBorrowedString(IntPtr ptr, nuint length)
+    {
+        if (ptr == IntPtr.Zero)
+        {
+            return null;
+        }
+
+        if (length > int.MaxValue)
+        {
+            throw new WebUIException("Native UTF-8 value exceeds the managed string limit.");
+        }
+
+        return length == 0
+            ? string.Empty
+            : Marshal.PtrToStringUTF8(ptr, checked((int)length));
+    }
+
     /// <summary>
     /// Reads the last error message from the native library.
     /// Returns <c>null</c> if there is no error.
@@ -322,4 +423,22 @@ internal static WebUIProtocolSafeHandle CreateProtocol(byte[] protocolData)
 
         return Marshal.PtrToStringUTF8(errorPtr);
     }
+
+    private static byte[] CopyBytes(IntPtr ptr, nuint length)
+    {
+        if (length == 0)
+        {
+            return Array.Empty<byte>();
+        }
+
+        if (length > int.MaxValue)
+        {
+            throw new WebUIException("Native byte payload exceeds the managed array limit.");
+        }
+
+        int count = checked((int)length);
+        byte[] bytes = new byte[count];
+        Marshal.Copy(ptr, bytes, 0, count);
+        return bytes;
+    }
 }
diff --git a/dotnet/src/Microsoft.WebUI/StreamingSession.cs b/dotnet/src/Microsoft.WebUI/StreamingSession.cs
index ca3b26083..2e5e4d860 100644
--- a/dotnet/src/Microsoft.WebUI/StreamingSession.cs
+++ b/dotnet/src/Microsoft.WebUI/StreamingSession.cs
@@ -17,39 +17,153 @@ public enum BoundaryMode
     Final = 0,
 
     /// <summary>
-    /// Retain the boundary roots and compiled state projection until the
-    /// terminal record, so <see cref="StreamingSession.Update"/> can patch them.
+    /// Retain the boundary roots and compiled state projection until terminal.
     /// </summary>
     Updatable = 1,
 }
 
 /// <summary>
-/// A progressive HTML response written one chunk at a time.
+/// The JSON type of an evaluated runtime boundary key.
+/// </summary>
+public enum BoundaryKeyType
+{
+    /// <summary>The boundary declaration has no key.</summary>
+    None = 0,
+
+    /// <summary>The boundary key is a string.</summary>
+    String = 1,
+
+    /// <summary>The boundary key is a finite number.</summary>
+    Number = 2,
+}
+
+/// <summary>
+/// A typed runtime boundary key.
+/// </summary>
+public readonly struct BoundaryKey
+{
+    internal BoundaryKey(BoundaryKeyType type, string? stringValue, double? numberValue)
+    {
+        Type = type;
+        StringValue = stringValue;
+        NumberValue = numberValue;
+    }
+
+    /// <summary>
+    /// Gets the key's JSON type.
+    /// </summary>
+    public BoundaryKeyType Type { get; }
+
+    /// <summary>
+    /// Gets the string value when <see cref="Type"/> is
+    /// <see cref="BoundaryKeyType.String"/>; otherwise <c>null</c>.
+    /// </summary>
+    public string? StringValue { get; }
+
+    /// <summary>
+    /// Gets the numeric value when <see cref="Type"/> is
+    /// <see cref="BoundaryKeyType.Number"/>; otherwise <c>null</c>.
+    /// </summary>
+    public double? NumberValue { get; }
+}
+
+/// <summary>
+/// One runtime occurrence discovered while traversing a streaming response.
+/// </summary>
+public sealed class BoundaryDescriptor
+{
+    internal BoundaryDescriptor(
+        uint instanceId,
+        uint declarationId,
+        string owner,
+        string name,
+        BoundaryKey key)
+    {
+        InstanceId = instanceId;
+        DeclarationId = declarationId;
+        Owner = owner;
+        Name = name;
+        Key = key;
+    }
+
+    /// <summary>
+    /// Gets the gapless response-local occurrence ID passed to
+    /// <see cref="StreamingSession.Resume"/> and <see cref="StreamingSession.Update"/>.
+    /// </summary>
+    public uint InstanceId { get; }
+
+    /// <summary>
+    /// Gets the stable compiler declaration ID.
+    /// </summary>
+    public uint DeclarationId { get; }
+
+    /// <summary>
+    /// Gets the entry or component template that owns the declaration.
+    /// </summary>
+    public string Owner { get; }
+
+    /// <summary>
+    /// Gets the authored boundary name.
+    /// </summary>
+    public string Name { get; }
+
+    /// <summary>
+    /// Gets the evaluated typed key, or <see cref="BoundaryKeyType.None"/>.
+    /// </summary>
+    public BoundaryKey Key { get; }
+}
+
+/// <summary>
+/// The immutable managed result of one streaming start or resume operation.
+/// </summary>
+public sealed class StreamingStep
+{
+    internal StreamingStep(byte[] bytes, bool done, BoundaryDescriptor? boundary)
+    {
+        Bytes = bytes;
+        Done = done;
+        Boundary = boundary;
+    }
+
+    /// <summary>
+    /// Gets the UTF-8 bytes produced by this semantic step.
+    /// </summary>
+    public byte[] Bytes { get; }
+
+    /// <summary>
+    /// Gets a value indicating whether terminal emission completed.
+    /// </summary>
+    public bool Done { get; }
+
+    /// <summary>
+    /// Gets the next runtime occurrence waiting for resume, or <c>null</c>.
+    /// </summary>
+    public BoundaryDescriptor? Boundary { get; }
+}
+
+/// <summary>
+/// A progressive HTML response advanced one semantic step at a time.
 /// </summary>
 /// <remarks>
-/// <para>Every method returns the bytes it produced instead of writing them, so
-/// the caller owns the transport and applies its own backpressure — write each
-/// chunk to <c>HttpResponse.Body</c> and <c>await FlushAsync()</c> when ready.
-/// The session never blocks on a socket.</para>
-/// <para>Ordering is enforced: the shell first, then each boundary exactly once
-/// in declaration order, <see cref="Update"/> only after its boundary commits as
-/// <see cref="BoundaryMode.Updatable"/>, and <see cref="Finish"/> last. A
-/// violation throws before any byte is produced.</para>
+/// <para><see cref="Start"/> and <see cref="Resume"/> eagerly copy native step
+/// bytes and descriptors into managed objects. The caller owns the transport
+/// and applies its own backpressure.</para>
 /// <para>This type is <b>not</b> thread-safe. Drive one session from one request
-/// at a time; independent sessions may run concurrently on the same handler and
-/// protocol.</para>
+/// at a time; independent sessions may run concurrently.</para>
 /// <example>
 /// <code>
 /// using var session = handler.StreamResponse(protocol, "index.html", request.Path);
-/// uint weather = session.Boundary("weather-shell");
-///
-/// await response.Body.WriteAsync(session.WriteShell(shellJson));
-/// await response.Body.WriteAsync(
-///     session.WriteBoundary(weather, weatherJson, BoundaryMode.Updatable));
-/// await response.Body.FlushAsync();
-///
-/// await response.Body.WriteAsync(session.Update(weather, await forecastTask));
-/// await response.Body.WriteAsync(session.Finish("{}"));
+/// StreamingStep step = session.Start(shellJson);
+/// while (true)
+/// {
+///     await response.Body.WriteAsync(step.Bytes);
+///     if (step.Done) break;
+///     BoundaryDescriptor boundary = step.Boundary!;
+///     step = session.Resume(
+///         boundary.InstanceId,
+///         await LoadBoundaryState(boundary),
+///         BoundaryMode.Final);
+/// }
 /// </code>
 /// </example>
 /// </remarks>
@@ -80,178 +194,196 @@ internal StreamingSession(
     }
 
     /// <summary>
-    /// Gets the number of compile-time boundaries declared by this entry.
+    /// Renders until the first runtime boundary occurrence or terminal completion.
     /// </summary>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    public uint BoundaryCount
+    /// <param name="stateJson">JSON-encoded initial response state.</param>
+    /// <returns>Produced bytes, completion state, and the next boundary descriptor.</returns>
+    /// <exception cref="ObjectDisposedException">Thrown after disposal.</exception>
+    /// <exception cref="WebUIException">Thrown when state parsing or rendering fails.</exception>
+    public StreamingStep Start(string stateJson)
     {
-        get
-        {
-            ThrowIfDisposed();
-            return NativeBindings.webui_streaming_session_boundary_count(_handle);
-        }
-    }
+        ThrowIfDisposed();
+        ArgumentNullException.ThrowIfNull(stateJson);
 
-    /// <summary>
-    /// Gets a value indicating whether the terminal record has been written.
-    /// </summary>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    public bool IsFinished
-    {
-        get
-        {
-            ThrowIfDisposed();
-            return NativeBindings.webui_streaming_session_is_finished(_handle);
-        }
+        return TakeStep(
+            NativeBindings.StartStreamingSession(_handle, stateJson),
+            nameof(Start));
     }
 
     /// <summary>
-    /// Resolves an authored boundary name to a stable integer handle.
+    /// Commits the pending occurrence and advances to the next occurrence or terminal.
     /// </summary>
-    /// <param name="name">The <c>name</c> attribute of a compiled <c>&lt;boundary&gt;</c>.</param>
-    /// <returns>An integer handle to pass to the write methods.</returns>
-    /// <remarks>
-    /// Resolve once outside the write loop; reusing the handle costs nothing.
-    /// </remarks>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    /// <exception cref="WebUIException">
-    /// Thrown when the entry declares no boundary called <paramref name="name"/>.
-    /// The message lists the valid names and suggests the closest match.
-    /// </exception>
-    public uint Boundary(string name)
+    /// <param name="instanceId">The pending descriptor's response-local instance ID.</param>
+    /// <param name="stateJson">JSON-encoded state used while rendering this occurrence.</param>
+    /// <param name="mode">Whether this occurrence may receive later updates.</param>
+    /// <returns>Produced bytes, completion state, and the next boundary descriptor.</returns>
+    /// <exception cref="ObjectDisposedException">Thrown after disposal.</exception>
+    /// <exception cref="ArgumentOutOfRangeException">Thrown for an unknown boundary mode.</exception>
+    /// <exception cref="WebUIException">Thrown for a stale ID or rendering failure.</exception>
+    public StreamingStep Resume(
+        uint instanceId,
+        string stateJson,
+        BoundaryMode mode = BoundaryMode.Final)
     {
         ThrowIfDisposed();
-        ArgumentNullException.ThrowIfNull(name);
-
-        if (!NativeBindings.webui_streaming_session_boundary(_handle, name, out uint boundary))
+        ArgumentNullException.ThrowIfNull(stateJson);
+        if (mode is not BoundaryMode.Final and not BoundaryMode.Updatable)
         {
-            throw new WebUIException(
-                NativeBindings.GetLastError() ?? $"Unknown streaming boundary '{name}'.");
+            throw new ArgumentOutOfRangeException(nameof(mode));
         }
 
-        return boundary;
+        return TakeStep(
+            NativeBindings.ResumeStreamingSession(
+                _handle,
+                instanceId,
+                stateJson,
+                (uint)mode),
+            nameof(Resume));
     }
 
     /// <summary>
-    /// Renders everything before the first boundary.
+    /// Emits a projected patch for a committed updatable runtime occurrence.
     /// </summary>
-    /// <param name="stateJson">JSON-encoded state for the document prefix.</param>
-    /// <returns>The UTF-8 bytes to write to the response.</returns>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    /// <exception cref="WebUIException">Thrown when called out of order or when rendering fails.</exception>
-    public byte[] WriteShell(string stateJson)
+    /// <param name="instanceId">A committed response-local instance ID.</param>
+    /// <param name="patchJson">A JSON object containing changed values.</param>
+    /// <returns>The UTF-8 update record bytes.</returns>
+    /// <exception cref="ObjectDisposedException">Thrown after disposal.</exception>
+    /// <exception cref="WebUIException">
+    /// Thrown when the occurrence is not updatable or the patch is invalid.
+    /// </exception>
+    public byte[] Update(uint instanceId, string patchJson)
     {
         ThrowIfDisposed();
-        ArgumentNullException.ThrowIfNull(stateJson);
+        ArgumentNullException.ThrowIfNull(patchJson);
 
-        IntPtr chunk = NativeBindings.webui_streaming_session_write_shell(
+        IntPtr chunk = NativeBindings.webui_streaming_session_update(
             _handle,
-            stateJson,
+            instanceId,
+            patchJson,
             out nuint length);
-        return TakeChunk(chunk, length, "WriteShell");
+        return TakeChunk(chunk, length, nameof(Update));
     }
 
     /// <summary>
-    /// Renders and commits the next boundary in declaration order.
+    /// Releases the native session. Safe to call before completion.
     /// </summary>
-    /// <param name="boundary">A handle from <see cref="Boundary"/>.</param>
-    /// <param name="stateJson">JSON-encoded state for this boundary.</param>
-    /// <param name="mode">
-    /// Pass <see cref="BoundaryMode.Updatable"/> only for boundaries you intend
-    /// to patch later; an updatable boundary retains its roots and projection
-    /// until the terminal record.
-    /// </param>
-    /// <returns>The UTF-8 bytes to write to the response.</returns>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    /// <exception cref="WebUIException">
-    /// Thrown when boundaries are written out of declaration order or when rendering fails.
-    /// </exception>
-    public byte[] WriteBoundary(
-        uint boundary,
-        string stateJson,
-        BoundaryMode mode = BoundaryMode.Final)
+    public void Dispose()
     {
-        ThrowIfDisposed();
-        ArgumentNullException.ThrowIfNull(stateJson);
+        if (Interlocked.CompareExchange(ref _disposed, 1, 0) != 0)
+        {
+            return;
+        }
 
-        IntPtr chunk = NativeBindings.webui_streaming_session_write_boundary(
-            _handle,
-            boundary,
-            stateJson,
-            mode == BoundaryMode.Updatable,
-            out nuint length);
-        return TakeChunk(chunk, length, "WriteBoundary");
+        _handle.Dispose();
     }
 
-    /// <summary>
-    /// Pushes a projected state patch to a committed updatable boundary.
-    /// </summary>
-    /// <param name="boundary">A handle from <see cref="Boundary"/>.</param>
-    /// <param name="stateJson">JSON object holding the changed values.</param>
-    /// <returns>The UTF-8 bytes to write to the response.</returns>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    /// <exception cref="WebUIException">
-    /// Thrown when the boundary has not committed, was committed as
-    /// <see cref="BoundaryMode.Final"/>, or when the state is not a JSON object.
-    /// </exception>
-    public byte[] Update(uint boundary, string stateJson)
+    private static StreamingStep TakeStep(
+        NativeBindings.WebUIStreamingStepSafeHandle nativeStep,
+        string operation)
     {
-        ThrowIfDisposed();
-        ArgumentNullException.ThrowIfNull(stateJson);
+        using (nativeStep)
+        {
+            if (nativeStep.IsInvalid)
+            {
+                throw NativeFailure(operation);
+            }
 
-        IntPtr chunk = NativeBindings.webui_streaming_session_update(
-            _handle,
-            boundary,
-            stateJson,
-            out nuint length);
-        return TakeChunk(chunk, length, "Update");
+            IntPtr bytesPtr = NativeBindings.webui_streaming_step_bytes(
+                nativeStep,
+                out nuint bytesLength);
+            byte[] bytes = NativeBindings.ReadBorrowedBytes(bytesPtr, bytesLength)
+                ?? throw NativeFailure($"{operation} byte access");
+            bool done = NativeBindings.webui_streaming_step_done(nativeStep);
+            bool hasBoundary = NativeBindings.webui_streaming_step_has_boundary(nativeStep);
+            BoundaryDescriptor? boundary = hasBoundary ? ReadBoundary(nativeStep) : null;
+            return new StreamingStep(bytes, done, boundary);
+        }
     }
 
-    /// <summary>
-    /// Renders the document tail and emits the terminal record.
-    /// </summary>
-    /// <param name="stateJson">JSON-encoded state for the document tail.</param>
-    /// <returns>The UTF-8 bytes to write to the response.</returns>
-    /// <remarks>Every later call throws. Dispose the session afterwards.</remarks>
-    /// <exception cref="ObjectDisposedException">Thrown when the session has been disposed.</exception>
-    /// <exception cref="WebUIException">
-    /// Thrown when boundaries remain uncommitted or when rendering fails.
-    /// </exception>
-    public byte[] Finish(string stateJson = "{}")
+    private static BoundaryDescriptor ReadBoundary(
+        NativeBindings.WebUIStreamingStepSafeHandle nativeStep)
     {
-        ThrowIfDisposed();
-        ArgumentNullException.ThrowIfNull(stateJson);
+        RequireNative(
+            NativeBindings.webui_streaming_step_boundary_instance_id(
+                nativeStep,
+                out uint instanceId),
+            "Read boundary instance ID");
+        RequireNative(
+            NativeBindings.webui_streaming_step_boundary_declaration_id(
+                nativeStep,
+                out uint declarationId),
+            "Read boundary declaration ID");
 
-        IntPtr chunk = NativeBindings.webui_streaming_session_finish(
-            _handle,
-            stateJson,
-            out nuint length);
-        return TakeChunk(chunk, length, "Finish");
+        IntPtr ownerPtr = NativeBindings.webui_streaming_step_boundary_owner(
+            nativeStep,
+            out nuint ownerLength);
+        string owner = NativeBindings.ReadBorrowedString(ownerPtr, ownerLength)
+            ?? throw NativeFailure("Read boundary owner");
+        IntPtr namePtr = NativeBindings.webui_streaming_step_boundary_name(
+            nativeStep,
+            out nuint nameLength);
+        string name = NativeBindings.ReadBorrowedString(namePtr, nameLength)
+            ?? throw NativeFailure("Read boundary name");
+
+        RequireNative(
+            NativeBindings.webui_streaming_step_boundary_key_type(
+                nativeStep,
+                out uint keyType),
+            "Read boundary key type");
+        BoundaryKey key = ReadBoundaryKey(nativeStep, keyType);
+        return new BoundaryDescriptor(instanceId, declarationId, owner, name, key);
     }
 
-    /// <summary>
-    /// Releases the native session. Safe to call on an unfinished session; any
-    /// buffered bytes are dropped.
-    /// </summary>
-    public void Dispose()
+    private static BoundaryKey ReadBoundaryKey(
+        NativeBindings.WebUIStreamingStepSafeHandle nativeStep,
+        uint keyType)
     {
-        if (Interlocked.CompareExchange(ref _disposed, 1, 0) != 0)
+        switch ((BoundaryKeyType)keyType)
         {
-            return;
+            case BoundaryKeyType.None:
+                return default;
+            case BoundaryKeyType.String:
+                IntPtr valuePtr = NativeBindings.webui_streaming_step_boundary_key_string(
+                    nativeStep,
+                    out nuint valueLength);
+                string value = NativeBindings.ReadBorrowedString(valuePtr, valueLength)
+                    ?? throw NativeFailure("Read boundary string key");
+                return new BoundaryKey(BoundaryKeyType.String, value, null);
+            case BoundaryKeyType.Number:
+                RequireNative(
+                    NativeBindings.webui_streaming_step_boundary_key_number(
+                        nativeStep,
+                        out double number),
+                    "Read boundary numeric key");
+                return new BoundaryKey(BoundaryKeyType.Number, null, number);
+            default:
+                throw new WebUIException($"Native streaming step returned unknown key type {keyType}.");
         }
-
-        _handle.Dispose();
     }
 
     private static byte[] TakeChunk(IntPtr chunk, nuint length, string operation)
     {
         if (chunk == IntPtr.Zero)
         {
-            throw new WebUIException(
-                NativeBindings.GetLastError() ?? $"{operation} failed.");
+            throw NativeFailure(operation);
         }
 
-        return NativeBindings.ReadAndFreeBytes(chunk, length)!;
+        return NativeBindings.ReadAndFreeBytes(chunk, length)
+            ?? throw NativeFailure($"{operation} byte copy");
+    }
+
+    private static void RequireNative(bool succeeded, string operation)
+    {
+        if (!succeeded)
+        {
+            throw NativeFailure(operation);
+        }
+    }
+
+    private static WebUIException NativeFailure(string operation)
+    {
+        return new WebUIException(
+            NativeBindings.GetLastError() ?? $"{operation} failed.");
     }
 
     private void ThrowIfDisposed()
diff --git a/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj b/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
index d79081625..71006b143 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
+++ b/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
@@ -32,11 +32,10 @@
   </Target>
 
   <!--
-    Compile the streaming fixture app the same way. It declares two compile-time
-    boundaries, which is what StreamingSessionTests drives chunk by chunk. As
-    above, no projection manifest is supplied, so every checkpoint falls back to
-    the whole state object; the tests assert chunk framing and ordering, not
-    boundary-local projection.
+    Compile the streaming fixture app the same way. Its keyed declaration
+    produces string and numeric runtime occurrences and can be skipped entirely
+    for boundary-free completion. No projection manifest is supplied, so every
+    checkpoint falls back to the whole state object.
   -->
   <Target Name="BuildStreamingFixtureProtocol"
           BeforeTargets="Build"
diff --git a/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs b/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
index 20e8a8ec6..2b25a6a02 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
+++ b/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
@@ -10,6 +10,9 @@ namespace Microsoft.WebUI.Tests;
 
 public class StreamingSessionTests
 {
+    private const string StreamingState =
+        """{"show":true,"items":[{"id":"alpha\u0000omega","label":"first"},{"id":7,"label":"second"}]}""";
+
     private static byte[] StreamingProtocolBytes() =>
         File.ReadAllBytes(Path.Combine(
             AppContext.BaseDirectory,
@@ -20,159 +23,159 @@ private static byte[] StreamingProtocolBytes() =>
     private static string Text(byte[] chunk) => Encoding.UTF8.GetString(chunk);
 
     [Fact]
-    public void Session_ReturnsOneChunkPerCallAndReassemblesTheDocument()
+    public void Session_StartResumeAndUpdateExposeTypedDescriptorsAndComplete()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        Assert.Equal(2u, session.BoundaryCount);
-
-        uint first = session.Boundary("first");
-        uint second = session.Boundary("second");
-        Assert.Equal(0u, first);
-        Assert.Equal(1u, second);
-
-        byte[][] chunks =
-        [
-            session.WriteShell("{}"),
-            session.WriteBoundary(first, "{\"firstLabel\":\"alpha\"}", BoundaryMode.Updatable),
-            session.Update(first, "{\"firstLabel\":\"alpha-2\"}"),
-            session.WriteBoundary(second, "{\"secondLabel\":\"beta\"}"),
-            session.Finish(),
-        ];
-
-        Assert.True(session.IsFinished);
-
-        var document = new StringBuilder();
-        foreach (byte[] chunk in chunks)
-        {
-            Assert.NotEmpty(chunk);
-            document.Append(Text(chunk));
-        }
-
-        string html = document.ToString();
-        Assert.StartsWith("<!DOCTYPE html>", html, StringComparison.OrdinalIgnoreCase);
-        Assert.EndsWith("</html>", html.TrimEnd());
-        Assert.Contains("alpha", html, StringComparison.Ordinal);
-        Assert.Contains("alpha-2", html, StringComparison.Ordinal);
-        Assert.Contains("beta", html, StringComparison.Ordinal);
-
-        // Each boundary is rendered exactly once, no matter how many chunks it took.
-        Assert.Equal(2, CountOccurrences(html, "<stream-item"));
+        StreamingStep first = session.Start(StreamingState);
+        Assert.False(first.Done);
+        BoundaryDescriptor firstBoundary = Assert.IsType<BoundaryDescriptor>(first.Boundary);
+        Assert.Equal(0u, firstBoundary.InstanceId);
+        Assert.Equal("index.html", firstBoundary.Owner);
+        Assert.Equal("row", firstBoundary.Name);
+        Assert.Equal(BoundaryKeyType.String, firstBoundary.Key.Type);
+        Assert.Equal("alpha\0omega", firstBoundary.Key.StringValue);
+        Assert.Null(firstBoundary.Key.NumberValue);
+
+        StreamingStep second = session.Resume(
+            firstBoundary.InstanceId,
+            StreamingState,
+            BoundaryMode.Updatable);
+        Assert.False(second.Done);
+        BoundaryDescriptor secondBoundary = Assert.IsType<BoundaryDescriptor>(second.Boundary);
+        Assert.Equal(1u, secondBoundary.InstanceId);
+        Assert.Equal(firstBoundary.DeclarationId, secondBoundary.DeclarationId);
+        Assert.Equal(BoundaryKeyType.Number, secondBoundary.Key.Type);
+        Assert.Null(secondBoundary.Key.StringValue);
+        Assert.Equal(7.0, secondBoundary.Key.NumberValue);
+
+        byte[] update = session.Update(firstBoundary.InstanceId, """{"label":"updated"}""");
+        Assert.NotEmpty(update);
+        Assert.Contains(@"""label"":""updated""", Text(update), StringComparison.Ordinal);
+
+        StreamingStep done = session.Resume(
+            secondBoundary.InstanceId,
+            StreamingState,
+            BoundaryMode.Final);
+        Assert.True(done.Done);
+        Assert.Null(done.Boundary);
+
+        string document = Text(first.Bytes) + Text(second.Bytes) + Text(update) + Text(done.Bytes);
+        Assert.StartsWith("<!DOCTYPE html>", document, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("first", document, StringComparison.Ordinal);
+        Assert.Contains("second", document, StringComparison.Ordinal);
+        Assert.Contains("</html>", document, StringComparison.Ordinal);
+        Assert.Equal(2, CountOccurrences(document, "<stream-item"));
     }
 
     [Fact]
-    public void Session_UnknownBoundaryName_ThrowsWithSuggestions()
+    public void Session_BoundaryFreeStateCompletesFromStart()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        var error = Assert.Throws<WebUIException>(() => session.Boundary("frist"));
-        Assert.Contains("frist", error.Message, StringComparison.Ordinal);
-        Assert.Contains("first", error.Message, StringComparison.Ordinal);
+        StreamingStep step = session.Start("""{"show":false,"items":[]}""");
+
+        Assert.True(step.Done);
+        Assert.Null(step.Boundary);
+        Assert.Contains("always-complete", Text(step.Bytes), StringComparison.Ordinal);
     }
 
     [Fact]
-    public void Session_OutOfOrderBoundary_Throws()
+    public void Session_StaleResumeThrowsAndLeavesPendingBoundaryUsable()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint second = session.Boundary("second");
-        session.WriteShell("{}");
+        StreamingStep first = session.Start(StreamingState);
+        BoundaryDescriptor boundary = Assert.IsType<BoundaryDescriptor>(first.Boundary);
 
-        Assert.Throws<WebUIException>(() =>
-            session.WriteBoundary(second, "{\"secondLabel\":\"beta\"}"));
+        WebUIException error = Assert.Throws<WebUIException>(() =>
+            session.Resume(99, StreamingState));
+        Assert.Contains("stale", error.Message, StringComparison.OrdinalIgnoreCase);
+
+        StreamingStep second = session.Resume(boundary.InstanceId, StreamingState);
+        Assert.NotNull(second.Boundary);
     }
 
     [Fact]
-    public void Session_UpdateToFinalBoundary_Throws()
+    public void Session_UpdateToFinalBoundaryThrows()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint first = session.Boundary("first");
-        session.WriteShell("{}");
-        session.WriteBoundary(first, "{\"firstLabel\":\"alpha\"}");
+        BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
+            session.Start(StreamingState).Boundary);
+        StreamingStep secondStep = session.Resume(first.InstanceId, StreamingState);
+        BoundaryDescriptor second = Assert.IsType<BoundaryDescriptor>(secondStep.Boundary);
 
         Assert.Throws<WebUIException>(() =>
-            session.Update(first, "{\"firstLabel\":\"alpha-2\"}"));
+            session.Update(first.InstanceId, """{"label":"ignored"}"""));
+
+        Assert.True(session.Resume(second.InstanceId, StreamingState).Done);
     }
 
     [Fact]
-    public void Session_CallAfterFinish_Throws()
+    public void Session_InvalidJsonThrowsAndSessionCanRetry()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint first = session.Boundary("first");
-        uint second = session.Boundary("second");
-        session.WriteShell("{}");
-        session.WriteBoundary(first, "{\"firstLabel\":\"alpha\"}");
-        session.WriteBoundary(second, "{\"secondLabel\":\"beta\"}");
-        session.Finish();
-
-        Assert.Throws<WebUIException>(() => session.Finish());
-        Assert.Throws<WebUIException>(() =>
-            session.WriteBoundary(second, "{\"secondLabel\":\"gamma\"}"));
+        Assert.Throws<WebUIException>(() => session.Start("not json"));
+        Assert.NotNull(session.Start(StreamingState).Boundary);
     }
 
     [Fact]
-    public void Session_InvalidStateJson_Throws()
+    public void Session_NullJsonArgumentsThrow()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        Assert.Throws<WebUIException>(() => session.WriteShell("not json"));
+        Assert.Throws<ArgumentNullException>(() => session.Start(null!));
+        BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
+            session.Start(StreamingState).Boundary);
+        Assert.Throws<ArgumentNullException>(() =>
+            session.Resume(first.InstanceId, null!));
+        Assert.Throws<ArgumentNullException>(() =>
+            session.Update(first.InstanceId, null!));
     }
 
     [Fact]
-    public void Session_StaysUsableAfterARejectedCall()
+    public void Session_InvalidBoundaryModeThrows()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint first = session.Boundary("first");
-        uint second = session.Boundary("second");
-
-        Assert.Throws<WebUIException>(() => session.Boundary("missing"));
-
-        session.WriteShell("{}");
-        session.WriteBoundary(first, "{\"firstLabel\":\"alpha\"}");
-        session.WriteBoundary(second, "{\"secondLabel\":\"beta\"}");
-        byte[] tail = session.Finish();
-
-        Assert.NotEmpty(tail);
-        Assert.True(session.IsFinished);
+        BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
+            session.Start(StreamingState).Boundary);
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            session.Resume(first.InstanceId, StreamingState, (BoundaryMode)99));
     }
 
     [Fact]
-    public void Session_OutOfOrderFinish_LeavesSessionUsable()
+    public void Session_CallAfterDoneThrows()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint first = session.Boundary("first");
-        uint second = session.Boundary("second");
-
-        session.WriteShell("{}");
-        session.WriteBoundary(first, "{\"firstLabel\":\"alpha\"}");
+        BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
+            session.Start(StreamingState).Boundary);
+        BoundaryDescriptor second = Assert.IsType<BoundaryDescriptor>(
+            session.Resume(first.InstanceId, StreamingState).Boundary);
+        Assert.True(session.Resume(second.InstanceId, StreamingState).Done);
 
-        // Rejected before any byte is written, so the open response survives.
-        Assert.Throws<WebUIException>(() => session.Finish());
-        Assert.False(session.IsFinished);
-
-        session.WriteBoundary(second, "{\"secondLabel\":\"beta\"}");
-        Assert.NotEmpty(session.Finish());
-        Assert.True(session.IsFinished);
+        Assert.Throws<WebUIException>(() => session.Start(StreamingState));
+        Assert.Throws<WebUIException>(() =>
+            session.Resume(second.InstanceId, StreamingState));
     }
 
     [Fact]
@@ -183,33 +186,46 @@ public void Session_ConcurrentSessionsAreIndependent()
         using StreamingSession a = handler.StreamResponse(protocol, "index.html", "/");
         using StreamingSession b = handler.StreamResponse(protocol, "index.html", "/");
 
-        uint firstA = a.Boundary("first");
-        uint firstB = b.Boundary("first");
+        BoundaryDescriptor firstA = Assert.IsType<BoundaryDescriptor>(
+            a.Start(StreamingState).Boundary);
+        BoundaryDescriptor firstB = Assert.IsType<BoundaryDescriptor>(
+            b.Start(StreamingState.Replace("first", "from-b", StringComparison.Ordinal)).Boundary);
 
-        a.WriteShell("{}");
-        b.WriteShell("{}");
+        string chunkA = Text(a.Resume(firstA.InstanceId, StreamingState).Bytes);
+        string chunkB = Text(b.Resume(
+            firstB.InstanceId,
+            StreamingState.Replace("first", "from-b", StringComparison.Ordinal)).Bytes);
 
-        string chunkA = Text(a.WriteBoundary(firstA, "{\"firstLabel\":\"from-a\"}"));
-        string chunkB = Text(b.WriteBoundary(firstB, "{\"firstLabel\":\"from-b\"}"));
-
-        Assert.Contains("from-a", chunkA, StringComparison.Ordinal);
+        Assert.Contains("first", chunkA, StringComparison.Ordinal);
         Assert.DoesNotContain("from-b", chunkA, StringComparison.Ordinal);
         Assert.Contains("from-b", chunkB, StringComparison.Ordinal);
-        Assert.DoesNotContain("from-a", chunkB, StringComparison.Ordinal);
     }
 
     [Fact]
-    public void Session_UseAfterDispose_ThrowsObjectDisposedException()
+    public void Session_EagerStepCopySurvivesSessionDisposal()
+    {
+        using var protocol = new Protocol(StreamingProtocolBytes());
+        using var handler = new WebUIHandler("webui");
+        StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
+
+        StreamingStep step = session.Start(StreamingState);
+        session.Dispose();
+
+        Assert.NotEmpty(step.Bytes);
+        Assert.Equal("alpha\0omega", step.Boundary?.Key.StringValue);
+    }
+
+    [Fact]
+    public void Session_UseAfterDisposeThrowsObjectDisposedException()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
         session.Dispose();
-        session.Dispose(); // Idempotent.
+        session.Dispose();
 
-        Assert.Throws<ObjectDisposedException>(() => session.WriteShell("{}"));
-        Assert.Throws<ObjectDisposedException>(() => session.Boundary("first"));
-        Assert.Throws<ObjectDisposedException>(() => session.BoundaryCount);
+        Assert.Throws<ObjectDisposedException>(() => session.Start(StreamingState));
+        Assert.Throws<ObjectDisposedException>(() => session.Update(0, "{}"));
     }
 
     [Fact]
@@ -218,12 +234,12 @@ public void Session_UnfinishedDisposeDoesNotThrow()
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
         StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
-        session.WriteShell("{}");
+        session.Start(StreamingState);
         session.Dispose();
     }
 
     [Fact]
-    public void StreamResponse_WithDisposedHandler_ThrowsObjectDisposedException()
+    public void StreamResponse_WithDisposedHandlerThrowsObjectDisposedException()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         var handler = new WebUIHandler("webui");
@@ -234,7 +250,7 @@ public void StreamResponse_WithDisposedHandler_ThrowsObjectDisposedException()
     }
 
     [Fact]
-    public void StreamResponse_WithDisposedProtocol_ThrowsObjectDisposedException()
+    public void StreamResponse_WithDisposedProtocolThrowsObjectDisposedException()
     {
         var protocol = new Protocol(StreamingProtocolBytes());
         protocol.Dispose();
@@ -245,7 +261,7 @@ public void StreamResponse_WithDisposedProtocol_ThrowsObjectDisposedException()
     }
 
     [Fact]
-    public void StreamResponse_WithUnknownEntry_Throws()
+    public void StreamResponse_WithUnknownEntryThrows()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
diff --git a/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html b/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
index aad9a63aa..c2623169f 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
+++ b/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
@@ -6,11 +6,13 @@
     <script type="module" async src="./index.js"></script>
   </head>
   <body>
-    <boundary name="first">
-      <stream-item label="{{firstLabel}}"></stream-item>
-    </boundary>
-    <boundary name="second">
-      <stream-item label="{{secondLabel}}"></stream-item>
-    </boundary>
+    <if condition="show">
+      <for each="item in items">
+        <boundary name="row" key="{{item.id}}">
+          <stream-item label="{{item.label}}"></stream-item>
+        </boundary>
+      </for>
+    </if>
+    <p>always-complete</p>
   </body>
 </html>
diff --git a/examples/README.md b/examples/README.md
index 579bf1646..a1f8881c6 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -20,7 +20,7 @@ Current entries:
 | `app/commerce` | WebUI Framework hydration app with a Rust backend for commerce demo app, dozens of controls |
 | `app/routes` | Nested declarative routing demo showing 4-level deep routes, full server side and client handoff |
 | `app/service-worker` | Static/CDN service worker app using `webui_wasm_handler` to stream WASM-rendered chunks from public API state |
-| `app/streaming` | Progressive streaming hydration demo - a Node API paces named `<boundary>` records while `webui serve` owns the Rust response session and bounded browser stream |
+| `app/streaming` | Progressive hydration demo with runtime-discovered component boundaries, descriptor-driven backend pacing, and a bounded browser stream |
 | `integration/node` | Node.js integration via native addon |
 | `integration/node-addon-bench` | Node/V8/N-API runtime benchmark for the native addon |
 | `integration/rust` | Rust integration via `webui-handler` |
diff --git a/examples/app/service-worker/README.md b/examples/app/service-worker/README.md
index 3728c94e7..7f9473bb0 100644
--- a/examples/app/service-worker/README.md
+++ b/examples/app/service-worker/README.md
@@ -11,9 +11,10 @@ The browser loads only static assets:
 - a service worker that streams the navigation response
 
 No application server is required. The service worker fetches public API state,
-constructs one `webui_wasm_handler.Protocol`, renders matching fragments with
-`Protocol.renderStream()`, and enqueues each section into a `ReadableStream` as
-soon as that API response resolves.
+constructs one `webui_wasm_handler.Protocol`, opens a
+`Protocol.streamResponse()` session, and enqueues every `start()` / `resume()`
+step into a `ReadableStream`. API fetches run concurrently, while each resume
+uses the runtime descriptor returned by the previous `StreamStep`.
 
 Because the example renders public API data, the service worker validates URL
 fields before calling the handler. Keep that boundary in copied code so
@@ -77,9 +78,9 @@ pnpm --filter service-worker-example test
 ```
 
 The Playwright smoke test verifies that the page is controlled by the service
-worker, renders all WebUI chunks, and receives the chunks in async completion
-order rather than source order. Each chunk is wrapped with a `data-chunk`
-marker so the stream order is visible and easy to assert.
+worker, renders all WebUI chunks, and commits them in the cursor's authored
+order while their API fetches overlap. Each chunk is wrapped with a
+`data-chunk` marker so the stream order is visible and easy to assert.
 
 ## Why this matters
 
@@ -88,9 +89,10 @@ from public APIs. The serverless edge path can be:
 
 1. CDN serves static files.
 2. Browser service worker loads `protocol.bin`.
-3. Public APIs return JSON state.
-4. WebUI WASM handler renders HTML chunks locally.
-5. The service worker streams the response to the page.
+3. Public APIs return JSON state concurrently.
+4. `start()` returns the first pending boundary descriptor.
+5. The worker resumes each descriptor with its matching state and streams the
+   returned bytes to the page; the final resume emits the terminal automatically.
 
 ## Source layout
 
diff --git a/examples/app/service-worker/public/api/metrics.json b/examples/app/service-worker/public/api/metrics.json
index 362f971df..abdf3078e 100644
--- a/examples/app/service-worker/public/api/metrics.json
+++ b/examples/app/service-worker/public/api/metrics.json
@@ -3,7 +3,7 @@
   "delayMs": 160,
   "state": {
     "label": "Public API: /api/metrics.json",
-    "title": "Chunks render as async state resolves",
+    "title": "Concurrent fetches feed an ordered cursor",
     "metrics": [
       {
         "value": "1",
diff --git a/examples/app/service-worker/scripts/check-render.ts b/examples/app/service-worker/scripts/check-render.ts
index 665e74c2a..43a49524a 100644
--- a/examples/app/service-worker/scripts/check-render.ts
+++ b/examples/app/service-worker/scripts/check-render.ts
@@ -16,6 +16,18 @@ const themeCssPath = resolve(exampleRoot, "public/theme.css");
 const apiFiles = ["shell", "hero", "metrics", "activity"];
 const baseUrl = new URL("http://localhost:4175/");
 
+interface WasmBoundaryDescriptor {
+  instanceId: number;
+  owner: string;
+  name: string;
+}
+
+interface WasmStreamStep {
+  bytes: Uint8Array;
+  done: boolean;
+  boundary?: WasmBoundaryDescriptor;
+}
+
 await initWasm({ module_or_path: await readFile(wasmPath) });
 
 const protocol = new Protocol(
@@ -23,36 +35,60 @@ const protocol = new Protocol(
   "webui",
 );
 
+const payloads = new Map<string, ReturnType<typeof sanitizePayload>>();
 for (const name of apiFiles) {
   const payload = JSON.parse(
     await readFile(resolve(exampleRoot, `public/api/${name}.json`), "utf-8"),
   );
-  const sanitized = sanitizePayload(payload, `api/${name}.json`, baseUrl);
-  let html = "";
-  const onChunk = (chunk: string): void => {
-    html += chunk;
-  };
-  protocol.renderStream(
-    JSON.stringify(sanitized.state),
-    onChunk,
-    { entry: sanitized.entry, requestPath: "/" },
-  );
-  if (!html.includes("card")) {
-    throw new Error(`Rendered ${sanitized.entry} did not include expected card markup`);
+  payloads.set(name, sanitizePayload(payload, `api/${name}.json`, baseUrl));
+}
+
+const themeCss = await readFile(themeCssPath, "utf-8");
+const session = protocol.streamResponse("index.html", "/", {
+  headInject: `<style>${themeCss}</style>`,
+});
+const decoder = new TextDecoder();
+let html = "";
+let step = session.start("{}") as WasmStreamStep;
+html += decoder.decode(step.bytes);
+while (!step.done) {
+  const boundary = step.boundary;
+  if (!boundary) {
+    throw new Error("Streaming session returned no pending boundary");
   }
-  if (!html.includes("<style>")) {
-    throw new Error(`Rendered ${sanitized.entry} did not include component CSS`);
+  const payload = payloads.get(boundary.name);
+  if (!payload || boundary.owner !== "index.html") {
+    throw new Error(`Unexpected boundary ${boundary.owner}/${boundary.name}`);
   }
-  if (html.includes("styles.css")) {
-    throw new Error(`Rendered ${sanitized.entry} referenced the removed standalone stylesheet`);
+  if (payload.entry !== `${boundary.name}-panel`) {
+    throw new Error(`Boundary ${boundary.name} received state for ${payload.entry}`);
   }
+  step = session.resume(
+    boundary.instanceId,
+    JSON.stringify(payload.state),
+  ) as WasmStreamStep;
+  html += decoder.decode(step.bytes);
+}
+
+for (const name of apiFiles) {
+  if (!html.includes(`data-chunk="${name}"`)) {
+    throw new Error(`Streaming response omitted ${name}`);
+  }
+}
+if ((html.match(/class="card/g) ?? []).length < apiFiles.length) {
+  throw new Error("Streaming response did not include every card");
+}
+if (!html.includes("<style>")) {
+  throw new Error("Streaming response did not include component CSS");
+}
+if (html.includes("styles.css")) {
+  throw new Error("Streaming response referenced the removed standalone stylesheet");
 }
 
 const bootstrapHtml = await readFile(resolve(exampleRoot, "public/index.html"), "utf-8");
 assert.match(bootstrapHtml, /--color-brand-primary: #0078d4;/);
 assert.doesNotMatch(bootstrapHtml, /WEBUI_THEME_(LIGHT|DARK)/);
 
-const themeCss = await readFile(themeCssPath, "utf-8");
 assert.match(themeCss, /--color-brand-primary: #0078d4;/);
 assert.doesNotMatch(themeCss, /WEBUI_THEME_(LIGHT|DARK)/);
 
diff --git a/examples/app/service-worker/src/index.html b/examples/app/service-worker/src/index.html
index 320b74884..653936d0b 100644
--- a/examples/app/service-worker/src/index.html
+++ b/examples/app/service-worker/src/index.html
@@ -7,10 +7,29 @@
 </head>
 
 <body>
-  <shell-panel></shell-panel>
-  <hero-panel></hero-panel>
-  <metrics-panel></metrics-panel>
-  <activity-panel></activity-panel>
+  <main class="page">
+    <div class="stream-note">Streaming from service worker + WebUI WASM handler</div>
+    <boundary name="shell">
+      <div class="stream-chunk" data-chunk="shell">
+        <shell-panel></shell-panel>
+      </div>
+    </boundary>
+    <boundary name="hero">
+      <div class="stream-chunk" data-chunk="hero">
+        <hero-panel></hero-panel>
+      </div>
+    </boundary>
+    <boundary name="metrics">
+      <div class="stream-chunk" data-chunk="metrics">
+        <metrics-panel></metrics-panel>
+      </div>
+    </boundary>
+    <boundary name="activity">
+      <div class="stream-chunk" data-chunk="activity">
+        <activity-panel></activity-panel>
+      </div>
+    </boundary>
+  </main>
 </body>
 
 </html>
diff --git a/examples/app/service-worker/src/service-worker.ts b/examples/app/service-worker/src/service-worker.ts
index 06b42fee0..e8f1e4969 100644
--- a/examples/app/service-worker/src/service-worker.ts
+++ b/examples/app/service-worker/src/service-worker.ts
@@ -4,7 +4,11 @@
 /// <reference lib="webworker" />
 
 import { API_CHUNKS, sanitizePayload, type ApiChunk, type ApiPayload } from './payload.js';
-import initWasm, { Protocol } from './wasm/handler/webui_wasm_handler.js';
+import initWasm, {
+  type BoundaryDescriptor,
+  Protocol,
+  type StreamStep,
+} from './wasm/handler/webui_wasm_handler.js';
 
 declare const self: ServiceWorkerGlobalScope;
 
@@ -52,14 +56,38 @@ async function streamNavigation(): Promise<Response> {
 }
 
 async function streamHtml(controller: ReadableStreamDefaultController<Uint8Array>): Promise<void> {
-  const themeCss = await loadThemeCss();
-  controller.enqueue(encode(documentStart(themeCss)));
-
-  const protocol = await loadProtocol();
-  controller.enqueue(encode("<!-- protocol-ready -->\n"));
+  const [themeCss, protocol] = await Promise.all([loadThemeCss(), loadProtocol()]);
+  const session = protocol.streamResponse('index.html', '/', {
+    headInject: `<style>${themeCss}</style>`,
+  });
+  const pending = new Map<
+    string,
+    Promise<{ chunk: ApiChunk; payload: ApiPayload }>
+  >(
+    API_CHUNKS.map((chunk) => [
+      chunk.label,
+      fetchChunk(chunk).then((payload) => ({ chunk, payload })),
+    ]),
+  );
 
-  await streamChunksAsReady(controller, protocol);
-  controller.enqueue(encode(documentEnd()));
+  let step = session.start('{}');
+  controller.enqueue(step.bytes);
+  while (!step.done) {
+    const boundary = pendingBoundary(step);
+    const result = await pending.get(boundary.name);
+    if (!result) {
+      throw new Error(
+        `Unexpected streaming boundary ${boundary.owner}/${boundary.name}`,
+      );
+    }
+    pending.delete(boundary.name);
+    validateBoundaryPayload(boundary, result.chunk, result.payload);
+    step = session.resume(
+      boundary.instanceId,
+      JSON.stringify(result.payload.state),
+    );
+    controller.enqueue(step.bytes);
+  }
 }
 
 async function loadThemeCss(): Promise<string> {
@@ -109,33 +137,27 @@ function loadWasm(): Promise<unknown> {
   return wasmReady;
 }
 
-async function streamChunksAsReady(
-  controller: ReadableStreamDefaultController<Uint8Array>,
-  protocol: Protocol,
-): Promise<void> {
-  const pending = API_CHUNKS.map((chunk) =>
-    fetchChunk(chunk).then((payload) => ({ chunk, payload })),
-  );
-
-  while (pending.length > 0) {
-    const indexed = pending.map((promise, index) =>
-      promise.then((result) => ({ index, result })),
-    );
-    const { index, result } = await Promise.race(indexed);
-    pending.splice(index, 1);
+function pendingBoundary(step: StreamStep): BoundaryDescriptor {
+  if (step.done || !step.boundary) {
+    throw new Error('Streaming session returned no pending boundary');
+  }
+  return step.boundary;
+}
 
-    controller.enqueue(
-      encode(`<div class="stream-chunk" data-chunk="${result.chunk.label}">\n`),
+function validateBoundaryPayload(
+  boundary: BoundaryDescriptor,
+  chunk: ApiChunk,
+  payload: ApiPayload,
+): void {
+  if (boundary.owner !== 'index.html' || boundary.name !== chunk.label) {
+    throw new Error(
+      `Expected index.html/${chunk.label}, received ${boundary.owner}/${boundary.name}`,
     );
-    protocol.renderStream(
-      JSON.stringify(result.payload.state),
-      (chunk: string) => controller.enqueue(encode(chunk)),
-      {
-        entry: result.payload.entry,
-        requestPath: '/',
-      },
+  }
+  if (payload.entry !== `${chunk.label}-panel`) {
+    throw new Error(
+      `API payload for ${chunk.label} targets unexpected entry ${payload.entry}`,
     );
-    controller.enqueue(encode("\n</div>\n"));
   }
 }
 
@@ -165,28 +187,6 @@ function encode(value: string): Uint8Array {
   return encoder.encode(value);
 }
 
-function documentStart(themeCss: string): string {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>WebUI Service Worker Streaming</title>
-  <style>${themeCss}</style>
-</head>
-<body>
-  <main class="page">
-    <div class="stream-note">Streaming from service worker + WebUI WASM handler</div>
-`;
-}
-
-function documentEnd(): string {
-  return `  </main>
-</body>
-</html>
-`;
-}
-
 function renderError(error: unknown): string {
   const message = error instanceof Error ? error.message : String(error);
   return `<section class="card error-card"><h1>Render failed</h1><p>${escapeHtml(message)}</p></section>`;
diff --git a/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts b/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
index cc5a6a82f..d7ffbe313 100644
--- a/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
+++ b/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
@@ -10,12 +10,33 @@ export default function init(
 export class Protocol {
   constructor(protocolBytes: Uint8Array, plugin?: string | null);
 
-  renderStream(
-    stateJson: string,
-    onChunk: (html: string) => void,
+  streamResponse(
+    entry: string,
+    requestPath: string,
     options?: {
-      entry?: string;
-      requestPath?: string;
+      nonce?: string;
+      headInject?: string;
+      bodyInject?: string;
     },
-  ): void;
+  ): StreamingSession;
+}
+
+export interface BoundaryDescriptor {
+  instanceId: number;
+  declarationId: number;
+  owner: string;
+  name: string;
+  key?: string | number;
+}
+
+export interface StreamStep {
+  bytes: Uint8Array;
+  done: boolean;
+  boundary?: BoundaryDescriptor;
+}
+
+export class StreamingSession {
+  start(stateJson: string): StreamStep;
+  resume(instanceId: number, stateJson: string, mode?: 'final' | 'updatable'): StreamStep;
+  update(instanceId: number, stateJson: string): Uint8Array;
 }
diff --git a/examples/app/service-worker/tests/service-worker.spec.ts b/examples/app/service-worker/tests/service-worker.spec.ts
index 903f92e90..285c1b401 100644
--- a/examples/app/service-worker/tests/service-worker.spec.ts
+++ b/examples/app/service-worker/tests/service-worker.spec.ts
@@ -22,13 +22,13 @@ test('streams WebUI-rendered chunks from a service worker', async ({ page }) =>
 
   await expect(page.getByRole('heading', { name: 'WebUI rendered in a service worker' })).toBeVisible();
   await expect(page.getByRole('heading', { name: 'Serverless HTML without an app server' })).toBeVisible();
-  await expect(page.getByText('Chunks render as async state resolves')).toBeVisible();
+  await expect(page.getByText('Concurrent fetches feed an ordered cursor')).toBeVisible();
   await expect(page.getByText('Streaming timeline')).toBeVisible();
   await expect(page.locator('.error-card')).toHaveCount(0);
 
   const headings = await page.locator('.card h1, .card h2').allTextContents();
   const shell = headings.indexOf('WebUI rendered in a service worker');
-  const metrics = headings.indexOf('Chunks render as async state resolves');
+  const metrics = headings.indexOf('Concurrent fetches feed an ordered cursor');
   const hero = headings.indexOf('Serverless HTML without an app server');
   const activity = headings.indexOf('Streaming timeline');
 
@@ -36,12 +36,12 @@ test('streams WebUI-rendered chunks from a service worker', async ({ page }) =>
   const chunkOrder = await page.locator('.stream-chunk').evaluateAll((nodes) =>
     nodes.map((node) => node.getAttribute('data-chunk')),
   );
-  expect(chunkOrder).toEqual(['shell', 'metrics', 'hero', 'activity']);
+  expect(chunkOrder).toEqual(['shell', 'hero', 'metrics', 'activity']);
 
   expect(shell).toBeGreaterThan(-1);
-  expect(metrics).toBeGreaterThan(shell);
-  expect(hero).toBeGreaterThan(metrics);
-  expect(activity).toBeGreaterThan(hero);
+  expect(hero).toBeGreaterThan(shell);
+  expect(metrics).toBeGreaterThan(hero);
+  expect(activity).toBeGreaterThan(metrics);
 
   await expect(page.locator('style')).toHaveCount(5);
   const themeCss = await page.locator('style').first().evaluate((node) => node.textContent ?? '');
diff --git a/examples/app/streaming/README.md b/examples/app/streaming/README.md
index 2c599cbfb..ed88d7522 100644
--- a/examples/app/streaming/README.md
+++ b/examples/app/streaming/README.md
@@ -11,7 +11,10 @@ interactive before `DOMContentLoaded` while the response is still open; a
 **`weather-panel`** shows its own skeleton and receives server state through the
 same response; a three-batch **feed** streams in afterward, each
 batch's `feed-item` islands hydrating independently as their own
-`<boundary>` commits.
+`<boundary>` commits. The document entry contains only one
+`<streaming-page>` host. Its component template owns all five boundaries, so
+the composer becomes interactive before the parent page's final tail and span
+completion arrive.
 
 ```bash
 # Install JS dependencies
@@ -44,7 +47,9 @@ instruction instead of silently falling back to full-state payloads.
 The Node API feed gaps are bounded by `--feed-delay-min-ms` (500) and
 `--feed-delay-max-ms` (1000) and are re-rolled per request, so repeated loads
 do not look mechanically identical. The forecast resolves independently, so its
-state record can appear between any two feed checkpoints:
+state record can appear between any two feed checkpoints. If it is still
+pending at the last gap, the API sends the update before the final resume,
+because that resume completes the session and closes its update window:
 
 ```bash
 pnpm start:api -- --feed-delay-min-ms 200 --feed-delay-max-ms 400
@@ -52,22 +57,25 @@ pnpm start:api -- --feed-delay-min-ms 200 --feed-delay-max-ms 400
 
 For an HTML request, `webui serve` advertises
 `Accept: application/x-webui-stream, application/json`. The API selects
-streaming with the first media type and writes versioned NDJSON commands:
+streaming with the first media type and writes version-2 NDJSON controls:
 
 ```text
-{"type":"shell","version":1,"state":{...}}
-{"type":"boundary","name":"weather-shell","mode":"updatable"}
-{"type":"boundary","name":"composer-ready"}
-{"type":"update","name":"weather-shell","state":{...}}
-{"type":"finish"}
+{"type":"start","version":2,"state":{...}}
+{"type":"resume","boundary":{"owner":"streaming-page","name":"weather-shell"},"mode":"updatable","state":{}}
+{"type":"resume","boundary":{"owner":"streaming-page","name":"composer-ready"},"state":{}}
+{"type":"update","boundary":{"owner":"streaming-page","name":"weather-shell"},"state":{...}}
 ```
 
 In this topology Node controls readiness and order, but does not render WebUI.
-The CLI resolves each name once to an integer boundary handle and owns the
-compiled protocol, `StreamingResponse`, pooled `StreamingWriter`, and
-browser-facing record format. A capacity-one command channel and Node's
-`response.write()` / `drain` contract propagate backpressure across the loopback
-bridge.
+Each `resume` echoes the expected runtime descriptor's owner, name, and optional
+typed key. The one-way channel has no acknowledgement carrying instance IDs, so
+the CLI validates that selector against the current `StreamStep`, remembers the
+committed descriptor-to-instance mapping for later updates, and rejects stale or
+ambiguous targets. `declarationId` may be included as an extra validation field.
+The final `resume` returns `done`, writes the terminal automatically, and the API
+closes its NDJSON body; there is no finish control. A capacity-one command
+channel and Node's `response.write()` / `drain` contract propagate backpressure
+across the loopback bridge.
 
 **This is one of two supported topologies.** This example uses the
 **API-proxy** topology, which is the right fit when you want the CLI to own
@@ -84,7 +92,7 @@ ordering, projection, the wire format, and every diagnostic are identical.
 
 ### Why weather uses a state record
 
-Boundary HTML is delivered strictly in document order, so the weather boundary
+Runtime boundary HTML is delivered in discovery order, so the weather boundary
 ships a complete `weather-panel` in its `loading` state immediately. The host
 commits it as `BoundaryMode::Updatable`, starts forecast work concurrently, and
 calls `StreamingResponse::update` when the forecast resolves. The typed state
@@ -184,10 +192,10 @@ by the application bundle, not by CSS. See
 ### How it stays deterministic
 
 `server/src/pacing.ts` races weather readiness against each feed delay and
-writes commands in completion order. `server/src/stream-protocol.ts` emits one
-record per semantic write, honors Node HTTP backpressure, and ends immediately
-after `finish`. The API caps concurrent admitted streams before sending a 200
-response.
+writes controls in completion order. `server/src/stream-protocol.ts` emits one
+record per semantic write, honors Node HTTP backpressure, and closes the body
+after the final resume. The API caps concurrent admitted streams before sending
+a 200 response.
 
 Inside `webui serve`, one blocking worker owns the real
 `WebUIHandler::stream_response` and `StreamingWriter` for the response
@@ -196,7 +204,7 @@ the existing capacity-four browser channel and 30-second flush timeout remain
 in force. The example never manufactures browser envelopes or duplicates
 protocol rendering in JavaScript.
 
-Three feed batches are three explicit `<boundary>` groups — WebUI does not
+Three feed batches are three explicit component-local `<boundary>` groups — WebUI does not
 implement an open-ended `<webui-stream>` directive. The feed's `<section>`
 container is never itself hydrated: each `feed-item` carries its own state in
 its own attributes, so one batch's items can never read or mutate another
diff --git a/examples/app/streaming/server/src/index.ts b/examples/app/streaming/server/src/index.ts
index a286434f2..f9aeb62e5 100644
--- a/examples/app/streaming/server/src/index.ts
+++ b/examples/app/streaming/server/src/index.ts
@@ -91,6 +91,7 @@ async function renderPage(
       testSession,
       signal: abort.signal,
     });
+    response.end();
   } catch (error) {
     if (!abort.signal.aborted) {
       const message = error instanceof Error ? error.message : String(error);
diff --git a/examples/app/streaming/server/src/pacing.test.ts b/examples/app/streaming/server/src/pacing.test.ts
index 3f23595bd..fe29c66eb 100644
--- a/examples/app/streaming/server/src/pacing.test.ts
+++ b/examples/app/streaming/server/src/pacing.test.ts
@@ -6,36 +6,40 @@ import { test } from 'node:test';
 
 import { STREAMING_STATE } from './data.js';
 import { streamPage } from './pacing.js';
-import { acceptsWebUIStream, type StreamSink } from './stream-protocol.js';
+import {
+  acceptsWebUIStream,
+  type BoundaryTarget,
+  type StreamSink,
+} from './stream-protocol.js';
 import { TestControls } from './test-controls.js';
 
 interface RecordedCommand {
-  type: 'shell' | 'boundary' | 'update' | 'finish';
-  name?: string;
+  type: 'start' | 'resume' | 'update';
+  boundary?: BoundaryTarget;
 }
 
 class RecordingSink implements StreamSink {
   readonly commands: RecordedCommand[] = [];
   #changed: (() => void) | undefined;
 
-  shell(): Promise<void> {
-    return this.#record({ type: 'shell' });
+  start(): Promise<void> {
+    return this.#record({ type: 'start' });
   }
 
-  boundary(name: string): Promise<void> {
-    return this.#record({ type: 'boundary', name });
+  resume(boundary: BoundaryTarget): Promise<void> {
+    return this.#record({ type: 'resume', boundary });
   }
 
-  update(name: string): Promise<void> {
-    return this.#record({ type: 'update', name });
-  }
-
-  finish(): Promise<void> {
-    return this.#record({ type: 'finish' });
+  update(boundary: BoundaryTarget): Promise<void> {
+    return this.#record({ type: 'update', boundary });
   }
 
   async waitFor(type: RecordedCommand['type'], name?: string): Promise<void> {
-    while (!this.commands.some((command) => command.type === type && command.name === name)) {
+    while (
+      !this.commands.some(
+        (command) => command.type === type && command.boundary?.name === name,
+      )
+    ) {
       await new Promise<void>((resolve) => {
         this.#changed = resolve;
       });
@@ -61,20 +65,22 @@ test('ready weather can arrive between feed boundaries', async () => {
     testSession: session,
   });
 
-  await sink.waitFor('boundary', 'composer-ready');
+  await sink.waitFor('resume', 'composer-ready');
   session.releaseNextFeedGap();
-  await sink.waitFor('boundary', 'feed-batch-1');
+  await sink.waitFor('resume', 'feed-batch-1');
   session.releaseWeather();
   await sink.waitFor('update', 'weather-shell');
   assert.equal(
-    sink.commands.some((command) => command.name === 'feed-batch-2'),
+    sink.commands.some((command) => command.boundary?.name === 'feed-batch-2'),
     false,
   );
 
   session.releaseAll();
   await streaming;
   assert.deepEqual(
-    sink.commands.filter((command) => command.type === 'boundary').map((command) => command.name),
+    sink.commands
+      .filter((command) => command.type === 'resume')
+      .map((command) => command.boundary?.name),
     [
       'weather-shell',
       'composer-ready',
@@ -83,7 +89,46 @@ test('ready weather can arrive between feed boundaries', async () => {
       'feed-batch-3',
     ],
   );
-  assert.equal(sink.commands.at(-1)?.type, 'finish');
+  assert.equal(sink.commands.at(-1)?.boundary?.name, 'feed-batch-3');
+  assert.equal(
+    sink.commands
+      .filter((command) => command.boundary)
+      .every((command) => command.boundary?.owner === 'streaming-page'),
+    true,
+  );
+});
+
+test('a late weather update is sent before the final resume completes the stream', async () => {
+  const controls = new TestControls();
+  const session = controls.session('late-weather');
+  assert.ok(session);
+  const sink = new RecordingSink();
+  const streaming = streamPage(sink, {
+    feedDelayMinMs: 0,
+    feedDelayMaxMs: 0,
+    testSession: session,
+  });
+
+  await sink.waitFor('resume', 'composer-ready');
+  session.releaseNextFeedGap();
+  await sink.waitFor('resume', 'feed-batch-1');
+  session.releaseNextFeedGap();
+  await sink.waitFor('resume', 'feed-batch-2');
+  session.releaseNextFeedGap();
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  assert.equal(
+    sink.commands.some((command) => command.boundary?.name === 'feed-batch-3'),
+    false,
+  );
+
+  session.releaseWeather();
+  await streaming;
+  const update = sink.commands.findIndex((command) => command.type === 'update');
+  const finalResume = sink.commands.findIndex(
+    (command) => command.boundary?.name === 'feed-batch-3',
+  );
+  assert.ok(update >= 0);
+  assert.ok(finalResume > update);
 });
 
 test('every feed post carries the fields bound by feed-item', () => {
@@ -124,11 +169,11 @@ test('disconnect cancellation stops before the next paced boundary', async () =>
     signal: abort.signal,
   });
 
-  await sink.waitFor('boundary', 'composer-ready');
+  await sink.waitFor('resume', 'composer-ready');
   abort.abort();
   await assert.rejects(streaming, { name: 'AbortError' });
   assert.equal(
-    sink.commands.some((command) => command.name === 'feed-batch-1'),
+    sink.commands.some((command) => command.boundary?.name === 'feed-batch-1'),
     false,
   );
   session.releaseAll();
diff --git a/examples/app/streaming/server/src/pacing.ts b/examples/app/streaming/server/src/pacing.ts
index 66a2030ad..596df813e 100644
--- a/examples/app/streaming/server/src/pacing.ts
+++ b/examples/app/streaming/server/src/pacing.ts
@@ -4,14 +4,20 @@
 import { randomInt } from 'node:crypto';
 
 import { createForecast, STREAMING_STATE, type ForecastState } from './data.js';
-import type { StreamSink } from './stream-protocol.js';
+import type { BoundaryTarget, StreamSink } from './stream-protocol.js';
 import type { TestSession } from './test-controls.js';
 
 export const FEED_BATCH_COUNT = 3;
 export const WEATHER_DELAY_MIN_MS = 700;
 
 const WEATHER_DELAY_MAX_MS = 1_400;
-const FEED_BOUNDARIES = ['feed-batch-1', 'feed-batch-2', 'feed-batch-3'] as const;
+const WEATHER_BOUNDARY = pageBoundary('weather-shell');
+const COMPOSER_BOUNDARY = pageBoundary('composer-ready');
+const FEED_BOUNDARIES = [
+  pageBoundary('feed-batch-1'),
+  pageBoundary('feed-batch-2'),
+  pageBoundary('feed-batch-3'),
+] as const;
 
 export interface PacingOptions {
   feedDelayMinMs: number;
@@ -25,9 +31,9 @@ type ReadyWork =
   | { type: 'feed' };
 
 export async function streamPage(sink: StreamSink, options: PacingOptions): Promise<void> {
-  await sink.shell(STREAMING_STATE);
-  await sink.boundary('weather-shell', 'updatable');
-  await sink.boundary('composer-ready');
+  await sink.start(STREAMING_STATE);
+  await sink.resume(WEATHER_BOUNDARY, {}, 'updatable');
+  await sink.resume(COMPOSER_BOUNDARY, {});
 
   const weather = loadForecast(options.testSession, options.signal).then(
     (forecast): ReadyWork => ({ type: 'weather', forecast }),
@@ -39,23 +45,26 @@ export async function streamPage(sink: StreamSink, options: PacingOptions): Prom
     if (weatherPending) {
       const ready = await Promise.race([weather, feed]);
       if (ready.type === 'weather') {
-        await sink.update('weather-shell', ready.forecast);
+        await sink.update(WEATHER_BOUNDARY, ready.forecast);
         weatherPending = false;
         await feed;
       }
     } else {
       await feed;
     }
-    await sink.boundary(FEED_BOUNDARIES[batch]);
-  }
-
-  if (weatherPending) {
-    const ready = await weather;
-    if (ready.type === 'weather') {
-      await sink.update('weather-shell', ready.forecast);
+    if (batch === FEED_BATCH_COUNT - 1 && weatherPending) {
+      const ready = await weather;
+      if (ready.type === 'weather') {
+        await sink.update(WEATHER_BOUNDARY, ready.forecast);
+        weatherPending = false;
+      }
     }
+    await sink.resume(FEED_BOUNDARIES[batch], {});
   }
-  await sink.finish();
+}
+
+function pageBoundary(name: string): BoundaryTarget {
+  return { owner: 'streaming-page', name };
 }
 
 async function waitForFeed(options: PacingOptions, batch: number): Promise<void> {
diff --git a/examples/app/streaming/server/src/stream-protocol.ts b/examples/app/streaming/server/src/stream-protocol.ts
index 3369c4f08..b7248370a 100644
--- a/examples/app/streaming/server/src/stream-protocol.ts
+++ b/examples/app/streaming/server/src/stream-protocol.ts
@@ -5,7 +5,7 @@ import type { ServerResponse } from 'node:http';
 
 export const WEBUI_STREAM_MEDIA_TYPE = 'application/x-webui-stream';
 
-const WEBUI_STREAM_VERSION = 1;
+const WEBUI_STREAM_VERSION = 2;
 const MAX_RECORD_BYTES = 2_000_000;
 
 export type JsonValue =
@@ -20,17 +20,31 @@ export interface JsonObject {
   readonly [key: string]: JsonValue;
 }
 
+export interface BoundaryTarget {
+  readonly owner: string;
+  readonly name: string;
+  readonly key?: string | number;
+  readonly declarationId?: number;
+}
+
 type StreamRecord =
-  | { type: 'shell'; version: typeof WEBUI_STREAM_VERSION; state: JsonObject }
-  | { type: 'boundary'; name: string; mode?: 'updatable'; state?: JsonObject }
-  | { type: 'update'; name: string; state: JsonObject }
-  | { type: 'finish'; state?: JsonObject };
+  | { type: 'start'; version: typeof WEBUI_STREAM_VERSION; state: JsonObject }
+  | {
+      type: 'resume';
+      boundary: BoundaryTarget;
+      mode?: 'updatable';
+      state: JsonObject;
+    }
+  | { type: 'update'; boundary: BoundaryTarget; state: JsonObject };
 
 export interface StreamSink {
-  shell(state: JsonObject): Promise<void>;
-  boundary(name: string, mode?: 'final' | 'updatable', state?: JsonObject): Promise<void>;
-  update(name: string, state: JsonObject): Promise<void>;
-  finish(state?: JsonObject): Promise<void>;
+  start(state: JsonObject): Promise<void>;
+  resume(
+    boundary: BoundaryTarget,
+    state: JsonObject,
+    mode?: 'final' | 'updatable',
+  ): Promise<void>;
+  update(boundary: BoundaryTarget, state: JsonObject): Promise<void>;
 }
 
 export function acceptsWebUIStream(header: string | undefined): boolean {
@@ -65,36 +79,24 @@ export class WebUIStreamWriter implements StreamSink {
     this.#response = response;
   }
 
-  shell(state: JsonObject): Promise<void> {
-    return this.#write({ type: 'shell', version: WEBUI_STREAM_VERSION, state });
+  start(state: JsonObject): Promise<void> {
+    return this.#write({ type: 'start', version: WEBUI_STREAM_VERSION, state });
   }
 
-  boundary(
-    name: string,
+  resume(
+    boundary: BoundaryTarget,
+    state: JsonObject,
     mode: 'final' | 'updatable' = 'final',
-    state?: JsonObject,
   ): Promise<void> {
-    const record: StreamRecord = { type: 'boundary', name };
+    const record: StreamRecord = { type: 'resume', boundary, state };
     if (mode === 'updatable') {
       record.mode = mode;
     }
-    if (state !== undefined) {
-      record.state = state;
-    }
     return this.#write(record);
   }
 
-  update(name: string, state: JsonObject): Promise<void> {
-    return this.#write({ type: 'update', name, state });
-  }
-
-  async finish(state?: JsonObject): Promise<void> {
-    const record: StreamRecord = { type: 'finish' };
-    if (state !== undefined) {
-      record.state = state;
-    }
-    await this.#write(record);
-    this.#response.end();
+  update(boundary: BoundaryTarget, state: JsonObject): Promise<void> {
+    return this.#write({ type: 'update', boundary, state });
   }
 
   async #write(record: StreamRecord): Promise<void> {
diff --git a/examples/app/streaming/src/index.html b/examples/app/streaming/src/index.html
index c70f6c1f9..9939391fe 100644
--- a/examples/app/streaming/src/index.html
+++ b/examples/app/streaming/src/index.html
@@ -35,79 +35,16 @@
       line-height: var(--line-height-base);
     }
 
-    header {
-      margin-bottom: var(--spacing-xl);
-    }
-
-    main {
-      display: flex;
-      flex-direction: column;
-      gap: var(--spacing-xl);
-    }
-
-    section[aria-label="Feed"] {
-      display: flex;
-      flex-direction: column;
-      gap: var(--spacing-m);
+    streaming-page {
+      display: block;
     }
   </style>
 </head>
 <body>
-  <header>
-    <h1>Streaming Home</h1>
-    <!--
-      The shell commits immediately as an updatable boundary, so slow forecast
-      work cannot hold back the composer. When that server work finishes, the
-      same response sends a projected state record to this boundary; no client
-      request or DOM replacement is involved.
-    -->
-    <boundary name="weather-shell">
-      <!--
-        The island's code ships with the island, not with the critical
-        bundle. The browser discovers this script when the weather chunk
-        reaches the parser, so `index.js` never carries the panel's bytes and
-        the composer's time to interactive does not pay for them.
-
-        Loading it late is safe by construction: the boundary commits before
-        the class exists, the coordinator parks the root on
-        `customElements.whenDefined('weather-panel')` with this boundary's
-        initial state stashed on it, merges any server update that won the
-        race, and activates it the moment `.define()` runs.
-        `webui:hydration-complete` waits for that.
-
-        Being *inside* the boundary is also what keeps this module out of the
-        build's `modulepreload` hints. Hinting it would put the island back on
-        the critical path and undo the split.
-      -->
-      <script type="module" async src="./weather-panel.js"></script>
-      <weather-panel status="loading"></weather-panel>
-    </boundary>
-  </header>
-
-  <main>
-    <boundary name="composer-ready">
-      <message-composer draft="" posted=""></message-composer>
-    </boundary>
-
-    <section aria-label="Feed">
-      <boundary name="feed-batch-1">
-        <for each="post in feedBatch1">
-          <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
-        </for>
-      </boundary>
-
-      <boundary name="feed-batch-2">
-        <for each="post in feedBatch2">
-          <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
-        </for>
-      </boundary>
-
-      <boundary name="feed-batch-3">
-        <for each="post in feedBatch3">
-          <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
-        </for>
-      </boundary>
-    </section>
-  </main>
+  <streaming-page
+    :feed-batch-1="{{feedBatch1}}"
+    :feed-batch-2="{{feedBatch2}}"
+    :feed-batch-3="{{feedBatch3}}"
+  ></streaming-page>
 </body>
 </html>
diff --git a/examples/app/streaming/src/index.ts b/examples/app/streaming/src/index.ts
index 7d2864a78..6449ba42a 100644
--- a/examples/app/streaming/src/index.ts
+++ b/examples/app/streaming/src/index.ts
@@ -4,9 +4,8 @@
 /**
  * Streaming priority-hydration entry point.
  *
- * The server streams `index.html` as priority-ordered `<boundary>`
- * chunks, using the Progressive Streaming Hydration contract from
- * DESIGN.md ("Progressive Streaming Hydration"):
+ * The entry renders one `<streaming-page>` whose component template suspends
+ * at priority-ordered runtime boundaries:
  *
  * 1. The weather boundary commits first. It carries no server data, so it is
  *    the cheapest checkpoint on the page — `weather-panel` hydrates while the
@@ -15,7 +14,7 @@
  * 2. The composer boundary (`message-composer`) commits next and must be
  *    interactive before `DOMContentLoaded`, while the response is still open.
  * 3. Three feed boundaries commit afterward, each with its own `feed-item`
- *    islands, hydrating independently and in order as their chunks arrive.
+ *    islands, before the parent page component emits its tail and completes.
  *
  * The component modules import `@microsoft/webui-framework`, which no longer
  * installs the streaming coordinator on its own. This entry imports
diff --git a/examples/app/streaming/src/streaming-page/streaming-page.css b/examples/app/streaming/src/streaming-page/streaming-page.css
new file mode 100644
index 000000000..b5fe7d452
--- /dev/null
+++ b/examples/app/streaming/src/streaming-page/streaming-page.css
@@ -0,0 +1,25 @@
+:host {
+  display: block;
+}
+
+header {
+  margin-bottom: var(--spacing-xl);
+}
+
+main {
+  display: flex;
+  flex-direction: column;
+  gap: var(--spacing-xl);
+}
+
+section[aria-label="Feed"] {
+  display: flex;
+  flex-direction: column;
+  gap: var(--spacing-m);
+}
+
+footer {
+  margin-top: var(--spacing-xl);
+  color: var(--color-neutral-700);
+  font-size: var(--font-size-m);
+}
diff --git a/examples/app/streaming/src/streaming-page/streaming-page.html b/examples/app/streaming/src/streaming-page/streaming-page.html
new file mode 100644
index 000000000..35abcf4a2
--- /dev/null
+++ b/examples/app/streaming/src/streaming-page/streaming-page.html
@@ -0,0 +1,46 @@
+<header>
+  <h1>Streaming Home</h1>
+  <!--
+    This component-local boundary commits immediately as updatable, so slow
+    forecast work cannot hold back the composer or the rest of this parent.
+  -->
+  <boundary name="weather-shell">
+    <!--
+      The island's code ships with the island, not with the critical bundle.
+      Loading it inside the boundary keeps it out of modulepreload hints and
+      lets the coordinator activate it whenever the late definition arrives.
+    -->
+    <script type="module" async src="./weather-panel.js"></script>
+    <weather-panel status="loading"></weather-panel>
+  </boundary>
+</header>
+
+<main>
+  <boundary name="composer-ready">
+    <message-composer draft="" posted=""></message-composer>
+  </boundary>
+
+  <section aria-label="Feed">
+    <boundary name="feed-batch-1">
+      <for each="post in feedBatch1">
+        <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
+      </for>
+    </boundary>
+
+    <boundary name="feed-batch-2">
+      <for each="post in feedBatch2">
+        <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
+      </for>
+    </boundary>
+
+    <boundary name="feed-batch-3">
+      <for each="post in feedBatch3">
+        <feed-item post-id="{{post.postId}}" author="{{post.author}}" text="{{post.text}}" like-count="{{post.likeCount}}"></feed-item>
+      </for>
+    </boundary>
+  </section>
+</main>
+
+<footer data-testid="page-tail">
+  The parent component tail arrives only after its interactive children.
+</footer>
diff --git a/examples/app/streaming/tests/streaming.spec.ts b/examples/app/streaming/tests/streaming.spec.ts
index 6bfe5a4ef..6fbde341d 100644
--- a/examples/app/streaming/tests/streaming.spec.ts
+++ b/examples/app/streaming/tests/streaming.spec.ts
@@ -8,8 +8,9 @@ import { test, expect, type Page } from '@playwright/test';
  * composer / weather / feed priority ordering, built on the boundary
  * contract in DESIGN.md ("Progressive Streaming Hydration").
  *
- * Checkpoint boundary IDs follow document order. Response record sequence
- * numbers also include state updates and the terminal record:
+ * Runtime boundary IDs follow discovery order inside `<streaming-page>`.
+ * Response record sequences also include state updates, the page component's
+ * span completion, and the terminal record:
  *
  * | Boundary ID | Boundary      | Delivery                            |
  * | ----------- | ------------- | ----------------------------------- |
@@ -20,8 +21,8 @@ import { test, expect, type Page } from '@playwright/test';
  * | 4           | feed batch 3  | jittered 500-1000ms                  |
  *
  * In the full controlled release, the weather state update consumes response
- * sequence 3 between feed batch 1 and feed batch 2; the terminal record follows
- * the final checkpoint.
+ * sequence 3 between feed batch 1 and feed batch 2. The page span completion
+ * follows the final checkpoint, then the terminal closes the response.
  *
  * The Node API (`server/src/pacing.ts`) paces only the gaps that precede feed
  * batches, bounded by `--feed-delay-min-ms` / `--feed-delay-max-ms`, so
@@ -37,7 +38,7 @@ import { test, expect, type Page } from '@playwright/test';
 interface BoundaryEvent {
   sequence: number;
   terminal: boolean;
-  kind: 'checkpoint' | 'update' | 'terminal';
+  kind: 'checkpoint' | 'span' | 'update' | 'terminal';
   t: number;
 }
 
@@ -145,10 +146,12 @@ test.describe('streaming priority hydration', () => {
     // still open at this point too — DOMContentLoaded needs the whole
     // (still-paced) response to finish parsing.
     expect(await page.evaluate(() => window.__dclFired)).toBe(false);
+    await expect(page.getByTestId('page-tail')).toHaveCount(0);
 
     await release(page, session, 'all');
     await page.waitForLoadState('domcontentloaded');
     expect(await page.evaluate(() => window.__dclFired)).toBe(true);
+    await expect(page.getByTestId('page-tail')).toBeVisible();
   });
 
   test('feed batch 1 hydrates and is interactive before batch 2 is delivered', async ({ page }) => {
@@ -179,6 +182,7 @@ test.describe('streaming priority hydration', () => {
     const events = await boundaryEvents(page);
     const sequences = events.map((e) => e.sequence);
     expect(events.filter((event) => event.kind === 'checkpoint')).toHaveLength(5);
+    expect(events.filter((event) => event.kind === 'span')).toHaveLength(1);
     expect(events.filter((event) => event.kind === 'update')).toHaveLength(1);
     for (let i = 1; i < sequences.length; i++) {
       expect(sequences[i]).toBeGreaterThan(sequences[i - 1]);
@@ -368,30 +372,43 @@ test.describe('streaming priority hydration', () => {
     await page.waitForFunction(() => window.__hydrationCompleteFired);
 
     const leftovers = await page.evaluate(() => {
-      const scripts = document.querySelectorAll('script[data-webui-boundary]').length;
-      const sentinels = document.querySelectorAll('webui-hydrate').length;
+      const pageRoot = document.querySelector('streaming-page')?.shadowRoot;
+      const roots: ParentNode[] = pageRoot ? [document, pageRoot] : [document];
+      const scripts = roots.reduce(
+        (count, root) => count + root.querySelectorAll('script[data-webui-boundary]').length,
+        0,
+      );
+      const sentinels = roots.reduce(
+        (count, root) => count + root.querySelectorAll('webui-hydrate').length,
+        0,
+      );
       // `<if>` conditions compile to an inline `templateFns` script emitted
       // between each payload and its sentinel. Those are boundary
       // scaffolding too, so a non-zero count means
       // `removeBoundaryScaffolding` missed them. The weather island's own
       // loader also lives in <body>, inside its boundary, so it is excluded
       // by src — teardown must not treat authored content as scaffolding.
-      const bodyScripts = Array.from(document.body.querySelectorAll('script')).filter(
+      const bodyScripts = Array.from(pageRoot?.querySelectorAll('script') ?? []).filter(
         (script) => !script.src.endsWith('/weather-panel.js'),
       ).length;
 
-      const walker = document.createTreeWalker(document.documentElement, NodeFilter.SHOW_COMMENT);
       let markers = 0;
-      let node: Node | null;
-      while ((node = walker.nextNode())) {
-        if (/^\/?wb:\d+$/.test((node as Comment).data)) markers++;
+      const markerRoots: Node[] = pageRoot
+        ? [document.documentElement, pageRoot]
+        : [document.documentElement];
+      for (const root of markerRoots) {
+        const walker = document.createTreeWalker(root, NodeFilter.SHOW_COMMENT);
+        let node: Node | null;
+        while ((node = walker.nextNode())) {
+          if (/^\/?w[bs]:\d+$/.test((node as Comment).data)) markers++;
+        }
       }
 
       // The island loader is authored markup, not scaffolding: it must
       // survive the teardown that removes everything else above.
-      const islandLoaders = document.querySelectorAll(
+      const islandLoaders = pageRoot?.querySelectorAll(
         'script[src$="/weather-panel.js"]',
-      ).length;
+      ).length ?? 0;
 
       return { scripts, sentinels, markers, bodyScripts, islandLoaders };
     });
@@ -615,4 +632,3 @@ test.describe('streaming reload recovery', () => {
     expect(errors, 'the degraded page produced errors').toEqual([]);
   });
 });
-
diff --git a/examples/integration/node/README.md b/examples/integration/node/README.md
index cfd8f1940..a257f841d 100644
--- a/examples/integration/node/README.md
+++ b/examples/integration/node/README.md
@@ -62,14 +62,23 @@ they produced rather than writing them anywhere. Your server keeps the socket:
 
 ```js
 const session = protocol.streamResponse({ entry: 'index.html', requestPath: '/' });
-const status = session.boundary('job-status');   // resolve names once
 
 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-await write(res, session.writeShell(baseState));
-await write(res, session.writeBoundary(status, statusState, 'updatable'));
+let step = session.start(baseState);
+await write(res, step.bytes);
+
+const status = step.boundary; // runtime descriptor discovered by start()
+step = session.resume(status.instanceId, statusState, 'updatable');
+await write(res, step.bytes);
 // ... later, on the same response:
-await write(res, session.update(status, { jobState: 'succeeded' }));
-res.end(session.finish({}));
+await write(res, session.update(status.instanceId, { jobState: 'succeeded' }));
+
+while (!step.done) {
+  const boundary = step.boundary;
+  step = session.resume(boundary.instanceId, await stateFor(boundary));
+  await write(res, step.bytes);
+}
+res.end();
 
 async function write(res, chunk) {
   if (res.write(chunk)) return;
@@ -99,19 +108,22 @@ client to see the chunk timing:
 
 ```
 status 200 at   7 ms
-chunk 1  627B at    8 ms   shell (<head> ships before any work finishes)
-chunk 2  670B at    8 ms   job-status boundary, committed as updatable
-chunk 3  875B at  418 ms   log batch 1
-chunk 4  687B at  823 ms   log batch 2
-chunk 5  156B at  918 ms   update -> job-status, on this same response
-chunk 6  626B at 1229 ms   log batch 3
-chunk 7  128B at 1230 ms   terminal record
+step 1             start (<head> ships before any work finishes)
+step 2             resume job-status as updatable
+step 3             resume log batch 1
+step 4             resume log batch 2
+update             patch job-status on this same response
+step 5             resume log batch 3 and emit the terminal automatically
 ```
 
-Chunk 5 is the interesting one: the slow job finishes *after* its boundary was
+The update is the interesting one: the slow job finishes *after* its boundary was
 already committed and hydrated, so the server patches it with a 156-byte state
 record instead of forcing a client-side fetch or replacing DOM.
 
+The host never resolves authored names before `start()`. Every runtime
+descriptor comes from the preceding `StreamStep`, which also covers boundaries
+discovered through loops, routes, conditions, or component templates.
+
 ### Scope
 
 This example covers the **response** half of streaming: chunking, ordering,
diff --git a/examples/integration/node/streaming-server.js b/examples/integration/node/streaming-server.js
index 63c03b2eb..e84adc679 100644
--- a/examples/integration/node/streaming-server.js
+++ b/examples/integration/node/streaming-server.js
@@ -84,21 +84,13 @@ async function handleRequest(request, response) {
 /**
  * Render one progressive response, one chunk per call.
  *
- * Ordering is enforced by the session, so the shape below is the contract:
- * shell first, then every boundary in declaration order, updates only to
- * boundaries committed as `updatable`, and `finish()` last.
+ * `start()` discovers the first runtime occurrence. Every `resume()` uses the
+ * descriptor returned by the previous step, so loops, conditions, component
+ * boundaries, and routes need no pre-resolved name table.
  */
 async function streamPage(response) {
   const session = protocol.streamResponse({ entry: "index.html", requestPath: "/" });
 
-  // Names are authored strings; resolve them once, outside the write loop.
-  const jobStatus = session.boundary("job-status");
-  const logBatches = [
-    session.boundary("log-batch-1"),
-    session.boundary("log-batch-2"),
-    session.boundary("log-batch-3"),
-  ];
-
   response.writeHead(200, {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
@@ -106,15 +98,17 @@ async function streamPage(response) {
     "X-Accel-Buffering": "no",
   });
 
-  // The shell carries the state the document prefix needs; each boundary below
-  // carries only its own.
-  await write(response, session.writeShell({ jobState: "running", jobDetail: "" }));
+  let step = session.start({ jobState: "running", jobDetail: "" });
+  await write(response, step.bytes);
 
   // Committed before its data exists, so nothing waits on the slow job.
-  await write(
-    response,
-    session.writeBoundary(jobStatus, { jobState: "running", jobDetail: "starting" }, "updatable"),
+  const jobStatus = pendingBoundary(step, "job-status");
+  step = session.resume(
+    jobStatus.instanceId,
+    { jobState: "running", jobDetail: "starting" },
+    "updatable",
   );
+  await write(response, step.bytes);
 
   // Started, not awaited: the job races the log batches below.
   const job = runSlowJob(options.jobDelayMs);
@@ -128,7 +122,7 @@ async function streamPage(response) {
       if (ready !== "batch") {
         // The job won: patch the already-committed boundary on this same
         // response. No second request, no DOM replacement, no re-hydration.
-        await write(response, session.update(jobStatus, ready));
+        await write(response, session.update(jobStatus.instanceId, ready));
         jobPending = false;
         await batch;
       }
@@ -136,17 +130,34 @@ async function streamPage(response) {
       await batch;
     }
 
-    await write(
-      response,
-      session.writeBoundary(logBatches[index], { [`batch${index + 1}`]: LOG_BATCHES[index] }),
-    );
+    if (index === LOG_BATCHES.length - 1 && jobPending) {
+      await write(response, session.update(jobStatus.instanceId, await job));
+      jobPending = false;
+    }
+    const boundary = pendingBoundary(step, `log-batch-${index + 1}`);
+    step = session.resume(boundary.instanceId, {
+      [`batch${index + 1}`]: LOG_BATCHES[index],
+    });
+    await write(response, step.bytes);
   }
 
-  if (jobPending) {
-    await write(response, session.update(jobStatus, await job));
+  if (!step.done) {
+    throw new Error("streaming session did not complete after the final log batch");
   }
+  response.end();
+}
 
-  response.end(session.finish({}));
+function pendingBoundary(step, expectedName) {
+  const boundary = step.boundary;
+  if (step.done || !boundary) {
+    throw new Error(`expected pending boundary ${expectedName}, but the stream is done`);
+  }
+  if (boundary.owner !== "index.html" || boundary.name !== expectedName) {
+    throw new Error(
+      `expected index.html/${expectedName}, received ${boundary.owner}/${boundary.name}`,
+    );
+  }
+  return boundary;
 }
 
 /**
@@ -227,7 +238,7 @@ function reportFailure(response, error) {
   if (response.destroyed) {
     return;
   }
-  // Once the shell is on the wire the status line is already committed, so a
+  // Once start bytes are on the wire the status line is already committed, so a
   // late failure can only be signalled by dropping the connection.
   if (response.headersSent) {
     response.destroy();
diff --git a/examples/integration/rust/README.md b/examples/integration/rust/README.md
index 4e032d0cf..ddee92d02 100644
--- a/examples/integration/rust/README.md
+++ b/examples/integration/rust/README.md
@@ -17,3 +17,17 @@ cargo run -- ../../app/hello-world/dist/protocol.bin ../../app/hello-world/data/
 ```
 
 This loads `protocol.bin`, passes the state from `state.json`, and prints the rendered HTML to stdout.
+
+For a protocol containing runtime `<boundary>` declarations, drive the clean
+cursor API directly:
+
+```bash
+cargo run -- streaming-protocol.bin state.json --plugin=webui --streaming
+```
+
+The example calls `StreamingResponse::start()`, then resumes each
+`BoundaryDescriptor::instance_id` returned by the preceding step. The final
+resume emits the terminal automatically when `StreamStatus::done` becomes true;
+there is no separate finish call. Real servers can commit an occurrence as
+`BoundaryMode::Updatable` and call `update(instance_id, patch)` before the final
+step.
diff --git a/examples/integration/rust/src/main.rs b/examples/integration/rust/src/main.rs
index 4597a98a8..f5a874d0a 100644
--- a/examples/integration/rust/src/main.rs
+++ b/examples/integration/rust/src/main.rs
@@ -13,12 +13,18 @@
 //!
 //!   # Render with WebUI Framework hydration markers
 //!   cargo run -- ../../app/contact-book-manager/dist/protocol.bin ../../app/contact-book-manager/data/state.json --plugin=webui
+//!
+//!   # Drive a progressive protocol through runtime boundary cursors
+//!   cargo run -- streaming-protocol.bin state.json --plugin=webui --streaming
 
 use anyhow::{Context, Result};
 use std::env;
 use std::fs;
+use std::io::Write;
 use webui_handler::plugin::webui::WebUIHydrationPlugin;
-use webui_handler::{Protocol, RenderOptions, ResponseWriter, WebUIHandler};
+use webui_handler::{
+    BoundaryMode, FlushWriter, Protocol, RenderOptions, ResponseWriter, WebUIHandler,
+};
 
 struct StdoutWriter;
 
@@ -34,11 +40,17 @@ impl ResponseWriter for StdoutWriter {
     }
 }
 
+impl FlushWriter for StdoutWriter {
+    fn flush(&mut self) -> webui_handler::Result<()> {
+        std::io::stdout().flush().map_err(Into::into)
+    }
+}
+
 fn main() -> Result<()> {
     let args: Vec<String> = env::args().collect();
     if args.len() < 3 {
         eprintln!(
-            "Usage: {} <protocol.bin> <state.json> [--plugin=webui]",
+            "Usage: {} <protocol.bin> <state.json> [--plugin=webui] [--streaming]",
             args[0]
         );
         std::process::exit(1);
@@ -68,14 +80,40 @@ fn main() -> Result<()> {
         None => WebUIHandler::new(),
     };
     let mut writer = StdoutWriter;
-    handler
-        .render(
-            &protocol,
-            &state,
-            &RenderOptions::new("index.html", "/"),
-            &mut writer,
-        )
-        .context("Failed to render")?;
+    let options = RenderOptions::new("index.html", "/");
+    if args.iter().any(|argument| argument == "--streaming") {
+        render_streaming(&handler, &protocol, &state, &options, &mut writer)?;
+    } else {
+        handler
+            .render(&protocol, &state, &options, &mut writer)
+            .context("Failed to render")?;
+    }
 
     Ok(())
 }
+
+fn render_streaming(
+    handler: &WebUIHandler,
+    protocol: &Protocol,
+    state: &serde_json::Value,
+    options: &RenderOptions<'_>,
+    writer: &mut StdoutWriter,
+) -> Result<()> {
+    let mut session = handler
+        .stream_response(protocol, options, writer)
+        .context("Failed to open streaming session")?;
+    let mut step = session.start(state).context("Failed to start stream")?;
+    while !step.done {
+        let boundary = step
+            .boundary
+            .as_ref()
+            .context("Streaming step is unfinished but has no boundary descriptor")?;
+        let instance_id = boundary.instance_id;
+        let owner = boundary.owner.clone();
+        let name = boundary.name.clone();
+        step = session
+            .resume(instance_id, state, BoundaryMode::Final)
+            .with_context(|| format!("Failed to resume boundary {owner}/{name}"))?;
+    }
+    Ok(())
+}
diff --git a/examples/integration/streaming-browser-bench/README.md b/examples/integration/streaming-browser-bench/README.md
index c78287d31..a4acf0a4e 100644
--- a/examples/integration/streaming-browser-bench/README.md
+++ b/examples/integration/streaming-browser-bench/README.md
@@ -72,23 +72,28 @@ roots (1500) and the **same** total projected state value bytes (24 KiB of
 `label` values); only the boundary count (and marker layout) changes. "Projected
 state value bytes" counts the streamed `label` values a real app would ship, and
 deliberately excludes unavoidable per-boundary protocol/property overhead (the
-`[1,seq,kind,target,{...}]` envelope framing, the first-boundary `templates` block,
-and the tiny fixed `note` property) - that overhead is inherent to having more
-boundaries, not equal work to hold constant. It is projected-state value bytes,
-not total wire bytes.
+v2 `[2,recordSequence,kind,target,{...}]` envelope framing, required
+`declarationId`, the first-boundary `templates` block, and the tiny fixed `note`
+property) - that overhead is inherent to having more boundaries, not equal work
+to hold constant. It is projected-state value bytes, not total wire bytes.
 
-Each streamed boundary is real wire format - `<!--wb:N-->` markers + SSR roots
-carrying `data-ws` + an inert `[data-webui-boundary]` JSON script + a
+Each streamed boundary uses the v2 browser contract - `<!--wb:N-->` markers + SSR
+roots carrying `data-ws` + an inert `[data-webui-boundary]` JSON script + a
 `<webui-hydrate>` sentinel - appended one at a time, with the driver spinning the
 coordinator's microtask pump until that boundary's scaffolding is removed (a
-deterministic "committed + cleaned" signal) before the next, then a terminal
-envelope. Consecutive chunks enter through separate `MessageChannel` tasks,
-matching browser response-chunk scheduling without the nested timer clamp that
-would add synthetic delay at 100 boundaries. The control uses the real inert
-`#webui-data` bootstrap (present in the base document so the framework's lazy
-loader latches on the real block); only its SSR roots are inserted at run time
-(after the baseline heap sample) so its empty->populated peak-heap transition
-matches the streaming arms.
+deterministic "committed + cleaned" signal) before the next, then a kind-4
+terminal envelope. Final/updatable checkpoints use kinds 0/1, state updates use
+kind 2, and kind 3 is reserved for generated span completion (unused by these flat
+entry-boundary scenarios). Every checkpoint bootstrap carries a deterministic
+`declarationId`; flat entry boundaries omit `enclosingSpanInstanceId`. Runtime
+boundary instance IDs and record sequences are gapless, and updates target the
+committed boundary instance ID. Consecutive chunks enter through separate
+`MessageChannel` tasks, matching browser response-chunk scheduling without the
+nested timer clamp that would add synthetic delay at 100 boundaries. The control
+uses the real inert `#webui-data` bootstrap (present in the base document so the
+framework's lazy loader latches on the real block); only its SSR roots are
+inserted at run time (after the baseline heap sample) so its empty->populated
+peak-heap transition matches the streaming arms.
 
 Coverage includes flat and deeply nested marker ranges (one root at each
 successive `<div>` depth) and the boundary-before-definition race (the class
@@ -138,8 +143,8 @@ comments, `[data-ws]`), no globally-published streamed state
 (`window.__webui.state` stays unset), the ordinary bundle contains no coordinator
 tokens (`webui-hydrate` / `data-webui-boundary`), measured component CPU is
 non-zero, distinct boundary-local states reach only their own real activation
-hooks, and the streaming entry adds no more than 10.625 KiB minified / 3.75 KiB
-gzip. Esbuild output is deterministic and the cap retains under 4% headroom, so
+hooks, and the streaming entry adds no more than 17.5 KiB minified / 6 KiB
+gzip. Esbuild output is deterministic and the cap retains roughly 4% headroom, so
 further growth still fails.
 
 Opt-in via `WEBUI_STREAMING_HYDRATION_ENFORCE=1` (noisy, off by default), each
diff --git a/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts b/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
index 74a932684..cd375da9f 100644
--- a/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
+++ b/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
@@ -95,17 +95,13 @@ const PEAK_HEAP_ABS_FLOOR_BYTES = 512 * 1024;
 const PEAK_HEAP_TOLERANCE_PCT = 15;
 /** Deterministic production coordinator size caps. Raising either requires
  *  explicit review because every streaming application pays these bytes.
- *  Typed checkpoints, retained-root state records, and terminal cleanup add
- *  ~1.9KiB minified / ~650B gzip over the final-only coordinator; trusting our
- *  own serializer instead of re-validating its output gives ~1.2KiB / ~440B
- *  back. Commit `performance.mark`s and the opt-in time-sliced drain add ~650B
- *  minified / ~260B gzip: the marks are unconditional because a consumer that
- *  loads after hydration cannot have subscribed in time, and the drain is the
- *  only way to keep hydration off one long task when an intermediary coalesces
- *  the response. The caps leave under 3% headroom, so further growth still
- *  fails. */
-const STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES = 11_520;
-const STREAMING_INCREMENTAL_GZIP_CAP_BYTES = 4_096;
+ *  The v2 coordinator includes checkpoint declaration/span validation, retained
+ *  roots for state updates, span completion, terminal cleanup, commit marks, and
+ *  the opt-in time-sliced drain. The reviewed production bundle is 17,147 bytes
+ *  minified / 5,885 bytes gzip incrementally; these caps leave roughly 4%
+ *  headroom, so further growth still fails. */
+const STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES = 17.5 * 1024;
+const STREAMING_INCREMENTAL_GZIP_CAP_BYTES = 6 * 1024;
 /** Marginal elapsed-time cap per added boundary. The relative allowance scales
  *  with slower hosts while the absolute floor absorbs sub-millisecond noise. */
 const COORDINATOR_MARGINAL_ABS_CAP_MS = 0.25;
@@ -260,7 +256,56 @@ function balancedArmOrder(armCount: number, round: number): number[] {
   return order.slice(shift).concat(order.slice(0, shift));
 }
 
+function parseBoundaryRecord(fragment: string): unknown[] {
+  const prefix = '<script type="application/json" data-webui-boundary>';
+  const start = fragment.indexOf(prefix);
+  const end = fragment.indexOf('</script>', start + prefix.length);
+  if (start < 0 || end < 0) {
+    throw new Error('benchmark fragment is missing its boundary record');
+  }
+  const parsed: unknown = JSON.parse(fragment.slice(start + prefix.length, end));
+  if (!Array.isArray(parsed)) {
+    throw new Error('benchmark boundary record is not an array');
+  }
+  return parsed;
+}
+
 test.describe('progressive streaming hydration matrix', () => {
+  test('generates gapless v2 checkpoint, update, and terminal records', () => {
+    const checkpointScenario = buildStreamingScenario(3, 'flat', 'eager', true);
+    const checkpointRecords = [
+      ...checkpointScenario.boundaries,
+      checkpointScenario.terminal,
+    ].map(parseBoundaryRecord);
+
+    expect(checkpointRecords.map((record) => record.length)).toEqual([5, 5, 5, 5, 5]);
+    expect(checkpointRecords.map((record) => record[0])).toEqual([2, 2, 2, 2, 2]);
+    expect(checkpointRecords.map((record) => record[1])).toEqual([0, 1, 2, 3, 4]);
+    expect(checkpointRecords.map((record) => record[2])).toEqual([0, 0, 0, 0, 4]);
+    expect(checkpointRecords.map((record) => record[3])).toEqual([0, 1, 2, 3, 0]);
+    for (const record of checkpointRecords.slice(0, -1)) {
+      const bootstrap = record[4] as Record<string, unknown>;
+      expect(bootstrap.declarationId).toBe(0);
+      expect(
+        Object.prototype.hasOwnProperty.call(bootstrap, 'enclosingSpanInstanceId'),
+        'flat entry checkpoints omit enclosingSpanInstanceId',
+      ).toBe(false);
+    }
+    expect(checkpointRecords[4]).toEqual([2, 4, 4, 0, {}]);
+
+    const updateScenario = buildStateUpdateScenario(3, 100);
+    const updateRecords = [
+      ...updateScenario.boundaries,
+      updateScenario.terminal,
+    ].map(parseBoundaryRecord);
+    expect(updateRecords.map((record) => record[0])).toEqual([2, 2, 2, 2, 2]);
+    expect(updateRecords.map((record) => record[1])).toEqual([0, 1, 2, 3, 4]);
+    expect(updateRecords.map((record) => record[2])).toEqual([1, 2, 2, 2, 4]);
+    expect(updateRecords.map((record) => record[3])).toEqual([0, 0, 0, 0, 0]);
+    expect((updateRecords[0][4] as Record<string, unknown>).declarationId).toBe(0);
+    expect(updateRecords[4]).toEqual([2, 4, 4, 0, {}]);
+  });
+
   test('measures real coordinator + WebUIElement hydration across boundary counts', async ({ browser }) => {
     const compareName = process.env.WEBUI_BENCH_COMPARE;
     const baseline = compareName ? loadSnapshot(compareName, ENFORCE) : null;
@@ -287,11 +332,11 @@ test.describe('progressive streaming hydration matrix', () => {
     expect(coordinatorTokensIn(fixtures.streaming.code).length).toBeGreaterThan(0);
     expect(
       fixtures.streamingIncrementalBytes,
-      'streaming coordinator incremental minified bytes stay within the reviewed 10.625KiB cap',
+      'streaming coordinator incremental minified bytes stay within the reviewed 17.5KiB cap',
     ).toBeLessThanOrEqual(STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES);
     expect(
       fixtures.streamingIncrementalGzipBytes,
-      'streaming coordinator incremental gzip bytes stay within the reviewed 3.75KiB cap',
+      'streaming coordinator incremental gzip bytes stay within the reviewed 6KiB cap',
     ).toBeLessThanOrEqual(STREAMING_INCREMENTAL_GZIP_CAP_BYTES);
 
     const bundle: BundleSizes = {
diff --git a/examples/integration/streaming-browser-bench/tests/lib/lazy-fixtures.ts b/examples/integration/streaming-browser-bench/tests/lib/lazy-fixtures.ts
index 7fabbef26..2ee42e790 100644
--- a/examples/integration/streaming-browser-bench/tests/lib/lazy-fixtures.ts
+++ b/examples/integration/streaming-browser-bench/tests/lib/lazy-fixtures.ts
@@ -36,15 +36,15 @@ const TODO_TEMPLATE = {
   h: '<article><input type="checkbox"><span></span><small></small><strong></strong><time></time><button type="button">Toggle</button><button type="button">Delete</button></article>',
   tr: ['title', 'description', 'priority', 'due'],
   tx: [
-    [[[0, 1], 0], [['title']]],
-    [[[0, 2], 0], [['description']]],
-    [[[0, 3], 0], [['priority']]],
-    [[[0, 4], 0], [['due']]],
+    [[3, 0], [['title']]],
+    [[4, 0], [['description']]],
+    [[5, 0], [['priority']]],
+    [[6, 0], [['due']]],
   ],
   eg: [
     ['click', [
-      ['toggle', [], [0, 5]],
-      ['remove', [], [0, 6]],
+      ['toggle', [], 7],
+      ['remove', [], 8],
     ]],
   ],
 } as const;
diff --git a/examples/integration/streaming-browser-bench/tests/lib/scenarios.ts b/examples/integration/streaming-browser-bench/tests/lib/scenarios.ts
index 19d5ba634..153163324 100644
--- a/examples/integration/streaming-browser-bench/tests/lib/scenarios.ts
+++ b/examples/integration/streaming-browser-bench/tests/lib/scenarios.ts
@@ -15,7 +15,7 @@
  * coordinator (`packages/webui-framework/src/streaming.ts`) parses:
  *
  *   <!--wb:N--> <bench-island data-ws>...</bench-island> <!--/wb:N-->
- *   <script type="application/json" data-webui-boundary>[1,seq,kind,target,payload]</script>
+ *   <script type="application/json" data-webui-boundary>[2,recordSequence,kind,target,payload]</script>
  *   <webui-hydrate></webui-hydrate>
  *
  * No whitespace is emitted between the `<!--/wb:N-->` end marker and the
@@ -37,10 +37,11 @@ export const TOTAL_ROOTS = 1500;
  * This counts only the bytes of the streamed `label` values (the dominant
  * projected state a real app would ship), summed across all boundaries. It
  * deliberately excludes the unavoidable per-boundary protocol/property overhead
- * — the `[1,seq,kind,target,{...}]` envelope framing, the `templates` block (first
- * boundary only), and the tiny fixed `note` property — because that overhead is
- * inherent to having more boundaries and is not "equal work" to hold constant.
- * It is therefore projected-state value bytes, not total wire bytes.
+ * — the v2 `[2,recordSequence,kind,target,{...}]` envelope framing, required
+ * `declarationId`, the `templates` block (first boundary only), and the tiny fixed
+ * `note` property — because that overhead is inherent to having more boundaries
+ * and is not "equal work" to hold constant. It is therefore projected-state
+ * value bytes, not total wire bytes.
  */
 export const TOTAL_STATE_VALUE_BYTES = 24_000;
 
@@ -50,6 +51,9 @@ export const BOUNDARY_COUNTS = [1, 3, 10, 100] as const;
 /** Custom-element tag every SSR root upgrades to. */
 export const ISLAND_TAG = 'bench-island';
 
+/** Stable compiler declaration identity used by every benchmark checkpoint. */
+const BENCH_DECLARATION_ID = 0;
+
 /**
  * Compiled template metadata for `bench-island`.
  *
@@ -63,8 +67,8 @@ export const ISLAND_TEMPLATE = {
   h: '<span></span><em></em>',
   tr: ['label', 'note'],
   tx: [
-    [[[0], 0], [['label']]],
-    [[[1], 0], [['note']]],
+    [[1, 0], [['label']]],
+    [[2, 0], [['note']]],
   ],
 } as const;
 
@@ -157,7 +161,8 @@ function nestedRoots(startCell: number, count: number): string {
  *  first boundary; state (`label` value + fixed `note`) is emitted in every
  *  boundary. `labelChars` is the projected-state value size for this boundary. */
 function boundaryFragment(
-  seq: number,
+  recordSequence: number,
+  boundaryInstanceId: number,
   cellStart: number,
   rootCount: number,
   label: string,
@@ -166,14 +171,21 @@ function boundaryFragment(
   kind: 0 | 1 = 0,
 ): string {
   const bootstrap: Record<string, unknown> = {
+    declarationId: BENCH_DECLARATION_ID,
     state: { label, note: 'n' },
   };
   if (withTemplates) bootstrap.templates = { [ISLAND_TAG]: ISLAND_TEMPLATE };
-  const envelope = JSON.stringify([1, seq, kind, seq, bootstrap]);
+  const envelope = JSON.stringify([
+    2,
+    recordSequence,
+    kind,
+    boundaryInstanceId,
+    bootstrap,
+  ]);
   const roots = layout === 'flat'
     ? flatRoots(cellStart, rootCount)
     : nestedRoots(cellStart, rootCount);
-  return `<!--wb:${seq}-->${roots}<!--/wb:${seq}-->`
+  return `<!--wb:${boundaryInstanceId}-->${roots}<!--/wb:${boundaryInstanceId}-->`
     + `<script type="application/json" data-webui-boundary>${envelope}</script>`
     + `<${'webui-hydrate'}></${'webui-hydrate'}>`;
 }
@@ -184,7 +196,7 @@ function stateUpdateFragment(
   label: string,
 ): string {
   const envelope = JSON.stringify([
-    1,
+    2,
     recordSequence,
     2,
     boundaryId,
@@ -194,9 +206,9 @@ function stateUpdateFragment(
     + `<${'webui-hydrate'}></${'webui-hydrate'}>`;
 }
 
-/** The terminal envelope: no markers, terminal kind 3, empty payload. */
-function terminalFragment(seq: number): string {
-  const envelope = JSON.stringify([1, seq, 3, 0, {}]);
+/** The v2 terminal envelope: no markers, terminal kind 4, empty payload. */
+function terminalFragment(recordSequence: number): string {
+  const envelope = JSON.stringify([2, recordSequence, 4, 0, {}]);
   return `<script type="application/json" data-webui-boundary>${envelope}</script>`
     + `<${'webui-hydrate'}></${'webui-hydrate'}>`;
 }
@@ -205,11 +217,14 @@ function terminalFragment(seq: number): string {
  * content boundary parses roots after the class has the same template metadata. */
 function templateSetupFragment(): string {
   const envelope = JSON.stringify([
-    1,
+    2,
     0,
     0,
     0,
-    { templates: { [ISLAND_TAG]: ISLAND_TEMPLATE } },
+    {
+      declarationId: BENCH_DECLARATION_ID,
+      templates: { [ISLAND_TAG]: ISLAND_TEMPLATE },
+    },
   ]);
   return '<!--wb:0--><!--/wb:0-->'
     + `<script type="application/json" data-webui-boundary>${envelope}</script>`
@@ -235,6 +250,7 @@ export function buildStreamingScenario(
   for (let seq = 0; seq < boundaryCount; seq++) {
     boundaries.push(
       boundaryFragment(
+        seq + sequenceOffset,
         seq + sequenceOffset,
         cell,
         rootsPer[seq],
@@ -273,6 +289,7 @@ export function buildStateDeliveryScenario(
   for (let seq = 0; seq < labels.length; seq++) {
     const label = labels[seq];
     boundaries[seq] = boundaryFragment(
+      seq,
       seq,
       cell,
       rootsPerBoundary,
@@ -303,6 +320,7 @@ export function buildStateUpdateScenario(
 ): StateUpdateScenario {
   const boundaries = new Array<string>(updateCount + 1);
   boundaries[0] = boundaryFragment(
+    0,
     0,
     0,
     rootCount,
diff --git a/packages/webui-framework/README.md b/packages/webui-framework/README.md
index 18cd2575b..3d92c45b2 100644
--- a/packages/webui-framework/README.md
+++ b/packages/webui-framework/README.md
@@ -199,12 +199,24 @@ authored `<boundary>` directives through
 `@microsoft/webui-framework` entry has no dependency on the coordinator, so
 normal applications pay no streaming bundle or initialization cost.
 
-Each committed boundary receives its own ephemeral state object directly during
+Boundaries may be authored in entries and reusable components, including
+runtime conditions, loops, outlets, and selected routes. A component-local
+boundary uses a generated parent span, so an early compiler-marked child can
+hydrate before the opaque parent tail in light or shadow DOM. Authored
+boundaries cannot nest.
+
+Each runtime occurrence receives an ephemeral state object directly during
 activation. The coordinator does not publish that state to
-`window.__webui.state`, and it removes generated checkpoint scaffolding after
-commit. Every commit also emits a `performance.mark()` — `webui:boundary:<id>`,
-`webui:boundary:<id>:update`, or `webui:streaming:terminal` — which needs no
-flag and no listener, so tooling that loads after hydration can still read it.
+`window.__webui.state`, and it removes generated checkpoint and span
+scaffolding after commit. Updates apply state to retained roots and never insert
+markup or rerun hydration.
+
+The browser reads version-2
+`[2, sequence, kind, target, payload]` records for final checkpoints,
+updatable checkpoints, updates, span completions, and terminal. Every commit
+also emits a `performance.mark()` - `webui:boundary:<id>`,
+`webui:boundary:<id>:update`, `webui:span:<id>`, or
+`webui:streaming:terminal` - which needs no flag or listener.
 Set `window.__WEBUI_STREAMING_DEBUG__ = true` only when tooling needs the live
 `webui:boundary-hydrated` event as well.
 
@@ -553,9 +565,8 @@ is driven by data (template metadata + state values), not code.  Any language
 that can read the compiled metadata and produce HTML can serve as the SSR
 backend.  No comment markers or data attributes are needed — the runtime
 resolves ordinary buffered SSR nodes via the lockstep hydration walk.
-Progressive streaming uses temporary checkpoint scaffolding only to delay
-activation until a complete region arrives; it removes that scaffolding after
-commit.
+Progressive streaming uses temporary checkpoint and generated-span scaffolding
+to activate complete runtime regions; it removes that scaffolding after commit.
 
 ### Build → Serve → Hydrate → Update
 
@@ -909,7 +920,8 @@ stylesheet specifier for a component.
 
 Unlike frameworks that use comment markers or data attributes to locate each
 dynamic binding, this framework uses **compiled element indices** — each
-binding names its element by pre-order position within its compiled section. Progressive streaming's temporary boundary markers locate complete
+binding names its element by pre-order position within its compiled section.
+Progressive streaming's temporary boundary and span markers locate complete
 activation regions, not individual bindings.
 
 ### Client-created resolution (`collectTemplateElements`)
diff --git a/packages/webui-framework/src/streaming-activation.ts b/packages/webui-framework/src/streaming-activation.ts
index 910c3fe39..acd39b238 100644
--- a/packages/webui-framework/src/streaming-activation.ts
+++ b/packages/webui-framework/src/streaming-activation.ts
@@ -22,6 +22,7 @@ export function activateRootsBetween(
   endMarker: Comment,
   state: Record<string, unknown> | undefined,
   updates?: PendingBoundaryUpdates,
+  bypassSpanInstanceId?: number,
 ): void {
   const root = startMarker.parentNode;
   if (!root) {
@@ -35,7 +36,13 @@ export function activateRootsBetween(
     root,
     endMarker,
     state,
-    updates ? { updates, countRetention: true } : undefined,
+    updates || bypassSpanInstanceId !== undefined
+      ? {
+        updates,
+        countRetention: updates !== undefined,
+        bypassSpanInstanceId,
+      }
+      : undefined,
   );
   if (!failure) return;
   abandonDeferredRange(startMarker, endMarker);
diff --git a/packages/webui-framework/src/streaming-bootstrap.ts b/packages/webui-framework/src/streaming-bootstrap.ts
index 7ccdfe945..cfe89ccf5 100644
--- a/packages/webui-framework/src/streaming-bootstrap.ts
+++ b/packages/webui-framework/src/streaming-bootstrap.ts
@@ -2,11 +2,14 @@
 // Licensed under the MIT license.
 
 import { registerTemplateData } from './template.js';
-import type { BoundaryBootstrap } from './streaming-protocol.js';
+import type {
+  BoundaryBootstrap,
+  SpanCompletionPayload,
+} from './streaming-protocol.js';
 
 /** Register template data and merge response-scoped checkpoint metadata. */
 export function applyBoundaryBootstrap(
-  bootstrap: BoundaryBootstrap,
+  bootstrap: BoundaryBootstrap | SpanCompletionPayload,
 ): void {
   if (bootstrap.templates) registerTemplateData(bootstrap.templates);
 
@@ -17,7 +20,12 @@ export function applyBoundaryBootstrap(
     const key = keys[i];
     // Templates are merged by registerTemplateData; boundary state remains
     // ephemeral and is handed directly to roots by the activation walk.
-    if (key === 'templates' || key === 'state') continue;
+    if (
+      key === 'templates' ||
+      key === 'state' ||
+      key === 'declarationId' ||
+      key === 'enclosingSpanInstanceId'
+    ) continue;
     if (key === 'inventory') {
       w.__webui.inventory = mergeInventory(
         w.__webui.inventory,
diff --git a/packages/webui-framework/src/streaming-cleanup.ts b/packages/webui-framework/src/streaming-cleanup.ts
index 9e0db7c8b..c992ae805 100644
--- a/packages/webui-framework/src/streaming-cleanup.ts
+++ b/packages/webui-framework/src/streaming-cleanup.ts
@@ -2,13 +2,24 @@
 // Licensed under the MIT license.
 
 import {
+  BOUNDARY_END_PREFIX,
+  BOUNDARY_SCRIPT_ATTR,
+  BOUNDARY_START_PREFIX,
   firstNodeWithin,
   MAX_MARKER_SCAN_NODES,
+  nextAfterSubtreeWithin,
   nextWithinRoot,
   safeRemoveAttribute,
+  safeRemove,
+  SPAN_END_PREFIX,
+  SPAN_START_PREFIX,
   streamingErrorMessage,
 } from './streaming-dom.js';
-import { STREAMED_HOST_ATTR } from './streaming-mode.js';
+import {
+  STREAMED_HOST_ATTR,
+  STREAMING_ENCLOSING_SPAN_ATTR,
+  STREAMING_SPAN_HOST_ATTR,
+} from './streaming-mode.js';
 
 const STREAMING_BOUNDARY_ABANDON = Symbol.for(
   'microsoft.webui.boundaryAbandon',
@@ -20,10 +31,11 @@ type BoundaryAbandonable = Element & {
 
 /** Clear both coordinator and element-owned streaming state from one root. */
 export function abandonDeferredElement(el: Element): void {
+  const marked = hasStreamingAttribute(el);
   try {
-    if (!el.hasAttribute(STREAMED_HOST_ATTR)) return;
+    if (!marked) return;
   } catch {
-    safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+    removeStreamingAttributes(el);
     return;
   }
   try {
@@ -38,10 +50,22 @@ export function abandonDeferredElement(el: Element): void {
       }>: ${streamingErrorMessage(error)}`,
     );
   } finally {
-    safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+    removeStreamingAttributes(el);
   }
 }
 
+function hasStreamingAttribute(el: Element): boolean {
+  return el.hasAttribute(STREAMED_HOST_ATTR) ||
+    el.hasAttribute(STREAMING_SPAN_HOST_ATTR) ||
+    el.hasAttribute(STREAMING_ENCLOSING_SPAN_ATTR);
+}
+
+function removeStreamingAttributes(el: Element): void {
+  safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+  safeRemoveAttribute(el, STREAMING_SPAN_HOST_ATTR);
+  safeRemoveAttribute(el, STREAMING_ENCLOSING_SPAN_ATTR);
+}
+
 /** Release a retained subtree after its undefined outer fails activation. */
 export function abandonDeferredDescendants(root: Element): void {
   abandonDeferredNodes(firstNodeWithin(root), root, null);
@@ -83,6 +107,13 @@ export function abandonDeferredDocumentRoots(): void {
     return;
   }
 
+  const documentRoot = document.documentElement;
+  if (documentRoot) {
+    abandonStreamingNodes(documentRoot.firstChild, documentRoot);
+    abandonDeferredElement(documentRoot);
+    return;
+  }
+
   const elements = document.getElementsByTagName('*');
   let visited = 0;
   for (
@@ -103,4 +134,38 @@ export function abandonDeferredDocumentRoots(): void {
       node = nextWithinRoot(node, shadowRoot!);
     }
   }
+
+  function abandonStreamingNodes(first: Node | null, root: Node): void {
+    let node = first;
+    let visited = 0;
+    while (node && visited < MAX_MARKER_SCAN_NODES) {
+      visited++;
+      if (node.nodeType === 8 /* COMMENT_NODE */) {
+        const next = nextWithinRoot(node, root);
+        if (isStreamingMarker((node as Comment).data)) safeRemove(node);
+        node = next;
+        continue;
+      }
+      if (node.nodeType === 1 /* ELEMENT_NODE */) {
+        const el = node as Element;
+        const scaffold = el.tagName === 'WEBUI-HYDRATE' ||
+          el.hasAttribute(BOUNDARY_SCRIPT_ATTR);
+        const next = scaffold
+          ? nextAfterSubtreeWithin(node, root)
+          : nextWithinRoot(node, root);
+        abandonDeferredElement(el);
+        if (scaffold) safeRemove(el);
+        node = next;
+        continue;
+      }
+      node = nextWithinRoot(node, root);
+    }
+  }
+
+  function isStreamingMarker(data: string): boolean {
+    return data.startsWith(BOUNDARY_START_PREFIX) ||
+      data.startsWith(BOUNDARY_END_PREFIX) ||
+      data.startsWith(SPAN_START_PREFIX) ||
+      data.startsWith(SPAN_END_PREFIX);
+  }
 }
diff --git a/packages/webui-framework/src/streaming-coordinator.ts b/packages/webui-framework/src/streaming-coordinator.ts
index 83e76962c..38ab9cec7 100644
--- a/packages/webui-framework/src/streaming-coordinator.ts
+++ b/packages/webui-framework/src/streaming-coordinator.ts
@@ -26,6 +26,7 @@ import {
   abandonPendingWaiters,
   configureStreamingFailureHandler,
   elementHasPendingStateForTests,
+  pendingBarrierRootCountForTests,
   pendingTagWaiterCountForTests,
   pendingUndefinedRootCountForTests,
   resetDeferredActivationForTests,
@@ -33,33 +34,47 @@ import {
 import type { PendingBoundaryUpdates } from './streaming-deferred.js';
 import {
   findBoundaryScript,
-  findEndMarkerByPrefix,
-  findStartMarkerByPrefix,
+  findRangeEndMarkerByPrefix,
+  findRangeStartMarkerByPrefix,
   removeBoundaryScaffolding,
   resolveBoundaryRange,
+  resolveMarkerlessRecord,
+  resolveSpanRange,
   streamingErrorMessage,
 } from './streaming-dom.js';
 import type { HydrationRange } from './streaming-dom.js';
 import {
   parseBoundaryEnvelope,
+  RECORD_KIND_FINAL_CHECKPOINT,
+  RECORD_KIND_SPAN_COMPLETION,
   RECORD_KIND_STATE_UPDATE,
   RECORD_KIND_TERMINAL,
   RECORD_KIND_UPDATABLE_CHECKPOINT,
 } from './streaming-protocol.js';
-import type { BoundaryBootstrap } from './streaming-protocol.js';
+import type {
+  BoundaryBootstrap,
+  SpanCompletionPayload,
+} from './streaming-protocol.js';
 import { applyStateUpdate } from './streaming-state.js';
+import {
+  abandonOpenSpans,
+  completeSpan,
+  hasOpenSpans,
+  openSpanCountForTests,
+  registerEnclosingSpans,
+  registerSpanCompletionTarget,
+  validateSpanCompletion,
+} from './streaming-spans.js';
 
 const MAX_QUEUED_BOUNDARIES = 512;
 const MAX_UPDATABLE_BOUNDARIES = 128;
 const MAX_RETAINED_UPDATE_ROOTS = 50_000;
 const BOUNDARY_HYDRATED_EVENT = 'webui:boundary-hydrated';
-/** `performance.mark()` label prefix. The suffix is the compile-time boundary
- *  ID — its declaration index — so a mark resolves back to the authored
- *  `<boundary name>` through the build manifest without any name string ever
- *  reaching the wire (rule 18). */
+/** `performance.mark()` prefix; suffixes are runtime BoundaryInstanceIds. */
 const BOUNDARY_MARK_PREFIX = 'webui:boundary:';
 const UPDATE_MARK_SUFFIX = ':update';
 const TERMINAL_MARK = 'webui:streaming:terminal';
+const SPAN_MARK_PREFIX = 'webui:span:';
 
 /** Captured once: marks and the slice clock must not re-resolve per commit. */
 const perf = (globalThis as { performance?: Performance }).performance;
@@ -71,7 +86,7 @@ let pumpScheduled = false;
 let slicedDrainActive = false;
 let halted = false;
 let nextExpectedRecordSequence = 0;
-let nextExpectedBoundaryId = 0;
+let nextExpectedBoundaryInstanceId = 0;
 let terminalCommitted = false;
 let pendingTerminalSequence: number | null = null;
 let terminalValidationScheduled = false;
@@ -201,6 +216,7 @@ function fail(reason: string): void {
   // successful completion event while their failure cleanup drains.
   abortStreamingGate();
   abandonPendingWaiters();
+  abandonOpenSpans();
   clearUpdatableBoundaries();
   settlePendingTerminal(false);
   for (let i = queueHead; i < queue.length; i++) {
@@ -221,8 +237,8 @@ function discardRejectedBoundary(sentinel: Element): void {
   let endMarker: Comment | null = null;
   let startMarker: Comment | null = null;
   if (scriptEl) {
-    endMarker = findEndMarkerByPrefix(scriptEl);
-    if (endMarker) startMarker = findStartMarkerByPrefix(endMarker);
+    endMarker = findRangeEndMarkerByPrefix(scriptEl);
+    if (endMarker) startMarker = findRangeStartMarkerByPrefix(endMarker);
   }
   if (startMarker && endMarker) {
     abandonDeferredRange(startMarker, endMarker);
@@ -269,6 +285,11 @@ function processSentinel(sentinel: Element): void {
   }
 
   if (kind === RECORD_KIND_STATE_UPDATE) {
+    const markerless = resolveMarkerlessRecord(scriptEl, 'state update');
+    if (!markerless.ok) {
+      failBoundary(sentinel, markerless.reason);
+      return;
+    }
     const boundary = updatableBoundaries.get(target);
     if (!boundary) {
       failBoundary(
@@ -290,9 +311,16 @@ function processSentinel(sentinel: Element): void {
   }
 
   if (kind === RECORD_KIND_TERMINAL) {
-    const resolved = resolveBoundaryRange(scriptEl, 0, true);
-    if (!resolved.ok) {
-      failBoundary(sentinel, resolved.reason);
+    const markerless = resolveMarkerlessRecord(scriptEl, 'terminal');
+    if (!markerless.ok) {
+      failBoundary(sentinel, markerless.reason);
+      return;
+    }
+    if (hasOpenSpans()) {
+      failBoundary(
+        sentinel,
+        'terminal record arrived before every component span completed',
+      );
       return;
     }
     nextExpectedRecordSequence++;
@@ -300,34 +328,47 @@ function processSentinel(sentinel: Element): void {
     return;
   }
 
-  if (target !== nextExpectedBoundaryId) {
+  if (kind === RECORD_KIND_SPAN_COMPLETION) {
+    const resolved = resolveSpanRange(scriptEl, target);
+    if (!resolved.ok) {
+      failRangeResolution(sentinel, scriptEl, resolved);
+      return;
+    }
+    nextExpectedRecordSequence++;
+    commitSpanCompletion(
+      payload as SpanCompletionPayload,
+      resolved.range,
+      sequence,
+      target,
+      sentinel,
+      scriptEl,
+    );
+    return;
+  }
+
+  if (
+    kind !== RECORD_KIND_FINAL_CHECKPOINT &&
+    kind !== RECORD_KIND_UPDATABLE_CHECKPOINT
+  ) {
+    failBoundary(sentinel, `unsupported streaming record kind ${kind}`);
+    return;
+  }
+
+  if (target !== nextExpectedBoundaryInstanceId) {
     failBoundary(
       sentinel,
-      `expected boundary ID ${nextExpectedBoundaryId}, received ${target}`,
+      `expected boundary instance ${nextExpectedBoundaryInstanceId}, received ${target}`,
     );
     return;
   }
-  const resolved = resolveBoundaryRange(scriptEl, target, false);
+  const resolved = resolveBoundaryRange(scriptEl, target);
   if (!resolved.ok) {
-    if (resolved.truncated) {
-      if (resolved.start) {
-        abandonDeferredRange(resolved.start, scriptEl);
-      }
-      removeBoundaryScaffolding(
-        sentinel,
-        scriptEl,
-        resolved.start,
-        null,
-      );
-      fail(resolved.reason);
-    } else {
-      failBoundary(sentinel, resolved.reason);
-    }
+    failRangeResolution(sentinel, scriptEl, resolved);
     return;
   }
 
   nextExpectedRecordSequence++;
-  nextExpectedBoundaryId++;
+  nextExpectedBoundaryInstanceId++;
   commitCheckpoint(
     payload as BoundaryBootstrap,
     resolved.range,
@@ -351,21 +392,33 @@ function commitCheckpoint(
   markBoundaryPending();
   let committed = false;
   try {
+    if (
+      bootstrap.enclosingSpanInstanceId !== undefined &&
+      range.start?.parentNode
+    ) {
+      const invalid = registerEnclosingSpans(
+        range.start.parentNode,
+        bootstrap.enclosingSpanInstanceId,
+      );
+      if (invalid) throw new Error(invalid);
+    }
     applyBoundaryBootstrap(bootstrap);
     if (range.start && range.end) {
       const boundary: UpdatableBoundary | undefined = updatable
-        ? { roots: [], retained: 0, pendingRoots: 0 }
+        ? { roots: [], active: true, retained: 0, pendingRoots: 0 }
         : undefined;
       activateRootsBetween(
         range.start,
         range.end,
         bootstrap.state,
         boundary,
+        bootstrap.enclosingSpanInstanceId,
       );
       if (boundary) retainUpdatableBoundary(target, boundary);
     } else if (updatable) {
       retainUpdatableBoundary(target, {
         roots: [],
+        active: true,
         retained: 0,
         pendingRoots: 0,
       });
@@ -391,6 +444,72 @@ function commitCheckpoint(
   }
 }
 
+function commitSpanCompletion(
+  payload: SpanCompletionPayload,
+  range: HydrationRange,
+  sequence: number,
+  target: number,
+  sentinel: Element,
+  scriptEl: Element,
+): void {
+  markBoundaryPending();
+  let committed = false;
+  try {
+    const registrationError = registerSpanCompletionTarget(target, range);
+    if (registrationError) throw new Error(registrationError);
+    const invalid = validateSpanCompletion(target, range);
+    if (invalid) throw new Error(invalid);
+    applyBoundaryBootstrap(payload);
+    if (!range.start || !range.end) {
+      throw new Error(`span ${target} completion is markerless`);
+    }
+    activateRootsBetween(
+      range.start,
+      range.end,
+      payload.state,
+    );
+    completeSpan(target);
+    committed = true;
+  } catch (error) {
+    fail(
+      `error completing span ${target}: ${streamingErrorMessage(error)}`,
+    );
+  } finally {
+    removeBoundaryScaffolding(
+      sentinel,
+      scriptEl,
+      range.start,
+      range.end,
+    );
+    if (committed) {
+      notifyCommit(`${SPAN_MARK_PREFIX}${target}`, sequence, 'span');
+    }
+    markBoundaryCommitted(false);
+  }
+}
+
+function failRangeResolution(
+  sentinel: Element,
+  scriptEl: Element,
+  resolved: Exclude<
+    ReturnType<typeof resolveBoundaryRange>,
+    { readonly ok: true }
+  >,
+): void {
+  if (!resolved.truncated) {
+    failBoundary(sentinel, resolved.reason);
+    return;
+  }
+  if (resolved.start) abandonDeferredRange(resolved.start, scriptEl);
+  removeBoundaryScaffolding(
+    sentinel,
+    scriptEl,
+    resolved.start,
+    null,
+  );
+  fail(resolved.reason);
+}
+
 function retainUpdatableBoundary(
   target: number,
   boundary: UpdatableBoundary,
@@ -466,11 +585,18 @@ function commitTerminal(
   removeBoundaryScaffolding(sentinel, scriptEl, null, null);
   terminalCommitted = true;
   pendingTerminalSequence = sequence;
-  clearUpdatableBoundaries();
+  clearUpdatableBoundaries(true);
   scheduleTerminalValidation();
 }
 
-function clearUpdatableBoundaries(): void {
+function clearUpdatableBoundaries(preservePendingPatches = false): void {
+  for (const boundary of updatableBoundaries.values()) {
+    boundary.active = false;
+    boundary.roots.length = 0;
+    if (!preservePendingPatches || boundary.pendingRoots === 0) {
+      boundary.patch = undefined;
+    }
+  }
   updatableBoundaries.clear();
   retainedUpdateRoots = 0;
 }
@@ -570,6 +696,7 @@ function onDomContentLoaded(generation: number): void {
 /** Reset coordinator singletons and invalidate queued promise reactions. */
 export function resetStreamingCoordinatorStateForTests(): void {
   resetDeferredActivationForTests();
+  abandonOpenSpans();
   settlePendingTerminal(false);
   clearUpdatableBoundaries();
   coordinatorGeneration++;
@@ -579,7 +706,7 @@ export function resetStreamingCoordinatorStateForTests(): void {
   slicedDrainActive = false;
   halted = false;
   nextExpectedRecordSequence = 0;
-  nextExpectedBoundaryId = 0;
+  nextExpectedBoundaryInstanceId = 0;
   terminalCommitted = false;
   pendingTerminalSequence = null;
   terminalValidationScheduled = false;
@@ -595,6 +722,8 @@ export function streamingRetentionStateForTests(): readonly [number, number] {
 
 export {
   elementHasPendingStateForTests,
+  openSpanCountForTests,
+  pendingBarrierRootCountForTests,
   pendingTagWaiterCountForTests,
   pendingUndefinedRootCountForTests,
 };
diff --git a/packages/webui-framework/src/streaming-deferred.ts b/packages/webui-framework/src/streaming-deferred.ts
index 1513cced4..0b00bcc17 100644
--- a/packages/webui-framework/src/streaming-deferred.ts
+++ b/packages/webui-framework/src/streaming-deferred.ts
@@ -20,7 +20,9 @@ import {
 } from './streaming-dom.js';
 import {
   PENDING_ROOT_CONNECTED,
+  STREAMING_ENCLOSING_SPAN_ATTR,
   STREAMED_HOST_ATTR,
+  STREAMING_SPAN_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
 import { applyStateUpdate } from './streaming-state.js';
@@ -28,14 +30,19 @@ import { applyStateUpdate } from './streaming-state.js';
 const ACTIVATION_ACTIVATED = 1;
 const ACTIVATION_STATIC_HOST_OPT_OUT = 2;
 export const ACTIVATION_MISSING_TEMPLATE = 3;
+const ACTIVATION_ANCESTOR_BARRIER = 4;
 export const ELEMENT_IGNORED = 0;
 export const ELEMENT_DEFERRED = 4;
 export const ELEMENT_LIMIT_FAILURE = 5;
+const ELEMENT_ACTIVATED_FROM_PENDING = 6;
+const ELEMENT_BARRIER_LIMIT_FAILURE = 7;
 export const MAX_PENDING_UNDEFINED_ROOTS = 50_000;
+export const MAX_PENDING_BARRIER_ROOTS = 50_000;
 
 type BoundaryActivatable = Element & {
   [STREAMING_BOUNDARY_ACTIVATE]?: (
     state?: Record<string, unknown>,
+    bypassSpanInstanceId?: number,
   ) => number;
 };
 
@@ -45,13 +52,16 @@ interface PendingTagWaiter {
 }
 
 const pendingTagWaiters = new Map<string, PendingTagWaiter>();
+const pendingBarrierRoots = new Set<Element>();
 let pendingUndefinedRoots = 0;
 let activationGeneration = 0;
 let failureHandler: ((reason: string) => void) | null = null;
 
 const PENDING_BOUNDARY_STATE = Symbol();
 const PENDING_BOUNDARY_UPDATES = Symbol();
+const PENDING_BYPASS_SPAN = Symbol();
 const NO_BOUNDARY_STATE: unique symbol = Symbol();
+const NO_BYPASS_SPAN: unique symbol = Symbol();
 
 /** One boundary-owned shallow patch shared by every deferred root. */
 export interface PendingBoundaryUpdates {
@@ -62,6 +72,12 @@ export interface PendingBoundaryUpdates {
    * absence means "finished with", not "activated".
    */
   readonly roots: Element[];
+  /**
+   * True while the response can still address this target. A successful
+   * terminal clears it but may leave `patch` alive until already-pending roots
+   * replay that last committed state. Fatal cleanup clears both.
+   */
+  active: boolean;
   /**
    * Marked roots seen by the checkpoint scan, including ones still deferred or
    * destined to fail. Bounds retention pessimistically so a boundary cannot
@@ -74,6 +90,8 @@ export interface PendingBoundaryUpdates {
 
 export interface DeferredActivationOptions {
   updates?: PendingBoundaryUpdates;
+  /** Span barrier this boundary's compiler-marked early roots may bypass. */
+  bypassSpanInstanceId?: number;
   /**
    * Set only by the checkpoint scan, which owns the boundary's retention
    * budget. A late activation re-walks a subtree the scan already counted, so
@@ -131,11 +149,33 @@ function activateMarkedElement(
   el: Element,
   state: Record<string, unknown> | undefined,
   updates?: PendingBoundaryUpdates,
+  bypassSpanInstanceId?: number,
 ): number {
   const tag = el.tagName.toLowerCase();
   if (tag.indexOf('-') === -1) return ELEMENT_IGNORED;
 
-  if (customElements.get(tag)) return invokeActivationHook(el, state);
+  if (customElements.get(tag)) {
+    if (pendingBarrierRoots.has(el)) {
+      return activatePendingBarrierRoot(el);
+    }
+    // A definition waiter still owns this root until its shared reaction runs.
+    // Consuming its state here would leave the waiter count and lifecycle stuck.
+    if (hasPendingState(el)) return ELEMENT_DEFERRED;
+    const outcome = invokeActivationHook(
+      el,
+      state,
+      bypassSpanInstanceId,
+    );
+    if (outcome !== ACTIVATION_ANCESTOR_BARRIER) return outcome;
+    if (pendingBarrierRoots.size >= MAX_PENDING_BARRIER_ROOTS) {
+      return ELEMENT_BARRIER_LIMIT_FAILURE;
+    }
+    stashPendingState(el, state, updates, bypassSpanInstanceId);
+    pendingBarrierRoots.add(el);
+    (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
+    return ELEMENT_DEFERRED;
+  }
+
   if (
     !hasPendingState(el) &&
     pendingUndefinedRoots >= MAX_PENDING_UNDEFINED_ROOTS
@@ -143,7 +183,9 @@ function activateMarkedElement(
     return ELEMENT_LIMIT_FAILURE;
   }
 
-  stashPendingState(el, state, updates);
+  if (!hasPendingState(el)) {
+    stashPendingState(el, state, updates, bypassSpanInstanceId);
+  }
   let waiter = pendingTagWaiters.get(tag);
   if (!waiter) {
     waiter = { generation: activationGeneration, roots: new Set() };
@@ -162,6 +204,65 @@ function activateMarkedElement(
   return ELEMENT_DEFERRED;
 }
 
+function activatePendingBarrierRoot(el: Element): number {
+  if (!pendingBarrierRoots.delete(el)) return ELEMENT_IGNORED;
+  delete (el as PendingRoot)[PENDING_ROOT_CONNECTED];
+  let updates: PendingBoundaryUpdates | undefined;
+  try {
+    updates = takePendingUpdates(el);
+    const state = takePendingState(el);
+    const bypassSpanInstanceId = takePendingBypassSpan(el);
+    const outcome = invokeActivationHook(
+      el,
+      state,
+      bypassSpanInstanceId,
+    );
+    if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
+      stashPendingState(
+        el,
+        state,
+        updates,
+        bypassSpanInstanceId,
+      );
+      pendingBarrierRoots.add(el);
+      (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
+      return ELEMENT_DEFERRED;
+    }
+    if (
+      updates &&
+      (outcome === ACTIVATION_ACTIVATED ||
+        outcome === ACTIVATION_STATIC_HOST_OPT_OUT)
+    ) {
+      if (updates.active) updates.roots.push(el);
+      if (updates.patch) requireStateUpdate(el, updates.patch);
+    }
+    return outcome === ACTIVATION_MISSING_TEMPLATE
+      ? outcome
+      : ELEMENT_ACTIVATED_FROM_PENDING;
+  } finally {
+    if (updates?.pendingRoots === 0) updates.patch = undefined;
+  }
+}
+
+/** Resume coordinator-owned activation when a component barrier releases. */
+function resumeBarrierRoot(this: Element): void {
+  try {
+    const outcome = activatePendingBarrierRoot(this);
+    if (outcome === ACTIVATION_MISSING_TEMPLATE) {
+      abandonDeferredDescendants(this);
+      abandonDeferredElement(this);
+      fail(
+        `template metadata missing while activating <${
+          this.tagName.toLowerCase()
+        }>`,
+      );
+    }
+  } catch (error) {
+    abandonDeferredDescendants(this);
+    reportActivationFailure(this.tagName.toLowerCase(), error);
+  }
+}
+
 function onTagDefined(tag: string, generation: number): void {
   if (generation !== activationGeneration) return;
   const waiter = pendingTagWaiters.get(tag);
@@ -221,18 +322,42 @@ function activatePendingRoot(
   try {
     updates = takePendingUpdates(el);
     const state = takePendingState(el);
-    const outcome = invokeActivationHook(el, state);
+    const bypassSpanInstanceId = takePendingBypassSpan(el);
+    const outcome = invokeActivationHook(
+      el,
+      state,
+      bypassSpanInstanceId,
+    );
     if (outcome === ACTIVATION_MISSING_TEMPLATE) {
       abandonDeferredDescendants(el);
       abandonDeferredElement(el);
       fail(`template metadata missing while activating <${tag}>`);
       return;
     }
+    if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
+      if (pendingBarrierRoots.size >= MAX_PENDING_BARRIER_ROOTS) {
+        abandonDeferredDescendants(el);
+        abandonDeferredElement(el);
+        fail(
+          `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`,
+        );
+        return;
+      }
+      stashPendingState(
+        el,
+        state,
+        updates,
+        bypassSpanInstanceId,
+      );
+      pendingBarrierRoots.add(el);
+      (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
+      return;
+    }
     // Parent first, and before the descendant walk: this root's own patch may
     // tear down the branch its retained descendants live in, and activating a
     // root inside an already-discarded branch is worse than never reaching it.
     if (updates) {
-      updates.roots.push(el);
+      if (updates.active) updates.roots.push(el);
       if (updates.patch) requireStateUpdate(el, updates.patch);
     }
     const failure = activateDeferredTree(
@@ -240,7 +365,11 @@ function activatePendingRoot(
       el,
       null,
       state,
-      updates ? { updates } : undefined,
+      updates
+        ? { updates, bypassSpanInstanceId }
+        : bypassSpanInstanceId === undefined
+        ? undefined
+        : { bypassSpanInstanceId },
     );
     if (failure) fail(failure);
   } catch (error) {
@@ -274,6 +403,7 @@ export function activateDeferredTree(
   // Hoisted out of the walk: these are read once per node otherwise, and this
   // loop runs over every node of every boundary.
   const updates = options?.updates;
+  const bypassSpanInstanceId = options?.bypassSpanInstanceId;
   const countRetention =
     options?.countRetention === true && updates !== undefined;
   let node = first;
@@ -315,7 +445,12 @@ export function activateDeferredTree(
       if (marked) {
         const el = node as Element;
         try {
-          const outcome = activateMarkedElement(el, state, updates);
+          const outcome = activateMarkedElement(
+            el,
+            state,
+            updates,
+            bypassSpanInstanceId,
+          );
           if (outcome === ACTIVATION_MISSING_TEMPLATE) {
             return `template metadata missing while activating <${
               el.tagName.toLowerCase()
@@ -324,17 +459,21 @@ export function activateDeferredTree(
           if (outcome === ELEMENT_LIMIT_FAILURE) {
             return `pending undefined root count exceeds ${MAX_PENDING_UNDEFINED_ROOTS}`;
           }
+          if (outcome === ELEMENT_BARRIER_LIMIT_FAILURE) {
+            return `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`;
+          }
           if (outcome === ELEMENT_DEFERRED) {
             resumeAfterDeferred = nextAfterSubtreeWithin(node, root);
             skippingDeferredDescendants = true;
           } else if (
             updates &&
+            outcome !== ELEMENT_ACTIVATED_FROM_PENDING &&
             (outcome === ACTIVATION_ACTIVATED ||
               outcome === ACTIVATION_STATIC_HOST_OPT_OUT)
           ) {
             // Joining here, on a known-good outcome, is what keeps a failed or
             // ignored element out of the update set for the life of the page.
-            updates.roots.push(el);
+            if (updates.active) updates.roots.push(el);
             // Replayed rather than merged into hydration state: `$hydrate` wires
             // bindings against the server's bytes without evaluating them, so
             // seeding a post-render value first would bind the old branch while
@@ -365,20 +504,25 @@ function reportActivationFailure(tag: string, error: unknown): void {
 
 /** Balance and clear every pending undefined-tag waiter exactly once. */
 export function abandonPendingWaiters(): void {
-  if (pendingTagWaiters.size === 0) {
-    pendingUndefinedRoots = 0;
-    return;
+  if (pendingBarrierRoots.size !== 0) {
+    for (const el of pendingBarrierRoots) clearPendingRoot(el);
+    pendingBarrierRoots.clear();
   }
-  for (const waiter of pendingTagWaiters.values()) {
-    for (const el of waiter.roots) clearPendingRoot(el);
-    settleLateActivation();
+  if (pendingTagWaiters.size !== 0) {
+    for (const waiter of pendingTagWaiters.values()) {
+      for (const el of waiter.roots) clearPendingRoot(el);
+      settleLateActivation();
+    }
+    pendingTagWaiters.clear();
   }
-  pendingTagWaiters.clear();
   pendingUndefinedRoots = 0;
 }
 
 function clearPendingRoot(el: Element): void {
-  if (hasPendingState(el)) takePendingState(el);
+  if (hasPendingState(el)) {
+    takePendingState(el);
+    takePendingBypassSpan(el);
+  }
   takePendingUpdates(el);
   delete (el as PendingRoot)[PENDING_ROOT_CONNECTED];
   abandonDeferredDescendants(el);
@@ -389,10 +533,14 @@ function stashPendingState(
   el: Element,
   state: Record<string, unknown> | undefined,
   updates?: PendingBoundaryUpdates,
+  bypassSpanInstanceId?: number,
 ): void {
   const store = el as unknown as Record<symbol, unknown>;
   store[PENDING_BOUNDARY_STATE] =
     state === undefined ? NO_BOUNDARY_STATE : state;
+  store[PENDING_BYPASS_SPAN] = bypassSpanInstanceId === undefined
+    ? NO_BYPASS_SPAN
+    : bypassSpanInstanceId;
   if (updates) {
     store[PENDING_BOUNDARY_UPDATES] = updates;
     updates.pendingRoots++;
@@ -417,39 +565,55 @@ function takePendingState(
     : (stored as Record<string, unknown> | undefined);
 }
 
+function takePendingBypassSpan(el: Element): number | undefined {
+  const store = el as unknown as Record<symbol, unknown>;
+  const stored = store[PENDING_BYPASS_SPAN];
+  delete store[PENDING_BYPASS_SPAN];
+  return stored === NO_BYPASS_SPAN ? undefined : stored as number | undefined;
+}
+
 function takePendingUpdates(el: Element): PendingBoundaryUpdates | undefined {
   const store = el as unknown as Record<symbol, unknown>;
   const updates = store[PENDING_BOUNDARY_UPDATES] as
     | PendingBoundaryUpdates
     | undefined;
   delete store[PENDING_BOUNDARY_UPDATES];
-  if (updates) updates.pendingRoots--;
-  return updates;
+  if (!updates) return undefined;
+  updates.pendingRoots--;
+  return updates.active || updates.patch !== undefined ? updates : undefined;
 }
 
 function invokeActivationHook(
   el: Element,
   state: Record<string, unknown> | undefined,
+  bypassSpanInstanceId?: number,
 ): number {
   const hook = (el as BoundaryActivatable)[STREAMING_BOUNDARY_ACTIVATE];
   if (typeof hook !== 'function') return ACTIVATION_MISSING_TEMPLATE;
   let outcome: number;
   try {
-    outcome = hook.call(el, state);
+    outcome = hook.call(el, state, bypassSpanInstanceId);
   } catch (error) {
-    safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+    removeStreamingAttributes(el);
     throw error;
   }
+  if (outcome === ACTIVATION_ANCESTOR_BARRIER) return outcome;
   if (
     outcome !== ACTIVATION_ACTIVATED &&
     outcome !== ACTIVATION_STATIC_HOST_OPT_OUT
   ) {
     return ACTIVATION_MISSING_TEMPLATE;
   }
-  safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+  removeStreamingAttributes(el);
   return outcome;
 }
 
+function removeStreamingAttributes(el: Element): void {
+  safeRemoveAttribute(el, STREAMED_HOST_ATTR);
+  safeRemoveAttribute(el, STREAMING_SPAN_HOST_ATTR);
+  safeRemoveAttribute(el, STREAMING_ENCLOSING_SPAN_ATTR);
+}
+
 /** Reset retained activation state and invalidate uncancellable waiters. */
 export function resetDeferredActivationForTests(): void {
   abandonPendingWaiters();
@@ -464,6 +628,10 @@ export function pendingUndefinedRootCountForTests(): number {
   return pendingUndefinedRoots;
 }
 
+export function pendingBarrierRootCountForTests(): number {
+  return pendingBarrierRoots.size;
+}
+
 export function elementHasPendingStateForTests(el: Element): boolean {
   return hasPendingState(el);
 }
diff --git a/packages/webui-framework/src/streaming-dom.ts b/packages/webui-framework/src/streaming-dom.ts
index 053ef975b..a86f36d04 100644
--- a/packages/webui-framework/src/streaming-dom.ts
+++ b/packages/webui-framework/src/streaming-dom.ts
@@ -11,8 +11,12 @@ export function streamingErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-const BOUNDARY_START_PREFIX = 'wb:';
-const BOUNDARY_END_PREFIX = '/wb:';
+/** Root-local runtime BoundaryInstanceId marker prefixes. */
+export const BOUNDARY_START_PREFIX = 'wb:';
+export const BOUNDARY_END_PREFIX = '/wb:';
+/** Root-local runtime SpanInstanceId marker prefixes. */
+export const SPAN_START_PREFIX = 'ws:';
+export const SPAN_END_PREFIX = '/ws:';
 
 /** The DOM span one committed boundary activates. */
 export interface HydrationRange {
@@ -32,40 +36,81 @@ export type RangeResolution =
 
 const MARKERLESS_RANGE: HydrationRange = { start: null, end: null };
 
-/** Resolve the in-order marker range for one checkpoint. */
+/** Resolve the root-local marker range for one boundary occurrence. */
 export function resolveBoundaryRange(
   scriptEl: Element,
-  sequence: number,
-  terminal: boolean,
+  instanceId: number,
 ): RangeResolution {
-  const end = findEndMarker(scriptEl, sequence);
+  return resolveMarkerRange(
+    scriptEl,
+    instanceId,
+    BOUNDARY_START_PREFIX,
+    BOUNDARY_END_PREFIX,
+    'boundary',
+  );
+}
+
+/** Resolve the root-local marker range for one completed component span. */
+export function resolveSpanRange(
+  scriptEl: Element,
+  instanceId: number,
+): RangeResolution {
+  return resolveMarkerRange(
+    scriptEl,
+    instanceId,
+    SPAN_START_PREFIX,
+    SPAN_END_PREFIX,
+    'span',
+  );
+}
+
+function resolveMarkerRange(
+  scriptEl: Element,
+  instanceId: number,
+  startPrefix: string,
+  endPrefix: string,
+  kind: string,
+): RangeResolution {
+  const end = findEndMarker(scriptEl, instanceId, endPrefix);
   if (end) {
-    if (terminal) {
-      return {
-        ok: false,
-        reason: `terminal boundary ${sequence} must be markerless`,
-        truncated: false,
-      };
-    }
-    const start = findStartMarkerBefore(end, sequence);
+    const start = findStartMarkerBefore(end, instanceId, startPrefix);
     if (!start) {
       return {
         ok: false,
-        reason: `missing start marker for boundary ${sequence}`,
+        reason: `missing start marker for ${kind} ${instanceId}`,
         truncated: false,
       };
     }
     return { ok: true, range: { start, end } };
   }
-  if (terminal) return { ok: true, range: MARKERLESS_RANGE };
   return {
     ok: false,
-    reason: `missing end marker for boundary ${sequence}`,
+    reason: `missing end marker for ${kind} ${instanceId}`,
     truncated: true,
-    start: findStartMarkerBefore(scriptEl, sequence),
+    start: findStartMarkerBefore(scriptEl, instanceId, startPrefix),
   };
 }
 
+/** Require an update or terminal record to carry no range markers. */
+export function resolveMarkerlessRecord(
+  scriptEl: Element,
+  kind: string,
+): RangeResolution {
+  const marker = previousComment(scriptEl);
+  if (
+    marker &&
+    (marker.data.startsWith(BOUNDARY_END_PREFIX) ||
+      marker.data.startsWith(SPAN_END_PREFIX))
+  ) {
+    return {
+      ok: false,
+      reason: `${kind} record must be markerless`,
+      truncated: false,
+    };
+  }
+  return { ok: true, range: MARKERLESS_RANGE };
+}
+
 export function findBoundaryScript(sentinel: Element): Element | null {
   let node: Element | null = sentinel.previousElementSibling;
   for (
@@ -86,40 +131,52 @@ export function findBoundaryScript(sentinel: Element): Element | null {
 
 function findEndMarker(
   scriptEl: Element,
-  sequence: number,
+  instanceId: number,
+  prefix: string,
 ): Comment | null {
   const marker = previousComment(scriptEl);
-  return marker?.data === `${BOUNDARY_END_PREFIX}${sequence}`
+  return marker?.data === `${prefix}${instanceId}`
     ? marker
     : null;
 }
 
 function findStartMarkerBefore(
   nodeBefore: Node,
-  sequence: number,
+  instanceId: number,
+  prefix: string,
 ): Comment | null {
   return findCommentBefore(
     nodeBefore,
-    `${BOUNDARY_START_PREFIX}${sequence}`,
+    `${prefix}${instanceId}`,
   );
 }
 
-/** Find a rejected boundary's end marker without a valid parsed sequence. */
-export function findEndMarkerByPrefix(
+/** Find a rejected record's end marker without a valid parsed target. */
+export function findRangeEndMarkerByPrefix(
   scriptEl: Element,
 ): Comment | null {
   const marker = previousComment(scriptEl);
-  return marker?.data.startsWith(BOUNDARY_END_PREFIX) ? marker : null;
+  return marker &&
+      (marker.data.startsWith(BOUNDARY_END_PREFIX) ||
+        marker.data.startsWith(SPAN_END_PREFIX))
+    ? marker
+    : null;
 }
 
 /** Find the start marker paired with a structurally discovered end marker. */
-export function findStartMarkerByPrefix(
+export function findRangeStartMarkerByPrefix(
   endMarker: Comment,
 ): Comment | null {
+  const endPrefix = endMarker.data.startsWith(BOUNDARY_END_PREFIX)
+    ? BOUNDARY_END_PREFIX
+    : SPAN_END_PREFIX;
+  const startPrefix = endPrefix === BOUNDARY_END_PREFIX
+    ? BOUNDARY_START_PREFIX
+    : SPAN_START_PREFIX;
   return findCommentBefore(
     endMarker,
-    `${BOUNDARY_START_PREFIX}${endMarker.data.slice(
-      BOUNDARY_END_PREFIX.length,
+    `${startPrefix}${endMarker.data.slice(
+      endPrefix.length,
     )}`,
   );
 }
diff --git a/packages/webui-framework/src/streaming-mode.ts b/packages/webui-framework/src/streaming-mode.ts
index 16fffe09f..d36a7bfa8 100644
--- a/packages/webui-framework/src/streaming-mode.ts
+++ b/packages/webui-framework/src/streaming-mode.ts
@@ -17,12 +17,26 @@ let cached: boolean | undefined;
 export const STREAMING_BOUNDARY_ACTIVATE = Symbol.for(
   'microsoft.webui.boundaryActivate',
 );
-/** Shared reconnect hook retained by a detached undefined streamed root. */
+/** Shared resume hook for definition and ancestor-barrier deferred roots. */
 export const PENDING_ROOT_CONNECTED = Symbol.for(
   'microsoft.webui.pendingRootConnected',
 );
 /** Compiler-owned marker for an uncommitted streamed host. */
 export const STREAMED_HOST_ATTR = 'data-ws';
+/**
+ * Compiler-owned SpanInstanceId on an unfinished component host.
+ *
+ * The value is a canonical base-10 integer. It identifies the root-local
+ * `<!--ws:S-->...<!--/ws:S-->` range that will eventually activate this host.
+ */
+export const STREAMING_SPAN_HOST_ATTR = 'data-ws-span';
+/**
+ * Compiler-owned enclosing SpanInstanceId on an early boundary child root.
+ *
+ * Matching this value to `data-ws-span` lets that root bypass exactly one
+ * unfinished ancestor barrier. Unmarked or mismatched roots stay dormant.
+ */
+export const STREAMING_ENCLOSING_SPAN_ATTR = 'data-ws-enclosing';
 
 /**
  * Whether this document was served in streaming-hydration mode.
diff --git a/packages/webui-framework/src/streaming-pipeline.test.ts b/packages/webui-framework/src/streaming-pipeline.test.ts
index 87af2d898..7edfc94f2 100644
--- a/packages/webui-framework/src/streaming-pipeline.test.ts
+++ b/packages/webui-framework/src/streaming-pipeline.test.ts
@@ -41,11 +41,15 @@ interface FakeElement extends FakeNode {
   shadowRoot: FakeNode | null;
   readonly isConnected: boolean;
   hasAttribute(name: string): boolean;
+  getAttribute(name: string): string | null;
   setAttribute(name: string, value: string): void;
   removeAttribute(name: string): void;
   readonly textContent: string;
   setState?: (state: Record<string, unknown>) => void;
-  [ACTIVATE]?: (state?: Record<string, unknown>) => number;
+  [ACTIVATE]?: (
+    state?: Record<string, unknown>,
+    bypassSpanInstanceId?: number,
+  ) => number;
   [ABANDON]?: () => void;
   [RESUME_PENDING]?: () => void;
 }
@@ -102,7 +106,10 @@ function comment(data: string): FakeNode & { data: string } {
 interface ElementSpec {
   attrs?: Record<string, string>;
   text?: string;
-  hook?: (state?: Record<string, unknown>) => void;
+  hook?: (
+    state?: Record<string, unknown>,
+    bypassSpanInstanceId?: number,
+  ) => void | number;
   activationOutcome?: number;
   abandon?: () => void;
   children?: Array<FakeNode>;
@@ -124,6 +131,11 @@ function element(tagName: string, spec: ElementSpec = {}): FakeElement {
     hasAttribute(name: string): boolean {
       return Object.prototype.hasOwnProperty.call(attrs, name);
     },
+    getAttribute(name: string): string | null {
+      return Object.prototype.hasOwnProperty.call(attrs, name)
+        ? attrs[name]
+        : null;
+    },
     setAttribute(name: string, value: string): void {
       attrs[name] = value;
     },
@@ -142,9 +154,11 @@ function element(tagName: string, spec: ElementSpec = {}): FakeElement {
   } as unknown as FakeElement & { _children: FakeNode[] };
   addSiblingGetters(node);
   if (spec.hook) {
-    node[ACTIVATE] = (state) => {
-      spec.hook!(state);
-      return spec.activationOutcome ?? 1;
+    node[ACTIVATE] = (state, bypassSpanInstanceId?: number) => {
+      const outcome = spec.hook!(state, bypassSpanInstanceId);
+      return typeof outcome === 'number'
+        ? outcome
+        : spec.activationOutcome ?? 1;
     };
   }
   if (spec.abandon) node[ABANDON] = spec.abandon;
@@ -353,6 +367,11 @@ const {
   __streamingRetentionStateForTests,
 } = await import('./streaming.js');
 
+const {
+  openSpanCountForTests: __openSpanCountForTests,
+  pendingBarrierRootCountForTests: __pendingBarrierRootCountForTests,
+} = await import('./streaming-coordinator.js');
+
 const {
   beginStreamingGate,
   __resetLifecycleForTests,
@@ -374,6 +393,12 @@ function hasWs(el: FakeElement): boolean {
   return el.hasAttribute('data-ws');
 }
 
+function hasStreamingAttrs(el: FakeElement): boolean {
+  return hasWs(el) ||
+    el.hasAttribute('data-ws-span') ||
+    el.hasAttribute('data-ws-enclosing');
+}
+
 /** The live `window.__webui` object the coordinator writes its handoff into. */
 function webuiGlobal(): Record<string, unknown> {
   return (globalThis as unknown as { window: { __webui: Record<string, unknown> } }).window.__webui;
@@ -447,11 +472,13 @@ function buildBoundary(sequence: number, terminal: number, roots: FakeElement[],
   const scriptEl = element('script', {
     attrs: { 'data-webui-boundary': '' },
     text: JSON.stringify([
-      1,
+      2,
       sequence,
-      terminal === 1 ? 3 : 0,
+      terminal === 1 ? 4 : 0,
       terminal === 1 ? 0 : sequence,
-      bootstrap,
+      terminal === 1
+        ? bootstrap
+        : { declarationId: sequence, ...bootstrap },
     ]),
   });
   const sentinel = element('webui-hydrate');
@@ -464,7 +491,15 @@ function buildBoundary(sequence: number, terminal: number, roots: FakeElement[],
 function buildMarkerless(sequence: number, terminal: number, bootstrap: object): BuiltBoundary {
   const scriptEl = element('script', {
     attrs: { 'data-webui-boundary': '' },
-    text: JSON.stringify([1, sequence, terminal === 1 ? 3 : 0, 0, bootstrap]),
+    text: JSON.stringify([
+      2,
+      sequence,
+      terminal === 1 ? 4 : 0,
+      0,
+      terminal === 1
+        ? bootstrap
+        : { declarationId: 0, ...bootstrap },
+    ]),
   });
   const sentinel = element('webui-hydrate');
   const root = body();
@@ -483,7 +518,13 @@ function buildUpdatableBoundary(
   const end = comment(`/wb:${boundaryId}`);
   const scriptEl = element('script', {
     attrs: { 'data-webui-boundary': '' },
-    text: JSON.stringify([1, recordSequence, 1, boundaryId, bootstrap]),
+    text: JSON.stringify([
+      2,
+      recordSequence,
+      1,
+      boundaryId,
+      { declarationId: boundaryId, ...bootstrap },
+    ]),
   });
   const sentinel = element('webui-hydrate');
   const root = body();
@@ -498,7 +539,7 @@ function buildStateUpdate(
 ): BuiltBoundary {
   const scriptEl = element('script', {
     attrs: { 'data-webui-boundary': '' },
-    text: JSON.stringify([1, recordSequence, 2, boundaryId, patch]),
+    text: JSON.stringify([2, recordSequence, 2, boundaryId, patch]),
   });
   const sentinel = element('webui-hydrate');
   const root = body();
@@ -506,6 +547,34 @@ function buildStateUpdate(
   return { root, sentinel, scriptEl, startMarker: null, endMarker: null, roots: [] };
 }
 
+/** Build a generated component span completion with no prior checkpoint. */
+function buildSpanCompletion(
+  recordSequence: number,
+  spanId: number,
+  host: FakeElement,
+  bootstrap: object,
+): BuiltBoundary {
+  host.setAttribute('data-ws', '');
+  host.setAttribute('data-ws-span', String(spanId));
+  const start = comment(`ws:${spanId}`);
+  const end = comment(`/ws:${spanId}`);
+  const scriptEl = element('script', {
+    attrs: { 'data-webui-boundary': '' },
+    text: JSON.stringify([2, recordSequence, 3, spanId, bootstrap]),
+  });
+  const sentinel = element('webui-hydrate');
+  const root = body();
+  link(root, [start, host, end, scriptEl, sentinel]);
+  return {
+    root,
+    sentinel,
+    scriptEl,
+    startMarker: start,
+    endMarker: end,
+    roots: [host],
+  };
+}
+
 /** Build a boundary whose payload script carries arbitrary (possibly
  *  malformed) text, while keeping a real marker pair around `roots`. Used to
  *  prove that a rejected boundary's scaffolding is still fully cleaned. */
@@ -520,6 +589,115 @@ function buildRawBoundary(sequence: number, rawText: string, roots: FakeElement[
   return { root, sentinel, scriptEl, startMarker: start, endMarker: end, roots };
 }
 
+interface BuiltSpanScenario {
+  root: FakeNode;
+  boundaryStart: FakeNode & { data: string };
+  boundaryEnd: FakeNode & { data: string };
+  boundaryScript: FakeElement;
+  boundarySentinel: FakeElement;
+  spanStart: FakeNode & { data: string };
+  spanEnd: FakeNode & { data: string };
+  spanScript: FakeElement;
+  spanSentinel: FakeElement;
+  parent: FakeElement;
+  child: FakeElement;
+}
+
+/** Build one early boundary inside an unfinished component host. */
+function buildSpanScenario(
+  parent: FakeElement,
+  child: FakeElement,
+  options: {
+    updatable?: boolean;
+    spanId?: number;
+    enclosingMarker?: number;
+    boundarySequence?: number;
+    spanSequence?: number;
+    nestedLight?: boolean;
+    includeCompletion?: boolean;
+  } = {},
+): BuiltSpanScenario {
+  const spanId = options.spanId ?? 0;
+  const boundarySequence = options.boundarySequence ?? 0;
+  const spanSequence = options.spanSequence ?? boundarySequence + 1;
+  parent.setAttribute('data-ws', '');
+  parent.setAttribute('data-ws-span', String(spanId));
+  child.setAttribute('data-ws', '');
+  child.setAttribute(
+    'data-ws-enclosing',
+    String(options.enclosingMarker ?? spanId),
+  );
+
+  const boundaryStart = comment('wb:0');
+  const boundaryEnd = comment('/wb:0');
+  const boundaryScript = element('script', {
+    attrs: { 'data-webui-boundary': '' },
+    text: JSON.stringify([
+      2,
+      boundarySequence,
+      options.updatable ? 1 : 0,
+      0,
+      {
+        declarationId: 9,
+        enclosingSpanInstanceId: spanId,
+        state: { scope: 'child' },
+      },
+    ]),
+  });
+  const boundarySentinel = element('webui-hydrate');
+  const boundaryNodes: FakeNode[] = [
+    boundaryStart,
+    child,
+    boundaryEnd,
+    boundaryScript,
+    boundarySentinel,
+  ];
+
+  if (parent.shadowRoot) {
+    link(parent.shadowRoot, boundaryNodes);
+  } else if (options.nestedLight) {
+    const wrapper = element('section');
+    link(wrapper, boundaryNodes);
+    link(parent, [wrapper]);
+  } else {
+    link(parent, boundaryNodes);
+  }
+
+  const spanStart = comment(`ws:${spanId}`);
+  const spanEnd = comment(`/ws:${spanId}`);
+  const spanScript = element('script', {
+    attrs: { 'data-webui-boundary': '' },
+    text: JSON.stringify([
+      2,
+      spanSequence,
+      3,
+      spanId,
+      { state: { scope: 'parent' } },
+    ]),
+  });
+  const spanSentinel = element('webui-hydrate');
+  const root = body();
+  link(
+    root,
+    options.includeCompletion === false
+      ? [spanStart, parent]
+      : [spanStart, parent, spanEnd, spanScript, spanSentinel],
+  );
+  return {
+    root,
+    boundaryStart,
+    boundaryEnd,
+    boundaryScript,
+    boundarySentinel,
+    spanStart,
+    spanEnd,
+    spanScript,
+    spanSentinel,
+    parent,
+    child,
+  };
+}
+
 /** Assert a boundary left no discoverable scaffolding (sentinel, payload
  *  script, and marker pair all detached) while every SSR root remains in the
  *  tree — the invariant every reject path must uphold. */
@@ -567,6 +745,63 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(documentWalkCalls, 0, 'valid streams never scan the document');
   });
 
+  test('orders runtime boundary occurrences independently of repeated declaration IDs', async () => {
+    const activated: string[] = [];
+    const firstRoot = element('repeated-boundary-root', {
+      hook() {
+        activated.push('first');
+      },
+    });
+    const secondRoot = element('repeated-boundary-root', {
+      hook() {
+        activated.push('second');
+      },
+    });
+    predefine('repeated-boundary-root');
+
+    enqueue(buildBoundary(
+      0,
+      0,
+      [firstRoot],
+      { declarationId: 17 },
+    ).sentinel);
+    await flush();
+    enqueue(buildBoundary(
+      1,
+      0,
+      [secondRoot],
+      { declarationId: 17 },
+    ).sentinel);
+    await flush();
+
+    assert.deepEqual(activated, ['first', 'second']);
+    assert.equal(__isHaltedForTests(), false);
+  });
+
+  test('rejects a gap in runtime BoundaryInstanceId occurrence order', async () => {
+    const previousError = console.error;
+    console.error = () => {};
+    try {
+      const root = element('gap-boundary-root', { hook() {} });
+      predefine('gap-boundary-root');
+      const boundary = buildUpdatableBoundary(
+        0,
+        1,
+        [root],
+        { declarationId: 4 },
+      );
+
+      enqueue(boundary.sentinel);
+      await flush();
+
+      assert.equal(__isHaltedForTests(), true);
+      assertScaffoldCleaned(boundary);
+      assert.equal(hasStreamingAttrs(root), false);
+    } finally {
+      console.error = previousError;
+    }
+  });
+
   test('applies state updates without reactivating an updatable boundary', async () => {
     const activations: Array<Record<string, unknown> | undefined> = [];
     const updates: Array<Record<string, unknown>> = [];
@@ -746,6 +981,44 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(__getLifecycleStateForTests().completed, true);
   });
 
+  test('terminal cleanup preserves a queued update until late hydration', async () => {
+    const activations: Array<Record<string, unknown> | undefined> = [];
+    const updates: Array<Record<string, unknown>> = [];
+    const late = element('terminal-late-panel', {
+      hook(state) {
+        activations.push(state);
+      },
+      setState(state) {
+        updates.push(state);
+      },
+    });
+
+    enqueue(buildUpdatableBoundary(
+      0,
+      0,
+      [late],
+      { state: { status: 'loading' } },
+    ).sentinel);
+    await flush();
+    enqueue(buildStateUpdate(1, 0, { status: 'stale' }).sentinel);
+    await flush();
+    enqueue(buildMarkerless(2, 1, {}).sentinel);
+    await flush();
+
+    assert.deepEqual(__streamingRetentionStateForTests(), [0, 0]);
+    defineTag('terminal-late-panel');
+    await flush();
+
+    assert.deepEqual(activations, [{ status: 'loading' }]);
+    assert.deepEqual(
+      plainPatches(updates),
+      [{ status: 'stale' }],
+      'the last committed update replays exactly once after terminal',
+    );
+    assert.equal(hasPending(late), false);
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
   test('a root whose activation fails never receives later updates', async () => {
     const previousError = console.error;
     const errors: string[] = [];
@@ -1153,7 +1426,11 @@ describe('streaming coordinator pipeline', () => {
     const previousError = console.error;
     console.error = () => {};
     try {
-      const boundary = buildBoundary(0, 0, [], null as unknown as object);
+      const boundary = buildRawBoundary(
+        0,
+        JSON.stringify([2, 0, 0, 0, null]),
+        [],
+      );
       enqueue(boundary.sentinel);
       await flush();
 
@@ -1305,7 +1582,7 @@ describe('streaming coordinator pipeline', () => {
       hook() {},
       abandon() { abandoned++; },
     });
-    const b = buildRawBoundary(0, '[1,0,0,{', [root0]);
+    const b = buildRawBoundary(0, '[2,0,0,{', [root0]);
 
     enqueue(b.sentinel);
     await flush();
@@ -1335,7 +1612,10 @@ describe('streaming coordinator pipeline', () => {
   test('a missing start marker halts and cleans the end marker + payload', async () => {
     // End marker present but no matching start marker: reject + clean.
     const end = comment('/wb:0');
-    const scriptEl = element('script', { attrs: { 'data-webui-boundary': '' }, text: JSON.stringify([1, 0, 0, 0, {}]) });
+    const scriptEl = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([2, 0, 0, 0, { declarationId: 0 }]),
+    });
     const sentinel = element('webui-hydrate');
     const root = body();
     link(root, [end, scriptEl, sentinel]);
@@ -1399,6 +1679,682 @@ describe('streaming coordinator pipeline', () => {
     assertScaffoldCleaned(b);
   });
 
+  test('registers and completes a component span with no prior boundary', async () => {
+    const states: Array<Record<string, unknown> | undefined> = [];
+    const host = element('zero-span-host', {
+      hook(state) {
+        states.push(state);
+      },
+    });
+    const span = buildSpanCompletion(0, 0, host, {
+      state: { scope: 'zero' },
+    });
+    predefine('zero-span-host');
+
+    enqueue(span.sentinel);
+    await flush();
+
+    assert.deepEqual(states, [{ scope: 'zero' }]);
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(host), false);
+    assertScaffoldCleaned(span);
+    assert.equal(documentWalkCalls, 0, 'completion discovery stays range-local');
+
+    enqueue(buildMarkerless(1, 1, {}).sentinel);
+    await flush();
+    assert.equal(__isHaltedForTests(), false);
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
+  test('registers nested zero-occurrence spans outer-first and completes them inner-first', async () => {
+    const order: string[] = [];
+    let outerActive = false;
+    const inner = element('zero-inner-host', {
+      hook() {
+        if (!outerActive) return 4;
+        order.push('inner');
+        return 1;
+      },
+    });
+    const outer = element('zero-outer-host', {
+      hook() {
+        outerActive = true;
+        order.push('outer');
+      },
+    });
+    inner.setAttribute('data-ws', '');
+    inner.setAttribute('data-ws-span', '1');
+    outer.setAttribute('data-ws', '');
+    outer.setAttribute('data-ws-span', '0');
+
+    const innerStart = comment('ws:1');
+    const innerEnd = comment('/ws:1');
+    const innerScript = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([
+        2,
+        0,
+        3,
+        1,
+        { state: { scope: 'inner' } },
+      ]),
+    });
+    const innerSentinel = element('webui-hydrate');
+    link(outer, [
+      innerStart,
+      inner,
+      innerEnd,
+      innerScript,
+      innerSentinel,
+    ]);
+
+    const outerStart = comment('ws:0');
+    const outerEnd = comment('/ws:0');
+    const outerScript = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([
+        2,
+        1,
+        3,
+        0,
+        { state: { scope: 'outer' } },
+      ]),
+    });
+    const outerSentinel = element('webui-hydrate');
+    const root = body();
+    link(root, [
+      outerStart,
+      outer,
+      outerEnd,
+      outerScript,
+      outerSentinel,
+    ]);
+    predefine('zero-inner-host', 'zero-outer-host');
+
+    enqueue(innerSentinel);
+    await flush();
+    assert.deepEqual(order, [], 'the inner host remains behind the outer barrier');
+    assert.equal(__openSpanCountForTests(), 1);
+
+    enqueue(outerSentinel);
+    await flush();
+    assert.deepEqual(order, ['outer', 'inner']);
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(inner), false);
+    assert.equal(hasStreamingAttrs(outer), false);
+    assert.equal(documentWalkCalls, 0, 'nested discovery stays range-local');
+
+    enqueue(buildMarkerless(2, 1, {}).sentinel);
+    await flush();
+    assert.equal(__isHaltedForTests(), false);
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
+  test('fails closed when a zero-occurrence span host declares another ID', async () => {
+    let activations = 0;
+    const host = element('malformed-zero-span', {
+      hook() {
+        activations++;
+      },
+    });
+    const span = buildSpanCompletion(0, 0, host, { state: {} });
+    host.setAttribute('data-ws-span', '1');
+    predefine('malformed-zero-span');
+
+    const previousError = console.error;
+    console.error = () => {};
+    try {
+      enqueue(span.sentinel);
+      await flush();
+    } finally {
+      console.error = previousError;
+    }
+
+    assert.equal(__isHaltedForTests(), true);
+    assert.equal(activations, 0);
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(host), false);
+    assertScaffoldCleaned(span);
+    assert.equal(__getLifecycleStateForTests().completed, false);
+  });
+
+  test('keeps later checkpoint span numbering gapless after a zero-occurrence completion', async () => {
+    const order: string[] = [];
+    const zeroHost = element('first-zero-span', {
+      hook() {
+        order.push('zero');
+      },
+    });
+    const zero = buildSpanCompletion(0, 0, zeroHost, {
+      state: { scope: 'zero' },
+    });
+    predefine('first-zero-span');
+    enqueue(zero.sentinel);
+    await flush();
+
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('later-span-child', {
+      hook(_state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        order.push('child');
+        return 1;
+      },
+    });
+    const parent = element('later-span-parent', {
+      hook() {
+        parentActive = true;
+        order.push('parent');
+      },
+    });
+    const later = buildSpanScenario(parent, child, {
+      spanId: 1,
+      boundarySequence: 1,
+      spanSequence: 2,
+    });
+    predefine('later-span-child', 'later-span-parent');
+
+    enqueue(later.boundarySentinel);
+    await flush();
+    assert.deepEqual(order, ['zero', 'child']);
+    assert.equal(__openSpanCountForTests(), 1);
+    assert.equal(__isHaltedForTests(), false);
+
+    enqueue(later.spanSentinel);
+    await flush();
+    assert.deepEqual(order, ['zero', 'child', 'parent']);
+    assert.equal(__openSpanCountForTests(), 0);
+
+    enqueue(buildMarkerless(3, 1, {}).sentinel);
+    await flush();
+    assert.equal(__isHaltedForTests(), false);
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
+  test('activates a marked child before its spanning parent closes, then completes the parent exactly once', async () => {
+    const order: string[] = [];
+    const childStates: Array<Record<string, unknown> | undefined> = [];
+    const parentStates: Array<Record<string, unknown> | undefined> = [];
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('early-child', {
+      hook(state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        order.push('child');
+        childStates.push(state);
+        return 1;
+      },
+    });
+    const parent = element('spanning-parent', {
+      hook(state) {
+        parentActive = true;
+        order.push('parent');
+        parentStates.push(state);
+      },
+    });
+    const scenario = buildSpanScenario(parent, child);
+    predefine('early-child', 'spanning-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+
+    assert.deepEqual(order, ['child']);
+    assert.deepEqual(childStates, [{ scope: 'child' }]);
+    assert.equal(__openSpanCountForTests(), 1);
+    assert.equal(__pendingBarrierRootCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(child), false);
+    assert.equal(hasStreamingAttrs(parent), true);
+    assert.equal(webuiGlobal().declarationId, undefined);
+    assert.equal(webuiGlobal().enclosingSpanInstanceId, undefined);
+    assert.equal(documentWalkCalls, 0, 'valid early commits stay root-local');
+
+    enqueue(scenario.spanSentinel);
+    await flush();
+
+    assert.deepEqual(order, ['child', 'parent']);
+    assert.deepEqual(parentStates, [{ scope: 'parent' }]);
+    assert.deepEqual(childStates, [{ scope: 'child' }], 'parent completion does not rehydrate the early child');
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(parent), false);
+    assert.equal(scenario.spanStart.parentNode, null);
+    assert.equal(scenario.spanEnd.parentNode, null);
+    assert.equal(scenario.spanScript.parentNode, null);
+    assert.equal(scenario.spanSentinel.parentNode, null);
+
+    enqueue(buildMarkerless(2, 1, {}).sentinel);
+    await flush();
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
+  test('keeps an unmarked or mismatched early child behind the ancestor barrier', async () => {
+    const order: string[] = [];
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('mismatch-child', {
+      hook(_state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        order.push('child');
+        return 1;
+      },
+    });
+    const parent = element('mismatch-parent', {
+      hook() {
+        parentActive = true;
+        order.push('parent');
+      },
+    });
+    const scenario = buildSpanScenario(parent, child, {
+      enclosingMarker: 1,
+    });
+    const unmarked = element('unmarked-child', {
+      hook() {
+        if (!parentActive) return 4;
+        order.push('unmarked');
+        return 1;
+      },
+    });
+    unmarked.setAttribute('data-ws', '');
+    link(parent, [
+      scenario.boundaryStart,
+      child,
+      unmarked,
+      scenario.boundaryEnd,
+      scenario.boundaryScript,
+      scenario.boundarySentinel,
+    ]);
+    predefine('mismatch-child', 'unmarked-child', 'mismatch-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+
+    assert.deepEqual(order, []);
+    assert.equal(__pendingBarrierRootCountForTests(), 2);
+    assert.equal(hasStreamingAttrs(child), true);
+    assert.equal(hasStreamingAttrs(unmarked), true);
+
+    enqueue(scenario.spanSentinel);
+    await flush();
+
+    assert.deepEqual(order, ['parent', 'child', 'unmarked']);
+    assert.equal(__pendingBarrierRootCountForTests(), 0);
+    assert.equal(hasStreamingAttrs(child), false);
+    assert.equal(hasStreamingAttrs(unmarked), false);
+    assert.equal(__isHaltedForTests(), false);
+  });
+
+  test('updates a live early child by BoundaryInstanceId before parent completion', async () => {
+    const activations: Array<Record<string, unknown> | undefined> = [];
+    const updates: Array<Record<string, unknown>> = [];
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('updatable-early-child', {
+      hook(state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        activations.push(state);
+        return 1;
+      },
+      setState(state) {
+        updates.push(state);
+      },
+    });
+    const parent = element('updatable-span-parent', {
+      hook() {
+        parentActive = true;
+      },
+    });
+    const scenario = buildSpanScenario(parent, child, {
+      updatable: true,
+      spanSequence: 2,
+    });
+    predefine('updatable-early-child', 'updatable-span-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    enqueue(buildStateUpdate(1, 0, { status: 'ready' }).sentinel);
+    await flush();
+
+    assert.deepEqual(activations, [{ scope: 'child' }]);
+    assert.deepEqual(updates, [{ status: 'ready' }]);
+    assert.deepEqual(__streamingRetentionStateForTests(), [1, 1]);
+
+    enqueue(scenario.spanSentinel);
+    await flush();
+    assert.deepEqual(activations, [{ scope: 'child' }], 'span completion does not duplicate activation');
+    assert.deepEqual(updates, [{ status: 'ready' }]);
+
+    enqueue(buildMarkerless(3, 1, {}).sentinel);
+    await flush();
+    assert.deepEqual(__streamingRetentionStateForTests(), [0, 0]);
+  });
+
+  test('replays an update once when an undefined early child defines before span completion', async () => {
+    const childActivations: Array<Record<string, unknown> | undefined> = [];
+    const childUpdates: Array<Record<string, unknown>> = [];
+    const bypasses: Array<number | undefined> = [];
+    let parentActivations = 0;
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('late-early-child', {
+      hook(state, bypassSpanInstanceId) {
+        bypasses.push(bypassSpanInstanceId);
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        childActivations.push(state);
+        return 1;
+      },
+      setState(state) {
+        childUpdates.push(state);
+      },
+    });
+    const parent = element('late-early-parent', {
+      hook() {
+        parentActive = true;
+        parentActivations++;
+      },
+    });
+    const scenario = buildSpanScenario(parent, child, {
+      updatable: true,
+      spanSequence: 2,
+    });
+    predefine('late-early-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    assert.equal(__pendingUndefinedRootCountForTests(), 1);
+    assert.deepEqual(__streamingRetentionStateForTests(), [1, 1]);
+
+    enqueue(buildStateUpdate(1, 0, { status: 'ready' }).sentinel);
+    await flush();
+    assert.deepEqual(childUpdates, []);
+
+    defineTag('late-early-child');
+    await flush();
+    assert.deepEqual(bypasses, [0], 'the pending root retains its enclosing-span bypass');
+    assert.deepEqual(childActivations, [{ scope: 'child' }]);
+    assert.deepEqual(plainPatches(childUpdates), [{ status: 'ready' }]);
+    assert.equal(parentActivations, 0, 'the child activates while its parent span is unfinished');
+
+    enqueue(scenario.spanSentinel);
+    await flush();
+    assert.equal(parentActivations, 1);
+    assert.deepEqual(
+      childActivations,
+      [{ scope: 'child' }],
+      'span completion must not rehydrate the already-live child',
+    );
+    assert.deepEqual(
+      plainPatches(childUpdates),
+      [{ status: 'ready' }],
+      'span completion must not overwrite or replay the newer update',
+    );
+
+    enqueue(buildMarkerless(3, 1, {}).sentinel);
+    await flush();
+    assert.deepEqual(__streamingRetentionStateForTests(), [0, 0]);
+    assert.equal(__pendingUndefinedRootCountForTests(), 0);
+    assert.equal(hasPending(child), false);
+    assert.equal(__getLifecycleStateForTests().completed, true);
+  });
+
+  test('resolves a nested light-DOM boundary inside its actual component render root', async () => {
+    const order: string[] = [];
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('light-span-child', {
+      hook(_state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        order.push('child');
+        return 1;
+      },
+    });
+    const parent = element('light-span-parent', {
+      hook() {
+        parentActive = true;
+        order.push('parent');
+      },
+    });
+    const scenario = buildSpanScenario(parent, child, {
+      nestedLight: true,
+    });
+    predefine('light-span-child', 'light-span-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    enqueue(scenario.spanSentinel);
+    await flush();
+
+    assert.deepEqual(order, ['child', 'parent']);
+    assert.equal(documentWalkCalls, 0);
+    assert.equal(__isHaltedForTests(), false);
+  });
+
+  test('completes nested light-DOM component spans parent-first with only one barrier bypassed', async () => {
+    const order: string[] = [];
+    let outerActive = false;
+    let innerActive = false;
+    let child!: FakeElement;
+    child = element('nested-span-child', {
+      hook(_state, bypassSpanInstanceId) {
+        const bypassesInner =
+          child.getAttribute('data-ws-enclosing') ===
+            String(bypassSpanInstanceId);
+        if ((!innerActive && !bypassesInner) || !outerActive) return 4;
+        order.push('child');
+        return 1;
+      },
+    });
+    const inner = element('nested-inner-parent', {
+      hook() {
+        if (!outerActive) return 4;
+        innerActive = true;
+        order.push('inner');
+        return 1;
+      },
+    });
+    const outer = element('nested-outer-parent', {
+      hook() {
+        outerActive = true;
+        order.push('outer');
+      },
+    });
+    outer.setAttribute('data-ws', '');
+    outer.setAttribute('data-ws-span', '0');
+    inner.setAttribute('data-ws', '');
+    inner.setAttribute('data-ws-span', '1');
+    child.setAttribute('data-ws', '');
+    child.setAttribute('data-ws-enclosing', '1');
+
+    const boundaryStart = comment('wb:0');
+    const boundaryEnd = comment('/wb:0');
+    const boundaryScript = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([
+        2,
+        0,
+        0,
+        0,
+        {
+          declarationId: 12,
+          enclosingSpanInstanceId: 1,
+          state: { scope: 'child' },
+        },
+      ]),
+    });
+    const boundarySentinel = element('webui-hydrate');
+    link(inner, [
+      boundaryStart,
+      child,
+      boundaryEnd,
+      boundaryScript,
+      boundarySentinel,
+    ]);
+
+    const innerStart = comment('ws:1');
+    const innerEnd = comment('/ws:1');
+    const innerScript = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([
+        2,
+        1,
+        3,
+        1,
+        { state: { scope: 'inner' } },
+      ]),
+    });
+    const innerSentinel = element('webui-hydrate');
+    link(outer, [
+      innerStart,
+      inner,
+      innerEnd,
+      innerScript,
+      innerSentinel,
+    ]);
+
+    const outerStart = comment('ws:0');
+    const outerEnd = comment('/ws:0');
+    const outerScript = element('script', {
+      attrs: { 'data-webui-boundary': '' },
+      text: JSON.stringify([
+        2,
+        2,
+        3,
+        0,
+        { state: { scope: 'outer' } },
+      ]),
+    });
+    const outerSentinel = element('webui-hydrate');
+    const root = body();
+    link(root, [
+      outerStart,
+      outer,
+      outerEnd,
+      outerScript,
+      outerSentinel,
+    ]);
+    predefine(
+      'nested-span-child',
+      'nested-inner-parent',
+      'nested-outer-parent',
+    );
+
+    enqueue(boundarySentinel);
+    await flush();
+    assert.deepEqual(order, [], 'the marker bypasses inner, not outer');
+    assert.equal(__openSpanCountForTests(), 2);
+
+    enqueue(innerSentinel);
+    await flush();
+    assert.deepEqual(order, [], 'inner completion remains behind outer');
+    assert.equal(__openSpanCountForTests(), 1);
+
+    enqueue(outerSentinel);
+    await flush();
+    assert.deepEqual(order, ['outer', 'inner', 'child']);
+    assert.equal(__pendingBarrierRootCountForTests(), 0);
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(documentWalkCalls, 0);
+  });
+
+  test('resolves an early boundary inside an open declarative shadow root', async () => {
+    const order: string[] = [];
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('shadow-span-child', {
+      hook(_state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        order.push('child');
+        return 1;
+      },
+    });
+    const parent = element('shadow-span-parent', {
+      shadowChildren: [],
+      hook() {
+        parentActive = true;
+        order.push('parent');
+      },
+    });
+    const scenario = buildSpanScenario(parent, child);
+    predefine('shadow-span-child', 'shadow-span-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    enqueue(scenario.spanSentinel);
+    await flush();
+
+    assert.deepEqual(order, ['child', 'parent']);
+    assert.equal(documentWalkCalls, 0);
+    assert.equal(hasStreamingAttrs(child), false);
+    assert.equal(hasStreamingAttrs(parent), false);
+  });
+
+  test('span truncation releases open-span state, markers, and compiler attributes', async () => {
+    __installTruncationGuardForTests();
+    let parentActive = false;
+    let child!: FakeElement;
+    child = element('truncated-span-child', {
+      hook(_state, bypassSpanInstanceId) {
+        if (
+          !parentActive &&
+          child.getAttribute('data-ws-enclosing') !==
+            String(bypassSpanInstanceId)
+        ) return 4;
+        return 1;
+      },
+    });
+    const parent = element('truncated-span-parent', {
+      hook() {
+        parentActive = true;
+      },
+    });
+    const scenario = buildSpanScenario(parent, child, {
+      includeCompletion: false,
+    });
+    predefine('truncated-span-child', 'truncated-span-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    assert.equal(__openSpanCountForTests(), 1);
+    assert.equal(scenario.spanStart.parentNode, scenario.root);
+
+    fireDomContentLoaded();
+    await flush();
+
+    assert.equal(__isHaltedForTests(), true);
+    assert.equal(__openSpanCountForTests(), 0);
+    assert.equal(__pendingBarrierRootCountForTests(), 0);
+    assert.equal(scenario.spanStart.parentNode, null);
+    assert.equal(hasStreamingAttrs(parent), false);
+    assert.equal(hasStreamingAttrs(child), false);
+    assert.equal(__getLifecycleStateForTests().completed, false);
+  });
+
   test('a nested island is activated exactly once in a single walk', async () => {
     const activated: string[] = [];
     const inner = element('my-inner', { hook() { activated.push('my-inner'); } });
@@ -1731,7 +2687,7 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(__getLifecycleStateForTests().pendingLateActivations, 1);
 
     // Halt via a malformed boundary at the next sequence.
-    const bad = buildRawBoundary(1, '[1,1,0,{', []);
+    const bad = buildRawBoundary(1, '[2,1,0,{', []);
     enqueue(bad.sentinel);
     await flush();
     assert.equal(__isHaltedForTests(), true);
@@ -1768,7 +2724,7 @@ describe('streaming coordinator pipeline', () => {
     await flush();
     detach(outer);
 
-    const bad = buildRawBoundary(1, '[1,1,0,{', []);
+    const bad = buildRawBoundary(1, '[2,1,0,{', []);
     enqueue(bad.sentinel);
     await flush();
 
@@ -1920,7 +2876,7 @@ describe('streaming coordinator pipeline', () => {
 
   test('an illegal record queued behind terminal aborts before hydration-complete', async () => {
     const terminal = buildMarkerless(0, 1, {});
-    const post = buildRawBoundary(1, '[1,1,0,{}]', []);
+    const post = buildRawBoundary(1, '[2,1,0,{}]', []);
 
     // Both records are present before the single pump runs. The terminal must
     // remain tentative until the queue validates the record behind it.
@@ -2162,7 +3118,7 @@ describe('streaming coordinator pipeline', () => {
   test('a rejected (malformed) boundary strips data-ws from its roots, keeping them', async () => {
     const root0 = element('my-ws', { attrs: { 'data-ws': '' }, hook() {} });
     assert.equal(hasWs(root0), true, 'root starts marked as a streamed host');
-    const b = buildRawBoundary(0, '[1,0,0,{', [root0]);
+    const b = buildRawBoundary(0, '[2,0,0,{', [root0]);
 
     enqueue(b.sentinel);
     await flush();
@@ -2193,7 +3149,7 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(hasWs(late), true, 'a deferred undefined-tag root keeps data-ws until activation');
 
     // Halt via a malformed follow-up boundary.
-    const bad = buildRawBoundary(1, '[1,1,0,{', []);
+    const bad = buildRawBoundary(1, '[2,1,0,{', []);
     enqueue(bad.sentinel);
     await flush();
 
diff --git a/packages/webui-framework/src/streaming-protocol.ts b/packages/webui-framework/src/streaming-protocol.ts
index 62f0647fb..137597336 100644
--- a/packages/webui-framework/src/streaming-protocol.ts
+++ b/packages/webui-framework/src/streaming-protocol.ts
@@ -3,10 +3,20 @@
 
 import type { TemplateMeta } from './template.js';
 
-const SUPPORTED_VERSION = 1;
+/** Clean-break component-local streaming protocol version. */
+export const STREAMING_PROTOCOL_VERSION = 2;
 
 /** Boundary-local data carried by one streamed hydration checkpoint. */
 export interface BoundaryBootstrap {
+  /** Compiler declaration that produced this runtime boundary occurrence. */
+  declarationId: number;
+  /**
+   * Nearest unfinished component span enclosing this boundary occurrence.
+   *
+   * When present, only roots carrying the same compiler-owned enclosing-span
+   * attribute may bypass that one ancestor's hydration barrier.
+   */
+  enclosingSpanInstanceId?: number;
   state?: Record<string, unknown>;
   templates?: Record<string, TemplateMeta>;
   inventory?: string;
@@ -23,17 +33,39 @@ export const RECORD_KIND_FINAL_CHECKPOINT = 0;
 export const RECORD_KIND_UPDATABLE_CHECKPOINT = 1;
 /** Apply projected state to one previously committed updatable checkpoint. */
 export const RECORD_KIND_STATE_UPDATE = 2;
+/** Finish one component span and activate its previously unfinished host. */
+export const RECORD_KIND_SPAN_COMPLETION = 3;
 /** Close the response and release all response-scoped references. */
-export const RECORD_KIND_TERMINAL = 3;
+export const RECORD_KIND_TERMINAL = 4;
 
 export type BoundaryRecordKind =
   | typeof RECORD_KIND_FINAL_CHECKPOINT
   | typeof RECORD_KIND_UPDATABLE_CHECKPOINT
   | typeof RECORD_KIND_STATE_UPDATE
+  | typeof RECORD_KIND_SPAN_COMPLETION
   | typeof RECORD_KIND_TERMINAL;
 
+/**
+ * Frozen state and metadata emitted when an unfinished component host closes.
+ *
+ * It deliberately reuses the bootstrap fields that register template and asset
+ * deltas. Unlike a boundary checkpoint it has no boundary declaration identity:
+ * the record target is a runtime SpanInstanceId in a separate kind namespace.
+ */
+export interface SpanCompletionPayload {
+  state?: Record<string, unknown>;
+  templates?: Record<string, TemplateMeta>;
+  inventory?: string;
+  nonce?: string;
+  chain?: unknown[];
+  css?: string[];
+  styles?: string[];
+  [key: string]: unknown;
+}
+
 export type BoundaryRecordPayload =
   | BoundaryBootstrap
+  | SpanCompletionPayload
   | Record<string, unknown>;
 
 /** Compact versioned wire record for one streamed response operation. */
@@ -65,9 +97,9 @@ function invalid(reason: string): ParseBoundaryEnvelopeResult {
  *
  * Past those checks the tuple was written by our own serializer and is not
  * re-validated. That makes `version` load-bearing: any new record kind or tuple
- * shape must bump it, because a stale client reads an unrecognized kind as a
- * final checkpoint. Sequence and target ordering are document state and are
- * checked by the coordinator, which fails the stream closed on a mismatch.
+ * shape must bump it. Sequence, kind, and target ordering are document state
+ * and are checked by the coordinator, which fails the stream closed on a
+ * mismatch.
  */
 export function parseBoundaryEnvelope(text: string): ParseBoundaryEnvelopeResult {
   let parsed: unknown;
@@ -82,7 +114,7 @@ export function parseBoundaryEnvelope(text: string): ParseBoundaryEnvelopeResult
       'boundary envelope must be a 5-element [version, recordSequence, kind, target, payload] array',
     );
   }
-  if (parsed[0] !== SUPPORTED_VERSION) {
+  if (parsed[0] !== STREAMING_PROTOCOL_VERSION) {
     return invalid(
       `unsupported boundary envelope version ${JSON.stringify(parsed[0])}`,
     );
diff --git a/packages/webui-framework/src/streaming-spans.ts b/packages/webui-framework/src/streaming-spans.ts
new file mode 100644
index 000000000..ba63e0d4e
--- /dev/null
+++ b/packages/webui-framework/src/streaming-spans.ts
@@ -0,0 +1,294 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+import {
+  MAX_MARKER_SCAN_NODES,
+  safeRemove,
+  safeRemoveAttribute,
+  SPAN_START_PREFIX,
+} from './streaming-dom.js';
+import type { HydrationRange } from './streaming-dom.js';
+import { STREAMING_SPAN_HOST_ATTR } from './streaming-mode.js';
+
+/** Maximum unfinished component hosts retained by one response. */
+export const MAX_OPEN_SPANS = 128;
+/** Maximum runtime component ancestry crossed by one early boundary. */
+export const MAX_SPAN_NESTING = 32;
+
+interface OpenSpan {
+  readonly host: Element;
+  readonly start: Comment;
+  readonly parentId: number | undefined;
+  openChildren: number;
+}
+
+const openSpans = new Map<number, OpenSpan>();
+// Reused by the single-record pump while it validates one ancestor chain.
+const hostScratch: Element[] = [];
+const idScratch: number[] = [];
+let nextExpectedSpanInstanceId = 0;
+
+/**
+ * Register the unfinished component ancestry enclosing an early boundary.
+ *
+ * Span IDs are allocated where `<!--ws:S-->` starts, outer-first and gapless.
+ * Walking from the boundary render root discovers them inner-first, so the two
+ * module-level scratch arrays are replayed backwards without per-record maps.
+ */
+export function registerEnclosingSpans(
+  renderRoot: Node,
+  enclosingSpanInstanceId: number,
+): string | null {
+  hostScratch.length = 0;
+  idScratch.length = 0;
+  let current: Node | null = renderRoot;
+  let hops = 0;
+  let firstSpan = true;
+
+  while (current && hops < MAX_MARKER_SCAN_NODES) {
+    hops++;
+    const element = elementForNode(current);
+    if (
+      element &&
+      typeof element.hasAttribute === 'function' &&
+      element.hasAttribute(STREAMING_SPAN_HOST_ATTR)
+    ) {
+      if (hostScratch.length >= MAX_SPAN_NESTING) {
+        clearScratch();
+        return `runtime component span nesting exceeds ${MAX_SPAN_NESTING}`;
+      }
+      const id = parseInstanceId(
+        element.getAttribute(STREAMING_SPAN_HOST_ATTR),
+      );
+      if (id === null) {
+        clearScratch();
+        return `invalid ${STREAMING_SPAN_HOST_ATTR} value`;
+      }
+      if (firstSpan && id !== enclosingSpanInstanceId) {
+        clearScratch();
+        return `boundary declares enclosing span ${enclosingSpanInstanceId}, but its nearest spanning ancestor is ${id}`;
+      }
+      firstSpan = false;
+      hostScratch.push(element);
+      idScratch.push(id);
+    }
+    current = parentAcrossRenderRoot(current, element);
+  }
+
+  if (firstSpan) {
+    clearScratch();
+    return `boundary declares enclosing span ${enclosingSpanInstanceId}, but no spanning ancestor was found`;
+  }
+  if (current) {
+    clearScratch();
+    return `spanning ancestor walk exceeds ${MAX_MARKER_SCAN_NODES} nodes`;
+  }
+
+  for (let i = hostScratch.length - 1; i >= 0; i--) {
+    const error = registerSpan(
+      idScratch[i],
+      hostScratch[i],
+      i + 1 < idScratch.length ? idScratch[i + 1] : undefined,
+    );
+    if (error) {
+      clearScratch();
+      return error;
+    }
+  }
+  clearScratch();
+  return null;
+}
+
+function registerSpan(
+  id: number,
+  host: Element,
+  parentId: number | undefined,
+): string | null {
+  const existing = openSpans.get(id);
+  if (existing) {
+    return existing.host === host && existing.parentId === parentId
+      ? null
+      : `span instance ${id} is already open for another ancestry`;
+  }
+  if (id !== nextExpectedSpanInstanceId) {
+    return `expected span instance ${nextExpectedSpanInstanceId}, received ${id}`;
+  }
+  if (openSpans.size >= MAX_OPEN_SPANS) {
+    return `open component span count exceeds ${MAX_OPEN_SPANS}`;
+  }
+  const marker = host.previousSibling;
+  if (
+    marker?.nodeType !== 8 /* COMMENT_NODE */ ||
+    (marker as Comment).data !== `${SPAN_START_PREFIX}${id}`
+  ) {
+    return `missing root-local start marker for span ${id}`;
+  }
+  const parent = parentId === undefined ? undefined : openSpans.get(parentId);
+  if (parentId !== undefined && !parent) {
+    return `parent span ${parentId} is not open`;
+  }
+
+  openSpans.set(id, {
+    host,
+    start: marker as Comment,
+    parentId,
+    openChildren: 0,
+  });
+  if (parent) parent.openChildren++;
+  nextExpectedSpanInstanceId++;
+  return null;
+}
+
+/**
+ * Discover a previously unseen completion target from its concrete marker range.
+ *
+ * Zero-occurrence component spans have no checkpoint to register their
+ * ancestry, so their completion must do the same bounded, root-local discovery.
+ */
+export function registerSpanCompletionTarget(
+  id: number,
+  range: HydrationRange,
+): string | null {
+  if (openSpans.has(id)) return null;
+  if (!range.start || !range.end) {
+    return `span ${id} completion is markerless`;
+  }
+
+  let node = range.start.nextSibling;
+  let hops = 0;
+  while (node && node !== range.end) {
+    if (hops >= MAX_MARKER_SCAN_NODES) {
+      return `span ${id} host lookup exceeds ${MAX_MARKER_SCAN_NODES} nodes`;
+    }
+    hops++;
+    if (node.nodeType === 1 /* ELEMENT_NODE */) {
+      const element = node as Element;
+      if (
+        typeof element.hasAttribute === 'function' &&
+        element.hasAttribute(STREAMING_SPAN_HOST_ATTR)
+      ) {
+        const hostId = parseInstanceId(
+          element.getAttribute(STREAMING_SPAN_HOST_ATTR),
+        );
+        if (hostId === null) {
+          return `invalid ${STREAMING_SPAN_HOST_ATTR} value`;
+        }
+        if (hostId !== id) {
+          return `span completion targets span ${id}, but its host declares span ${hostId}`;
+        }
+        return registerEnclosingSpans(element, id);
+      }
+    }
+    node = node.nextSibling;
+  }
+  return `span completion targets span ${id}, but no spanning host was found inside its markers`;
+}
+
+/** Validate one span completion before mutating or hydrating its range. */
+export function validateSpanCompletion(
+  id: number,
+  range: HydrationRange,
+): string | null {
+  const span = openSpans.get(id);
+  if (!span) return `span completion targets span ${id}, which is not open`;
+  if (span.openChildren !== 0) {
+    return `span ${id} completed before its nested component spans`;
+  }
+  if (
+    !range.start ||
+    !range.end ||
+    range.start !== span.start ||
+    span.host.parentNode !== range.start.parentNode
+  ) {
+    return `span completion markers do not match the open span ${id}`;
+  }
+
+  let node = range.start.nextSibling;
+  let hops = 0;
+  while (node && node !== range.end && node !== span.host) {
+    if (hops >= MAX_MARKER_SCAN_NODES) {
+      return `span ${id} host lookup exceeds ${MAX_MARKER_SCAN_NODES} nodes`;
+    }
+    hops++;
+    node = node.nextSibling;
+  }
+  return node === span.host
+    ? null
+    : `span ${id} host is outside its completion markers`;
+}
+
+/** Release one successfully completed span and its ancestry accounting. */
+export function completeSpan(id: number): void {
+  const span = openSpans.get(id);
+  if (!span) return;
+  openSpans.delete(id);
+  safeRemoveAttribute(span.host, STREAMING_SPAN_HOST_ATTR);
+  if (span.parentId === undefined) return;
+  const parent = openSpans.get(span.parentId);
+  if (parent && parent.openChildren > 0) parent.openChildren--;
+}
+
+/** Fail-closed release of every retained span host and opening marker. */
+export function abandonOpenSpans(): void {
+  for (const span of openSpans.values()) {
+    safeRemoveAttribute(span.host, STREAMING_SPAN_HOST_ATTR);
+    safeRemove(span.start);
+  }
+  openSpans.clear();
+  clearScratch();
+  nextExpectedSpanInstanceId = 0;
+}
+
+function elementForNode(node: Node): Element | null {
+  if (node.nodeType === 1 /* ELEMENT_NODE */) return node as Element;
+  if (node.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
+    return (node as ShadowRoot).host ?? null;
+  }
+  return null;
+}
+
+function parentAcrossRenderRoot(
+  node: Node,
+  element: Element | null,
+): Node | null {
+  let current = node;
+  let currentElement = element;
+  if (node.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
+    const host = (node as ShadowRoot).host;
+    if (!host) return null;
+    current = host;
+    currentElement = host;
+  }
+  if (currentElement?.assignedSlot) return currentElement.assignedSlot;
+  const parent = current.parentNode;
+  if (parent?.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
+    return (parent as ShadowRoot).host ?? null;
+  }
+  return parent;
+}
+
+function parseInstanceId(raw: string | null): number | null {
+  if (raw === null || raw.length === 0) return null;
+  let value = 0;
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i) - 48;
+    if (code < 0 || code > 9) return null;
+    value = value * 10 + code;
+    if (!Number.isSafeInteger(value)) return null;
+  }
+  return String(value) === raw ? value : null;
+}
+
+function clearScratch(): void {
+  hostScratch.length = 0;
+  idScratch.length = 0;
+}
+
+export function openSpanCountForTests(): number {
+  return openSpans.size;
+}
+
+/** Whether terminal validation still has unfinished component spans. */
+export function hasOpenSpans(): boolean {
+  return openSpans.size !== 0;
+}
diff --git a/packages/webui-framework/src/streaming.test.ts b/packages/webui-framework/src/streaming.test.ts
index 10cc6bf2d..e38002a39 100644
--- a/packages/webui-framework/src/streaming.test.ts
+++ b/packages/webui-framework/src/streaming.test.ts
@@ -20,34 +20,35 @@ const { parseBoundaryEnvelope } = await import('./streaming.js');
 describe('parseBoundaryEnvelope', () => {
   test('accepts a well-formed non-terminal boundary envelope', () => {
     const result = parseBoundaryEnvelope(
-      '[1,0,0,0,{"inventory":"01","state":{"count":1},"templates":{"my-counter":{"h":"<button></button>"}}}]',
+      '[2,0,0,0,{"declarationId":7,"inventory":"01","state":{"count":1},"templates":{"my-counter":{"h":"<button></button>"}}}]',
     );
     assert.equal(result.ok, true);
     if (!result.ok) return;
     const [version, sequence, kind, target, payload] = result.envelope;
     const bootstrap = payload as BoundaryBootstrap;
-    assert.equal(version, 1);
+    assert.equal(version, 2);
     assert.equal(sequence, 0);
     assert.equal(kind, 0);
     assert.equal(target, 0);
+    assert.equal(bootstrap.declarationId, 7);
     assert.equal(bootstrap.inventory, '01');
     assert.deepEqual(bootstrap.state, { count: 1 });
     assert.ok(bootstrap.templates?.['my-counter']);
   });
 
   test('accepts the empty terminal boundary envelope', () => {
-    const result = parseBoundaryEnvelope('[1,2,3,0,{}]');
+    const result = parseBoundaryEnvelope('[2,2,4,0,{}]');
     assert.equal(result.ok, true);
     if (!result.ok) return;
     const [, sequence, kind, target, bootstrap] = result.envelope;
     assert.equal(sequence, 2);
-    assert.equal(kind, 3);
+    assert.equal(kind, 4);
     assert.equal(target, 0);
     assert.deepEqual(bootstrap, {});
   });
 
   test('accepts a projected state update record', () => {
-    const result = parseBoundaryEnvelope('[1,2,2,0,{"forecast":"Sunny"}]');
+    const result = parseBoundaryEnvelope('[2,2,2,0,{"forecast":"Sunny"}]');
     assert.equal(result.ok, true);
     if (!result.ok) return;
     const [, sequence, kind, target, patch] = result.envelope;
@@ -57,29 +58,45 @@ describe('parseBoundaryEnvelope', () => {
     assert.deepEqual(patch, { forecast: 'Sunny' });
   });
 
+  test('accepts a component span completion in its separate target namespace', () => {
+    const result = parseBoundaryEnvelope(
+      '[2,3,3,0,{"state":{"parent":"complete"},"inventory":"03"}]',
+    );
+    assert.equal(result.ok, true);
+    if (!result.ok) return;
+    const [, sequence, kind, target, payload] = result.envelope;
+    assert.equal(sequence, 3);
+    assert.equal(kind, 3);
+    assert.equal(target, 0);
+    assert.deepEqual(payload, {
+      state: { parent: 'complete' },
+      inventory: '03',
+    });
+  });
+
   test('rejects invalid JSON', () => {
-    const result = parseBoundaryEnvelope('[1,0,0,0,{');
+    const result = parseBoundaryEnvelope('[2,0,0,0,{');
     assert.equal(result.ok, false);
     if (result.ok) return;
     assert.match(result.reason, /not valid JSON/);
   });
 
   test('rejects a non-array envelope', () => {
-    const result = parseBoundaryEnvelope('{"version":1}');
+    const result = parseBoundaryEnvelope('{"version":2}');
     assert.equal(result.ok, false);
     if (result.ok) return;
     assert.match(result.reason, /5-element/);
   });
 
   test('rejects an envelope with the wrong element count', () => {
-    const result = parseBoundaryEnvelope('[1,0,0,0]');
+    const result = parseBoundaryEnvelope('[2,0,0,0]');
     assert.equal(result.ok, false);
     if (result.ok) return;
     assert.match(result.reason, /5-element/);
   });
 
   test('rejects an unsupported version', () => {
-    const result = parseBoundaryEnvelope('[2,0,0,0,{}]');
+    const result = parseBoundaryEnvelope('[1,0,0,0,{}]');
     assert.equal(result.ok, false);
     if (result.ok) return;
     assert.match(result.reason, /unsupported boundary envelope version/);
@@ -91,11 +108,11 @@ describe('parseBoundaryEnvelope', () => {
   // coordinator instead, which is covered in streaming-pipeline.test.ts.
   test('passes malformed trailing fields through to the coordinator', () => {
     for (const record of [
-      '[1,-1,0,0,{}]',
-      '[1,0,9,0,{}]',
-      '[1,0,0,-1,{}]',
-      '[1,0,0,0,null]',
-      '[1,2,3,0,{"state":{"count":1}}]',
+      '[2,-1,0,0,{}]',
+      '[2,0,9,0,{}]',
+      '[2,0,0,-1,{}]',
+      '[2,0,0,0,null]',
+      '[2,2,4,0,{"state":{"count":1}}]',
     ]) {
       const result = parseBoundaryEnvelope(record);
       assert.equal(result.ok, true, `expected ${record} to parse`);
diff --git a/packages/webui-framework/src/template-element.test.ts b/packages/webui-framework/src/template-element.test.ts
index 04efdaf0f..a3737f20b 100644
--- a/packages/webui-framework/src/template-element.test.ts
+++ b/packages/webui-framework/src/template-element.test.ts
@@ -88,6 +88,7 @@ const {
 /** The activation hook the streaming coordinator invokes on a committed boundary. */
 const STREAMING_BOUNDARY_ACTIVATE = Symbol.for('microsoft.webui.boundaryActivate');
 const STREAMING_BOUNDARY_ABANDON = Symbol.for('microsoft.webui.boundaryAbandon');
+const PENDING_ROOT_CONNECTED = Symbol.for('microsoft.webui.pendingRootConnected');
 
 /** Register template metadata for a tag exactly like `registerTemplateData()`. */
 function registerTemplate(tag: string): void {
@@ -198,6 +199,53 @@ describe('TemplateElement.connectedCallback — streamed-host (data-ws) deferral
     }
   });
 
+  test('lets a pending-definition resume own activation without replaying ordinary bootstrap state', () => {
+    const tag = 'test-pending-resume-widget';
+    registerTemplate(tag);
+    let ordinaryDeferrals = 0;
+    let received: Record<string, unknown> | undefined;
+
+    class PendingResumeElement extends TemplateElement {
+      protected override $didDeferSSRHydration(): void {
+        ordinaryDeferrals++;
+      }
+    }
+
+    const el = new PendingResumeElement();
+    const raw = el as unknown as {
+      tagName: string;
+      $deferredSSR: boolean;
+      $hydrated: boolean;
+      setAttribute(name: string, value: string): void;
+      removeAttribute(name: string): void;
+      [PENDING_ROOT_CONNECTED]?: () => void;
+      [STREAMING_BOUNDARY_ACTIVATE](
+        state?: Record<string, unknown>,
+      ): number;
+    };
+    raw.tagName = tag;
+    raw.$hydrated = true;
+    raw.setAttribute('data-ws', '');
+    raw[PENDING_ROOT_CONNECTED] = () => {
+      received = { status: 'ready' };
+      assert.equal(
+        raw[STREAMING_BOUNDARY_ACTIVATE](received),
+        1,
+      );
+      raw.removeAttribute('data-ws');
+    };
+
+    el.connectedCallback();
+
+    assert.deepEqual(received, { status: 'ready' });
+    assert.equal(raw.$deferredSSR, false);
+    assert.equal(
+      ordinaryDeferrals,
+      0,
+      'ordinary deferral would replay older page bootstrap state after the queued update',
+    );
+  });
+
   test('warns for an UNMARKED client-created element with missing metadata (no silent defer)', () => {
     resetStreamingModeForTests();
 
@@ -342,6 +390,92 @@ describe('TemplateElement — streamed-host activation ownership', () => {
     assert.deepEqual(received, { detached: true });
   });
 
+  test('a matching compiler span marker bypasses exactly the unfinished spanning ancestor', () => {
+    const parentTag = 'test-spanning-parent';
+    const childTag = 'test-early-span-child';
+    registerTemplate(parentTag);
+    registerTemplate(childTag);
+
+    const parent = new TemplateElement();
+    const parentRaw = parent as unknown as {
+      tagName: string;
+      parentElement: Element | null;
+      $deferredSSR: boolean;
+      setAttribute(name: string, value: string): void;
+    };
+    parentRaw.tagName = parentTag;
+    parentRaw.parentElement = null;
+    parentRaw.$deferredSSR = true;
+    parentRaw.setAttribute('data-ws-span', '4');
+
+    const child = new TemplateElement();
+    const childRaw = child as unknown as {
+      tagName: string;
+      parentElement: Element;
+      $deferredSSR: boolean;
+      $hydrated: boolean;
+      setAttribute(name: string, value: string): void;
+      [STREAMING_BOUNDARY_ACTIVATE](
+        state?: Record<string, unknown>,
+        bypassSpanInstanceId?: number,
+      ): number;
+    };
+    childRaw.tagName = childTag;
+    childRaw.parentElement = parent as unknown as Element;
+    childRaw.setAttribute('data-ws', '');
+    childRaw.setAttribute('data-ws-enclosing', '4');
+    child.connectedCallback();
+    childRaw.$hydrated = true;
+
+    assert.equal(
+      childRaw[STREAMING_BOUNDARY_ACTIVATE]({ child: true }, 4),
+      1,
+    );
+    assert.equal(childRaw.$deferredSSR, false);
+  });
+
+  test('a mismatched compiler span marker preserves the parent-first barrier', () => {
+    const parentTag = 'test-mismatch-span-parent';
+    const childTag = 'test-mismatch-span-child';
+    registerTemplate(parentTag);
+    registerTemplate(childTag);
+
+    const parent = new TemplateElement();
+    const parentRaw = parent as unknown as {
+      tagName: string;
+      parentElement: Element | null;
+      $deferredSSR: boolean;
+      setAttribute(name: string, value: string): void;
+    };
+    parentRaw.tagName = parentTag;
+    parentRaw.parentElement = null;
+    parentRaw.$deferredSSR = true;
+    parentRaw.setAttribute('data-ws-span', '4');
+
+    const child = new TemplateElement();
+    const childRaw = child as unknown as {
+      tagName: string;
+      parentElement: Element;
+      $deferredSSR: boolean;
+      setAttribute(name: string, value: string): void;
+      [STREAMING_BOUNDARY_ACTIVATE](
+        state?: Record<string, unknown>,
+        bypassSpanInstanceId?: number,
+      ): number;
+    };
+    childRaw.tagName = childTag;
+    childRaw.parentElement = parent as unknown as Element;
+    childRaw.setAttribute('data-ws', '');
+    childRaw.setAttribute('data-ws-enclosing', '5');
+    child.connectedCallback();
+
+    assert.equal(
+      childRaw[STREAMING_BOUNDARY_ACTIVATE]({ child: true }, 4),
+      4,
+    );
+    assert.equal(childRaw.$deferredSSR, true);
+  });
+
   test('authored components do not globally defer unmarked SSR-shaped light DOM', () => {
     const el = new TemplateElement() as unknown as {
       $shouldDeferSSRHydration(): boolean;
diff --git a/packages/webui-framework/src/template-element.ts b/packages/webui-framework/src/template-element.ts
index 447a836d6..77d7126c2 100644
--- a/packages/webui-framework/src/template-element.ts
+++ b/packages/webui-framework/src/template-element.ts
@@ -60,7 +60,9 @@ import { hydrationStart, hydrationEnd } from './lifecycle.js';
 import {
   isStreamingHydrationMode,
   PENDING_ROOT_CONNECTED,
+  STREAMING_ENCLOSING_SPAN_ATTR,
   STREAMED_HOST_ATTR,
+  STREAMING_SPAN_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
 import {
@@ -189,6 +191,7 @@ const STREAMING_BOUNDARY_ABANDON = Symbol.for('microsoft.webui.boundaryAbandon')
 const ACTIVATION_ACTIVATED = 1;
 const ACTIVATION_STATIC_HOST_OPT_OUT = 2;
 const ACTIVATION_MISSING_TEMPLATE = 3;
+const ACTIVATION_ANCESTOR_BARRIER = 4;
 
 const templateMetaByCtor = new WeakMap<Function, TemplateMeta>();
 const pendingAncestorDescendants = new WeakMap<Element, TemplateElement[]>();
@@ -424,7 +427,10 @@ export class TemplateElement extends HTMLElement {
    * state, handed straight through to hydration instead of via the global
    * `window.__webui.state` handoff.
    */
-  [STREAMING_BOUNDARY_ACTIVATE](state?: Record<string, unknown>): number {
+  [STREAMING_BOUNDARY_ACTIVATE](
+    state?: Record<string, unknown>,
+    bypassSpanInstanceId?: number,
+  ): number {
     // `customElements.upgrade()` installs this class on detached roots without
     // invoking connectedCallback(). Preserve the same marker-driven dormant
     // state those roots would have entered while connected before activation.
@@ -441,13 +447,19 @@ export class TemplateElement extends HTMLElement {
     }
     this.$meta = meta;
     if (!this.$shouldActivateOnBoundaryCommit()) return ACTIVATION_STATIC_HOST_OPT_OUT;
-    const ancestor = this.$nearestHydrationBarrier();
+    const ancestor = this.$nearestHydrationBarrier(bypassSpanInstanceId);
     if (ancestor) {
       this.$deferredByAncestor = true;
       this.$ancestorBoundaryState = state;
       this.$hasAncestorBoundaryState = true;
       this.$registerWithHydrationBarrier(ancestor);
-      return ACTIVATION_ACTIVATED;
+      return ACTIVATION_ANCESTOR_BARRIER;
+    }
+    if (this.$deferredByAncestor) {
+      this.$detachDeferredAncestor();
+      this.$deferredByAncestor = undefined;
+      this.$ancestorBoundaryState = undefined;
+      this.$hasAncestorBoundaryState = undefined;
     }
     this.$activatingDeferredSSR = true;
     try {
@@ -546,7 +558,14 @@ export class TemplateElement extends HTMLElement {
       this.$deferredSSR = true;
       this.$ready = true;
       const resume = (this as unknown as { [PENDING_ROOT_CONNECTED]?: () => void })[PENDING_ROOT_CONNECTED];
-      if (typeof resume === 'function') resume.call(this);
+      if (typeof resume === 'function') {
+        // The coordinator owns every continuation after a pending definition:
+        // eager activation, span-barrier registration, lazy observation, or
+        // static-host opt-out. Re-entering ordinary deferral here can replay
+        // older page bootstrap state over a queued boundary update.
+        resume.call(this);
+        return;
+      }
       this.$didDeferSSRHydration();
       return;
     }
@@ -934,7 +953,16 @@ export class TemplateElement extends HTMLElement {
     return this.$meta ?? this.$templateMeta();
   }
 
-  private $nearestHydrationBarrier(): Element | undefined {
+  private $nearestHydrationBarrier(
+    bypassSpanInstanceId?: number,
+  ): Element | undefined {
+    const bypassSpan = bypassSpanInstanceId === undefined
+      ? undefined
+      : String(bypassSpanInstanceId);
+    const mayBypass = bypassSpan !== undefined &&
+      this.getAttribute(STREAMING_ENCLOSING_SPAN_ATTR) ===
+        bypassSpan;
+    let bypassed = false;
     let current: Element = this;
     while (true) {
       let parent: Element | null =
@@ -952,6 +980,16 @@ export class TemplateElement extends HTMLElement {
           : null;
       }
       if (!parent) return undefined;
+      if (
+        mayBypass &&
+        !bypassed &&
+        parent.getAttribute(STREAMING_SPAN_HOST_ATTR) ===
+          bypassSpan
+      ) {
+        bypassed = true;
+        current = parent;
+        continue;
+      }
       if (parent instanceof TemplateElement) {
         const parentMeta = parent.$meta ?? parent.$templateMeta();
         if (parentMeta?.th) {
@@ -1072,6 +1110,13 @@ export class TemplateElement extends HTMLElement {
     const boundaryState = this.$ancestorBoundaryState;
     this.$hasAncestorBoundaryState = undefined;
     this.$ancestorBoundaryState = undefined;
+    const resume = (
+      this as unknown as { [PENDING_ROOT_CONNECTED]?: () => void }
+    )[PENDING_ROOT_CONNECTED];
+    if (typeof resume === 'function') {
+      resume.call(this);
+      return;
+    }
     const meta = this.$meta;
     if (meta && this.$shouldDeferSSRHydration(meta)) {
       if (hasBoundaryState) {
diff --git a/packages/webui/README.md b/packages/webui/README.md
index 8f95759df..0dd9b3e32 100644
--- a/packages/webui/README.md
+++ b/packages/webui/README.md
@@ -165,23 +165,31 @@ protocol.renderStream(state, (chunk) => {
 
 ### `protocol.streamResponse(options?): StreamingSession`
 
-Opens a progressive streaming session for an entry that declares `<boundary>`
-directives. Unlike `renderStream`, the session **returns** each chunk, so your
-server keeps the socket, the write order, and the backpressure contract.
+Opens a runtime-discovered progressive session. Unlike `renderStream`, each
+session call returns bytes so your server keeps the socket and backpressure.
 
 ```js
-import { once } from 'node:events';
-
-const session = protocol.streamResponse({ entry: 'index.html', requestPath: '/' });
-const status = session.boundary('job-status');   // resolve names once
+const session = protocol.streamResponse({
+  entry: 'index.html',
+  requestPath: '/',
+});
 
 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-await write(res, session.writeShell(baseState));
-await write(res, session.writeBoundary(status, statusState, 'updatable'));
-
-// Patches an already-hydrated island on this same response.
-await write(res, session.update(status, { jobState: 'succeeded' }));
-res.end(session.finish({}));
+let step = session.start(initialState);
+await write(res, step.bytes);
+
+while (!step.done) {
+  const boundary = step.boundary;
+  if (!boundary) throw new Error('unfinished step has no boundary');
+  const state = await loadBoundaryState(
+    boundary.owner,
+    boundary.name,
+    boundary.key,
+  );
+  step = session.resume(boundary.instanceId, state, 'final');
+  await write(res, step.bytes);
+}
+res.end();
 
 async function write(res, chunk) {
   if (res.write(chunk)) return;
@@ -204,17 +212,14 @@ async function write(res, chunk) {
 
 | Member | Returns | Description |
 |--------|---------|-------------|
-| `boundary(name)` | `number` | Integer handle for an authored boundary name |
-| `boundaryCount` | `number` | Boundaries declared by the entry |
-| `finished` | `boolean` | Whether `finish()` has been called |
-| `writeShell(state)` | `Buffer` | Document prefix through the first semantic flush |
-| `writeBoundary(id, state, mode?)` | `Buffer` | One boundary's markup and checkpoint (`'final'` \| `'updatable'`) |
-| `update(id, state)` | `Buffer` | Projected state patch to an updatable boundary |
-| `finish(state)` | `Buffer` | Tail checkpoint, terminal record, and document suffix |
-
-Ordering is enforced. A rejected call throws and leaves the session usable, so
-invalid state does not cost you the response. Sessions are independent — hold
-one per in-flight request.
+| `start(state)` | `StreamStep` | Bytes through the first occurrence or terminal |
+| `resume(instanceId, state, mode?)` | `StreamStep` | Commit the pending occurrence and continue (`'final'` \| `'updatable'`) |
+| `update(instanceId, patch)` | `Buffer` | Projected state for a committed updatable occurrence |
+
+`StreamStep` contains `bytes`, `done`, and optional
+`{ instanceId, declarationId, owner, name, key }`. The completed step already
+contains tail and terminal bytes. Updates insert no markup and never rerun
+hydration. Sessions are single-driver and independent; hold one per request.
 
 ### `inspect(protocol: Buffer): string`
 
diff --git a/packages/webui/src/index.ts b/packages/webui/src/index.ts
index 234f60462..649106c7d 100644
--- a/packages/webui/src/index.ts
+++ b/packages/webui/src/index.ts
@@ -96,6 +96,30 @@ export interface ProtocolOptions {
  */
 export type BoundaryMode = "final" | "updatable";
 
+/** A runtime-discovered boundary occurrence waiting to be resumed. */
+export interface BoundaryDescriptor {
+  /** Gapless response-local occurrence ID passed to `resume()` and `update()`. */
+  instanceId: number;
+  /** Stable build-local ID for the authored boundary declaration. */
+  declarationId: number;
+  /** Entry or component template that owns the declaration. */
+  owner: string;
+  /** Free-form authored boundary name. */
+  name: string;
+  /** Evaluated repeat key, preserving its authored JSON type. */
+  key?: string | number;
+}
+
+/** Bytes and continuation state produced by `start()` and `resume()`. */
+export interface StreamStep {
+  /** Complete bytes produced by this semantic step. */
+  bytes: Buffer;
+  /** Whether the document tail and terminal record have been emitted. */
+  done: boolean;
+  /** Next runtime boundary occurrence, absent when `done` is true. */
+  boundary?: BoundaryDescriptor;
+}
+
 /** Per-response settings for a host-driven streaming session. */
 export interface StreamOptions {
   /** Fragment ID to start rendering from (default: "index.html"). */
@@ -189,13 +213,23 @@ interface NativeProtocol {
 }
 
 interface NativeStreamingSession {
-  readonly boundaryCount: number;
-  readonly finished: boolean;
-  boundary(name: string): number;
-  writeShell(stateJson: string): Buffer;
-  writeBoundary(boundary: number, stateJson: string, mode?: BoundaryMode): Buffer;
-  update(boundary: number, stateJson: string): Buffer;
-  finish(stateJson: string): Buffer;
+  start(stateJson: string): NativeStreamStep;
+  resume(instanceId: number, stateJson: string, mode?: BoundaryMode): NativeStreamStep;
+  update(instanceId: number, patchJson: string): Buffer;
+}
+
+interface NativeBoundaryDescriptor {
+  instanceId: number;
+  declarationId: number;
+  owner: string;
+  name: string;
+  key?: string | number | null;
+}
+
+interface NativeStreamStep {
+  bytes: Buffer;
+  done: boolean;
+  boundary?: NativeBoundaryDescriptor | null;
 }
 
 let addon: NativeAddon | undefined;
@@ -359,24 +393,23 @@ export class Protocol {
  * caller decides when they reach the socket and can await `drain` between
  * chunks. The session holds no transport and never blocks on one.
  *
- * Ordering is enforced: the shell first, then each boundary exactly once in
- * declaration order, `update()` only after its boundary commits as
- * `updatable`, and `finish()` last. A violation throws before any byte is
- * produced.
+ * `start()` discovers the first runtime occurrence. Each `resume()` commits the
+ * pending occurrence and discovers the next one, or returns a completed step
+ * containing the document tail and terminal record. `update()` targets a
+ * previously committed `updatable` occurrence.
  *
  * ```js
  * const session = protocol.streamResponse({ requestPath: req.url });
- * const weather = session.boundary("weather-shell");
- *
- * res.write(session.writeShell(shellState));
- * res.write(session.writeBoundary(weather, weatherShell, "updatable"));
+ * let step = session.start(shellState);
+ * res.write(step.bytes);
  *
- * const forecast = await forecastReady;
- * if (!res.write(session.update(weather, forecast))) {
- *   await once(res, "drain");
+ * while (!step.done) {
+ *   const boundary = step.boundary;
+ *   const state = await loadBoundary(boundary.owner, boundary.name, boundary.key);
+ *   step = session.resume(boundary.instanceId, state);
+ *   res.write(step.bytes);
  * }
- *
- * res.end(session.finish({}));
+ * res.end();
  * ```
  */
 export class StreamingSession {
@@ -387,49 +420,51 @@ export class StreamingSession {
     this.#native = native;
   }
 
-  /** Number of compile-time boundaries declared by this entry. */
-  get boundaryCount(): number {
-    return this.#native.boundaryCount;
-  }
-
-  /** Whether the terminal record has been written. */
-  get finished(): boolean {
-    return this.#native.finished;
+  /** Render until the first runtime boundary occurrence or terminal. */
+  start(state: object | string): StreamStep {
+    return toStreamStep(this.#native.start(toStateJson(state)));
   }
 
-  /**
-   * Resolve an authored boundary name to a stable integer handle.
-   *
-   * Resolve once outside the write loop; reusing the handle costs nothing.
-   * An unknown name throws with the valid names and a suggestion.
-   */
-  boundary(name: string): number {
-    return this.#native.boundary(name);
-  }
-
-  /** Render everything before the first boundary. */
-  writeShell(state: object | string): Buffer {
-    return this.#native.writeShell(toStateJson(state));
-  }
-
-  /** Render and commit the next boundary in declaration order. */
-  writeBoundary(
-    boundary: number,
+  /** Commit the pending occurrence and advance to the next one or terminal. */
+  resume(
+    instanceId: number,
     state: object | string,
     mode: BoundaryMode = "final",
-  ): Buffer {
-    return this.#native.writeBoundary(boundary, toStateJson(state), mode);
+  ): StreamStep {
+    return toStreamStep(this.#native.resume(instanceId, toStateJson(state), mode));
   }
 
-  /** Push a projected state patch to a committed `updatable` boundary. */
-  update(boundary: number, state: object | string): Buffer {
-    return this.#native.update(boundary, toStateJson(state));
+  /** Push a projected state patch to a committed `updatable` occurrence. */
+  update(instanceId: number, patch: object | string): Buffer {
+    return this.#native.update(instanceId, toStateJson(patch));
   }
+}
+
+function toStreamStep(step: NativeStreamStep): StreamStep {
+  const boundary = step.boundary;
+  if (!boundary) {
+    return { bytes: step.bytes, done: step.done };
+  }
+  return {
+    bytes: step.bytes,
+    done: step.done,
+    boundary: toBoundaryDescriptor(boundary),
+  };
+}
 
-  /** Render the document tail and emit the terminal record. */
-  finish(state: object | string = {}): Buffer {
-    return this.#native.finish(toStateJson(state));
+function toBoundaryDescriptor(
+  boundary: NativeBoundaryDescriptor,
+): BoundaryDescriptor {
+  const descriptor: BoundaryDescriptor = {
+    instanceId: boundary.instanceId,
+    declarationId: boundary.declarationId,
+    owner: boundary.owner,
+    name: boundary.name,
+  };
+  if (boundary.key !== undefined && boundary.key !== null) {
+    descriptor.key = boundary.key;
   }
+  return descriptor;
 }
 
 function toStateJson(state: object | string): string {
diff --git a/packages/webui/test/integration.test.ts b/packages/webui/test/integration.test.ts
index 49a59efd0..d0c0fd042 100644
--- a/packages/webui/test/integration.test.ts
+++ b/packages/webui/test/integration.test.ts
@@ -13,7 +13,11 @@ import {
   inspect,
   Protocol,
 } from '@microsoft/webui';
-import type { ComponentTemplatesResponse } from '@microsoft/webui';
+import type {
+  BoundaryDescriptor,
+  ComponentTemplatesResponse,
+  StreamStep,
+} from '@microsoft/webui';
 import { existsSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { createServer, get } from 'node:http';
 import type { IncomingMessage, ServerResponse } from 'node:http';
@@ -77,6 +81,26 @@ before(() => {
   </boundary>
 </body>
 </html>
+`);
+  writeFileSync(join(appDir, 'index-stream-repeat.html'), `
+<!DOCTYPE html>
+<html>
+<head><script type="module" async src="./index.js"></script></head>
+<body>
+  <for each="item in items">
+    <boundary name="row" key="{{item.id}}">
+      <stream-item label="{{item.label}}"></stream-item>
+    </boundary>
+  </for>
+</body>
+</html>
+`);
+  writeFileSync(join(appDir, 'index-stream-empty.html'), `
+<!DOCTYPE html>
+<html>
+<head><script type="module" async src="./index.js"></script></head>
+<body><p>boundary-free</p></body>
+</html>
 `);
 });
 
@@ -250,134 +274,128 @@ describe('renderStream', () => {
 describe('streamResponse', () => {
   const streamOptions = { entry: 'index-stream.html', requestPath: '/' };
 
-  function streamingProtocol(): Protocol {
+  function streamingProtocol(entry = 'index-stream.html'): Protocol {
     return new Protocol(
-      build({ appDir, entry: 'index-stream.html', plugin: 'webui' }).protocol,
+      build({ appDir, entry, plugin: 'webui' }).protocol,
     );
   }
 
-  test('returns one chunk per host call and reassembles a complete document', () => {
+  function boundaryOf(step: StreamStep): BoundaryDescriptor {
+    assert.ok(step.boundary);
+    return step.boundary;
+  }
+
+  test('discovers runtime boundary descriptors from start', () => {
     const session = streamingProtocol().streamResponse(streamOptions);
-    assert.equal(session.boundaryCount, 2);
-
-    const first = session.boundary('first');
-    const second = session.boundary('second');
-    assert.equal(first, 0);
-    assert.equal(second, 1);
-
-    const chunks = [
-      session.writeShell({}),
-      session.writeBoundary(first, { firstLabel: 'alpha' }, 'updatable'),
-      session.update(first, { firstLabel: 'alpha-2' }),
-      session.writeBoundary(second, { secondLabel: 'beta' }),
-      session.finish({}),
-    ];
-
-    for (const chunk of chunks) {
-      assert.ok(Buffer.isBuffer(chunk));
-    }
-    assert.equal(session.finished, true);
+    const step = session.start({});
+    const boundary = boundaryOf(step);
+
+    assert.ok(Buffer.isBuffer(step.bytes));
+    assert.equal(step.done, false);
+    assert.equal(boundary.instanceId, 0);
+    assert.equal(typeof boundary.declarationId, 'number');
+    assert.equal(boundary.owner, 'index-stream.html');
+    assert.equal(boundary.name, 'first');
+    assert.equal(boundary.key, undefined);
+  });
 
-    const html = Buffer.concat(chunks).toString('utf8');
+  test('resume discovers the next boundary and returns a completed final step', () => {
+    const session = streamingProtocol().streamResponse(streamOptions);
+    const start = session.start({});
+    const first = boundaryOf(start);
+    const next = session.resume(first.instanceId, { firstLabel: 'alpha' });
+    const second = boundaryOf(next);
+
+    assert.ok(Buffer.isBuffer(next.bytes));
+    assert.equal(next.done, false);
+    assert.equal(second.instanceId, 1);
+    assert.equal(second.name, 'second');
+
+    const done = session.resume(second.instanceId, { secondLabel: 'beta' });
+    assert.ok(Buffer.isBuffer(done.bytes));
+    assert.equal(done.done, true);
+    assert.equal(done.boundary, undefined);
+
+    const html = Buffer.concat([start.bytes, next.bytes, done.bytes]).toString('utf8');
     assert.ok(html.includes('<!DOCTYPE html>'));
     assert.ok(html.includes('alpha'));
-    assert.ok(html.includes('alpha-2'));
     assert.ok(html.includes('beta'));
-    assert.ok(html.trimEnd().endsWith('</html>'));
+    assert.equal(html.match(/class="item"/g)?.length, 2);
+    assert.ok(html.includes('</html>'));
   });
 
-  test('renders every boundary exactly once into the reassembled document', () => {
-    const protocol = streamingProtocol();
-    const state = { firstLabel: 'alpha', secondLabel: 'beta' };
-
-    const session = protocol.streamResponse(streamOptions);
-    const streamed = Buffer.concat([
-      session.writeShell(state),
-      session.writeBoundary(session.boundary('first'), state),
-      session.writeBoundary(session.boundary('second'), state),
-      session.finish(state),
-    ]).toString('utf8');
-
-    // Streaming reorders delivery, never content.
-    assert.equal(streamed.match(/class="item"/g)?.length, 2);
+  test('preserves string and number repeat keys', () => {
+    const entry = 'index-stream-repeat.html';
+    const session = streamingProtocol(entry).streamResponse({
+      entry,
+      requestPath: '/',
+    });
+    const state = {
+      items: [
+        { id: 'alpha', label: 'first' },
+        { id: 20, label: 'second' },
+      ],
+    };
+
+    const start = session.start(state);
+    const first = boundaryOf(start);
+    assert.equal(first.key, 'alpha');
+
+    const next = session.resume(first.instanceId, {});
+    const second = boundaryOf(next);
+    assert.equal(second.instanceId, 1);
+    assert.equal(second.declarationId, first.declarationId);
+    assert.equal(second.key, 20);
+
+    const done = session.resume(second.instanceId, {});
+    assert.equal(done.done, true);
   });
 
-  test('rejects boundaries written out of declaration order', () => {
+  test('updates a committed updatable occurrence', () => {
     const session = streamingProtocol().streamResponse(streamOptions);
-    session.writeShell({});
-    assert.throws(
-      () => session.writeBoundary(session.boundary('second'), { secondLabel: 'beta' }),
-      /order/i,
+    const start = session.start({});
+    const first = boundaryOf(start);
+    const next = session.resume(
+      first.instanceId,
+      { firstLabel: 'alpha' },
+      'updatable',
     );
-  });
+    const update = session.update(first.instanceId, {
+      firstLabel: 'alpha-2',
+    });
 
-  test('rejects updates to a boundary committed as final', () => {
-    const session = streamingProtocol().streamResponse(streamOptions);
-    const first = session.boundary('first');
-    session.writeShell({});
-    session.writeBoundary(first, { firstLabel: 'alpha' });
-    assert.throws(() => session.update(first, { firstLabel: 'alpha-2' }), /updatable/i);
-  });
+    assert.ok(Buffer.isBuffer(update));
+    assert.match(update.toString('utf8'), /alpha-2/);
 
-  test('rejects an unknown boundary name with the valid names', () => {
-    const session = streamingProtocol().streamResponse(streamOptions);
-    assert.throws(() => session.boundary('firts'), /first/);
+    const second = boundaryOf(next);
+    const done = session.resume(second.instanceId, { secondLabel: 'beta' });
+    assert.equal(done.done, true);
   });
 
-  test('rejects an unknown boundary mode', () => {
-    const session = streamingProtocol().streamResponse(streamOptions);
-    session.writeShell({});
-    assert.throws(
-      () =>
-        session.writeBoundary(
-          session.boundary('first'),
-          { firstLabel: 'alpha' },
-          'sometimes' as 'final',
-        ),
-      /unknown boundary mode/,
-    );
-  });
+  test('start completes a boundary-free document', () => {
+    const entry = 'index-stream-empty.html';
+    const session = streamingProtocol(entry).streamResponse({
+      entry,
+      requestPath: '/',
+    });
+    const done = session.start({});
 
-  test('rejects every call after finish', () => {
-    const session = streamingProtocol().streamResponse(streamOptions);
-    session.writeShell({});
-    session.writeBoundary(session.boundary('first'), { firstLabel: 'alpha' });
-    session.writeBoundary(session.boundary('second'), { secondLabel: 'beta' });
-    session.finish({});
-
-    assert.equal(session.finished, true);
-    assert.throws(() => session.writeShell({}), /already finished/);
-    assert.throws(() => session.finish({}), /already finished/);
+    assert.ok(Buffer.isBuffer(done.bytes));
+    assert.equal(done.done, true);
+    assert.equal(done.boundary, undefined);
+    assert.match(done.bytes.toString('utf8'), /boundary-free/);
+    assert.ok(done.bytes.toString('utf8').includes('</html>'));
   });
 
-  test('an out-of-order finish leaves the session usable', () => {
+  test('does not expose legacy wrapper members', () => {
     const session = streamingProtocol().streamResponse(streamOptions);
-    session.writeShell({});
-    session.writeBoundary(session.boundary('first'), { firstLabel: 'alpha' });
-
-    // Rejected before any byte is written, so the open response survives.
-    assert.throws(() => session.finish({}), /every boundary must be committed/);
-    assert.equal(session.finished, false);
-
-    session.writeBoundary(session.boundary('second'), { secondLabel: 'beta' });
-    assert.ok(session.finish({}).length > 0);
-    assert.equal(session.finished, true);
-  });
-
-  test('keeps concurrent sessions independent', () => {
-    const protocol = streamingProtocol();
-    const a = protocol.streamResponse(streamOptions);
-    const b = protocol.streamResponse(streamOptions);
-
-    a.writeShell({});
-    b.writeShell({});
-    const fromA = a.writeBoundary(a.boundary('first'), { firstLabel: 'from-a' }).toString('utf8');
-    const fromB = b.writeBoundary(b.boundary('first'), { firstLabel: 'from-b' }).toString('utf8');
-
-    assert.ok(fromA.includes('from-a'));
-    assert.ok(!fromA.includes('from-b'));
-    assert.ok(fromB.includes('from-b'));
-    assert.ok(!fromB.includes('from-a'));
+    const members = session as unknown as Record<string, unknown>;
+    assert.equal(members.boundary, undefined);
+    assert.equal(members.boundaryCount, undefined);
+    assert.equal(members.finished, undefined);
+    assert.equal(members.writeShell, undefined);
+    assert.equal(members.writeBoundary, undefined);
+    assert.equal(members.finish, undefined);
   });
 });
 
@@ -409,18 +427,21 @@ describe('streamResponse over node:http', () => {
     const server = createServer((_request, response) => {
       void (async () => {
         const session = protocol.streamResponse(streamOptions);
-        const first = session.boundary('first');
-        const second = session.boundary('second');
 
         response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        await write(response, session.writeShell({}));
-        await write(response, session.writeBoundary(first, { firstLabel: 'alpha' }));
+        let step = session.start({});
+        await write(response, step.bytes);
+        assert.ok(step.boundary);
+        step = session.resume(step.boundary.instanceId, { firstLabel: 'alpha' });
+        await write(response, step.bytes);
 
         // Only reached if the client already has the bytes above.
         await clientSawFirstBoundary;
 
-        await write(response, session.writeBoundary(second, { secondLabel: 'beta' }));
-        response.end(session.finish({}));
+        assert.ok(step.boundary);
+        step = session.resume(step.boundary.instanceId, { secondLabel: 'beta' });
+        assert.equal(step.done, true);
+        response.end(step.bytes);
       })().catch((error: unknown) => {
         serverError = error;
         response.destroy();
@@ -456,7 +477,7 @@ describe('streamResponse over node:http', () => {
       assert.equal(sawTailBeforeRelease, false);
       assert.ok(received.includes('alpha'));
       assert.ok(received.includes('beta'));
-      assert.ok(received.trimEnd().endsWith('</html>'));
+      assert.ok(received.includes('</html>'));
     } finally {
       server.close();
       await once(server, 'close');

From 710b87b260a33db47ccb2f4875dbe35bc23e05be Mon Sep 17 00:00:00 2001
From: Mohamed Mansour <mmansour@microsoft.com>
Date: Thu, 20 Aug 2026 01:05:27 -0700
Subject: [PATCH 2/5] perf: optimize streaming continuation hot paths

Cache fragment records, reuse projection buffers, avoid redundant state overlays, remove plan locking, and reduce optional browser streaming code.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 DESIGN.md                                     |   5 +-
 .../benches/streaming_hydration_bench.rs      | 102 +++++
 crates/webui-handler/src/lib.rs               | 166 ++++++--
 crates/webui-handler/src/route_handler.rs     | 309 ++++++++++++++-
 crates/webui-handler/src/route_renderer.rs    |  12 +-
 .../webui-handler/src/streaming/checkpoint.rs | 105 ++---
 crates/webui-handler/src/streaming/mod.rs     |   9 +-
 crates/webui-handler/src/streaming/session.rs | 350 +++++++++++++++-
 crates/webui-handler/src/streaming/state.rs   |  47 ++-
 crates/webui-handler/src/streaming/vm.rs      | 123 ++++--
 .../streaming-browser-bench/README.md         |  30 +-
 .../tests/hydration_matrix.spec.ts            |  83 +++-
 .../tests/lib/fixtures.ts                     |  22 +-
 packages/webui-framework/README.md            |   7 +
 .../src/index-decoupling.test.ts              |  63 +++
 .../src/streaming-activation.ts               |  11 +-
 .../webui-framework/src/streaming-cleanup.ts  | 129 +++---
 .../src/streaming-coordinator.ts              | 196 ++++-----
 .../webui-framework/src/streaming-deferred.ts | 373 +++++++++---------
 packages/webui-framework/src/streaming-dom.ts |  92 +++--
 .../webui-framework/src/streaming-mode.ts     |  21 +-
 .../src/streaming-pipeline.test.ts            | 164 ++++----
 .../webui-framework/src/streaming-spans.ts    | 186 +++++----
 .../src/template-element.test.ts              |  82 +++-
 .../webui-framework/src/template-element.ts   | 110 +++---
 .../lazy-hydration/lazy-hydration.spec.ts     |   8 +-
 26 files changed, 2010 insertions(+), 795 deletions(-)

diff --git a/DESIGN.md b/DESIGN.md
index b376cc1fe..5547c556a 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -2178,7 +2178,10 @@ regions while the document is still loading.
    lexical locals, component attributes, route state, inventories, and
    continuation frames. Resume state overlays the frozen parent projection for
    selected keys. Expression resolution remains lexical first, then the
-   boundary resume overlay, then frozen parent state.
+   boundary resume overlay, then frozen parent state. The one-shot
+   `WebUIHandler::render_streaming` helper resumes every occurrence directly
+   against its original start snapshot, avoiding redundant overlays when one
+   state value drives the complete response.
 6. **Generated component spans.** When traversal suspends inside a reusable
    component, the handler opens a generated component span around its unfinished
    host. An early child checkpoint may bypass exactly its nearest unfinished
diff --git a/crates/webui-handler/benches/streaming_hydration_bench.rs b/crates/webui-handler/benches/streaming_hydration_bench.rs
index 783f182c6..af7b0838b 100644
--- a/crates/webui-handler/benches/streaming_hydration_bench.rs
+++ b/crates/webui-handler/benches/streaming_hydration_bench.rs
@@ -27,6 +27,8 @@ use webui_parser::{ComponentRegistration, CssStrategy, HtmlParser};
 use webui_protocol::{ComponentData, InitialStateStrategy, StateProjectionMode, WebUIProtocol};
 
 const BOUNDARY_COUNTS: &[usize] = &[1, 3, 10, 100];
+const LARGE_STATE_BOUNDARIES: &[usize] = &[1, 8];
+const LARGE_STATE_ROWS: usize = 128;
 const WRITER_CAPACITY: usize = 32 * 1024;
 const ENTRY_ID: &str = "index.html";
 const REQUEST_PATH: &str = "/";
@@ -545,6 +547,106 @@ fn bench_streaming_hydration(c: &mut Criterion) {
         );
     }
     update_group.finish();
+
+    bench_large_state_boundaries(c);
+}
+
+/// Time a full-state continuation across several boundaries.
+///
+/// A protocol whose reachable component projects `ALL` forces the response to
+/// retain the caller's whole state for the life of the response. The per-
+/// boundary cost must stay flat in the size of that state: the snapshot is
+/// taken once when the response starts, not re-merged at every occurrence.
+fn bench_large_state_boundaries(c: &mut Criterion) {
+    let state = large_state(LARGE_STATE_ROWS);
+    let mut group = c.benchmark_group("streaming_large_state");
+    for boundaries in LARGE_STATE_BOUNDARIES.iter().copied() {
+        let protocol = full_state_protocol(boundaries);
+        let handler = hydration_handler();
+        let mut writer = BenchWriter::new(boundaries + 2);
+        render_streaming(&handler, &protocol, &state, &mut writer);
+        let bytes = writer.output.len();
+        assert_eq!(
+            occurrences(&writer.output, "data-webui-boundary"),
+            boundaries + 1,
+            "each boundary plus the terminal needs one envelope"
+        );
+        println!(
+            "streaming_large_state boundaries={boundaries}: rows={LARGE_STATE_ROWS}, output_bytes={bytes}"
+        );
+
+        group.throughput(Throughput::Bytes(bytes as u64));
+        group.bench_with_input(
+            BenchmarkId::from_parameter(boundaries),
+            &protocol,
+            |b, protocol| {
+                let handler = hydration_handler();
+                let mut writer = BenchWriter::new(boundaries + 2);
+                b.iter(|| {
+                    writer.reset();
+                    render_streaming(
+                        &handler,
+                        black_box(protocol),
+                        black_box(&state),
+                        &mut writer,
+                    );
+                    black_box(writer.output.len());
+                });
+            },
+        );
+    }
+    group.finish();
+}
+
+/// Build the same authored page as [`parser_protocol`] with an island whose
+/// compiled hydration surface is `ALL`, which is what forces the continuation
+/// to retain full state.
+fn full_state_protocol(boundaries: usize) -> Protocol {
+    let entry_html = entry_html(boundaries);
+    let mut parser =
+        HtmlParser::with_plugin_options(Box::new(WebUIParserPlugin::new()), CssStrategy::Style);
+    if let Err(error) = parser
+        .component_registry_mut()
+        .register_component(ComponentRegistration {
+            tag_name: ISLAND_TAG,
+            html_content: "<button>{{title}}</button>",
+            css_content: None,
+            is_client_owned: false,
+        })
+    {
+        panic!("registering <bench-island> failed: {error}");
+    }
+    if let Err(error) = parser.parse(ENTRY_ID, &entry_html) {
+        panic!("parsing benchmark entry failed: {error}");
+    }
+    let mut document = WebUIProtocol::new(parser.into_fragment_records());
+    document.initial_state_strategy = InitialStateStrategy::Components as i32;
+    document.components.insert(
+        ISLAND_TAG.to_string(),
+        ComponentData {
+            template_json: r#"{"h":"<button></button>","th":1}"#.to_string(),
+            hydration_mode: StateProjectionMode::All as i32,
+            ..Default::default()
+        },
+    );
+    Protocol::new(document)
+}
+
+/// A state whose payload makes a per-boundary copy unmistakable.
+fn large_state(rows: usize) -> Value {
+    let mut items = Vec::with_capacity(rows);
+    for row in 0..rows {
+        items.push(json!({
+            "id": row,
+            "label": format!("row-{row}"),
+            "tags": ["alpha", "beta", "gamma"],
+        }));
+    }
+    json!({
+        "count": 42,
+        "title": "Hydration benchmark",
+        "rows": items,
+    })
 }
 
 criterion_group!(benches, bench_streaming_hydration);
diff --git a/crates/webui-handler/src/lib.rs b/crates/webui-handler/src/lib.rs
index eec8a3a88..2170fbfca 100644
--- a/crates/webui-handler/src/lib.rs
+++ b/crates/webui-handler/src/lib.rs
@@ -30,6 +30,7 @@ pub use html_encode::encode_safe;
 use plugin::BootstrapExtensionContext;
 use plugin::HandlerPlugin;
 use plugin::WebUiTemplatePayload;
+use route_handler::ComponentReachabilityIndex;
 use route_matcher::CompiledRouteIndex;
 use serde::ser::SerializeMap;
 use serde::Serialize;
@@ -711,7 +712,7 @@ where
 /// carry nothing hydratable and serialize as an empty object.
 struct ProjectedState<'a> {
     value: &'a Value,
-    keys: &'a [&'a str],
+    keys: KeyView<'a>,
 }
 
 impl Serialize for ProjectedState<'_> {
@@ -726,15 +727,15 @@ impl Serialize for ProjectedState<'_> {
         let mut out = serializer.serialize_map(None)?;
         if self.keys.len() < map.len() {
             let mut previous = None;
-            for key in self.keys {
-                if *key == STATE_INJECT_KEY {
+            for key in self.keys.iter() {
+                if key == STATE_INJECT_KEY {
                     continue;
                 }
-                if previous == Some(*key) {
+                if previous == Some(key) {
                     continue;
                 }
-                previous = Some(*key);
-                if let Some(value) = map.get(*key) {
+                previous = Some(key);
+                if let Some(value) = map.get(key) {
                     out.serialize_entry(key, value)?;
                 }
             }
@@ -743,11 +744,7 @@ impl Serialize for ProjectedState<'_> {
                 if key == STATE_INJECT_KEY {
                     continue;
                 }
-                if self
-                    .keys
-                    .binary_search_by(|candidate| candidate.cmp(&key.as_str()))
-                    .is_ok()
-                {
+                if self.keys.contains(key.as_str()) {
                     out.serialize_entry(key, value)?;
                 }
             }
@@ -822,8 +819,8 @@ pub(crate) fn write_selected_state(
 ) -> Result<()> {
     let keys = match selection {
         StateSelection::Full => return write_full_state(writer, scratch, state),
-        StateSelection::Keys(keys) => keys.as_slice(),
-        StateSelection::BorrowedKeys(keys) => *keys,
+        StateSelection::Keys(keys) => KeyView::Borrowed(keys.as_slice()),
+        StateSelection::KeyIds(selection) => KeyView::Ids(*selection),
     };
     if keys.is_empty() {
         return writer.write("{}");
@@ -834,12 +831,14 @@ pub(crate) fn write_selected_state(
     // deduped at build time; this guard makes hand-built protocols that violate
     // the invariant fail loudly in tests at zero release cost.
     debug_assert!(
-        keys.windows(2).all(|pair| pair[0] <= pair[1]),
+        keys.iter()
+            .zip(keys.iter().skip(1))
+            .all(|(left, right)| left <= right),
         "hydration keys must be sorted for binary-search projection"
     );
     if let Value::Object(map) = state {
         let selects_entire_map =
-            keys.len() == map.len() && keys.iter().copied().eq(map.keys().map(String::as_str));
+            keys.len() == map.len() && keys.iter().eq(map.keys().map(String::as_str));
         if selects_entire_map {
             return write_full_state(writer, scratch, state);
         }
@@ -857,8 +856,79 @@ pub(crate) enum StateSelection<'a> {
     Full,
     /// Project an object to a sorted, deduplicated key allowlist.
     Keys(Vec<&'a str>),
-    /// Project using request-local scratch owned by the streaming render.
-    BorrowedKeys(&'a [&'a str]),
+    /// Project using the streaming continuation's interned hydration key IDs.
+    ///
+    /// IDs are assigned in lexicographic order, so a sorted ID slice is a
+    /// sorted key slice and the projection needs no borrowed-string buffer at
+    /// all — the streaming record keeps its scratch as plain integers that
+    /// survive every semantic step.
+    KeyIds(HydrationKeySelection<'a>),
+}
+
+/// A projection expressed as interned hydration key IDs.
+#[derive(Clone, Copy)]
+pub(crate) struct HydrationKeySelection<'a> {
+    pub(crate) ids: &'a [u32],
+    pub(crate) index: &'a ComponentReachabilityIndex,
+}
+
+impl<'a> HydrationKeySelection<'a> {
+    fn key(self, position: usize) -> Option<&'a str> {
+        let id = self.ids.get(position).copied()?;
+        self.index.hydration_key(id)
+    }
+}
+
+/// A sorted, deduplicated key allowlist in whichever form its producer holds.
+#[derive(Clone, Copy)]
+enum KeyView<'a> {
+    Borrowed(&'a [&'a str]),
+    Ids(HydrationKeySelection<'a>),
+}
+
+impl<'a> KeyView<'a> {
+    fn len(self) -> usize {
+        match self {
+            Self::Borrowed(keys) => keys.len(),
+            Self::Ids(selection) => selection.ids.len(),
+        }
+    }
+
+    fn is_empty(self) -> bool {
+        self.len() == 0
+    }
+
+    fn get(self, position: usize) -> Option<&'a str> {
+        match self {
+            Self::Borrowed(keys) => keys.get(position).copied(),
+            Self::Ids(selection) => selection.key(position),
+        }
+    }
+
+    fn iter(self) -> impl Iterator<Item = &'a str> {
+        (0..self.len()).map_while(move |position| self.get(position))
+    }
+
+    /// Sorted-membership probe used when the state object is smaller than the
+    /// allowlist.
+    fn contains(self, key: &str) -> bool {
+        match self {
+            Self::Borrowed(keys) => keys
+                .binary_search_by(|candidate| str::cmp(candidate, key))
+                .is_ok(),
+            Self::Ids(selection) => selection
+                .ids
+                .binary_search_by(|id| {
+                    selection
+                        .index
+                        .hydration_key(*id)
+                        .map_or(std::cmp::Ordering::Less, |candidate| {
+                            str::cmp(candidate, key)
+                        })
+                })
+                .is_ok(),
+        }
+    }
 }
 
 #[derive(Clone, Copy)]
@@ -882,16 +952,32 @@ pub(crate) fn collect_hydration_state<'a, 'b>(
     collect_component_state(protocol, components, ComponentStateSurface::Hydration)
 }
 
-pub(crate) fn collect_hydration_state_into<'a, 'b>(
-    protocol: &'a WebUIProtocol,
-    components: impl IntoIterator<Item = &'b str>,
-    keys: &mut Vec<&'a str>,
+/// Fill a reusable hydration key-ID allowlist for a streaming record.
+///
+/// Components arrive as inventory indexes, so the projection never resolves a
+/// component name, never hashes it against the compiled component map, and
+/// never sorts strings: the interned runs concatenate and the integer sort
+/// leaves the IDs in lexicographic key order. Returns `true` when correctness
+/// requires sending full state instead.
+pub(crate) fn collect_hydration_key_ids_into(
+    protocol: &WebUIProtocol,
+    index: &ComponentReachabilityIndex,
+    components: impl IntoIterator<Item = u32>,
+    ids: &mut Vec<u32>,
 ) -> bool {
+    ids.clear();
     if protocol.initial_state_strategy != InitialStateStrategy::Components as i32 {
-        keys.clear();
         return true;
     }
-    collect_component_state_into(protocol, components, ComponentStateSurface::Hydration, keys)
+    for component in components {
+        if index.extend_hydration_keys(component, ids) {
+            ids.clear();
+            return true;
+        }
+    }
+    ids.sort_unstable();
+    ids.dedup();
+    false
 }
 
 /// Select state for client-created components reachable during navigation.
@@ -8729,7 +8815,7 @@ mod tests {
 
         match collect_navigation_state(&protocol, ["app-shell"]) {
             StateSelection::Keys(keys) => assert_eq!(keys, vec!["selected"]),
-            StateSelection::Full | StateSelection::BorrowedKeys(_) => {
+            StateSelection::Full | StateSelection::KeyIds(_) => {
                 panic!("legacy navigation keys should remain owned and projected")
             }
         }
@@ -9574,12 +9660,38 @@ mod tests {
     }
 
     #[test]
-    fn write_selected_state_strips_reserved_key_from_borrowed_projection() {
+    fn write_selected_state_strips_reserved_key_from_key_id_projection() {
+        // The streaming record projects through interned key IDs, so the
+        // reserved inject key must be filtered on that path too.
+        let mut protocol = WebUIProtocol::new(HashMap::new());
+        protocol.initial_state_strategy = InitialStateStrategy::Components as i32;
+        protocol.fragments.insert(
+            "keep-card".to_string(),
+            webui_protocol::FragmentList::default(),
+        );
+        protocol.components.insert(
+            "keep-card".to_string(),
+            webui_protocol::ComponentData {
+                hydration_mode: StateProjectionMode::Keys as i32,
+                hydration_keys: vec![STATE_INJECT_KEY.to_string(), "keep".to_string()],
+                ..Default::default()
+            },
+        );
+        let protocol = Protocol::new(protocol);
+        let index = protocol.component_reachability();
+        let component = protocol.component_index()["keep-card"];
+        let mut ids = Vec::new();
+        assert!(!collect_hydration_key_ids_into(
+            protocol.protocol(),
+            index,
+            [component],
+            &mut ids
+        ));
+
         let state = test_json!({
             "$webui": { "bodyEnd": "<b>x</b>" },
             "keep": 1,
         });
-        let keys = [STATE_INJECT_KEY, "keep", "missing"];
         let mut sink = TestWriter::new();
         let mut scratch = Vec::new();
 
@@ -9587,7 +9699,7 @@ mod tests {
             &mut sink,
             &mut scratch,
             &state,
-            &StateSelection::BorrowedKeys(&keys),
+            &StateSelection::KeyIds(HydrationKeySelection { ids: &ids, index }),
         )
         .unwrap();
 
diff --git a/crates/webui-handler/src/route_handler.rs b/crates/webui-handler/src/route_handler.rs
index 3045cad50..440dbc2e0 100644
--- a/crates/webui-handler/src/route_handler.rs
+++ b/crates/webui-handler/src/route_handler.rs
@@ -20,7 +20,8 @@ use std::collections::{HashMap, HashSet};
 use std::fmt;
 use std::sync::{Arc, OnceLock, RwLock};
 use webui_protocol::{
-    web_ui_fragment::Fragment, CssStrategy, DomStrategy, WebUIFragmentRoute, WebUIProtocol,
+    web_ui_fragment::Fragment, CssStrategy, DomStrategy, StateProjectionMode, WebUIFragmentRoute,
+    WebUIProtocol,
 };
 
 use crate::streaming::PreparedContinuationStatePlan;
@@ -46,7 +47,7 @@ pub struct Protocol {
     fragment_slots: HashMap<Arc<str>, u32>,
     route_index: CompiledRouteIndex,
     boundary_declarations: OnceLock<HashMap<u32, BoundaryDeclaration>>,
-    continuation_state_plans: RwLock<HashMap<Box<str>, Arc<PreparedContinuationStatePlan>>>,
+    continuation_state_plans: OnceLock<Box<[OnceLock<PreparedContinuationStatePlan>]>>,
     template_metadata_cache: RwLock<HashMap<String, Value>>,
 }
 
@@ -114,7 +115,7 @@ impl Protocol {
             fragment_slots,
             route_index,
             boundary_declarations: OnceLock::new(),
-            continuation_state_plans: RwLock::new(HashMap::new()),
+            continuation_state_plans: OnceLock::new(),
             template_metadata_cache: RwLock::new(HashMap::new()),
         }
     }
@@ -178,24 +179,32 @@ impl Protocol {
     ///
     /// The graph walk that decides which top-level state keys a continuation
     /// retains depends only on the compiled protocol, so it runs at most once
-    /// per entry for the lifetime of this [`Protocol`]. Responses clone a
-    /// pointer instead of rebuilding the surface. Failures are captured and
-    /// replayed so the memo never re-walks a graph that is known to be
-    /// unusable.
+    /// per entry for the lifetime of this [`Protocol`]. Memoization is a
+    /// slot-indexed table of [`OnceLock`] cells: after the first response for
+    /// an entry, every later response reads the plan through one acquire load
+    /// with no lock, no hash, and no reference-count traffic. The table itself
+    /// is allocated on first streaming use, so protocols that never stream pay
+    /// nothing. Failures are captured and replayed so the memo never re-walks a
+    /// graph that is known to be unusable.
     pub(crate) fn continuation_state_plan(
         &self,
         entry_id: &str,
-    ) -> Arc<PreparedContinuationStatePlan> {
-        if let Ok(plans) = self.continuation_state_plans.read() {
-            if let Some(plan) = plans.get(entry_id) {
-                return Arc::clone(plan);
-            }
-        }
-        let plan = Arc::new(PreparedContinuationStatePlan::new(&self.protocol, entry_id));
-        if let Ok(mut plans) = self.continuation_state_plans.write() {
-            return Arc::clone(plans.entry(entry_id.into()).or_insert(plan));
-        }
-        plan
+    ) -> Result<&PreparedContinuationStatePlan, HandlerError> {
+        let slot = self
+            .fragment_slot(entry_id)
+            .ok_or_else(|| HandlerError::MissingFragment(entry_id.to_string()))?;
+        let index = usize::try_from(slot).map_err(|_| {
+            HandlerError::Invariant("continuation plan slot does not fit usize".to_string())
+        })?;
+        let plans = self.continuation_state_plans.get_or_init(|| {
+            (0..self.fragment_ids.len())
+                .map(|_| OnceLock::new())
+                .collect()
+        });
+        let cell = plans
+            .get(index)
+            .ok_or_else(|| HandlerError::MissingFragment(entry_id.to_string()))?;
+        Ok(cell.get_or_init(|| PreparedContinuationStatePlan::new(&self.protocol, entry_id)))
     }
 
     /// Borrow the build-time CSS token list.
@@ -374,10 +383,41 @@ pub(crate) fn build_component_index(protocol: &WebUIProtocol) -> HashMap<String,
 /// checkpoints. Route-free component surfaces walk integer indexes on the
 /// request path; only route-dependent surfaces need the more expensive
 /// request-aware fragment traversal.
+///
+/// The same table interns each component's compiled hydration projection as a
+/// run of key IDs. IDs are assigned in lexicographic order, so a checkpoint
+/// collects its projection by concatenating integer runs and sorting integers —
+/// no per-checkpoint component-name hash, no string sort, and no borrowed-string
+/// scratch that would have to be rebuilt on every semantic step.
 pub(crate) struct ComponentReachabilityIndex {
     names: Vec<String>,
     dependencies: Vec<Box<[u32]>>,
     route_dependent: Vec<bool>,
+    hydration_keys: Vec<Box<str>>,
+    hydration_key_ids: Vec<u32>,
+    hydration_runs: Vec<HydrationRun>,
+}
+
+/// One component's interned hydration projection.
+///
+/// `len == FULL_STATE_RUN` marks a compiled surface that is not expressible as
+/// a key allowlist, which forces the whole record to full state exactly as the
+/// name-based collector did.
+#[derive(Clone, Copy)]
+struct HydrationRun {
+    start: u32,
+    len: u32,
+}
+
+impl HydrationRun {
+    const FULL_STATE: Self = Self {
+        start: 0,
+        len: u32::MAX,
+    };
+
+    const fn requires_full_state(self) -> bool {
+        self.len == u32::MAX
+    }
 }
 
 impl ComponentReachabilityIndex {
@@ -394,11 +434,16 @@ impl ComponentReachabilityIndex {
             route_dependent.push(has_route);
         }
         propagate_route_dependencies(&dependencies, &mut route_dependent);
+        let (hydration_keys, hydration_key_ids, hydration_runs) =
+            intern_hydration_projections(protocol, &names);
 
         Self {
             names,
             dependencies,
             route_dependent,
+            hydration_keys,
+            hydration_key_ids,
+            hydration_runs,
         }
     }
 
@@ -417,6 +462,84 @@ impl ComponentReachabilityIndex {
     pub(crate) fn requires_expansion(&self, index: u32) -> Option<bool> {
         Some(self.is_route_dependent(index)? || !self.dependencies.get(index as usize)?.is_empty())
     }
+
+    /// Resolve one interned hydration key ID.
+    pub(crate) fn hydration_key(&self, id: u32) -> Option<&str> {
+        self.hydration_keys.get(id as usize).map(Box::as_ref)
+    }
+
+    /// Append one component's hydration key IDs to `ids`.
+    ///
+    /// Returns `true` when the component's compiled surface requires full
+    /// state, in which case `ids` is meaningless for this record.
+    pub(crate) fn extend_hydration_keys(&self, index: u32, ids: &mut Vec<u32>) -> bool {
+        let Some(run) = self.hydration_runs.get(index as usize).copied() else {
+            return true;
+        };
+        if run.requires_full_state() {
+            return true;
+        }
+        let start = run.start as usize;
+        let end = start.saturating_add(run.len as usize);
+        match self.hydration_key_ids.get(start..end) {
+            Some(run) => ids.extend_from_slice(run),
+            None => return true,
+        }
+        false
+    }
+}
+
+/// Intern every component's compiled hydration projection into lexicographic
+/// key IDs plus one flat run per component.
+fn intern_hydration_projections(
+    protocol: &WebUIProtocol,
+    names: &[String],
+) -> (Vec<Box<str>>, Vec<u32>, Vec<HydrationRun>) {
+    let mut distinct: Vec<&str> = Vec::new();
+    for name in names {
+        if let Some(component) = protocol.components.get(name) {
+            distinct.extend(component.hydration_keys.iter().map(String::as_str));
+        }
+    }
+    distinct.sort_unstable();
+    distinct.dedup();
+    let keys: Vec<Box<str>> = distinct.iter().map(|key| Box::from(*key)).collect();
+
+    let mut key_ids = Vec::new();
+    let mut runs = Vec::with_capacity(names.len());
+    for name in names {
+        let Some(component) = protocol.components.get(name) else {
+            // A component with no compiled surface cannot be projected, exactly
+            // as the name-based collector treated a missing entry.
+            runs.push(HydrationRun::FULL_STATE);
+            continue;
+        };
+        let mode = component.hydration_mode;
+        let component_keys = &component.hydration_keys;
+        let projects_keys = mode == StateProjectionMode::Keys as i32
+            || (mode == StateProjectionMode::None as i32 && !component_keys.is_empty());
+        if mode == StateProjectionMode::All as i32
+            || (!projects_keys && mode != StateProjectionMode::None as i32)
+        {
+            runs.push(HydrationRun::FULL_STATE);
+            continue;
+        }
+        let start = key_ids.len();
+        if projects_keys {
+            for key in component_keys {
+                if let Ok(position) = distinct.binary_search(&key.as_str()) {
+                    if let Ok(id) = u32::try_from(position) {
+                        key_ids.push(id);
+                    }
+                }
+            }
+        }
+        match (u32::try_from(start), u32::try_from(key_ids.len() - start)) {
+            (Ok(start), Ok(len)) if len != u32::MAX => runs.push(HydrationRun { start, len }),
+            _ => runs.push(HydrationRun::FULL_STATE),
+        }
+    }
+    (keys, key_ids, runs)
 }
 
 enum ComponentDependencyWork<'a> {
@@ -842,7 +965,10 @@ fn select_raw_state<'de>(
                 .map_err(|error| invalid_state_json(&error.to_string()));
         }
         StateSelection::Keys(keys) => keys.as_slice(),
-        StateSelection::BorrowedKeys(keys) => *keys,
+        // Key-ID projections are produced only by the streaming continuation,
+        // which serializes through `write_selected_state` and never reaches
+        // partial navigation's raw-JSON projection.
+        StateSelection::KeyIds(_) => return Err(unexpected_key_id_selection()),
     };
     project_raw_state(state_json, state_keys).map(SelectedRawState::Keys)
 }
@@ -1104,6 +1230,14 @@ fn invalid_state_json(message: &str) -> HandlerError {
     HandlerError::InvalidState(message.to_string())
 }
 
+#[cold]
+#[inline(never)]
+fn unexpected_key_id_selection() -> HandlerError {
+    HandlerError::Invariant(
+        "streaming hydration key-ID projection reached partial navigation".to_string(),
+    )
+}
+
 #[cold]
 #[inline(never)]
 fn partial_serialize_error(message: &str) -> HandlerError {
@@ -2033,7 +2167,8 @@ fn select_owned_state(state: Value, selection: &StateSelection<'_>) -> Value {
     let state_keys = match selection {
         StateSelection::Full => return state,
         StateSelection::Keys(keys) => keys.as_slice(),
-        StateSelection::BorrowedKeys(keys) => *keys,
+        // Streaming's key-ID projection never reaches partial navigation.
+        StateSelection::KeyIds(_) => return Value::Object(Map::new()),
     };
     let Value::Object(mut source) = state else {
         return Value::Object(Map::new());
@@ -2518,6 +2653,140 @@ mod tests {
         assert_eq!(prepared.tokens(), ["colorBrand"]);
     }
 
+    #[test]
+    fn continuation_state_plans_memoize_per_entry_without_locking() {
+        // Every response for an entry must read the same prepared plan through
+        // the slot table: no lock, no hash, and no per-response rebuild.
+        let mut fragments = HashMap::new();
+        fragments.insert(
+            "index.html".to_string(),
+            FragmentList {
+                fragments: vec![WebUIFragment::raw("<p>plan</p>")],
+                contains_boundary: false,
+            },
+        );
+        let prepared = Protocol::new(WebUIProtocol::new(fragments));
+
+        let first = prepared.continuation_state_plan("index.html").unwrap();
+        let second = prepared.continuation_state_plan("index.html").unwrap();
+        assert!(
+            std::ptr::eq(first, second),
+            "a memoized plan must be borrowed, not rebuilt or cloned"
+        );
+        // The table reserves one cell per compiled record, so the cell must stay
+        // small enough that a large protocol's lazy table is a rounding error.
+        let cell = std::mem::size_of::<OnceLock<PreparedContinuationStatePlan>>();
+        assert!(
+            cell <= 40,
+            "continuation plan memo cell grew to {cell} bytes"
+        );
+
+        let barrier = Arc::new(Barrier::new(4));
+        let address = std::ptr::from_ref(first).addr();
+        thread::scope(|scope| {
+            for _ in 0..4 {
+                let barrier = Arc::clone(&barrier);
+                let prepared = &prepared;
+                scope.spawn(move || {
+                    barrier.wait();
+                    let plan = prepared.continuation_state_plan("index.html").unwrap();
+                    assert_eq!(
+                        std::ptr::from_ref(plan).addr(),
+                        address,
+                        "concurrent responses must share one initialization"
+                    );
+                    assert!(plan.resolve().is_ok());
+                });
+            }
+        });
+    }
+
+    #[test]
+    fn continuation_state_plans_replay_captured_failures() {
+        // A malformed entry is diagnosed identically on every response, and an
+        // unknown entry still reports the missing record rather than a slot.
+        let mut fragments = HashMap::new();
+        fragments.insert(
+            "index.html".to_string(),
+            FragmentList {
+                fragments: vec![WebUIFragment::component("missing-card")],
+                contains_boundary: false,
+            },
+        );
+        let prepared = Protocol::new(WebUIProtocol::new(fragments));
+
+        for _ in 0..2 {
+            match prepared
+                .continuation_state_plan("index.html")
+                .and_then(|plan| plan.resolve())
+                .err()
+            {
+                Some(HandlerError::MissingFragment(id)) => assert_eq!(id, "missing-card"),
+                other => panic!("expected a replayable missing-record failure, got {other:?}"),
+            }
+        }
+        match prepared.continuation_state_plan("absent.html").err() {
+            Some(HandlerError::MissingFragment(id)) => assert_eq!(id, "absent.html"),
+            other => panic!("expected a missing-entry diagnostic, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn component_reachability_interns_hydration_projections() {
+        // Streaming records collect their projection from component indexes, so
+        // the interned runs must reproduce the compiled per-component surface
+        // in lexicographic ID order.
+        let mut fragments = HashMap::new();
+        fragments.insert("keyed-card".to_string(), FragmentList::default());
+        fragments.insert("all-card".to_string(), FragmentList::default());
+        fragments.insert("bare-card".to_string(), FragmentList::default());
+        let mut protocol = WebUIProtocol::new(fragments);
+        protocol.components.insert(
+            "keyed-card".to_string(),
+            webui_protocol::ComponentData {
+                hydration_mode: StateProjectionMode::Keys as i32,
+                hydration_keys: vec!["zebra".to_string(), "alpha".to_string()],
+                ..Default::default()
+            },
+        );
+        protocol.components.insert(
+            "all-card".to_string(),
+            webui_protocol::ComponentData {
+                hydration_mode: StateProjectionMode::All as i32,
+                ..Default::default()
+            },
+        );
+        let prepared = Protocol::new(protocol);
+        let index = prepared.component_reachability();
+        let component = prepared.component_index();
+
+        let mut ids = Vec::new();
+        assert!(
+            !index.extend_hydration_keys(component["keyed-card"], &mut ids),
+            "a keyed surface projects keys"
+        );
+        ids.sort_unstable();
+        let keys: Vec<&str> = ids
+            .iter()
+            .filter_map(|id| index.hydration_key(*id))
+            .collect();
+        assert_eq!(
+            keys,
+            ["alpha", "zebra"],
+            "sorted IDs must be lexicographically sorted keys"
+        );
+
+        let mut ids = Vec::new();
+        assert!(
+            index.extend_hydration_keys(component["all-card"], &mut ids),
+            "an ALL surface forces full state"
+        );
+        assert!(
+            index.extend_hydration_keys(component["bare-card"], &mut ids),
+            "a component without compiled metadata forces full state"
+        );
+    }
+
     #[test]
     fn protocol_retains_only_serialized_component_asset_styles() {
         let mut protocol = WebUIProtocol::default();
diff --git a/crates/webui-handler/src/route_renderer.rs b/crates/webui-handler/src/route_renderer.rs
index 023d8ca33..049b55cb3 100644
--- a/crates/webui-handler/src/route_renderer.rs
+++ b/crates/webui-handler/src/route_renderer.rs
@@ -75,6 +75,11 @@ pub(crate) fn write_escaped_state_attr(writer: &mut dyn ResponseWriter, value: &
 /// This ensures `/contacts/add` (2 literals) beats `/contacts/:id` (1 literal + 1 param).
 ///
 /// `route_base` is used to resolve relative paths (starting with `./`).
+///
+/// Request segmentation is deferred until a route fragment is actually seen:
+/// every record entry calls this, and the overwhelming majority of records —
+/// component bodies, conditions, loop bodies — carry no routes at all, so a
+/// route-free record must not pay for a segment vector.
 pub(crate) fn find_best_route_match(
     fragments: &[WebUIFragment],
     request_path: &str,
@@ -82,16 +87,17 @@ pub(crate) fn find_best_route_match(
     route_index: &CompiledRouteIndex,
 ) -> Option<(String, route_matcher::RouteMatch)> {
     let mut best: Option<(String, route_matcher::RouteMatch)> = None;
-
-    let request_segments = route_matcher::split_request_path(request_path);
+    let mut request_segments: Option<Vec<&str>> = None;
 
     for item in fragments {
         if let Some(Fragment::Route(route_frag)) = item.fragment.as_ref() {
+            let segments = request_segments
+                .get_or_insert_with(|| route_matcher::split_request_path(request_path));
             if let Some(m) = route_matcher::match_route_indexed_with_segments(
                 route_index,
                 &route_frag.path,
                 route_base,
-                &request_segments,
+                segments,
                 route_frag.exact,
             ) {
                 let is_better = best
diff --git a/crates/webui-handler/src/streaming/checkpoint.rs b/crates/webui-handler/src/streaming/checkpoint.rs
index db9a3a107..71233e1b2 100644
--- a/crates/webui-handler/src/streaming/checkpoint.rs
+++ b/crates/webui-handler/src/streaming/checkpoint.rs
@@ -11,8 +11,9 @@ use super::state::StateUpdatePlan;
 use super::{flush_streaming_transport, streaming_state, MarkerBuffer};
 use crate::plugin::WebUiTemplatePayload;
 use crate::{
-    collect_hydration_state_into, write_selected_state, write_webui_bootstrap, HandlerError,
-    Result, StateSelection, WebUIHandler, WebUIProcessContext, WebUiBootstrap,
+    collect_hydration_key_ids_into, write_selected_state, write_webui_bootstrap, HandlerError,
+    HydrationKeySelection, Result, StateSelection, WebUIHandler, WebUIProcessContext,
+    WebUiBootstrap,
 };
 
 pub(super) const RECORD_KIND_FINAL_CHECKPOINT: usize = 0;
@@ -121,19 +122,18 @@ impl WebUIHandler {
         let template_payloads = context.plugin.as_ref().and_then(|plugin| {
             plugin.collect_template_payloads_slice(context.protocol, &new_template_tags)
         });
-        let (mut state_key_scratch, checkpoint_reachability) = {
+        let (mut state_key_ids, checkpoint_reachability) = {
             let streaming = streaming_state(context)?;
             (
-                std::mem::take(&mut streaming.state_key_scratch),
+                std::mem::take(&mut streaming.state_key_ids),
                 streaming.component_reachability,
             )
         };
-        let requires_full_state = collect_hydration_state_into(
+        let requires_full_state = collect_hydration_key_ids_into(
             context.protocol,
-            checkpoint_tags
-                .iter()
-                .filter_map(|&index| checkpoint_reachability.name(index)),
-            &mut state_key_scratch,
+            checkpoint_reachability,
+            checkpoint_tags.iter().copied(),
+            &mut state_key_ids,
         );
         let chain = if first_checkpoint {
             crate::route_handler::collect_route_chain(
@@ -198,7 +198,10 @@ impl WebUIHandler {
         let state_selection = if requires_full_state {
             StateSelection::Full
         } else {
-            StateSelection::BorrowedKeys(&state_key_scratch)
+            StateSelection::KeyIds(HydrationKeySelection {
+                ids: &state_key_ids,
+                index: checkpoint_reachability,
+            })
         };
         let inventory = context
             .streaming
@@ -253,21 +256,27 @@ impl WebUIHandler {
             if streaming.update_plans.len() <= target {
                 streaming.update_plans.resize_with(target + 1, || None);
             }
-            streaming.update_plans[target] = Some(StateUpdatePlan {
-                requires_full_state,
-                keys: if requires_full_state {
-                    Vec::new()
-                } else {
-                    state_key_scratch.iter().copied().map(Box::from).collect()
-                },
-            });
+            // Reuse the slot's existing key buffer so a boundary that commits
+            // updatable more than once in a response does not re-allocate.
+            let mut plan = streaming.update_plans[target]
+                .take()
+                .unwrap_or(StateUpdatePlan {
+                    requires_full_state,
+                    key_ids: Vec::new(),
+                });
+            plan.requires_full_state = requires_full_state;
+            plan.key_ids.clear();
+            if !requires_full_state {
+                plan.key_ids.extend_from_slice(&state_key_ids);
+            }
+            streaming.update_plans[target] = Some(plan);
         }
         finish_capture(
             context,
             CapturedBuffers {
                 checkpoint_tags,
                 template_tags: new_template_tags,
-                state_keys: state_key_scratch,
+                state_key_ids,
                 css_hrefs,
                 style_specs,
             },
@@ -298,6 +307,9 @@ impl WebUIHandler {
         if !context.state.is_object() {
             return Err(super::error::state_update_type_error());
         }
+        // The plan is moved out for the duration of the write so the record can
+        // borrow the writer mutably, then handed straight back: an update never
+        // rebuilds or reallocates the projection it committed with.
         let Some(plan) = context
             .streaming
             .as_mut()
@@ -314,32 +326,37 @@ impl WebUIHandler {
             RECORD_KIND_STATE_UPDATE,
             boundary_id,
         )?;
-        let selection = if plan.requires_full_state {
-            StateSelection::Full
-        } else {
-            StateSelection::Keys(plan.keys.iter().map(Box::as_ref).collect())
+        let result = match context.streaming.as_ref() {
+            Some(streaming) if !plan.requires_full_state => write_selected_state(
+                context.writer,
+                &mut context.json_scratch,
+                context.state,
+                &StateSelection::KeyIds(HydrationKeySelection {
+                    ids: &plan.key_ids,
+                    index: streaming.component_reachability,
+                }),
+            ),
+            _ => write_selected_state(
+                context.writer,
+                &mut context.json_scratch,
+                context.state,
+                &StateSelection::Full,
+            ),
         };
-        write_selected_state(
-            context.writer,
-            &mut context.json_scratch,
-            context.state,
-            &selection,
-        )?;
-        context
-            .writer
-            .write("]</script><webui-hydrate></webui-hydrate>")?;
-        flush_streaming_transport(context)?;
-        let Some(slot) = context
+        // Restore the plan before propagating a write failure so a poisoned
+        // response still owns its buffers instead of leaking their capacity.
+        if let Some(slot) = context
             .streaming
             .as_mut()
             .and_then(|streaming| streaming.update_plans.get_mut(boundary_id))
-        else {
-            return Err(HandlerError::Invariant(
-                "streaming update projection slot disappeared".to_string(),
-            ));
-        };
-        *slot = Some(plan);
-        Ok(())
+        {
+            *slot = Some(plan);
+        }
+        result?;
+        context
+            .writer
+            .write("]</script><webui-hydrate></webui-hydrate>")?;
+        flush_streaming_transport(context)
     }
 }
 
@@ -392,7 +409,7 @@ fn write_script_open(context: &mut WebUIProcessContext<'_, '_, '_>) -> Result<()
 struct CapturedBuffers<'a> {
     checkpoint_tags: Vec<u32>,
     template_tags: Vec<&'a str>,
-    state_keys: Vec<&'a str>,
+    state_key_ids: Vec<u32>,
     css_hrefs: Vec<&'a str>,
     style_specs: Vec<&'a str>,
 }
@@ -409,8 +426,8 @@ fn finish_capture<'a>(
     streaming.checkpoint_walk_roots.clear();
     buffers.template_tags.clear();
     streaming.template_tag_scratch = buffers.template_tags;
-    buffers.state_keys.clear();
-    streaming.state_key_scratch = buffers.state_keys;
+    buffers.state_key_ids.clear();
+    streaming.state_key_ids = buffers.state_key_ids;
     buffers.css_hrefs.clear();
     streaming.css_href_scratch = buffers.css_hrefs;
     buffers.style_specs.clear();
diff --git a/crates/webui-handler/src/streaming/mod.rs b/crates/webui-handler/src/streaming/mod.rs
index 88be732cf..8ec63f9b8 100644
--- a/crates/webui-handler/src/streaming/mod.rs
+++ b/crates/webui-handler/src/streaming/mod.rs
@@ -335,8 +335,11 @@ impl WebUIHandler {
 
     /// Render every runtime boundary in document order as final.
     ///
-    /// Hosts that need asynchronous work between occurrences should use
-    /// [`Self::stream_response`] or [`StreamingSession`].
+    /// The value is snapshotted once when the response starts and every
+    /// occurrence resumes against that snapshot, so a large state is projected
+    /// once per response rather than re-merged once per boundary. Hosts that
+    /// need asynchronous work — or genuinely new state — between occurrences
+    /// should use [`Self::stream_response`] or [`StreamingSession`].
     pub fn render_streaming<'a, W: FlushWriter + ?Sized>(
         &self,
         protocol: &'a Protocol,
@@ -352,7 +355,7 @@ impl WebUIHandler {
                     "unfinished streaming step has no pending boundary".to_string(),
                 ));
             };
-            status = response.resume(boundary.instance_id, state, BoundaryMode::Final)?;
+            status = response.resume_current(boundary.instance_id, BoundaryMode::Final)?;
         }
         Ok(())
     }
diff --git a/crates/webui-handler/src/streaming/session.rs b/crates/webui-handler/src/streaming/session.rs
index d686385d3..81e740a84 100644
--- a/crates/webui-handler/src/streaming/session.rs
+++ b/crates/webui-handler/src/streaming/session.rs
@@ -231,6 +231,27 @@ impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
         )
     }
 
+    /// Commit the pending occurrence without merging new state.
+    ///
+    /// Used by [`WebUIHandler::render_streaming`], which drives every
+    /// occurrence from the single value it already snapshotted at start.
+    pub(crate) fn resume_current(
+        &mut self,
+        instance_id: BoundaryInstanceId,
+        mode: BoundaryMode,
+    ) -> Result<StreamStatus> {
+        self.core.resume_current(
+            SessionCall {
+                handler: self.handler,
+                protocol: self.protocol,
+                options: &self.options,
+                writer: &mut self.sink,
+            },
+            instance_id,
+            mode,
+        )
+    }
+
     /// Whether the response has emitted its terminal and ended its writer.
     #[must_use]
     pub fn is_done(&self) -> bool {
@@ -274,8 +295,7 @@ impl SessionCore {
         if !protocol.protocol().fragments.contains_key(entry_id) {
             return Err(HandlerError::MissingFragment(entry_id.to_string()));
         }
-        let prepared = protocol.continuation_state_plan(entry_id);
-        let state_plan = prepared.resolve()?;
+        let state_plan = protocol.continuation_state_plan(entry_id)?.resolve()?;
         Ok(Self {
             vm: ContinuationVm::new(entry_id, protocol)?,
             frozen_keys: Arc::clone(&state_plan.keys),
@@ -342,6 +362,28 @@ impl SessionCore {
         self.run_advance(call, Some((instance_id, mode)))
     }
 
+    /// Commit the pending occurrence against the snapshot the response already
+    /// holds.
+    ///
+    /// Callers that never introduce new state between occurrences — the
+    /// one-shot [`WebUIHandler::render_streaming`] helper is the canonical one —
+    /// would otherwise re-merge an identical value into the retained snapshot
+    /// once per boundary, making a large state cost O(boundaries × state size)
+    /// for a result that is byte-for-byte what the previous step already held.
+    /// The public [`Self::resume`] entry point keeps the overlay for hosts that
+    /// genuinely resolve new data per occurrence.
+    pub(crate) fn resume_current(
+        &mut self,
+        call: SessionCall<'_, '_>,
+        instance_id: BoundaryInstanceId,
+        mode: BoundaryMode,
+    ) -> Result<StreamStatus> {
+        self.require_usable("resume")?;
+        self.require_started("resume")?;
+        self.vm.validate_resume(instance_id)?;
+        self.run_advance(call, Some((instance_id, mode)))
+    }
+
     pub(crate) fn update(
         &mut self,
         call: SessionCall<'_, '_>,
@@ -504,3 +546,307 @@ impl SessionCore {
 fn missing_progress_error() -> HandlerError {
     HandlerError::Invariant("streaming progress is unavailable".to_string())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{FlushWriter, ResponseWriter};
+    use webui_parser::{ComponentRegistration, HtmlParser};
+    use webui_protocol::{ComponentData, InitialStateStrategy, StateProjectionMode, WebUIProtocol};
+    use webui_test_utils::test_json;
+
+    const ISLAND_TAG: &str = "state-island";
+
+    struct TestSink {
+        output: String,
+    }
+
+    impl ResponseWriter for TestSink {
+        fn write(&mut self, content: &str) -> Result<()> {
+            self.output.push_str(content);
+            Ok(())
+        }
+
+        fn end(&mut self) -> Result<()> {
+            Ok(())
+        }
+    }
+
+    impl FlushWriter for TestSink {
+        fn flush(&mut self) -> Result<()> {
+            Ok(())
+        }
+    }
+
+    /// Build a parser-produced entry with `boundaries` runtime occurrences,
+    /// each hosting one island component.
+    fn boundary_protocol(boundaries: usize, hydration_mode: StateProjectionMode) -> Protocol {
+        let mut html = String::from("<!doctype html><html><head></head><body>");
+        for sequence in 0..boundaries {
+            html.push_str("<boundary name=\"b");
+            html.push_str(&sequence.to_string());
+            html.push_str("\"><article><");
+            html.push_str(ISLAND_TAG);
+            html.push_str("></");
+            html.push_str(ISLAND_TAG);
+            html.push_str("></article></boundary>");
+        }
+        html.push_str("</body></html>");
+
+        let mut parser = HtmlParser::new();
+        match parser
+            .component_registry_mut()
+            .register_component(ComponentRegistration::new(
+                ISLAND_TAG,
+                "<button>{{title}}</button>",
+                None,
+                true,
+            )) {
+            Ok(()) => {}
+            Err(error) => panic!("registering the island failed: {error}"),
+        }
+        if let Err(error) = parser.parse("index.html", &html) {
+            panic!("parsing the streaming entry failed: {error}");
+        }
+        let mut document = WebUIProtocol::new(parser.into_fragment_records());
+        document.initial_state_strategy = InitialStateStrategy::Components as i32;
+        document.components.insert(
+            ISLAND_TAG.to_string(),
+            ComponentData {
+                template_json: r#"{"h":"<button></button>","th":1}"#.to_string(),
+                hydration_mode: hydration_mode as i32,
+                hydration_keys: if matches!(hydration_mode, StateProjectionMode::Keys) {
+                    vec!["count".to_string(), "title".to_string()]
+                } else {
+                    Vec::new()
+                },
+                ..Default::default()
+            },
+        );
+        Protocol::new(document)
+    }
+
+    /// A state whose payload is large enough that a per-boundary copy would be
+    /// unmistakable in both time and allocation.
+    fn large_state(rows: usize) -> Value {
+        let mut items = Vec::with_capacity(rows);
+        for row in 0..rows {
+            items.push(test_json!({
+                "id": row,
+                "label": format!("row-{row}"),
+                "tags": ["alpha", "beta", "gamma"],
+            }));
+        }
+        test_json!({
+            "count": 42,
+            "title": "large state",
+            "rows": items,
+        })
+    }
+
+    /// Heap address of the retained snapshot's `rows` buffer, or `None` when
+    /// the snapshot does not hold it.
+    fn rows_address(state: &Value) -> Option<usize> {
+        state
+            .get("rows")
+            .and_then(Value::as_array)
+            .map(|rows| rows.as_ptr().addr())
+    }
+
+    fn options<'a>() -> RenderOptions<'a> {
+        RenderOptions::new("index.html", "/")
+    }
+
+    #[test]
+    fn render_streaming_projects_full_state_once_per_response() -> Result<()> {
+        // Full-state protocols retain the caller's whole tree. Committing each
+        // occurrence against the snapshot the response already holds must not
+        // re-copy that tree, so the retained buffer keeps its identity for the
+        // entire response no matter how many boundaries commit.
+        let protocol = boundary_protocol(8, StateProjectionMode::All);
+        let handler = WebUIHandler::new();
+        let state = large_state(256);
+        let render_options = options();
+        let mut sink = TestSink {
+            output: String::new(),
+        };
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let mut status = response.start(&state)?;
+        let snapshot = rows_address(&response.core.frozen_state);
+        assert!(
+            snapshot.is_some(),
+            "a full-state protocol must retain the caller's payload"
+        );
+        assert_ne!(
+            snapshot,
+            rows_address(&state),
+            "the response owns its snapshot rather than borrowing the caller's tree"
+        );
+
+        let mut committed = 0usize;
+        while !status.done {
+            let Some(boundary) = status.boundary.as_ref() else {
+                panic!("an unfinished step must carry a pending boundary");
+            };
+            status = response.resume_current(boundary.instance_id, BoundaryMode::Final)?;
+            committed += 1;
+            assert_eq!(
+                rows_address(&response.core.frozen_state),
+                snapshot,
+                "committing occurrence {committed} must not re-copy the retained snapshot"
+            );
+        }
+        assert_eq!(committed, 8, "every authored boundary must commit");
+
+        // The one-shot helper drives exactly this loop, so its bytes must match
+        // the snapshot-only path it delegates to.
+        let mut helper_sink = TestSink {
+            output: String::new(),
+        };
+        handler.render_streaming(&protocol, &state, &render_options, &mut helper_sink)?;
+        assert_eq!(
+            helper_sink.output, sink.output,
+            "render_streaming must resume against the retained snapshot"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn resume_overlays_new_state_and_reuses_unchanged_subtrees() -> Result<()> {
+        // The public resume keeps its patch semantics: a changed key lands in
+        // the snapshot, an omitted key survives, and an unchanged subtree is
+        // left in place instead of being copied again.
+        let protocol = boundary_protocol(2, StateProjectionMode::All);
+        let handler = WebUIHandler::new();
+        let state = large_state(64);
+        let render_options = options();
+        let mut sink = TestSink {
+            output: String::new(),
+        };
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let status = response.start(&state)?;
+        let snapshot = rows_address(&response.core.frozen_state);
+        let Some(boundary) = status.boundary.as_ref() else {
+            panic!("the first occurrence must suspend");
+        };
+
+        let mut next = state.clone();
+        if let Some(object) = next.as_object_mut() {
+            object.insert("title".to_string(), Value::String("second".to_string()));
+            object.remove("count");
+        }
+        let status = response.resume(boundary.instance_id, &next, BoundaryMode::Final)?;
+
+        assert_eq!(
+            response.core.frozen_state.get("title"),
+            Some(&Value::String("second".to_string())),
+            "a changed key must land in the snapshot"
+        );
+        assert_eq!(
+            response.core.frozen_state.get("count"),
+            Some(&test_json!(42)),
+            "an omitted key keeps the value the snapshot already holds"
+        );
+        assert_eq!(
+            rows_address(&response.core.frozen_state),
+            snapshot,
+            "an unchanged subtree must not be copied again"
+        );
+        assert!(status.boundary.is_some(), "the second occurrence follows");
+        Ok(())
+    }
+
+    #[test]
+    fn semantic_steps_reuse_projection_scratch() -> Result<()> {
+        // The record projection scratch lives in the retained progress as plain
+        // integers, so after the first record every later step reuses the same
+        // allocation instead of rebuilding one per step.
+        let protocol = boundary_protocol(6, StateProjectionMode::Keys);
+        let handler = WebUIHandler::new();
+        let state = test_json!({ "count": 1, "title": "scratch", "unused": "x" });
+        let render_options = options();
+        let mut sink = TestSink {
+            output: String::new(),
+        };
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let mut status = response.start(&state)?;
+        let mut retained: Option<(usize, usize)> = None;
+        while !status.done {
+            let Some(boundary) = status.boundary.as_ref() else {
+                panic!("an unfinished step must carry a pending boundary");
+            };
+            status = response.resume_current(boundary.instance_id, BoundaryMode::Updatable)?;
+            let Some(progress) = response.core.streaming.as_ref() else {
+                panic!("a suspended response must retain its progress");
+            };
+            let observed = (
+                progress.state_key_ids.capacity(),
+                progress.state_key_ids.as_ptr().addr(),
+            );
+            assert!(
+                observed.0 > 0,
+                "the projection scratch must survive the record that filled it"
+            );
+            match retained {
+                None => retained = Some(observed),
+                Some(previous) => assert_eq!(
+                    observed, previous,
+                    "a later step must reuse the projection buffer, not allocate a new one"
+                ),
+            }
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn updates_reuse_their_committed_projection_buffer() -> Result<()> {
+        // An update writes through the plan captured at commit time: no key
+        // list is rebuilt, so the plan's buffer keeps its identity across every
+        // update it serves.
+        let protocol = boundary_protocol(2, StateProjectionMode::Keys);
+        let handler = WebUIHandler::new();
+        let state = test_json!({ "count": 1, "title": "updates" });
+        let render_options = options();
+        let mut sink = TestSink {
+            output: String::new(),
+        };
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let status = response.start(&state)?;
+        let Some(boundary) = status.boundary.as_ref() else {
+            panic!("the first occurrence must suspend");
+        };
+        let instance_id = boundary.instance_id;
+        response.resume(instance_id, &state, BoundaryMode::Updatable)?;
+
+        let mut retained: Option<(usize, usize)> = None;
+        for _ in 0..4 {
+            response.update(instance_id, &state)?;
+            let Some(progress) = response.core.streaming.as_ref() else {
+                panic!("a live response must retain its progress");
+            };
+            let Some(Some(plan)) = progress.update_plans.first() else {
+                panic!("an updatable occurrence must retain its projection plan");
+            };
+            let observed = (plan.key_ids.capacity(), plan.key_ids.as_ptr().addr());
+            assert!(!plan.requires_full_state, "keyed islands project keys");
+            assert!(observed.0 > 0, "the plan must retain its key buffer");
+            match retained {
+                None => retained = Some(observed),
+                Some(previous) => assert_eq!(
+                    observed, previous,
+                    "every update must reuse the committed projection buffer"
+                ),
+            }
+        }
+        assert_eq!(
+            sink.output.matches(",2,0,{").count(),
+            4,
+            "each update emits exactly one typed state-update record"
+        );
+        Ok(())
+    }
+}
diff --git a/crates/webui-handler/src/streaming/state.rs b/crates/webui-handler/src/streaming/state.rs
index f0c737148..52fe818a3 100644
--- a/crates/webui-handler/src/streaming/state.rs
+++ b/crates/webui-handler/src/streaming/state.rs
@@ -59,7 +59,12 @@ pub(crate) struct StreamingRenderState<'data> {
     pub(super) checkpoint_walk_roots: Vec<(u32, Option<Box<str>>)>,
     pub(super) checkpoint_seen: Vec<u8>,
     pub(super) checkpoint_needs_expansion: bool,
-    pub(super) state_key_scratch: Vec<&'data str>,
+    /// Interned hydration key IDs for the record being committed.
+    ///
+    /// Integers instead of borrowed keys: the buffer outlives every semantic
+    /// step in [`StreamingProgress`], so a checkpoint or update never allocates
+    /// a fresh projection scratch.
+    pub(super) state_key_ids: Vec<u32>,
     pub(super) template_tag_scratch: Vec<&'data str>,
     pub(super) css_href_scratch: Vec<&'data str>,
     pub(super) style_spec_scratch: Vec<&'data str>,
@@ -69,7 +74,7 @@ pub(crate) struct StreamingRenderState<'data> {
 
 pub(super) struct StateUpdatePlan {
     pub(super) requires_full_state: bool,
-    pub(super) keys: Vec<Box<str>>,
+    pub(super) key_ids: Vec<u32>,
 }
 
 /// Owned state retained between calls by borrowed and host-owned sessions.
@@ -90,6 +95,7 @@ pub(crate) struct StreamingProgress {
     pub(super) checkpoint_walk_roots: Vec<(u32, Option<Box<str>>)>,
     pub(super) checkpoint_seen: Vec<u8>,
     pub(super) checkpoint_needs_expansion: bool,
+    pub(super) state_key_ids: Vec<u32>,
     pub(super) reachability_stack: Vec<u32>,
     pub(super) update_plans: Vec<Option<StateUpdatePlan>>,
 }
@@ -114,6 +120,7 @@ impl StreamingProgress {
             checkpoint_walk_roots: Vec::new(),
             checkpoint_seen: vec![0; inventory_bytes],
             checkpoint_needs_expansion: false,
+            state_key_ids: Vec::new(),
             reachability_stack: Vec::new(),
             update_plans: Vec::new(),
         }
@@ -128,7 +135,9 @@ impl<'data> StreamingRenderState<'data> {
         Self {
             component_reachability,
             pending_root: None,
-            state_key_scratch: Vec::with_capacity(crate::INITIAL_KEY_CAPACITY),
+            // Borrowed template/CSS scratch starts empty: only a record that
+            // delivers first-time component metadata ever fills it, so a
+            // steady-state step allocates nothing here.
             template_tag_scratch: Vec::new(),
             css_href_scratch: Vec::new(),
             style_spec_scratch: Vec::new(),
@@ -148,6 +157,7 @@ impl<'data> StreamingRenderState<'data> {
             checkpoint_walk_roots: progress.checkpoint_walk_roots,
             checkpoint_seen: progress.checkpoint_seen,
             checkpoint_needs_expansion: progress.checkpoint_needs_expansion,
+            state_key_ids: progress.state_key_ids,
             reachability_stack: progress.reachability_stack,
             update_plans: progress.update_plans,
         }
@@ -171,6 +181,7 @@ impl<'data> StreamingRenderState<'data> {
             checkpoint_walk_roots: self.checkpoint_walk_roots,
             checkpoint_seen: self.checkpoint_seen,
             checkpoint_needs_expansion: self.checkpoint_needs_expansion,
+            state_key_ids: self.state_key_ids,
             reachability_stack: self.reachability_stack,
             update_plans: self.update_plans,
         }
@@ -235,9 +246,16 @@ pub(crate) fn selected_state_snapshot(
 /// Merge the caller's state for this step into the retained continuation
 /// snapshot.
 ///
-/// Keys already present reuse their existing entry, so a host that supplies
-/// the same surface on every step pays no key allocation and lets
-/// [`serde_json::Value::clone_from`] reuse the previous value's buffers.
+/// Merging is *patch*, not replace: a key the caller omits keeps the value the
+/// snapshot already holds, and no key is ever removed. Only the projected
+/// surface is considered, so state a continuation never reads is not retained.
+///
+/// A value that is already identical is left alone, so a host resuming with the
+/// same surface every step copies nothing — the comparison walks the shared
+/// shape and stops at the first difference, while a copy would allocate a fresh
+/// tree for data the snapshot already holds. Keys that do change reuse their
+/// existing entry, letting [`serde_json::Value::clone_from`] reuse the previous
+/// value's buffers.
 pub(crate) fn overlay_selected_state(
     frozen: &mut serde_json::Value,
     state: &serde_json::Value,
@@ -257,7 +275,11 @@ pub(crate) fn overlay_selected_state(
             continue;
         };
         match target.get_mut(key.as_ref()) {
-            Some(slot) => slot.clone_from(value),
+            Some(slot) => {
+                if slot != value {
+                    slot.clone_from(value);
+                }
+            }
             None => {
                 target.insert(key.to_string(), value.clone());
             }
@@ -265,6 +287,11 @@ pub(crate) fn overlay_selected_state(
     }
 }
 
+/// Merge every top-level key of the caller's state into the retained snapshot.
+///
+/// Same patch semantics as [`overlay_selected_state`]: omitted keys keep their
+/// snapshot value, nothing is removed, and an unchanged subtree is neither
+/// copied nor reallocated.
 pub(crate) fn overlay_full_state(frozen: &mut serde_json::Value, state: &serde_json::Value) {
     let serde_json::Value::Object(source) = state else {
         return;
@@ -277,7 +304,11 @@ pub(crate) fn overlay_full_state(frozen: &mut serde_json::Value, state: &serde_j
     };
     for (key, value) in source {
         match target.get_mut(key) {
-            Some(slot) => slot.clone_from(value),
+            Some(slot) => {
+                if slot != value {
+                    slot.clone_from(value);
+                }
+            }
             None => {
                 target.insert(key.clone(), value.clone());
             }
diff --git a/crates/webui-handler/src/streaming/vm.rs b/crates/webui-handler/src/streaming/vm.rs
index 974815056..b637ff2a6 100644
--- a/crates/webui-handler/src/streaming/vm.rs
+++ b/crates/webui-handler/src/streaming/vm.rs
@@ -46,6 +46,50 @@ const CAPTURE_POOL_LIMIT: usize = 8;
 /// a component host, and one conditional or loop body) so the common response
 /// never reallocates its frame stack.
 const INITIAL_FRAME_CAPACITY: usize = 16;
+/// Records kept resolved while one semantic step walks the graph.
+///
+/// A step touches the record it entered, the parent it returns to, and at most
+/// a couple of enclosing hosts, so four entries cover the common continuation
+/// without turning the probe into a search.
+const RECORD_CACHE_SIZE: usize = 4;
+
+/// Bounded slot→record cache scoped to a single [`ContinuationVm::advance`].
+///
+/// Resolving a slot costs a dense-vector read plus a hash of the compiled
+/// record ID, and a step re-resolves the same few records every time it
+/// descends into a child and unwinds back to the parked parent. Caching the
+/// borrow for the duration of one step collapses those repeats to a handful of
+/// integer comparisons while keeping the VM itself lifetime-free between calls.
+struct RecordCache<'data> {
+    entries: [Option<(u32, &'data webui_protocol::FragmentList)>; RECORD_CACHE_SIZE],
+    next: usize,
+}
+
+impl<'data> RecordCache<'data> {
+    const fn new() -> Self {
+        Self {
+            entries: [None; RECORD_CACHE_SIZE],
+            next: 0,
+        }
+    }
+
+    /// Borrow the record for `slot`, resolving and retaining it on a miss.
+    fn record(
+        &mut self,
+        protocol: &'data crate::Protocol,
+        slot: u32,
+    ) -> Result<&'data webui_protocol::FragmentList> {
+        for (cached, list) in self.entries.iter().flatten() {
+            if *cached == slot {
+                return Ok(list);
+            }
+        }
+        let list = slot_fragment(protocol, slot)?;
+        self.entries[self.next] = Some((slot, list));
+        self.next = (self.next + 1) % RECORD_CACHE_SIZE;
+        Ok(list)
+    }
+}
 
 pub(crate) struct ContinuationVm {
     frames: Vec<Frame>,
@@ -77,8 +121,10 @@ pub(crate) struct ContinuationStatePlan {
 /// Building the plan can fail on a malformed protocol. Capturing that failure
 /// keeps the memo authoritative: a bad entry is diagnosed identically on every
 /// response without re-walking a graph that is already known to be unusable.
+/// The failure is boxed so the memo table stores one small cell per compiled
+/// record instead of reserving the diagnostic's payload for every slot.
 pub(crate) struct PreparedContinuationStatePlan {
-    result: std::result::Result<ContinuationStatePlan, ContinuationStatePlanError>,
+    result: std::result::Result<ContinuationStatePlan, Box<ContinuationStatePlanError>>,
 }
 
 enum ContinuationStatePlanError {
@@ -95,14 +141,14 @@ impl PreparedContinuationStatePlan {
                 entry_id,
                 super::session::MAX_FROZEN_STATE_KEYS,
             )
-            .map_err(ContinuationStatePlanError::capture),
+            .map_err(|error| Box::new(ContinuationStatePlanError::capture(error))),
         }
     }
 
     pub(crate) fn resolve(&self) -> Result<&ContinuationStatePlan> {
         self.result
             .as_ref()
-            .map_err(ContinuationStatePlanError::to_handler_error)
+            .map_err(|error| error.to_handler_error())
     }
 }
 
@@ -295,16 +341,23 @@ impl ContinuationVm {
         protocol: &'data crate::Protocol,
         context: &mut WebUIProcessContext<'data, '_, '_>,
     ) -> Result<StreamStatus> {
+        let mut records = RecordCache::new();
         while let Some(frame) = self.frames.pop() {
             match frame {
                 Frame::EnterFragment(slot) => {
-                    let frame = self.open_fragment(slot, protocol, context)?;
-                    if let Some(status) = self.run_fragment(frame, handler, protocol, context)? {
+                    let list = records.record(protocol, slot)?;
+                    let frame = open_fragment(slot, list, context);
+                    if let Some(status) =
+                        self.run_fragment(frame, list, (handler, protocol), context)?
+                    {
                         return Ok(status);
                     }
                 }
                 Frame::Fragment(frame) => {
-                    if let Some(status) = self.run_fragment(frame, handler, protocol, context)? {
+                    let list = records.record(protocol, frame.slot)?;
+                    if let Some(status) =
+                        self.run_fragment(frame, list, (handler, protocol), context)?
+                    {
                         return Ok(status);
                     }
                 }
@@ -391,41 +444,21 @@ impl ContinuationVm {
         })
     }
 
-    fn open_fragment(
-        &mut self,
-        slot: u32,
-        protocol: &crate::Protocol,
-        context: &WebUIProcessContext<'_, '_, '_>,
-    ) -> Result<FragmentFrame> {
-        let list = slot_fragment(protocol, slot)?;
-        let best_route = crate::route_renderer::find_best_route_match(
-            &list.fragments,
-            context.request_path,
-            &context.route_base,
-            context.route_index,
-        );
-        Ok(FragmentFrame {
-            slot,
-            index: 0,
-            best_route,
-        })
-    }
-
     /// Walk one fragment record until it descends, suspends, or ends.
     ///
-    /// The record is resolved once per entry and inert fragments never touch
-    /// the frame stack, so a boundary body costs one map lookup rather than one
-    /// per fragment. Only a construct that owns a child record (component,
-    /// condition, loop, route, outlet) or a discovered boundary parks the frame
-    /// and returns to the caller.
+    /// The record is resolved by the caller — once per step for the whole
+    /// descend/unwind cycle — and inert fragments never touch the frame stack,
+    /// so a boundary body costs no record lookups at all. Only a construct that
+    /// owns a child record (component, condition, loop, route, outlet) or a
+    /// discovered boundary parks the frame and returns to the caller.
     fn run_fragment<'data>(
         &mut self,
         mut frame: FragmentFrame,
-        handler: &WebUIHandler,
-        protocol: &'data crate::Protocol,
+        list: &'data webui_protocol::FragmentList,
+        runtime: (&WebUIHandler, &'data crate::Protocol),
         context: &mut WebUIProcessContext<'data, '_, '_>,
     ) -> Result<Option<StreamStatus>> {
-        let list = slot_fragment(protocol, frame.slot)?;
+        let (handler, protocol) = runtime;
         loop {
             let index = frame.index;
             let Some(fragment) = list.fragments.get(index) else {
@@ -1366,6 +1399,28 @@ fn fragment_slot(protocol: &crate::Protocol, id: &str) -> Result<u32> {
         .ok_or_else(|| HandlerError::MissingFragment(id.to_string()))
 }
 
+/// Park a freshly entered record, pre-selecting its best route match.
+///
+/// The record is already resolved by the caller's step-local cache, so entering
+/// a child costs no additional lookup.
+fn open_fragment(
+    slot: u32,
+    list: &webui_protocol::FragmentList,
+    context: &WebUIProcessContext<'_, '_, '_>,
+) -> FragmentFrame {
+    let best_route = crate::route_renderer::find_best_route_match(
+        &list.fragments,
+        context.request_path,
+        &context.route_base,
+        context.route_index,
+    );
+    FragmentFrame {
+        slot,
+        index: 0,
+        best_route,
+    }
+}
+
 /// Borrow the record a continuation frame is walking.
 fn slot_fragment(protocol: &crate::Protocol, slot: u32) -> Result<&webui_protocol::FragmentList> {
     let id = protocol
diff --git a/examples/integration/streaming-browser-bench/README.md b/examples/integration/streaming-browser-bench/README.md
index a4acf0a4e..53be6d64c 100644
--- a/examples/integration/streaming-browser-bench/README.md
+++ b/examples/integration/streaming-browser-bench/README.md
@@ -141,11 +141,31 @@ root proven hydrated** (successful-hydration count and reactive `setState`-probe
 count both equal 1500), zero residual scaffolding (scripts, sentinels, `wb:`
 comments, `[data-ws]`), no globally-published streamed state
 (`window.__webui.state` stays unset), the ordinary bundle contains no coordinator
-tokens (`webui-hydrate` / `data-webui-boundary`), measured component CPU is
-non-zero, distinct boundary-local states reach only their own real activation
-hooks, and the streaming entry adds no more than 17.5 KiB minified / 6 KiB
-gzip. Esbuild output is deterministic and the cap retains roughly 4% headroom, so
-further growth still fails.
+tokens (`webui-hydrate`, `data-webui-boundary`, the `data-ws-span` /
+`data-ws-enclosing` compiler span attributes, or open-span registry code),
+measured component CPU is non-zero, distinct boundary-local states reach only
+their own real activation hooks, and four absolute bundle-byte caps hold.
+
+The byte caps come in two kinds, and both are required:
+
+| Cap | Bytes | Measured | Headroom |
+|---|---|---|---|
+| ordinary minified | 63,500 | 60,528 | 4.7% |
+| ordinary gzip | 19,850 | 18,993 | 4.3% |
+| streaming incremental minified | 17,400 | 16,652 | 4.3% |
+| streaming incremental gzip | 6,190 | 5,928 | 4.2% |
+
+The **ordinary** caps are absolute because they bound what a *non-streaming* app
+downloads. The incremental caps alone cannot: they subtract the ordinary bundle,
+so bytes added to the always-shipped entry cancel out of them entirely. Component
+spans are the concrete case — the compiler attribute names and open-span registry
+live only in the opt-in coordinator, and `TemplateElement` receives an
+already-resolved bypass ancestor element it compares by identity.
+
+Esbuild output is deterministic, so ~4-5% headroom absorbs a minifier or
+toolchain nudge while still failing on real growth. The spec logs measured bytes
+and remaining headroom on every run; update the recorded numbers and the caps
+together, never a cap alone.
 
 Opt-in via `WEBUI_STREAMING_HYDRATION_ENFORCE=1` (noisy, off by default), each
 printing its effective cap:
diff --git a/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts b/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
index cd375da9f..60810ca6d 100644
--- a/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
+++ b/examples/integration/streaming-browser-bench/tests/hydration_matrix.spec.ts
@@ -17,9 +17,10 @@
  *
  * Deterministic correctness is always enforced (equal live roots, zero residual
  * scaffolding, no globally-published streamed state, coordinator-free ordinary
- * bundle, bounded coordinator bundle bytes). The noisy performance/memory gates
- * (component CPU <= single-boundary streaming one-shot * 1.05, bounded retained-
- * heap slope, bounded peak heap, linear elapsed growth) are opt-in via
+ * bundle, absolute ordinary bundle byte caps, bounded coordinator bundle
+ * bytes). The noisy performance/memory gates (component CPU <= single-boundary
+ * streaming one-shot * 1.05, bounded retained-heap slope, bounded peak heap,
+ * linear elapsed growth) are opt-in via
  * `WEBUI_STREAMING_HYDRATION_ENFORCE=1` so ordinary CI stays stable.
  *
  * # Baseline workflow (distinct from the transport snapshot)
@@ -93,15 +94,39 @@ const RETAINED_SLOPE_PCT = 2;
  *  scaffolding the control never allocates. */
 const PEAK_HEAP_ABS_FLOOR_BYTES = 512 * 1024;
 const PEAK_HEAP_TOLERANCE_PCT = 15;
-/** Deterministic production coordinator size caps. Raising either requires
- *  explicit review because every streaming application pays these bytes.
- *  The v2 coordinator includes checkpoint declaration/span validation, retained
- *  roots for state updates, span completion, terminal cleanup, commit marks, and
- *  the opt-in time-sliced drain. The reviewed production bundle is 17,147 bytes
- *  minified / 5,885 bytes gzip incrementally; these caps leave roughly 4%
- *  headroom, so further growth still fails. */
-const STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES = 17.5 * 1024;
-const STREAMING_INCREMENTAL_GZIP_CAP_BYTES = 6 * 1024;
+/**
+ * Deterministic production bundle-size caps. Raising any of them requires
+ * explicit review because every application pays these bytes.
+ *
+ * Two kinds are enforced, and both are needed:
+ *
+ * - **Absolute ordinary caps.** The always-shipped `@microsoft/webui-framework`
+ *   entry is what a *non-streaming* app downloads. Only an absolute cap catches
+ *   growth here, because the incremental metric below subtracts the ordinary
+ *   bundle — so code added to the always-shipped entry silently cancels out of
+ *   it. That is exactly how span-attribute parsing once reached every app while
+ *   the incremental number looked unchanged.
+ * - **Incremental coordinator caps.** Streaming bytes an app pays *on top of*
+ *   the ordinary entry: checkpoint/span validation, retained roots for state
+ *   updates, span completion, terminal cleanup, commit marks, and the opt-in
+ *   time-sliced drain.
+ *
+ * Measured with this exact fixture pipeline (esbuild, `minify: true`,
+ * `__WEBUI_DEV__=false`, `format: 'iife'`, `target: es2022`):
+ *
+ *   ordinary     60,528 minified / 18,993 gzip
+ *   streaming    77,180 minified / 24,921 gzip
+ *   incremental  16,652 minified /  5,928 gzip
+ *
+ * Each cap is that measurement plus ~4.5% headroom, so real growth fails while
+ * a minifier or toolchain nudge does not. The test logs the live numbers and
+ * the remaining headroom on every run — update both together, never the cap
+ * alone.
+ */
+const ORDINARY_MINIFIED_CAP_BYTES = 63_500;
+const ORDINARY_GZIP_CAP_BYTES = 19_850;
+const STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES = 17_400;
+const STREAMING_INCREMENTAL_GZIP_CAP_BYTES = 6_190;
 /** Marginal elapsed-time cap per added boundary. The relative allowance scales
  *  with slower hosts while the absolute floor absorbs sub-millisecond noise. */
 const COORDINATOR_MARGINAL_ABS_CAP_MS = 0.25;
@@ -327,16 +352,30 @@ test.describe('progressive streaming hydration matrix', () => {
     const fixtures: BuiltFixtures = await buildFixtures();
 
     const ordinaryTokens = coordinatorTokensIn(fixtures.ordinary.code);
-    expect(ordinaryTokens, 'ordinary bundle must be coordinator-free').toEqual([]);
+    expect(
+      ordinaryTokens,
+      'ordinary bundle must be coordinator-free (no boundary transport, no span attributes, no open-span registry)',
+    ).toEqual([]);
     // Sanity: the streaming bundle *does* carry the coordinator it advertises.
     expect(coordinatorTokensIn(fixtures.streaming.code).length).toBeGreaterThan(0);
+
+    // Absolute caps on the always-shipped entry. These are what stop growth
+    // there from being cancelled out of the incremental numbers below.
+    expect(
+      fixtures.ordinary.minifiedBytes,
+      `ordinary (always-shipped) minified bytes stay within ${ORDINARY_MINIFIED_CAP_BYTES}`,
+    ).toBeLessThanOrEqual(ORDINARY_MINIFIED_CAP_BYTES);
+    expect(
+      fixtures.ordinary.gzipBytes,
+      `ordinary (always-shipped) gzip bytes stay within ${ORDINARY_GZIP_CAP_BYTES}`,
+    ).toBeLessThanOrEqual(ORDINARY_GZIP_CAP_BYTES);
     expect(
       fixtures.streamingIncrementalBytes,
-      'streaming coordinator incremental minified bytes stay within the reviewed 17.5KiB cap',
+      `streaming coordinator incremental minified bytes stay within ${STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES}`,
     ).toBeLessThanOrEqual(STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES);
     expect(
       fixtures.streamingIncrementalGzipBytes,
-      'streaming coordinator incremental gzip bytes stay within the reviewed 6KiB cap',
+      `streaming coordinator incremental gzip bytes stay within ${STREAMING_INCREMENTAL_GZIP_CAP_BYTES}`,
     ).toBeLessThanOrEqual(STREAMING_INCREMENTAL_GZIP_CAP_BYTES);
 
     const bundle: BundleSizes = {
@@ -354,6 +393,20 @@ test.describe('progressive streaming hydration matrix', () => {
     console.log(`ordinary    | ${String(bundle.ordinaryMinifiedBytes).padStart(9)} | ${String(bundle.ordinaryGzipBytes).padStart(8)}`);
     console.log(`streaming   | ${String(bundle.streamingMinifiedBytes).padStart(9)} | ${String(bundle.streamingGzipBytes).padStart(8)}`);
     console.log(`incremental | ${String(bundle.streamingIncrementalBytes).padStart(9)} | ${String(bundle.streamingIncrementalGzipBytes).padStart(8)}`);
+    console.log('\nCap headroom (measured vs cap):');
+    for (
+      const [label, value, cap] of [
+        ['ordinary    minified', bundle.ordinaryMinifiedBytes, ORDINARY_MINIFIED_CAP_BYTES],
+        ['ordinary        gzip', bundle.ordinaryGzipBytes, ORDINARY_GZIP_CAP_BYTES],
+        ['incremental minified', bundle.streamingIncrementalBytes, STREAMING_INCREMENTAL_MINIFIED_CAP_BYTES],
+        ['incremental     gzip', bundle.streamingIncrementalGzipBytes, STREAMING_INCREMENTAL_GZIP_CAP_BYTES],
+      ] as const
+    ) {
+      console.log(
+        `${label} | ${String(value).padStart(6)} / ${String(cap).padStart(6)}`
+        + ` | ${(100 * (1 - value / cap)).toFixed(2)}% headroom`,
+      );
+    }
 
     // ── 2. Verify equal-total-work invariants across scenarios ───────
     const control = buildOrdinaryScenario();
diff --git a/examples/integration/streaming-browser-bench/tests/lib/fixtures.ts b/examples/integration/streaming-browser-bench/tests/lib/fixtures.ts
index 075f859a9..4bf73bf88 100644
--- a/examples/integration/streaming-browser-bench/tests/lib/fixtures.ts
+++ b/examples/integration/streaming-browser-bench/tests/lib/fixtures.ts
@@ -28,8 +28,26 @@ const here = dirname(fileURLToPath(import.meta.url));
  *  the framework's `./foo.js` intra-package imports to their `.ts` sources. */
 const FRAMEWORK_SRC = resolve(here, '..', '..', '..', '..', '..', 'packages', 'webui-framework', 'src');
 
-/** Coordinator wire tokens that must never leak into the ordinary bundle. */
-export const COORDINATOR_TOKENS = ['webui-hydrate', 'data-webui-boundary'] as const;
+/**
+ * Coordinator wire tokens that must never leak into the ordinary bundle.
+ *
+ * The first two are the boundary transport. The rest are component-span
+ * hydration: the compiler attribute names and the open-span registry that
+ * resolves them are coordinator-owned, and `TemplateElement` only ever
+ * receives an already-resolved bypass ancestor element it compares by
+ * identity. A leak here means a non-streaming app is paying for spans, which
+ * the incremental metric alone cannot detect — subtracting a grown ordinary
+ * bundle from a grown streaming bundle hides exactly this.
+ */
+export const COORDINATOR_TOKENS = [
+  'webui-hydrate',
+  'data-webui-boundary',
+  'data-ws-span',
+  'data-ws-enclosing',
+  'registerEnclosingSpans',
+  'prepareSpanCompletion',
+  'component span',
+] as const;
 
 export interface Fixture {
   readonly kind: 'ordinary' | 'streaming';
diff --git a/packages/webui-framework/README.md b/packages/webui-framework/README.md
index 3d92c45b2..7b90e0b2b 100644
--- a/packages/webui-framework/README.md
+++ b/packages/webui-framework/README.md
@@ -205,6 +205,13 @@ boundary uses a generated parent span, so an early compiler-marked child can
 hydrate before the opaque parent tail in light or shadow DOM. Authored
 boundaries cannot nest.
 
+Span resolution is entirely coordinator-owned: the generated `data-ws-span` and
+`data-ws-enclosing` attributes, and the open-span registry that pairs them, live
+only in the opt-in streaming entry. It resolves the one ancestor an entitled
+early child may skip and passes that element to the activation hook, which
+compares it by identity. The always-shipped entry therefore carries no span
+attribute name and no span bookkeeping at all.
+
 Each runtime occurrence receives an ephemeral state object directly during
 activation. The coordinator does not publish that state to
 `window.__webui.state`, and it removes generated checkpoint and span
diff --git a/packages/webui-framework/src/index-decoupling.test.ts b/packages/webui-framework/src/index-decoupling.test.ts
index b2536fa12..c125f2f53 100644
--- a/packages/webui-framework/src/index-decoupling.test.ts
+++ b/packages/webui-framework/src/index-decoupling.test.ts
@@ -41,6 +41,33 @@ import { fileURLToPath } from 'node:url';
  */
 const ALLOWED_STREAMING_MODULES = new Set(['./streaming-mode.js']);
 
+/**
+ * Tokens that must never reach the always-shipped bundle.
+ *
+ * Component-span hydration is an opt-in streaming feature: the compiler
+ * attribute names and the open-span registry that resolves them belong to the
+ * coordinator graph. `TemplateElement` receives an already-resolved bypass
+ * ancestor element and compares it by identity, so a non-streaming app pays
+ * nothing for spans. One leaked string literal is enough to show that contract
+ * broke — and because `streaming-mode.js` is allow-listed above, a leak there
+ * would slip past the module-reachability walk. So the reachable graph is also
+ * checked as text.
+ */
+const FORBIDDEN_ORDINARY_TOKENS = [
+  // Compiler-owned span attribute names.
+  'data-ws-span',
+  'data-ws-enclosing',
+  // Open-span registry surface.
+  'registerEnclosingSpans',
+  'prepareSpanCompletion',
+  'spanHostFor',
+  'openSpans',
+  'SpanInstanceId',
+  // Span registry diagnostics.
+  'span instance ',
+  'component span',
+] as const;
+
 /**
  * The one lazy-hydration module the default entry is allowed to reach.
  *
@@ -130,6 +157,42 @@ describe('default entry decoupling', () => {
     assert.ok(visited.size > 3, 'import-graph walk should visit multiple modules');
   });
 
+  test('the reachable default-entry graph contains no span attribute or registry token', () => {
+    const distDir = dirname(fileURLToPath(import.meta.url));
+    const visited = walkIndexImportGraph(distDir);
+
+    const leaks: string[] = [];
+    for (const spec of visited) {
+      let source: string;
+      try {
+        source = readFileSync(resolve(distDir, spec), 'utf8');
+      } catch {
+        continue;
+      }
+      for (const token of FORBIDDEN_ORDINARY_TOKENS) {
+        if (source.includes(token)) leaks.push(`${spec}: ${token}`);
+      }
+    }
+
+    assert.deepEqual(
+      leaks,
+      [],
+      'the default index entry must ship no component-span attribute names or ' +
+        `open-span registry code, but found: ${leaks.join(', ')}`,
+    );
+    // Sanity: the tokens are real — the opt-in streaming graph does carry them.
+    const dom = readFileSync(resolve(distDir, 'streaming-dom.js'), 'utf8');
+    assert.ok(
+      dom.includes('data-ws-span') && dom.includes('data-ws-enclosing'),
+      'expected the opt-in streaming graph to own the compiler span attributes',
+    );
+    const spans = readFileSync(resolve(distDir, 'streaming-spans.js'), 'utf8');
+    assert.ok(
+      spans.includes('registerEnclosingSpans'),
+      'expected the opt-in streaming graph to own the open-span registry',
+    );
+  });
+
   test('dist/index.js has no static or dynamic path to the lazy-hydration coordinator', () => {
     const distDir = dirname(fileURLToPath(import.meta.url));
 
diff --git a/packages/webui-framework/src/streaming-activation.ts b/packages/webui-framework/src/streaming-activation.ts
index acd39b238..c2266a38c 100644
--- a/packages/webui-framework/src/streaming-activation.ts
+++ b/packages/webui-framework/src/streaming-activation.ts
@@ -9,6 +9,7 @@ import {
 } from './streaming-deferred.js';
 import type {
   PendingBoundaryUpdates,
+  SpanBypass,
 } from './streaming-deferred.js';
 
 /**
@@ -22,7 +23,7 @@ export function activateRootsBetween(
   endMarker: Comment,
   state: Record<string, unknown> | undefined,
   updates?: PendingBoundaryUpdates,
-  bypassSpanInstanceId?: number,
+  bypass?: SpanBypass,
 ): void {
   const root = startMarker.parentNode;
   if (!root) {
@@ -36,12 +37,8 @@ export function activateRootsBetween(
     root,
     endMarker,
     state,
-    updates || bypassSpanInstanceId !== undefined
-      ? {
-        updates,
-        countRetention: updates !== undefined,
-        bypassSpanInstanceId,
-      }
+    updates || bypass
+      ? { updates, bypass, countRetention: updates !== undefined }
       : undefined,
   );
   if (!failure) return;
diff --git a/packages/webui-framework/src/streaming-cleanup.ts b/packages/webui-framework/src/streaming-cleanup.ts
index c992ae805..d35c5fbd3 100644
--- a/packages/webui-framework/src/streaming-cleanup.ts
+++ b/packages/webui-framework/src/streaming-cleanup.ts
@@ -2,29 +2,39 @@
 // Licensed under the MIT license.
 
 import {
-  BOUNDARY_END_PREFIX,
   BOUNDARY_SCRIPT_ATTR,
   BOUNDARY_START_PREFIX,
   firstNodeWithin,
+  isRangeEndMarker,
   MAX_MARKER_SCAN_NODES,
   nextAfterSubtreeWithin,
   nextWithinRoot,
   safeRemoveAttribute,
   safeRemove,
-  SPAN_END_PREFIX,
   SPAN_START_PREFIX,
-  streamingErrorMessage,
-} from './streaming-dom.js';
-import {
-  STREAMED_HOST_ATTR,
   STREAMING_ENCLOSING_SPAN_ATTR,
   STREAMING_SPAN_HOST_ATTR,
-} from './streaming-mode.js';
+  streamingErrorMessage,
+} from './streaming-dom.js';
+import { STREAMED_HOST_ATTR } from './streaming-mode.js';
 
 const STREAMING_BOUNDARY_ABANDON = Symbol.for(
   'microsoft.webui.boundaryAbandon',
 );
 
+/**
+ * Every compiler-owned attribute one streamed root can still be carrying.
+ *
+ * Listed once so the abandon check and the post-activation strip cannot drift
+ * apart, and so a future marker costs one array entry instead of two more
+ * call sites.
+ */
+const STREAMING_ROOT_ATTRS = [
+  STREAMED_HOST_ATTR,
+  STREAMING_SPAN_HOST_ATTR,
+  STREAMING_ENCLOSING_SPAN_ATTR,
+] as const;
+
 type BoundaryAbandonable = Element & {
   [STREAMING_BOUNDARY_ABANDON]?: () => void;
 };
@@ -55,15 +65,17 @@ export function abandonDeferredElement(el: Element): void {
 }
 
 function hasStreamingAttribute(el: Element): boolean {
-  return el.hasAttribute(STREAMED_HOST_ATTR) ||
-    el.hasAttribute(STREAMING_SPAN_HOST_ATTR) ||
-    el.hasAttribute(STREAMING_ENCLOSING_SPAN_ATTR);
+  for (let i = 0; i < STREAMING_ROOT_ATTRS.length; i++) {
+    if (el.hasAttribute(STREAMING_ROOT_ATTRS[i])) return true;
+  }
+  return false;
 }
 
-function removeStreamingAttributes(el: Element): void {
-  safeRemoveAttribute(el, STREAMED_HOST_ATTR);
-  safeRemoveAttribute(el, STREAMING_SPAN_HOST_ATTR);
-  safeRemoveAttribute(el, STREAMING_ENCLOSING_SPAN_ATTR);
+/** Strip every compiler-owned streaming marker from one finished root. */
+export function removeStreamingAttributes(el: Element): void {
+  for (let i = 0; i < STREAMING_ROOT_ATTRS.length; i++) {
+    safeRemoveAttribute(el, STREAMING_ROOT_ATTRS[i]);
+  }
 }
 
 /** Release a retained subtree after its undefined outer fails activation. */
@@ -98,7 +110,14 @@ function abandonDeferredNodes(
   }
 }
 
-/** Bounded failure-only sweep for roots preceding a missing sentinel. */
+/**
+ * Bounded failure-only sweep for roots preceding a missing sentinel.
+ *
+ * One walk, not two: the shared `abandonStreamingNodes` scan handles the
+ * document element in a real browser and each shadow root reached by the
+ * `getElementsByTagName('*')` fallback that a documentElement-less document
+ * (only reachable outside a parsed HTML document) falls back to.
+ */
 export function abandonDeferredDocumentRoots(): void {
   if (
     typeof document === 'undefined' ||
@@ -115,57 +134,47 @@ export function abandonDeferredDocumentRoots(): void {
   }
 
   const elements = document.getElementsByTagName('*');
-  let visited = 0;
-  for (
-    let i = 0;
-    i < elements.length && visited < MAX_MARKER_SCAN_NODES;
-    i++
-  ) {
+  const limit = elements.length < MAX_MARKER_SCAN_NODES
+    ? elements.length
+    : MAX_MARKER_SCAN_NODES;
+  for (let i = 0; i < limit; i++) {
     const el = elements[i];
-    visited++;
     abandonDeferredElement(el);
     const shadowRoot = el.shadowRoot;
-    let node: Node | null = shadowRoot?.firstChild ?? null;
-    while (node && visited < MAX_MARKER_SCAN_NODES) {
-      visited++;
-      if (node.nodeType === 1 /* ELEMENT_NODE */) {
-        abandonDeferredElement(node as Element);
-      }
-      node = nextWithinRoot(node, shadowRoot!);
-    }
+    if (shadowRoot) abandonStreamingNodes(shadowRoot.firstChild, shadowRoot);
   }
+}
 
-  function abandonStreamingNodes(first: Node | null, root: Node): void {
-    let node = first;
-    let visited = 0;
-    while (node && visited < MAX_MARKER_SCAN_NODES) {
-      visited++;
-      if (node.nodeType === 8 /* COMMENT_NODE */) {
-        const next = nextWithinRoot(node, root);
-        if (isStreamingMarker((node as Comment).data)) safeRemove(node);
-        node = next;
-        continue;
-      }
-      if (node.nodeType === 1 /* ELEMENT_NODE */) {
-        const el = node as Element;
-        const scaffold = el.tagName === 'WEBUI-HYDRATE' ||
-          el.hasAttribute(BOUNDARY_SCRIPT_ATTR);
-        const next = scaffold
-          ? nextAfterSubtreeWithin(node, root)
-          : nextWithinRoot(node, root);
-        abandonDeferredElement(el);
-        if (scaffold) safeRemove(el);
-        node = next;
-        continue;
-      }
-      node = nextWithinRoot(node, root);
+/** Strip streamed roots, generated scaffolding, and markers from one tree. */
+function abandonStreamingNodes(first: Node | null, root: Node): void {
+  let node = first;
+  let visited = 0;
+  while (node && visited < MAX_MARKER_SCAN_NODES) {
+    visited++;
+    if (node.nodeType === 8 /* COMMENT_NODE */) {
+      const next = nextWithinRoot(node, root);
+      if (isStreamingMarker((node as Comment).data)) safeRemove(node);
+      node = next;
+      continue;
+    }
+    if (node.nodeType === 1 /* ELEMENT_NODE */) {
+      const el = node as Element;
+      const scaffold = el.tagName === 'WEBUI-HYDRATE' ||
+        el.hasAttribute(BOUNDARY_SCRIPT_ATTR);
+      const next = scaffold
+        ? nextAfterSubtreeWithin(node, root)
+        : nextWithinRoot(node, root);
+      abandonDeferredElement(el);
+      if (scaffold) safeRemove(el);
+      node = next;
+      continue;
     }
+    node = nextWithinRoot(node, root);
   }
+}
 
-  function isStreamingMarker(data: string): boolean {
-    return data.startsWith(BOUNDARY_START_PREFIX) ||
-      data.startsWith(BOUNDARY_END_PREFIX) ||
-      data.startsWith(SPAN_START_PREFIX) ||
-      data.startsWith(SPAN_END_PREFIX);
-  }
+function isStreamingMarker(data: string): boolean {
+  return data.startsWith(BOUNDARY_START_PREFIX) ||
+    data.startsWith(SPAN_START_PREFIX) ||
+    isRangeEndMarker(data);
 }
diff --git a/packages/webui-framework/src/streaming-coordinator.ts b/packages/webui-framework/src/streaming-coordinator.ts
index 38ab9cec7..cc4d0e803 100644
--- a/packages/webui-framework/src/streaming-coordinator.ts
+++ b/packages/webui-framework/src/streaming-coordinator.ts
@@ -31,14 +31,14 @@ import {
   pendingUndefinedRootCountForTests,
   resetDeferredActivationForTests,
 } from './streaming-deferred.js';
-import type { PendingBoundaryUpdates } from './streaming-deferred.js';
+import type { PendingBoundaryUpdates, SpanBypass } from './streaming-deferred.js';
 import {
   findBoundaryScript,
   findRangeEndMarkerByPrefix,
   findRangeStartMarkerByPrefix,
+  markerlessRecordViolation,
   removeBoundaryScaffolding,
   resolveBoundaryRange,
-  resolveMarkerlessRecord,
   resolveSpanRange,
   streamingErrorMessage,
 } from './streaming-dom.js';
@@ -61,9 +61,9 @@ import {
   completeSpan,
   hasOpenSpans,
   openSpanCountForTests,
+  prepareSpanCompletion,
   registerEnclosingSpans,
-  registerSpanCompletionTarget,
-  validateSpanCompletion,
+  spanHostFor,
 } from './streaming-spans.js';
 
 const MAX_QUEUED_BOUNDARIES = 512;
@@ -284,10 +284,26 @@ function processSentinel(sentinel: Element): void {
     return;
   }
 
-  if (kind === RECORD_KIND_STATE_UPDATE) {
-    const markerless = resolveMarkerlessRecord(scriptEl, 'state update');
-    if (!markerless.ok) {
-      failBoundary(sentinel, markerless.reason);
+  if (kind === RECORD_KIND_STATE_UPDATE || kind === RECORD_KIND_TERMINAL) {
+    const terminal = kind === RECORD_KIND_TERMINAL;
+    const violation = markerlessRecordViolation(
+      scriptEl,
+      terminal ? 'terminal' : 'state update',
+    );
+    if (violation) {
+      failBoundary(sentinel, violation);
+      return;
+    }
+    if (terminal) {
+      if (hasOpenSpans()) {
+        failBoundary(
+          sentinel,
+          'terminal record arrived before every component span completed',
+        );
+        return;
+      }
+      nextExpectedRecordSequence++;
+      commitTerminal(sequence, sentinel, scriptEl);
       return;
     }
     const boundary = updatableBoundaries.get(target);
@@ -310,24 +326,6 @@ function processSentinel(sentinel: Element): void {
     return;
   }
 
-  if (kind === RECORD_KIND_TERMINAL) {
-    const markerless = resolveMarkerlessRecord(scriptEl, 'terminal');
-    if (!markerless.ok) {
-      failBoundary(sentinel, markerless.reason);
-      return;
-    }
-    if (hasOpenSpans()) {
-      failBoundary(
-        sentinel,
-        'terminal record arrived before every component span completed',
-      );
-      return;
-    }
-    nextExpectedRecordSequence++;
-    commitTerminal(sequence, sentinel, scriptEl);
-    return;
-  }
-
   if (kind === RECORD_KIND_SPAN_COMPLETION) {
     const resolved = resolveSpanRange(scriptEl, target);
     if (!resolved.ok) {
@@ -335,11 +333,13 @@ function processSentinel(sentinel: Element): void {
       return;
     }
     nextExpectedRecordSequence++;
-    commitSpanCompletion(
+    commitRecord(
+      true,
       payload as SpanCompletionPayload,
       resolved.range,
       sequence,
       target,
+      false,
       sentinel,
       scriptEl,
     );
@@ -369,7 +369,8 @@ function processSentinel(sentinel: Element): void {
 
   nextExpectedRecordSequence++;
   nextExpectedBoundaryInstanceId++;
-  commitCheckpoint(
+  commitRecord(
+    false,
     payload as BoundaryBootstrap,
     resolved.range,
     sequence,
@@ -380,8 +381,19 @@ function processSentinel(sentinel: Element): void {
   );
 }
 
-function commitCheckpoint(
-  bootstrap: BoundaryBootstrap,
+/**
+ * Run one range-hydrating record inside the shared commit shell.
+ *
+ * Checkpoints and span completions differ only in what they hydrate; the
+ * lifecycle accounting, failure policy, scaffold removal, and commit
+ * notification are identical, so they are written once here. The body is
+ * selected by a numeric op rather than a callback so a commit still allocates
+ * nothing, and both the mark and the failure message are built only on the
+ * path that actually needs them.
+ */
+function commitRecord(
+  span: boolean,
+  payload: BoundaryBootstrap | SpanCompletionPayload,
   range: HydrationRange,
   sequence: number,
   target: number,
@@ -392,43 +404,23 @@ function commitCheckpoint(
   markBoundaryPending();
   let committed = false;
   try {
-    if (
-      bootstrap.enclosingSpanInstanceId !== undefined &&
-      range.start?.parentNode
-    ) {
-      const invalid = registerEnclosingSpans(
-        range.start.parentNode,
-        bootstrap.enclosingSpanInstanceId,
-      );
-      if (invalid) throw new Error(invalid);
-    }
-    applyBoundaryBootstrap(bootstrap);
-    if (range.start && range.end) {
-      const boundary: UpdatableBoundary | undefined = updatable
-        ? { roots: [], active: true, retained: 0, pendingRoots: 0 }
-        : undefined;
-      activateRootsBetween(
-        range.start,
-        range.end,
-        bootstrap.state,
-        boundary,
-        bootstrap.enclosingSpanInstanceId,
+    if (span) {
+      hydrateSpanCompletion(payload as SpanCompletionPayload, range, target);
+    } else {
+      hydrateCheckpoint(
+        payload as BoundaryBootstrap,
+        range,
+        target,
+        updatable,
       );
-      if (boundary) retainUpdatableBoundary(target, boundary);
-    } else if (updatable) {
-      retainUpdatableBoundary(target, {
-        roots: [],
-        active: true,
-        retained: 0,
-        pendingRoots: 0,
-      });
     }
     committed = true;
   } catch (error) {
+    const detail = streamingErrorMessage(error);
     fail(
-      `error committing boundary ${sequence}: ${
-        streamingErrorMessage(error)
-      }`,
+      span
+        ? `error completing span ${target}: ${detail}`
+        : `error committing boundary ${sequence}: ${detail}`,
     );
   } finally {
     removeBoundaryScaffolding(
@@ -438,56 +430,68 @@ function commitCheckpoint(
       range.end,
     );
     if (committed) {
-      notifyCommit(`${BOUNDARY_MARK_PREFIX}${target}`, sequence, 'checkpoint');
+      notifyCommit(
+        `${span ? SPAN_MARK_PREFIX : BOUNDARY_MARK_PREFIX}${target}`,
+        sequence,
+        span ? 'span' : 'checkpoint',
+      );
     }
     markBoundaryCommitted(false);
   }
 }
 
-function commitSpanCompletion(
-  payload: SpanCompletionPayload,
+function hydrateCheckpoint(
+  bootstrap: BoundaryBootstrap,
   range: HydrationRange,
-  sequence: number,
   target: number,
-  sentinel: Element,
-  scriptEl: Element,
+  updatable: boolean,
 ): void {
-  markBoundaryPending();
-  let committed = false;
-  try {
-    const registrationError = registerSpanCompletionTarget(target, range);
-    if (registrationError) throw new Error(registrationError);
-    const invalid = validateSpanCompletion(target, range);
+  let bypass: SpanBypass | undefined;
+  const enclosing = bootstrap.enclosingSpanInstanceId;
+  if (enclosing !== undefined && range.start?.parentNode) {
+    const invalid = registerEnclosingSpans(range.start.parentNode, enclosing);
     if (invalid) throw new Error(invalid);
-    applyBoundaryBootstrap(payload);
-    if (!range.start || !range.end) {
-      throw new Error(`span ${target} completion is markerless`);
-    }
+    // Resolved once per boundary, never per root: the activation walk compares
+    // this element by identity, so `TemplateElement` never sees a span
+    // attribute name and the always-shipped bundle never carries one.
+    const host = spanHostFor(enclosing);
+    if (host) bypass = { id: String(enclosing), host };
+  }
+  applyBoundaryBootstrap(bootstrap);
+  if (range.start && range.end) {
+    const boundary: UpdatableBoundary | undefined = updatable
+      ? newUpdatableBoundary()
+      : undefined;
     activateRootsBetween(
       range.start,
       range.end,
-      payload.state,
-    );
-    completeSpan(target);
-    committed = true;
-  } catch (error) {
-    fail(
-      `error completing span ${target}: ${streamingErrorMessage(error)}`,
-    );
-  } finally {
-    removeBoundaryScaffolding(
-      sentinel,
-      scriptEl,
-      range.start,
-      range.end,
+      bootstrap.state,
+      boundary,
+      bypass,
     );
-    if (committed) {
-      notifyCommit(`${SPAN_MARK_PREFIX}${target}`, sequence, 'span');
-    }
-    markBoundaryCommitted(false);
+    if (boundary) retainUpdatableBoundary(target, boundary);
+  } else if (updatable) {
+    retainUpdatableBoundary(target, newUpdatableBoundary());
   }
 }
 
+function newUpdatableBoundary(): UpdatableBoundary {
+  return { roots: [], active: true, retained: 0, pendingRoots: 0 };
+}
+
+function hydrateSpanCompletion(
+  payload: SpanCompletionPayload,
+  range: HydrationRange,
+  target: number,
+): void {
+  const invalid = prepareSpanCompletion(target, range);
+  if (invalid) throw new Error(invalid);
+  applyBoundaryBootstrap(payload);
+  // `prepareSpanCompletion` already rejected a markerless range.
+  activateRootsBetween(range.start!, range.end!, payload.state);
+  completeSpan(target);
+}
+
 function failRangeResolution(
   sentinel: Element,
   scriptEl: Element,
diff --git a/packages/webui-framework/src/streaming-deferred.ts b/packages/webui-framework/src/streaming-deferred.ts
index 0b00bcc17..106f9e03e 100644
--- a/packages/webui-framework/src/streaming-deferred.ts
+++ b/packages/webui-framework/src/streaming-deferred.ts
@@ -8,6 +8,7 @@ import {
 import {
   abandonDeferredDescendants,
   abandonDeferredElement,
+  removeStreamingAttributes,
 } from './streaming-cleanup.js';
 import {
   firstNodeWithin,
@@ -15,14 +16,12 @@ import {
   MAX_MARKER_SCAN_NODES,
   nextAfterSubtreeWithin,
   nextWithinRoot,
-  safeRemoveAttribute,
+  STREAMING_ENCLOSING_SPAN_ATTR,
   streamingErrorMessage,
 } from './streaming-dom.js';
 import {
   PENDING_ROOT_CONNECTED,
-  STREAMING_ENCLOSING_SPAN_ATTR,
   STREAMED_HOST_ATTR,
-  STREAMING_SPAN_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
 import { applyStateUpdate } from './streaming-state.js';
@@ -42,26 +41,50 @@ export const MAX_PENDING_BARRIER_ROOTS = 50_000;
 type BoundaryActivatable = Element & {
   [STREAMING_BOUNDARY_ACTIVATE]?: (
     state?: Record<string, unknown>,
-    bypassSpanInstanceId?: number,
+    bypassAncestor?: Element,
   ) => number;
 };
 
+/**
+ * The one unfinished component host an early boundary's marked roots may skip.
+ *
+ * Allocated once per boundary that declares an enclosing span, never per root.
+ * `id` is the canonical decimal SpanInstanceId the compiler wrote onto both the
+ * host (`data-ws-span`) and the entitled early roots (`data-ws-enclosing`);
+ * `host` is the element that attribute already resolved to. Matching here and
+ * handing the element itself to the activation hook is what keeps every span
+ * attribute name out of the always-shipped bundle.
+ */
+export interface SpanBypass {
+  readonly id: string;
+  readonly host: Element;
+}
+
 interface PendingTagWaiter {
   readonly generation: number;
   readonly roots: Set<Element>;
 }
 
+/**
+ * Everything one deferred root must replay when it finally activates.
+ *
+ * Held as a single symbol-keyed record rather than three parallel properties:
+ * one hidden-class transition per retained root instead of three, one delete
+ * instead of three, and no absent-vs-`undefined` sentinels.
+ */
+interface PendingRootRecord {
+  readonly state: Record<string, unknown> | undefined;
+  readonly updates: PendingBoundaryUpdates | undefined;
+  readonly bypass: SpanBypass | undefined;
+}
+
 const pendingTagWaiters = new Map<string, PendingTagWaiter>();
 const pendingBarrierRoots = new Set<Element>();
 let pendingUndefinedRoots = 0;
 let activationGeneration = 0;
 let failureHandler: ((reason: string) => void) | null = null;
 
-const PENDING_BOUNDARY_STATE = Symbol();
-const PENDING_BOUNDARY_UPDATES = Symbol();
-const PENDING_BYPASS_SPAN = Symbol();
-const NO_BOUNDARY_STATE: unique symbol = Symbol();
-const NO_BYPASS_SPAN: unique symbol = Symbol();
+const PENDING_RECORD = Symbol();
 
 /** One boundary-owned shallow patch shared by every deferred root. */
 export interface PendingBoundaryUpdates {
@@ -91,7 +114,7 @@ export interface PendingBoundaryUpdates {
 export interface DeferredActivationOptions {
   updates?: PendingBoundaryUpdates;
   /** Span barrier this boundary's compiler-marked early roots may bypass. */
-  bypassSpanInstanceId?: number;
+  bypass?: SpanBypass;
   /**
    * Set only by the checkpoint scan, which owns the boundary's retention
    * budget. A late activation re-walks a subtree the scan already counted, so
@@ -118,6 +141,18 @@ function fail(reason: string): void {
   failureHandler(reason);
 }
 
+function tagOf(el: Element): string {
+  return el.tagName.toLowerCase();
+}
+
+function missingTemplateReason(tag: string): string {
+  return `template metadata missing while activating <${tag}>`;
+}
+
+function barrierLimitReason(): string {
+  return `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`;
+}
+
 /**
  * Deliver a replayed patch, halting when the target cannot accept one.
  *
@@ -133,9 +168,22 @@ function requireStateUpdate(
   patch: Record<string, unknown>,
 ): void {
   if (applyStateUpdate(el, patch)) return;
-  fail(
-    `<${el.tagName.toLowerCase()}> activated without a setState() method`,
-  );
+  fail(`<${tagOf(el)}> activated without a setState() method`);
+}
+
+/** Join one activated root to its boundary and replay any collapsed patch. */
+function joinBoundaryUpdates(
+  el: Element,
+  updates: PendingBoundaryUpdates,
+): void {
+  // Joining only on a known-good outcome is what keeps a failed or ignored
+  // element out of the update set for the life of the page.
+  if (updates.active) updates.roots.push(el);
+  // Replayed rather than merged into hydration state: `$hydrate` wires
+  // bindings against the server's bytes without evaluating them, so seeding a
+  // post-render value first would bind the old branch while the element
+  // believed it held the new one.
+  if (updates.patch) requireStateUpdate(el, updates.patch);
 }
 
 /**
@@ -149,9 +197,9 @@ function activateMarkedElement(
   el: Element,
   state: Record<string, unknown> | undefined,
   updates?: PendingBoundaryUpdates,
-  bypassSpanInstanceId?: number,
+  bypass?: SpanBypass,
 ): number {
-  const tag = el.tagName.toLowerCase();
+  const tag = tagOf(el);
   if (tag.indexOf('-') === -1) return ELEMENT_IGNORED;
 
   if (customElements.get(tag)) {
@@ -160,31 +208,21 @@ function activateMarkedElement(
     }
     // A definition waiter still owns this root until its shared reaction runs.
     // Consuming its state here would leave the waiter count and lifecycle stuck.
-    if (hasPendingState(el)) return ELEMENT_DEFERRED;
-    const outcome = invokeActivationHook(
-      el,
-      state,
-      bypassSpanInstanceId,
-    );
+    if (hasPendingRecord(el)) return ELEMENT_DEFERRED;
+    const outcome = invokeActivationHook(el, state, bypass);
     if (outcome !== ACTIVATION_ANCESTOR_BARRIER) return outcome;
     if (pendingBarrierRoots.size >= MAX_PENDING_BARRIER_ROOTS) {
       return ELEMENT_BARRIER_LIMIT_FAILURE;
     }
-    stashPendingState(el, state, updates, bypassSpanInstanceId);
-    pendingBarrierRoots.add(el);
-    (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
+    deferBehindBarrier(el, state, updates, bypass);
     return ELEMENT_DEFERRED;
   }
 
-  if (
-    !hasPendingState(el) &&
-    pendingUndefinedRoots >= MAX_PENDING_UNDEFINED_ROOTS
-  ) {
-    return ELEMENT_LIMIT_FAILURE;
-  }
-
-  if (!hasPendingState(el)) {
-    stashPendingState(el, state, updates, bypassSpanInstanceId);
+  if (!hasPendingRecord(el)) {
+    if (pendingUndefinedRoots >= MAX_PENDING_UNDEFINED_ROOTS) {
+      return ELEMENT_LIMIT_FAILURE;
+    }
+    stashPendingRecord(el, state, updates, bypass);
   }
   let waiter = pendingTagWaiters.get(tag);
   if (!waiter) {
@@ -204,38 +242,26 @@ function activateMarkedElement(
   return ELEMENT_DEFERRED;
 }
 
+/** Retain one root whose hook reported an unfinished ancestor barrier. */
+function deferBehindBarrier(
+  el: Element,
+  state: Record<string, unknown> | undefined,
+  updates: PendingBoundaryUpdates | undefined,
+  bypass: SpanBypass | undefined,
+): void {
+  stashPendingRecord(el, state, updates, bypass);
+  pendingBarrierRoots.add(el);
+  (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
+}
+
 function activatePendingBarrierRoot(el: Element): number {
   if (!pendingBarrierRoots.delete(el)) return ELEMENT_IGNORED;
   delete (el as PendingRoot)[PENDING_ROOT_CONNECTED];
-  let updates: PendingBoundaryUpdates | undefined;
+  const record = takePendingRecord(el);
+  const updates = releaseUpdates(record);
   try {
-    updates = takePendingUpdates(el);
-    const state = takePendingState(el);
-    const bypassSpanInstanceId = takePendingBypassSpan(el);
-    const outcome = invokeActivationHook(
-      el,
-      state,
-      bypassSpanInstanceId,
-    );
-    if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
-      stashPendingState(
-        el,
-        state,
-        updates,
-        bypassSpanInstanceId,
-      );
-      pendingBarrierRoots.add(el);
-      (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
-      return ELEMENT_DEFERRED;
-    }
-    if (
-      updates &&
-      (outcome === ACTIVATION_ACTIVATED ||
-        outcome === ACTIVATION_STATIC_HOST_OPT_OUT)
-    ) {
-      if (updates.active) updates.roots.push(el);
-      if (updates.patch) requireStateUpdate(el, updates.patch);
-    }
+    const outcome = resumeRetainedRoot(el, record, updates);
+    if (outcome === ACTIVATION_ANCESTOR_BARRIER) return ELEMENT_DEFERRED;
     return outcome === ACTIVATION_MISSING_TEMPLATE
       ? outcome
       : ELEMENT_ACTIVATED_FROM_PENDING;
@@ -244,22 +270,44 @@ function activatePendingBarrierRoot(el: Element): number {
   }
 }
 
+/**
+ * Re-run one retained root's activation and hand back the raw outcome.
+ *
+ * Shared by both retention reasons — an undefined tag and an unfinished
+ * ancestor barrier — because they differ only in the bookkeeping around the
+ * call. A root still behind a barrier is re-retained here so neither caller
+ * can forget to, and an activated root joins its boundary parent-first,
+ * before any descendant walk.
+ */
+function resumeRetainedRoot(
+  el: Element,
+  record: PendingRootRecord | undefined,
+  updates: PendingBoundaryUpdates | undefined,
+): number {
+  const outcome = invokeActivationHook(el, record?.state, record?.bypass);
+  if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
+    deferBehindBarrier(el, record?.state, updates, record?.bypass);
+  } else if (
+    updates &&
+    (outcome === ACTIVATION_ACTIVATED ||
+      outcome === ACTIVATION_STATIC_HOST_OPT_OUT)
+  ) {
+    joinBoundaryUpdates(el, updates);
+  }
+  return outcome;
+}
+
 /** Resume coordinator-owned activation when a component barrier releases. */
 function resumeBarrierRoot(this: Element): void {
   try {
     const outcome = activatePendingBarrierRoot(this);
     if (outcome === ACTIVATION_MISSING_TEMPLATE) {
-      abandonDeferredDescendants(this);
-      abandonDeferredElement(this);
-      fail(
-        `template metadata missing while activating <${
-          this.tagName.toLowerCase()
-        }>`,
-      );
+      abandonDeferredTree(this);
+      fail(missingTemplateReason(tagOf(this)));
     }
   } catch (error) {
     abandonDeferredDescendants(this);
-    reportActivationFailure(this.tagName.toLowerCase(), error);
+    reportActivationFailure(tagOf(this), error);
   }
 }
 
@@ -297,7 +345,7 @@ function onTagDefined(tag: string, generation: number): void {
 
 /** Shared reconnect seam for roots that were undefined at checkpoint time. */
 function resumePendingRoot(this: Element): void {
-  const tag = this.tagName.toLowerCase();
+  const tag = tagOf(this);
   const waiter = pendingTagWaiters.get(tag);
   if (
     !waiter ||
@@ -318,58 +366,31 @@ function activatePendingRoot(
   if (!waiter.roots.delete(el)) return;
   pendingUndefinedRoots--;
   delete (el as PendingRoot)[PENDING_ROOT_CONNECTED];
-  let updates: PendingBoundaryUpdates | undefined;
+  const record = takePendingRecord(el);
+  const updates = releaseUpdates(record);
+  const state = record?.state;
+  const bypass = record?.bypass;
   try {
-    updates = takePendingUpdates(el);
-    const state = takePendingState(el);
-    const bypassSpanInstanceId = takePendingBypassSpan(el);
-    const outcome = invokeActivationHook(
-      el,
-      state,
-      bypassSpanInstanceId,
-    );
+    const outcome = resumeRetainedRoot(el, record, updates);
     if (outcome === ACTIVATION_MISSING_TEMPLATE) {
-      abandonDeferredDescendants(el);
-      abandonDeferredElement(el);
-      fail(`template metadata missing while activating <${tag}>`);
+      abandonDeferredTree(el);
+      fail(missingTemplateReason(tag));
       return;
     }
     if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
-      if (pendingBarrierRoots.size >= MAX_PENDING_BARRIER_ROOTS) {
-        abandonDeferredDescendants(el);
-        abandonDeferredElement(el);
-        fail(
-          `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`,
-        );
-        return;
+      // Re-retained by `resumeRetainedRoot`; only the budget is enforced here.
+      if (pendingBarrierRoots.size > MAX_PENDING_BARRIER_ROOTS) {
+        abandonDeferredTree(el);
+        fail(barrierLimitReason());
       }
-      stashPendingState(
-        el,
-        state,
-        updates,
-        bypassSpanInstanceId,
-      );
-      pendingBarrierRoots.add(el);
-      (el as PendingRoot)[PENDING_ROOT_CONNECTED] = resumeBarrierRoot;
       return;
     }
-    // Parent first, and before the descendant walk: this root's own patch may
-    // tear down the branch its retained descendants live in, and activating a
-    // root inside an already-discarded branch is worse than never reaching it.
-    if (updates) {
-      if (updates.active) updates.roots.push(el);
-      if (updates.patch) requireStateUpdate(el, updates.patch);
-    }
     const failure = activateDeferredTree(
       firstNodeWithin(el),
       el,
       null,
       state,
-      updates
-        ? { updates, bypassSpanInstanceId }
-        : bypassSpanInstanceId === undefined
-        ? undefined
-        : { bypassSpanInstanceId },
+      updates || bypass ? { updates, bypass } : undefined,
     );
     if (failure) fail(failure);
   } catch (error) {
@@ -403,7 +424,7 @@ export function activateDeferredTree(
   // Hoisted out of the walk: these are read once per node otherwise, and this
   // loop runs over every node of every boundary.
   const updates = options?.updates;
-  const bypassSpanInstanceId = options?.bypassSpanInstanceId;
+  const bypass = options?.bypass;
   const countRetention =
     options?.countRetention === true && updates !== undefined;
   let node = first;
@@ -445,45 +466,28 @@ export function activateDeferredTree(
       if (marked) {
         const el = node as Element;
         try {
-          const outcome = activateMarkedElement(
-            el,
-            state,
-            updates,
-            bypassSpanInstanceId,
-          );
+          const outcome = activateMarkedElement(el, state, updates, bypass);
           if (outcome === ACTIVATION_MISSING_TEMPLATE) {
-            return `template metadata missing while activating <${
-              el.tagName.toLowerCase()
-            }>`;
+            return missingTemplateReason(tagOf(el));
           }
           if (outcome === ELEMENT_LIMIT_FAILURE) {
             return `pending undefined root count exceeds ${MAX_PENDING_UNDEFINED_ROOTS}`;
           }
           if (outcome === ELEMENT_BARRIER_LIMIT_FAILURE) {
-            return `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`;
+            return barrierLimitReason();
           }
           if (outcome === ELEMENT_DEFERRED) {
             resumeAfterDeferred = nextAfterSubtreeWithin(node, root);
             skippingDeferredDescendants = true;
           } else if (
             updates &&
-            outcome !== ELEMENT_ACTIVATED_FROM_PENDING &&
             (outcome === ACTIVATION_ACTIVATED ||
               outcome === ACTIVATION_STATIC_HOST_OPT_OUT)
           ) {
-            // Joining here, on a known-good outcome, is what keeps a failed or
-            // ignored element out of the update set for the life of the page.
-            if (updates.active) updates.roots.push(el);
-            // Replayed rather than merged into hydration state: `$hydrate` wires
-            // bindings against the server's bytes without evaluating them, so
-            // seeding a post-render value first would bind the old branch while
-            // the element believed it held the new one.
-            if (updates.patch) {
-              requireStateUpdate(el, updates.patch);
-            }
+            joinBoundaryUpdates(el, updates);
           }
         } catch (error) {
-          reportActivationFailure(el.tagName.toLowerCase(), error);
+          reportActivationFailure(tagOf(el), error);
         }
       }
     }
@@ -502,6 +506,12 @@ function reportActivationFailure(tag: string, error: unknown): void {
   );
 }
 
+/** Release one failed root together with the subtree it was gating. */
+function abandonDeferredTree(el: Element): void {
+  abandonDeferredDescendants(el);
+  abandonDeferredElement(el);
+}
+
 /** Balance and clear every pending undefined-tag waiter exactly once. */
 export function abandonPendingWaiters(): void {
   if (pendingBarrierRoots.size !== 0) {
@@ -519,65 +529,47 @@ export function abandonPendingWaiters(): void {
 }
 
 function clearPendingRoot(el: Element): void {
-  if (hasPendingState(el)) {
-    takePendingState(el);
-    takePendingBypassSpan(el);
-  }
-  takePendingUpdates(el);
+  releaseUpdates(takePendingRecord(el));
   delete (el as PendingRoot)[PENDING_ROOT_CONNECTED];
-  abandonDeferredDescendants(el);
-  abandonDeferredElement(el);
+  abandonDeferredTree(el);
 }
 
-function stashPendingState(
+function stashPendingRecord(
   el: Element,
   state: Record<string, unknown> | undefined,
-  updates?: PendingBoundaryUpdates,
-  bypassSpanInstanceId?: number,
+  updates: PendingBoundaryUpdates | undefined,
+  bypass: SpanBypass | undefined,
 ): void {
-  const store = el as unknown as Record<symbol, unknown>;
-  store[PENDING_BOUNDARY_STATE] =
-    state === undefined ? NO_BOUNDARY_STATE : state;
-  store[PENDING_BYPASS_SPAN] = bypassSpanInstanceId === undefined
-    ? NO_BYPASS_SPAN
-    : bypassSpanInstanceId;
-  if (updates) {
-    store[PENDING_BOUNDARY_UPDATES] = updates;
-    updates.pendingRoots++;
-  }
+  (el as unknown as Record<symbol, PendingRootRecord>)[PENDING_RECORD] = {
+    state,
+    updates,
+    bypass,
+  };
+  if (updates) updates.pendingRoots++;
 }
 
-function hasPendingState(el: Element): boolean {
-  return Object.prototype.hasOwnProperty.call(
-    el,
-    PENDING_BOUNDARY_STATE,
-  );
+function hasPendingRecord(el: Element): boolean {
+  return Object.prototype.hasOwnProperty.call(el, PENDING_RECORD);
 }
 
-function takePendingState(
-  el: Element,
-): Record<string, unknown> | undefined {
-  const store = el as unknown as Record<symbol, unknown>;
-  const stored = store[PENDING_BOUNDARY_STATE];
-  delete store[PENDING_BOUNDARY_STATE];
-  return stored === NO_BOUNDARY_STATE
-    ? undefined
-    : (stored as Record<string, unknown> | undefined);
-}
-
-function takePendingBypassSpan(el: Element): number | undefined {
-  const store = el as unknown as Record<symbol, unknown>;
-  const stored = store[PENDING_BYPASS_SPAN];
-  delete store[PENDING_BYPASS_SPAN];
-  return stored === NO_BYPASS_SPAN ? undefined : stored as number | undefined;
-}
-
-function takePendingUpdates(el: Element): PendingBoundaryUpdates | undefined {
-  const store = el as unknown as Record<symbol, unknown>;
-  const updates = store[PENDING_BOUNDARY_UPDATES] as
-    | PendingBoundaryUpdates
-    | undefined;
-  delete store[PENDING_BOUNDARY_UPDATES];
+function takePendingRecord(el: Element): PendingRootRecord | undefined {
+  const store = el as unknown as Record<symbol, PendingRootRecord | undefined>;
+  const record = store[PENDING_RECORD];
+  delete store[PENDING_RECORD];
+  return record;
+}
+
+/**
+ * Balance one taken record against its boundary's pending-root accounting.
+ *
+ * Returns the boundary only while it can still receive this root: a terminal
+ * that already dropped both the live set and the collapsed patch leaves
+ * nothing to join or replay.
+ */
+function releaseUpdates(
+  record: PendingRootRecord | undefined,
+): PendingBoundaryUpdates | undefined {
+  const updates = record?.updates;
   if (!updates) return undefined;
   updates.pendingRoots--;
   return updates.active || updates.patch !== undefined ? updates : undefined;
@@ -586,13 +578,20 @@ function takePendingUpdates(el: Element): PendingBoundaryUpdates | undefined {
 function invokeActivationHook(
   el: Element,
   state: Record<string, unknown> | undefined,
-  bypassSpanInstanceId?: number,
+  bypass: SpanBypass | undefined,
 ): number {
   const hook = (el as BoundaryActivatable)[STREAMING_BOUNDARY_ACTIVATE];
   if (typeof hook !== 'function') return ACTIVATION_MISSING_TEMPLATE;
+  // The compiler entitles a specific set of early roots to skip the enclosing
+  // span host, so the attribute is matched here and the resolved element is
+  // handed over. One read, and only for a boundary that declares a span.
+  const bypassAncestor = bypass !== undefined &&
+      el.getAttribute(STREAMING_ENCLOSING_SPAN_ATTR) === bypass.id
+    ? bypass.host
+    : undefined;
   let outcome: number;
   try {
-    outcome = hook.call(el, state, bypassSpanInstanceId);
+    outcome = hook.call(el, state, bypassAncestor);
   } catch (error) {
     removeStreamingAttributes(el);
     throw error;
@@ -608,12 +607,6 @@ function invokeActivationHook(
   return outcome;
 }
 
-function removeStreamingAttributes(el: Element): void {
-  safeRemoveAttribute(el, STREAMED_HOST_ATTR);
-  safeRemoveAttribute(el, STREAMING_SPAN_HOST_ATTR);
-  safeRemoveAttribute(el, STREAMING_ENCLOSING_SPAN_ATTR);
-}
-
 /** Reset retained activation state and invalidate uncancellable waiters. */
 export function resetDeferredActivationForTests(): void {
   abandonPendingWaiters();
@@ -633,5 +626,5 @@ export function pendingBarrierRootCountForTests(): number {
 }
 
 export function elementHasPendingStateForTests(el: Element): boolean {
-  return hasPendingState(el);
+  return hasPendingRecord(el);
 }
diff --git a/packages/webui-framework/src/streaming-dom.ts b/packages/webui-framework/src/streaming-dom.ts
index a86f36d04..b1d5a27c7 100644
--- a/packages/webui-framework/src/streaming-dom.ts
+++ b/packages/webui-framework/src/streaming-dom.ts
@@ -6,6 +6,27 @@ export const MAX_ELEMENTS_PER_BOUNDARY = 10_000;
 export const MAX_MARKER_SCAN_NODES = 50_000;
 export const MAX_BOUNDARY_SCRIPT_SCAN = 8;
 
+/**
+ * Compiler-owned SpanInstanceId on an unfinished component host.
+ *
+ * The value is a canonical base-10 integer. It identifies the root-local
+ * `<!--ws:S-->...<!--/ws:S-->` range that will eventually activate this host.
+ *
+ * It lives here, in the opt-in streaming graph, rather than in
+ * `streaming-mode.ts`: only the coordinator ever reads or writes it, so the
+ * always-shipped bundle must not carry the name.
+ */
+export const STREAMING_SPAN_HOST_ATTR = 'data-ws-span';
+/**
+ * Compiler-owned enclosing SpanInstanceId on an early boundary child root.
+ *
+ * Matching this value to `data-ws-span` lets that root bypass exactly one
+ * unfinished ancestor barrier. Unmarked or mismatched roots stay dormant. The
+ * coordinator resolves the match and hands `TemplateElement` the concrete
+ * ancestor element, so nothing outside this graph parses the value.
+ */
+export const STREAMING_ENCLOSING_SPAN_ATTR = 'data-ws-enclosing';
+
 /** Normalize an unknown exception for cold streaming diagnostics. */
 export function streamingErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
@@ -18,6 +39,17 @@ export const BOUNDARY_END_PREFIX = '/wb:';
 export const SPAN_START_PREFIX = 'ws:';
 export const SPAN_END_PREFIX = '/ws:';
 
+/**
+ * Whether one comment closes a boundary or span range.
+ *
+ * Every end marker is its start marker prefixed with `/`, which is also what
+ * lets `findRangeStartMarkerByPrefix` pair the two with a single slice.
+ */
+export function isRangeEndMarker(data: string): boolean {
+  return data.startsWith(BOUNDARY_END_PREFIX) ||
+    data.startsWith(SPAN_END_PREFIX);
+}
+
 /** The DOM span one committed boundary activates. */
 export interface HydrationRange {
   readonly start: Comment | null;
@@ -34,7 +66,8 @@ export type RangeResolution =
       readonly start: Comment | null;
     };
 
-const MARKERLESS_RANGE: HydrationRange = { start: null, end: null };
+const MARKER_KIND_BOUNDARY = 'boundary';
+const MARKER_KIND_SPAN = 'span';
 
 /** Resolve the root-local marker range for one boundary occurrence. */
 export function resolveBoundaryRange(
@@ -46,7 +79,7 @@ export function resolveBoundaryRange(
     instanceId,
     BOUNDARY_START_PREFIX,
     BOUNDARY_END_PREFIX,
-    'boundary',
+    MARKER_KIND_BOUNDARY,
   );
 }
 
@@ -60,7 +93,7 @@ export function resolveSpanRange(
     instanceId,
     SPAN_START_PREFIX,
     SPAN_END_PREFIX,
-    'span',
+    MARKER_KIND_SPAN,
   );
 }
 
@@ -92,23 +125,13 @@ function resolveMarkerRange(
 }
 
 /** Require an update or terminal record to carry no range markers. */
-export function resolveMarkerlessRecord(
+export function markerlessRecordViolation(
   scriptEl: Element,
   kind: string,
-): RangeResolution {
-  const marker = previousComment(scriptEl);
-  if (
-    marker &&
-    (marker.data.startsWith(BOUNDARY_END_PREFIX) ||
-      marker.data.startsWith(SPAN_END_PREFIX))
-  ) {
-    return {
-      ok: false,
-      reason: `${kind} record must be markerless`,
-      truncated: false,
-    };
-  }
-  return { ok: true, range: MARKERLESS_RANGE };
+): string | null {
+  return previousRangeEndMarker(scriptEl)
+    ? `${kind} record must be markerless`
+    : null;
 }
 
 export function findBoundaryScript(sentinel: Element): Element | null {
@@ -155,30 +178,25 @@ function findStartMarkerBefore(
 export function findRangeEndMarkerByPrefix(
   scriptEl: Element,
 ): Comment | null {
-  const marker = previousComment(scriptEl);
-  return marker &&
-      (marker.data.startsWith(BOUNDARY_END_PREFIX) ||
-        marker.data.startsWith(SPAN_END_PREFIX))
-    ? marker
-    : null;
+  return previousRangeEndMarker(scriptEl);
 }
 
-/** Find the start marker paired with a structurally discovered end marker. */
+/**
+ * Find the start marker paired with a structurally discovered end marker.
+ *
+ * `/wb:7` pairs with `wb:7` and `/ws:7` with `ws:7`, so dropping the leading
+ * `/` is the pairing for both range kinds.
+ */
 export function findRangeStartMarkerByPrefix(
   endMarker: Comment,
 ): Comment | null {
-  const endPrefix = endMarker.data.startsWith(BOUNDARY_END_PREFIX)
-    ? BOUNDARY_END_PREFIX
-    : SPAN_END_PREFIX;
-  const startPrefix = endPrefix === BOUNDARY_END_PREFIX
-    ? BOUNDARY_START_PREFIX
-    : SPAN_START_PREFIX;
-  return findCommentBefore(
-    endMarker,
-    `${startPrefix}${endMarker.data.slice(
-      endPrefix.length,
-    )}`,
-  );
+  return findCommentBefore(endMarker, endMarker.data.slice(1));
+}
+
+/** The preceding comment when it closes a boundary or span range. */
+function previousRangeEndMarker(node: Node): Comment | null {
+  const marker = previousComment(node);
+  return marker && isRangeEndMarker(marker.data) ? marker : null;
 }
 
 function previousComment(node: Node): Comment | null {
diff --git a/packages/webui-framework/src/streaming-mode.ts b/packages/webui-framework/src/streaming-mode.ts
index d36a7bfa8..f4ce86db8 100644
--- a/packages/webui-framework/src/streaming-mode.ts
+++ b/packages/webui-framework/src/streaming-mode.ts
@@ -9,6 +9,13 @@
  * (`streaming.ts`), which itself imports `static-host.ts` →
  * `template-element.ts`. A direct import from `template-element.ts` back to
  * `streaming.ts` would close that cycle.
+ *
+ * It carries only what the always-shipped bundle genuinely needs: mode
+ * detection, the two shared hook symbols, and the single `data-ws` dormancy
+ * marker. Everything span-shaped — the `data-ws-span` / `data-ws-enclosing`
+ * attribute names and the open-span registry that resolves them — lives in the
+ * opt-in streaming graph (`streaming-dom.ts`, `streaming-spans.ts`), so a
+ * non-streaming app never downloads a byte of it.
  */
 
 let cached: boolean | undefined;
@@ -23,20 +30,6 @@ export const PENDING_ROOT_CONNECTED = Symbol.for(
 );
 /** Compiler-owned marker for an uncommitted streamed host. */
 export const STREAMED_HOST_ATTR = 'data-ws';
-/**
- * Compiler-owned SpanInstanceId on an unfinished component host.
- *
- * The value is a canonical base-10 integer. It identifies the root-local
- * `<!--ws:S-->...<!--/ws:S-->` range that will eventually activate this host.
- */
-export const STREAMING_SPAN_HOST_ATTR = 'data-ws-span';
-/**
- * Compiler-owned enclosing SpanInstanceId on an early boundary child root.
- *
- * Matching this value to `data-ws-span` lets that root bypass exactly one
- * unfinished ancestor barrier. Unmarked or mismatched roots stay dormant.
- */
-export const STREAMING_ENCLOSING_SPAN_ATTR = 'data-ws-enclosing';
 
 /**
  * Whether this document was served in streaming-hydration mode.
diff --git a/packages/webui-framework/src/streaming-pipeline.test.ts b/packages/webui-framework/src/streaming-pipeline.test.ts
index 7edfc94f2..c1c7d86b5 100644
--- a/packages/webui-framework/src/streaming-pipeline.test.ts
+++ b/packages/webui-framework/src/streaming-pipeline.test.ts
@@ -48,7 +48,7 @@ interface FakeElement extends FakeNode {
   setState?: (state: Record<string, unknown>) => void;
   [ACTIVATE]?: (
     state?: Record<string, unknown>,
-    bypassSpanInstanceId?: number,
+    bypassAncestor?: FakeElement,
   ) => number;
   [ABANDON]?: () => void;
   [RESUME_PENDING]?: () => void;
@@ -108,7 +108,7 @@ interface ElementSpec {
   text?: string;
   hook?: (
     state?: Record<string, unknown>,
-    bypassSpanInstanceId?: number,
+    bypassAncestor?: FakeElement,
   ) => void | number;
   activationOutcome?: number;
   abandon?: () => void;
@@ -154,8 +154,8 @@ function element(tagName: string, spec: ElementSpec = {}): FakeElement {
   } as unknown as FakeElement & { _children: FakeNode[] };
   addSiblingGetters(node);
   if (spec.hook) {
-    node[ACTIVATE] = (state, bypassSpanInstanceId?: number) => {
-      const outcome = spec.hook!(state, bypassSpanInstanceId);
+    node[ACTIVATE] = (state, bypassAncestor?: FakeElement) => {
+      const outcome = spec.hook!(state, bypassAncestor);
       return typeof outcome === 'number'
         ? outcome
         : spec.activationOutcome ?? 1;
@@ -1833,19 +1833,16 @@ describe('streaming coordinator pipeline', () => {
     await flush();
 
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('later-span-child', {
-      hook(_state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(_state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         order.push('child');
         return 1;
       },
     });
-    const parent = element('later-span-parent', {
+    parent = element('later-span-parent', {
       hook() {
         parentActive = true;
         order.push('parent');
@@ -1880,20 +1877,17 @@ describe('streaming coordinator pipeline', () => {
     const childStates: Array<Record<string, unknown> | undefined> = [];
     const parentStates: Array<Record<string, unknown> | undefined> = [];
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('early-child', {
-      hook(state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         order.push('child');
         childStates.push(state);
         return 1;
       },
     });
-    const parent = element('spanning-parent', {
+    parent = element('spanning-parent', {
       hook(state) {
         parentActive = true;
         order.push('parent');
@@ -1937,19 +1931,16 @@ describe('streaming coordinator pipeline', () => {
   test('keeps an unmarked or mismatched early child behind the ancestor barrier', async () => {
     const order: string[] = [];
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('mismatch-child', {
-      hook(_state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(_state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         order.push('child');
         return 1;
       },
     });
-    const parent = element('mismatch-parent', {
+    parent = element('mismatch-parent', {
       hook() {
         parentActive = true;
         order.push('parent');
@@ -1994,18 +1985,68 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(__isHaltedForTests(), false);
   });
 
+  test('activates the retained subtree of a barrier-deferred root after release', async () => {
+    const order: string[] = [];
+    let parentActive = false;
+    let parent!: FakeElement;
+    const nested = element('barrier-nested-root', {
+      hook() {
+        order.push('nested');
+        return 1;
+      },
+    });
+    nested.setAttribute('data-ws', '');
+    const child = element('barrier-outer-root', {
+      hook() {
+        if (!parentActive) return 4;
+        order.push('child');
+        return 1;
+      },
+      children: [nested],
+    });
+    parent = element('barrier-span-parent', {
+      hook() {
+        parentActive = true;
+        order.push('parent');
+      },
+    });
+    // `enclosingMarker: 1` mismatches span 0, so the outer child is retained
+    // behind the barrier and the coordinator's walk skips its whole subtree.
+    const scenario = buildSpanScenario(parent, child, { enclosingMarker: 1 });
+    predefine(
+      'barrier-outer-root',
+      'barrier-nested-root',
+      'barrier-span-parent',
+    );
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    assert.deepEqual(order, []);
+    assert.equal(__pendingBarrierRootCountForTests(), 1);
+    assert.equal(hasWs(nested), true, 'the skipped descendant stays marked');
+
+    enqueue(scenario.spanSentinel);
+    await flush();
+
+    assert.deepEqual(
+      order,
+      ['parent', 'child', 'nested'],
+      'the released root activates its own retained subtree, parent-first',
+    );
+    assert.equal(hasWs(nested), false);
+    assert.equal(__pendingBarrierRootCountForTests(), 0);
+    assert.equal(__isHaltedForTests(), false);
+  });
+
   test('updates a live early child by BoundaryInstanceId before parent completion', async () => {
     const activations: Array<Record<string, unknown> | undefined> = [];
     const updates: Array<Record<string, unknown>> = [];
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('updatable-early-child', {
-      hook(state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         activations.push(state);
         return 1;
       },
@@ -2013,7 +2054,7 @@ describe('streaming coordinator pipeline', () => {
         updates.push(state);
       },
     });
-    const parent = element('updatable-span-parent', {
+    parent = element('updatable-span-parent', {
       hook() {
         parentActive = true;
       },
@@ -2046,18 +2087,15 @@ describe('streaming coordinator pipeline', () => {
   test('replays an update once when an undefined early child defines before span completion', async () => {
     const childActivations: Array<Record<string, unknown> | undefined> = [];
     const childUpdates: Array<Record<string, unknown>> = [];
-    const bypasses: Array<number | undefined> = [];
+    const bypasses: Array<FakeElement | undefined> = [];
     let parentActivations = 0;
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('late-early-child', {
-      hook(state, bypassSpanInstanceId) {
-        bypasses.push(bypassSpanInstanceId);
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(state, bypassAncestor) {
+        bypasses.push(bypassAncestor);
+        if (!parentActive && bypassAncestor !== parent) return 4;
         childActivations.push(state);
         return 1;
       },
@@ -2065,7 +2103,7 @@ describe('streaming coordinator pipeline', () => {
         childUpdates.push(state);
       },
     });
-    const parent = element('late-early-parent', {
+    parent = element('late-early-parent', {
       hook() {
         parentActive = true;
         parentActivations++;
@@ -2088,7 +2126,7 @@ describe('streaming coordinator pipeline', () => {
 
     defineTag('late-early-child');
     await flush();
-    assert.deepEqual(bypasses, [0], 'the pending root retains its enclosing-span bypass');
+    assert.deepEqual(bypasses, [parent], 'the pending root retains its enclosing-span bypass');
     assert.deepEqual(childActivations, [{ scope: 'child' }]);
     assert.deepEqual(plainPatches(childUpdates), [{ status: 'ready' }]);
     assert.equal(parentActivations, 0, 'the child activates while its parent span is unfinished');
@@ -2118,19 +2156,16 @@ describe('streaming coordinator pipeline', () => {
   test('resolves a nested light-DOM boundary inside its actual component render root', async () => {
     const order: string[] = [];
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('light-span-child', {
-      hook(_state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(_state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         order.push('child');
         return 1;
       },
     });
-    const parent = element('light-span-parent', {
+    parent = element('light-span-parent', {
       hook() {
         parentActive = true;
         order.push('parent');
@@ -2155,18 +2190,17 @@ describe('streaming coordinator pipeline', () => {
     const order: string[] = [];
     let outerActive = false;
     let innerActive = false;
+    let inner!: FakeElement;
     let child!: FakeElement;
     child = element('nested-span-child', {
-      hook(_state, bypassSpanInstanceId) {
-        const bypassesInner =
-          child.getAttribute('data-ws-enclosing') ===
-            String(bypassSpanInstanceId);
+      hook(_state, bypassAncestor) {
+        const bypassesInner = bypassAncestor === inner;
         if ((!innerActive && !bypassesInner) || !outerActive) return 4;
         order.push('child');
         return 1;
       },
     });
-    const inner = element('nested-inner-parent', {
+    inner = element('nested-inner-parent', {
       hook() {
         if (!outerActive) return 4;
         innerActive = true;
@@ -2281,19 +2315,16 @@ describe('streaming coordinator pipeline', () => {
   test('resolves an early boundary inside an open declarative shadow root', async () => {
     const order: string[] = [];
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('shadow-span-child', {
-      hook(_state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(_state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         order.push('child');
         return 1;
       },
     });
-    const parent = element('shadow-span-parent', {
+    parent = element('shadow-span-parent', {
       shadowChildren: [],
       hook() {
         parentActive = true;
@@ -2317,18 +2348,15 @@ describe('streaming coordinator pipeline', () => {
   test('span truncation releases open-span state, markers, and compiler attributes', async () => {
     __installTruncationGuardForTests();
     let parentActive = false;
+    let parent!: FakeElement;
     let child!: FakeElement;
     child = element('truncated-span-child', {
-      hook(_state, bypassSpanInstanceId) {
-        if (
-          !parentActive &&
-          child.getAttribute('data-ws-enclosing') !==
-            String(bypassSpanInstanceId)
-        ) return 4;
+      hook(_state, bypassAncestor) {
+        if (!parentActive && bypassAncestor !== parent) return 4;
         return 1;
       },
     });
-    const parent = element('truncated-span-parent', {
+    parent = element('truncated-span-parent', {
       hook() {
         parentActive = true;
       },
diff --git a/packages/webui-framework/src/streaming-spans.ts b/packages/webui-framework/src/streaming-spans.ts
index ba63e0d4e..30a8c4137 100644
--- a/packages/webui-framework/src/streaming-spans.ts
+++ b/packages/webui-framework/src/streaming-spans.ts
@@ -6,15 +6,18 @@ import {
   safeRemove,
   safeRemoveAttribute,
   SPAN_START_PREFIX,
+  STREAMING_SPAN_HOST_ATTR,
 } from './streaming-dom.js';
 import type { HydrationRange } from './streaming-dom.js';
-import { STREAMING_SPAN_HOST_ATTR } from './streaming-mode.js';
 
 /** Maximum unfinished component hosts retained by one response. */
 export const MAX_OPEN_SPANS = 128;
 /** Maximum runtime component ancestry crossed by one early boundary. */
 export const MAX_SPAN_NESTING = 32;
 
+const INVALID_SPAN_ID = -1;
+const NOT_A_SPAN_HOST = -2;
+
 interface OpenSpan {
   readonly host: Element;
   readonly start: Comment;
@@ -28,6 +31,43 @@ const hostScratch: Element[] = [];
 const idScratch: number[] = [];
 let nextExpectedSpanInstanceId = 0;
 
+/**
+ * Read one element's declared SpanInstanceId.
+ *
+ * `NOT_A_SPAN_HOST` when the element carries no marker at all and
+ * `INVALID_SPAN_ID` when it carries one that is not a canonical base-10
+ * integer, so both discovery walks share one attribute read and one parse.
+ */
+function spanIdOf(element: Element): number {
+  if (typeof element.hasAttribute !== 'function') return NOT_A_SPAN_HOST;
+  if (!element.hasAttribute(STREAMING_SPAN_HOST_ATTR)) return NOT_A_SPAN_HOST;
+  const raw = element.getAttribute(STREAMING_SPAN_HOST_ATTR);
+  if (raw === null || raw.length === 0) return INVALID_SPAN_ID;
+  let value = 0;
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i) - 48;
+    if (code < 0 || code > 9) return INVALID_SPAN_ID;
+    value = value * 10 + code;
+    if (!Number.isSafeInteger(value)) return INVALID_SPAN_ID;
+  }
+  return String(value) === raw ? value : INVALID_SPAN_ID;
+}
+
+function invalidSpanAttrReason(): string {
+  return `invalid ${STREAMING_SPAN_HOST_ATTR} value`;
+}
+
+/**
+ * The element one already-registered span will eventually activate.
+ *
+ * The coordinator hands this to the activation walk so an entitled early root
+ * can skip that exact ancestor by identity — no attribute name, and no span
+ * bookkeeping, ever reaches the always-shipped bundle.
+ */
+export function spanHostFor(id: number): Element | undefined {
+  return openSpans.get(id)?.host;
+}
+
 /**
  * Register the unfinished component ancestry enclosing an early boundary.
  *
@@ -47,32 +87,28 @@ export function registerEnclosingSpans(
 
   while (current && hops < MAX_MARKER_SCAN_NODES) {
     hops++;
-    const element = elementForNode(current);
-    if (
-      element &&
-      typeof element.hasAttribute === 'function' &&
-      element.hasAttribute(STREAMING_SPAN_HOST_ATTR)
-    ) {
+    const element = current.nodeType === 1 /* ELEMENT_NODE */
+      ? current as Element
+      : null;
+    const id = element ? spanIdOf(element) : NOT_A_SPAN_HOST;
+    if (id !== NOT_A_SPAN_HOST) {
       if (hostScratch.length >= MAX_SPAN_NESTING) {
         clearScratch();
         return `runtime component span nesting exceeds ${MAX_SPAN_NESTING}`;
       }
-      const id = parseInstanceId(
-        element.getAttribute(STREAMING_SPAN_HOST_ATTR),
-      );
-      if (id === null) {
+      if (id === INVALID_SPAN_ID) {
         clearScratch();
-        return `invalid ${STREAMING_SPAN_HOST_ATTR} value`;
+        return invalidSpanAttrReason();
       }
       if (firstSpan && id !== enclosingSpanInstanceId) {
         clearScratch();
         return `boundary declares enclosing span ${enclosingSpanInstanceId}, but its nearest spanning ancestor is ${id}`;
       }
       firstSpan = false;
-      hostScratch.push(element);
+      hostScratch.push(element as Element);
       idScratch.push(id);
     }
-    current = parentAcrossRenderRoot(current, element);
+    current = ascendRenderRoots(current);
   }
 
   if (firstSpan) {
@@ -140,81 +176,59 @@ function registerSpan(
 }
 
 /**
- * Discover a previously unseen completion target from its concrete marker range.
+ * Resolve and validate one span completion before it mutates or hydrates.
  *
- * Zero-occurrence component spans have no checkpoint to register their
- * ancestry, so their completion must do the same bounded, root-local discovery.
+ * One bounded, root-local sibling scan serves both jobs. A span opened by an
+ * earlier checkpoint is already registered and only needs its recorded host and
+ * marker confirmed; a zero-occurrence span has never been seen at all, so the
+ * same scan discovers the host its ancestry is registered from.
  */
-export function registerSpanCompletionTarget(
+export function prepareSpanCompletion(
   id: number,
   range: HydrationRange,
 ): string | null {
-  if (openSpans.has(id)) return null;
-  if (!range.start || !range.end) {
-    return `span ${id} completion is markerless`;
-  }
+  const start = range.start;
+  const end = range.end;
+  if (!start || !end) return `span ${id} completion is markerless`;
 
-  let node = range.start.nextSibling;
+  let host: Element | undefined;
+  let node: Node | null = start.nextSibling;
   let hops = 0;
-  while (node && node !== range.end) {
+  while (node && node !== end) {
     if (hops >= MAX_MARKER_SCAN_NODES) {
       return `span ${id} host lookup exceeds ${MAX_MARKER_SCAN_NODES} nodes`;
     }
     hops++;
     if (node.nodeType === 1 /* ELEMENT_NODE */) {
-      const element = node as Element;
-      if (
-        typeof element.hasAttribute === 'function' &&
-        element.hasAttribute(STREAMING_SPAN_HOST_ATTR)
-      ) {
-        const hostId = parseInstanceId(
-          element.getAttribute(STREAMING_SPAN_HOST_ATTR),
-        );
-        if (hostId === null) {
-          return `invalid ${STREAMING_SPAN_HOST_ATTR} value`;
-        }
+      const hostId = spanIdOf(node as Element);
+      if (hostId === INVALID_SPAN_ID) return invalidSpanAttrReason();
+      if (hostId !== NOT_A_SPAN_HOST) {
         if (hostId !== id) {
           return `span completion targets span ${id}, but its host declares span ${hostId}`;
         }
-        return registerEnclosingSpans(element, id);
+        host = node as Element;
+        break;
       }
     }
     node = node.nextSibling;
   }
-  return `span completion targets span ${id}, but no spanning host was found inside its markers`;
-}
+  if (!host) {
+    return `span completion targets span ${id}, but no spanning host was found inside its markers`;
+  }
 
-/** Validate one span completion before mutating or hydrating its range. */
-export function validateSpanCompletion(
-  id: number,
-  range: HydrationRange,
-): string | null {
+  if (!openSpans.has(id)) {
+    const error = registerEnclosingSpans(host, id);
+    if (error) return error;
+  }
   const span = openSpans.get(id);
   if (!span) return `span completion targets span ${id}, which is not open`;
   if (span.openChildren !== 0) {
     return `span ${id} completed before its nested component spans`;
   }
-  if (
-    !range.start ||
-    !range.end ||
-    range.start !== span.start ||
-    span.host.parentNode !== range.start.parentNode
-  ) {
-    return `span completion markers do not match the open span ${id}`;
-  }
-
-  let node = range.start.nextSibling;
-  let hops = 0;
-  while (node && node !== range.end && node !== span.host) {
-    if (hops >= MAX_MARKER_SCAN_NODES) {
-      return `span ${id} host lookup exceeds ${MAX_MARKER_SCAN_NODES} nodes`;
-    }
-    hops++;
-    node = node.nextSibling;
-  }
-  return node === span.host
+  return span.host === host && span.start === start &&
+      host.parentNode === start.parentNode
     ? null
-    : `span ${id} host is outside its completion markers`;
+    : `span completion markers do not match the open span ${id}`;
 }
 
 /** Release one successfully completed span and its ancestry accounting. */
@@ -239,44 +253,22 @@ export function abandonOpenSpans(): void {
   nextExpectedSpanInstanceId = 0;
 }
 
-function elementForNode(node: Node): Element | null {
-  if (node.nodeType === 1 /* ELEMENT_NODE */) return node as Element;
+/**
+ * Step one level out of the current render root.
+ *
+ * A shadow root resolves to its host, a slotted element to its assigned slot,
+ * and anything else to its parent node — so one function crosses every render
+ * root boundary an ancestry walk can hit.
+ */
+function ascendRenderRoots(node: Node): Node | null {
   if (node.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
     return (node as ShadowRoot).host ?? null;
   }
-  return null;
-}
-
-function parentAcrossRenderRoot(
-  node: Node,
-  element: Element | null,
-): Node | null {
-  let current = node;
-  let currentElement = element;
-  if (node.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
-    const host = (node as ShadowRoot).host;
-    if (!host) return null;
-    current = host;
-    currentElement = host;
-  }
-  if (currentElement?.assignedSlot) return currentElement.assignedSlot;
-  const parent = current.parentNode;
-  if (parent?.nodeType === 11 /* DOCUMENT_FRAGMENT_NODE */) {
-    return (parent as ShadowRoot).host ?? null;
-  }
-  return parent;
-}
-
-function parseInstanceId(raw: string | null): number | null {
-  if (raw === null || raw.length === 0) return null;
-  let value = 0;
-  for (let i = 0; i < raw.length; i++) {
-    const code = raw.charCodeAt(i) - 48;
-    if (code < 0 || code > 9) return null;
-    value = value * 10 + code;
-    if (!Number.isSafeInteger(value)) return null;
+  if (node.nodeType === 1 /* ELEMENT_NODE */) {
+    const slot = (node as Element).assignedSlot;
+    if (slot) return slot;
   }
-  return String(value) === raw ? value : null;
+  return node.parentNode;
 }
 
 function clearScratch(): void {
diff --git a/packages/webui-framework/src/template-element.test.ts b/packages/webui-framework/src/template-element.test.ts
index a3737f20b..d0b8ef448 100644
--- a/packages/webui-framework/src/template-element.test.ts
+++ b/packages/webui-framework/src/template-element.test.ts
@@ -390,7 +390,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
     assert.deepEqual(received, { detached: true });
   });
 
-  test('a matching compiler span marker bypasses exactly the unfinished spanning ancestor', () => {
+  test('a coordinator-resolved bypass ancestor is skipped exactly once', () => {
     const parentTag = 'test-spanning-parent';
     const childTag = 'test-early-span-child';
     registerTemplate(parentTag);
@@ -401,12 +401,10 @@ describe('TemplateElement — streamed-host activation ownership', () => {
       tagName: string;
       parentElement: Element | null;
       $deferredSSR: boolean;
-      setAttribute(name: string, value: string): void;
     };
     parentRaw.tagName = parentTag;
     parentRaw.parentElement = null;
     parentRaw.$deferredSSR = true;
-    parentRaw.setAttribute('data-ws-span', '4');
 
     const child = new TemplateElement();
     const childRaw = child as unknown as {
@@ -417,24 +415,26 @@ describe('TemplateElement — streamed-host activation ownership', () => {
       setAttribute(name: string, value: string): void;
       [STREAMING_BOUNDARY_ACTIVATE](
         state?: Record<string, unknown>,
-        bypassSpanInstanceId?: number,
+        bypassAncestor?: Element,
       ): number;
     };
     childRaw.tagName = childTag;
     childRaw.parentElement = parent as unknown as Element;
     childRaw.setAttribute('data-ws', '');
-    childRaw.setAttribute('data-ws-enclosing', '4');
     child.connectedCallback();
     childRaw.$hydrated = true;
 
     assert.equal(
-      childRaw[STREAMING_BOUNDARY_ACTIVATE]({ child: true }, 4),
+      childRaw[STREAMING_BOUNDARY_ACTIVATE](
+        { child: true },
+        parent as unknown as Element,
+      ),
       1,
     );
     assert.equal(childRaw.$deferredSSR, false);
   });
 
-  test('a mismatched compiler span marker preserves the parent-first barrier', () => {
+  test('an unrelated bypass ancestor preserves the parent-first barrier', () => {
     const parentTag = 'test-mismatch-span-parent';
     const childTag = 'test-mismatch-span-child';
     registerTemplate(parentTag);
@@ -445,12 +445,13 @@ describe('TemplateElement — streamed-host activation ownership', () => {
       tagName: string;
       parentElement: Element | null;
       $deferredSSR: boolean;
-      setAttribute(name: string, value: string): void;
     };
     parentRaw.tagName = parentTag;
     parentRaw.parentElement = null;
     parentRaw.$deferredSSR = true;
-    parentRaw.setAttribute('data-ws-span', '4');
+
+    const unrelated = new TemplateElement();
+    (unrelated as unknown as { tagName: string }).tagName = parentTag;
 
     const child = new TemplateElement();
     const childRaw = child as unknown as {
@@ -460,17 +461,74 @@ describe('TemplateElement — streamed-host activation ownership', () => {
       setAttribute(name: string, value: string): void;
       [STREAMING_BOUNDARY_ACTIVATE](
         state?: Record<string, unknown>,
-        bypassSpanInstanceId?: number,
+        bypassAncestor?: Element,
       ): number;
     };
     childRaw.tagName = childTag;
     childRaw.parentElement = parent as unknown as Element;
     childRaw.setAttribute('data-ws', '');
-    childRaw.setAttribute('data-ws-enclosing', '5');
     child.connectedCallback();
 
     assert.equal(
-      childRaw[STREAMING_BOUNDARY_ACTIVATE]({ child: true }, 4),
+      childRaw[STREAMING_BOUNDARY_ACTIVATE](
+        { child: true },
+        unrelated as unknown as Element,
+      ),
+      4,
+    );
+    assert.equal(childRaw.$deferredSSR, true);
+  });
+
+  test('only one barrier is bypassed when barriers nest', () => {
+    const outerTag = 'test-nested-bypass-outer';
+    const innerTag = 'test-nested-bypass-inner';
+    const childTag = 'test-nested-bypass-child';
+    registerTemplate(outerTag);
+    registerTemplate(innerTag);
+    registerTemplate(childTag);
+
+    const outer = new TemplateElement();
+    const outerRaw = outer as unknown as {
+      tagName: string;
+      parentElement: Element | null;
+      $deferredSSR: boolean;
+    };
+    outerRaw.tagName = outerTag;
+    outerRaw.parentElement = null;
+    outerRaw.$deferredSSR = true;
+
+    const inner = new TemplateElement();
+    const innerRaw = inner as unknown as {
+      tagName: string;
+      parentElement: Element | null;
+      $deferredSSR: boolean;
+    };
+    innerRaw.tagName = innerTag;
+    innerRaw.parentElement = outer as unknown as Element;
+    innerRaw.$deferredSSR = true;
+
+    const child = new TemplateElement();
+    const childRaw = child as unknown as {
+      tagName: string;
+      parentElement: Element;
+      $deferredSSR: boolean;
+      setAttribute(name: string, value: string): void;
+      [STREAMING_BOUNDARY_ACTIVATE](
+        state?: Record<string, unknown>,
+        bypassAncestor?: Element,
+      ): number;
+    };
+    childRaw.tagName = childTag;
+    childRaw.parentElement = inner as unknown as Element;
+    childRaw.setAttribute('data-ws', '');
+    child.connectedCallback();
+
+    // `inner` is stepped over, but `outer` is still an unfinished barrier.
+    assert.equal(
+      childRaw[STREAMING_BOUNDARY_ACTIVATE](
+        { child: true },
+        inner as unknown as Element,
+      ),
       4,
     );
     assert.equal(childRaw.$deferredSSR, true);
diff --git a/packages/webui-framework/src/template-element.ts b/packages/webui-framework/src/template-element.ts
index 77d7126c2..d2c8a7ad4 100644
--- a/packages/webui-framework/src/template-element.ts
+++ b/packages/webui-framework/src/template-element.ts
@@ -60,9 +60,7 @@ import { hydrationStart, hydrationEnd } from './lifecycle.js';
 import {
   isStreamingHydrationMode,
   PENDING_ROOT_CONNECTED,
-  STREAMING_ENCLOSING_SPAN_ATTR,
   STREAMED_HOST_ATTR,
-  STREAMING_SPAN_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
 import {
@@ -426,10 +424,17 @@ export class TemplateElement extends HTMLElement {
    * result objects. The optional `state` is this element's boundary-local SSR
    * state, handed straight through to hydration instead of via the global
    * `window.__webui.state` handoff.
+   *
+   * `bypassAncestor`, when supplied, is one already-resolved ancestor element
+   * this root may skip exactly once while looking for its hydration barrier.
+   * The coordinator owns that resolution — which compiler attributes name the
+   * ancestor, and whether this root is entitled to skip it — so the
+   * always-shipped bundle carries a plain identity comparison and no streaming
+   * attribute names at all.
    */
   [STREAMING_BOUNDARY_ACTIVATE](
     state?: Record<string, unknown>,
-    bypassSpanInstanceId?: number,
+    bypassAncestor?: Element,
   ): number {
     // `customElements.upgrade()` installs this class on detached roots without
     // invoking connectedCallback(). Preserve the same marker-driven dormant
@@ -447,7 +452,7 @@ export class TemplateElement extends HTMLElement {
     }
     this.$meta = meta;
     if (!this.$shouldActivateOnBoundaryCommit()) return ACTIVATION_STATIC_HOST_OPT_OUT;
-    const ancestor = this.$nearestHydrationBarrier(bypassSpanInstanceId);
+    const ancestor = this.$nearestHydrationBarrier(bypassAncestor);
     if (ancestor) {
       this.$deferredByAncestor = true;
       this.$ancestorBoundaryState = state;
@@ -455,12 +460,9 @@ export class TemplateElement extends HTMLElement {
       this.$registerWithHydrationBarrier(ancestor);
       return ACTIVATION_ANCESTOR_BARRIER;
     }
-    if (this.$deferredByAncestor) {
-      this.$detachDeferredAncestor();
-      this.$deferredByAncestor = undefined;
-      this.$ancestorBoundaryState = undefined;
-      this.$hasAncestorBoundaryState = undefined;
-    }
+    // A root re-activated after its barrier lifted must not keep the stale
+    // registration; the boundary state it carried is superseded by `state`.
+    if (this.$deferredByAncestor) this.$clearAncestorDeferral();
     this.$activatingDeferredSSR = true;
     try {
       this.$activateDeferredSSR(state);
@@ -472,18 +474,47 @@ export class TemplateElement extends HTMLElement {
 
   /** Clear element-owned streaming deferral after a fatal stream failure. */
   [STREAMING_BOUNDARY_ABANDON](): void {
-    this.$detachDeferredAncestor();
+    this.$clearAncestorDeferral();
     this.$abandonDeferredDescendants();
     this.$deferredSSR = false;
-    this.$deferredByAncestor = undefined;
-    this.$ancestorBoundaryState = undefined;
-    this.$hasAncestorBoundaryState = undefined;
     this.$activatingDeferredSSR = false;
     this.$ready = false;
     this.$preReadyWrites = null;
     if (this.$deferredWrites) this.$deferredWrites = undefined;
   }
 
+  /**
+   * Drop any registration behind an ancestor hydration barrier.
+   *
+   * Shared by abandon, destroy, and re-activation so the four pieces of
+   * barrier bookkeeping can never be cleared partially.
+   */
+  private $clearAncestorDeferral(): void {
+    this.$detachDeferredAncestor();
+    this.$deferredByAncestor = undefined;
+    this.$ancestorBoundaryState = undefined;
+    this.$hasAncestorBoundaryState = undefined;
+  }
+
+  /**
+   * Hand control back to whoever retained this root, if anyone did.
+   *
+   * The streaming coordinator installs the hook on roots it is holding — for a
+   * pending definition or a pending ancestor barrier — and owns every
+   * continuation from there: eager activation, re-registration behind a
+   * barrier, lazy observation, or a static-host opt-out. Re-entering ordinary
+   * deferral instead can replay older page bootstrap state over a queued
+   * boundary update.
+   */
+  private $resumeRetainedRoot(): boolean {
+    const resume = (
+      this as unknown as { [PENDING_ROOT_CONNECTED]?: () => void }
+    )[PENDING_ROOT_CONNECTED];
+    if (typeof resume !== 'function') return false;
+    resume.call(this);
+    return true;
+  }
+
   /**
    * Register this constructor for a tag and install template-derived observers.
    */
@@ -557,15 +588,7 @@ export class TemplateElement extends HTMLElement {
     ) {
       this.$deferredSSR = true;
       this.$ready = true;
-      const resume = (this as unknown as { [PENDING_ROOT_CONNECTED]?: () => void })[PENDING_ROOT_CONNECTED];
-      if (typeof resume === 'function') {
-        // The coordinator owns every continuation after a pending definition:
-        // eager activation, span-barrier registration, lazy observation, or
-        // static-host opt-out. Re-entering ordinary deferral here can replay
-        // older page bootstrap state over a queued boundary update.
-        resume.call(this);
-        return;
-      }
+      if (this.$resumeRetainedRoot()) return;
       this.$didDeferSSRHydration();
       return;
     }
@@ -820,12 +843,9 @@ export class TemplateElement extends HTMLElement {
       this.$resetClientShadow = true;
     }
     if (!this.$root) {
-      this.$detachDeferredAncestor();
+      this.$clearAncestorDeferral();
       this.$abandonDeferredDescendants();
       this.$deferredSSR = false;
-      this.$deferredByAncestor = undefined;
-      this.$ancestorBoundaryState = undefined;
-      this.$hasAncestorBoundaryState = undefined;
       this.$ready = false;
       this.$hasUnknownScopes = false;
       if (this.$deferredWrites) this.$deferredWrites = undefined;
@@ -953,16 +973,19 @@ export class TemplateElement extends HTMLElement {
     return this.$meta ?? this.$templateMeta();
   }
 
+  /**
+   * Walk up to the nearest ancestor that must hydrate before this instance.
+   *
+   * `bypassAncestor` is an opt-in, coordinator-resolved escape hatch: exactly
+   * one occurrence of that element is stepped over, which is how an early
+   * streamed child hydrates ahead of the still-unfinished component host that
+   * encloses it. Every other barrier — including a second, outer one — is
+   * still honoured, so parent-first ordering holds.
+   */
   private $nearestHydrationBarrier(
-    bypassSpanInstanceId?: number,
+    bypassAncestor?: Element,
   ): Element | undefined {
-    const bypassSpan = bypassSpanInstanceId === undefined
-      ? undefined
-      : String(bypassSpanInstanceId);
-    const mayBypass = bypassSpan !== undefined &&
-      this.getAttribute(STREAMING_ENCLOSING_SPAN_ATTR) ===
-        bypassSpan;
-    let bypassed = false;
+    let bypass = bypassAncestor;
     let current: Element = this;
     while (true) {
       let parent: Element | null =
@@ -980,13 +1003,8 @@ export class TemplateElement extends HTMLElement {
           : null;
       }
       if (!parent) return undefined;
-      if (
-        mayBypass &&
-        !bypassed &&
-        parent.getAttribute(STREAMING_SPAN_HOST_ATTR) ===
-          bypassSpan
-      ) {
-        bypassed = true;
+      if (parent === bypass) {
+        bypass = undefined;
         current = parent;
         continue;
       }
@@ -1110,13 +1128,7 @@ export class TemplateElement extends HTMLElement {
     const boundaryState = this.$ancestorBoundaryState;
     this.$hasAncestorBoundaryState = undefined;
     this.$ancestorBoundaryState = undefined;
-    const resume = (
-      this as unknown as { [PENDING_ROOT_CONNECTED]?: () => void }
-    )[PENDING_ROOT_CONNECTED];
-    if (typeof resume === 'function') {
-      resume.call(this);
-      return;
-    }
+    if (this.$resumeRetainedRoot()) return;
     const meta = this.$meta;
     if (meta && this.$shouldDeferSSRHydration(meta)) {
       if (hasBoundaryState) {
diff --git a/packages/webui-framework/tests/fixtures/lazy-hydration/lazy-hydration.spec.ts b/packages/webui-framework/tests/fixtures/lazy-hydration/lazy-hydration.spec.ts
index 9cc26305d..9559d5e4d 100644
--- a/packages/webui-framework/tests/fixtures/lazy-hydration/lazy-hydration.spec.ts
+++ b/packages/webui-framework/tests/fixtures/lazy-hydration/lazy-hydration.spec.ts
@@ -405,7 +405,13 @@ test.describe('component lazy hydration', () => {
       hydratedBefore: [false, false],
       hydratedAfterParent: [false, false],
       hydratedAfter: [false, false],
-      outcomes: [1, 1],
+      // The parent is a lazy (visibility-deferred) host, so its own activation
+      // is an accepted commit that simply does not hydrate yet. The child sits
+      // behind that unfinished barrier, which the hook reports distinctly
+      // (`ACTIVATION_ANCESTOR_BARRIER`) so the coordinator retains it and
+      // replays activation when the barrier lifts, rather than believing it
+      // already activated.
+      outcomes: [1, 4],
       streamingMode: true,
     });
     await expect(page.locator('#streamed-nested')).not.toHaveAttribute(

From dd4c4b3821ea16f4309f0984a6abf51c6fb8ce2a Mon Sep 17 00:00:00 2001
From: Mohamed Mansour <mmansour@microsoft.com>
Date: Thu, 20 Aug 2026 07:29:19 -0700
Subject: [PATCH 3/5] docs: document streaming performance profile

Clarify one-shot state snapshot reuse and record the final server and browser bundle measurements.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 docs/ai/SKILL.md                   |  3 +++
 docs/guide/concepts/performance.md | 42 +++++++++++++++++++++++++++---
 docs/guide/integrations/rust.md    |  6 +++++
 3 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/docs/ai/SKILL.md b/docs/ai/SKILL.md
index 58d0ed589..a32d21800 100644
--- a/docs/ai/SKILL.md
+++ b/docs/ai/SKILL.md
@@ -764,6 +764,9 @@ loops, outlets, and selected route content.
   rerunning `hydratedCallback()`.
 - State resolution across a suspension is lexical locals, resume state, then
   the frozen projected parent state.
+- `render_streaming` projects its one state value once for the complete
+  response. Host-driven `stream_response` sessions use each `resume` state as
+  an overlay for newly resolved occurrence data.
 - A component-local boundary uses generated parent spans. Its early marked child
   may hydrate before the opaque parent tail in light or shadow DOM.
 - `webui:boundary-hydrated` is emitted only when
diff --git a/docs/guide/concepts/performance.md b/docs/guide/concepts/performance.md
index 33cf7a9a3..f6446e093 100644
--- a/docs/guide/concepts/performance.md
+++ b/docs/guide/concepts/performance.md
@@ -197,10 +197,11 @@ Each layer of the architecture contributes to the overall performance profile:
 - **Runtime-discovered streaming.** The continuation VM walks only the selected
   entry, component, condition, loop, and route path. It is iterative and keeps
   bounded frames, projected parent keys, lexical locals, occurrence keys, and
-  generated component spans instead of cloning the full state or prebuilding a
-  request plan. Boundary-free fragment records are skipped through a build-time
-  `contains_boundary` bit. Capture and projection scratch buffers retain
-  capacity across checkpoints.
+  generated component spans instead of cloning full state for every boundary or
+  prebuilding a request plan. Full-state fallback snapshots once per response;
+  `render_streaming` reuses that snapshot for every occurrence. Boundary-free
+  fragment records are skipped through a build-time `contains_boundary` bit.
+  Capture and projection scratch buffers retain capacity across checkpoints.
 - **Bounded browser activation.** Each checkpoint or generated span completion
   walks one root-local marker range, including open shadow roots, and removes
   its scaffolding after commit. Final occurrences retain no root list.
@@ -228,6 +229,39 @@ Each layer of the architecture contributes to the overall performance profile:
   only the affected DOM nodes - not entire subtrees. This keeps hydration and
   reactive updates fast even in large documents.
 
+### Progressive streaming cost profile
+
+The progressive path does more work than the former fixed entry-boundary model:
+it discovers runtime occurrences, preserves continuation state, and completes
+generated component spans. Interleaved release-mode measurements against that
+fixed model produced:
+
+| Boundaries | Fixed model | Runtime-discovered model |
+|-----------:|------------:|-------------------------:|
+| 1 | 2.20 us | 2.57 us |
+| 3 | 4.25 us | 4.58 us |
+| 10 | 9.95 us | 11.05 us |
+| 100 | 76.1 us | 98.3 us |
+
+The ordinary renderer remains effectively unchanged in the same comparison
+(732 ns versus 741 ns). A separate large-state benchmark verifies that frozen
+state is projected once per response: optimization reduced an eight-boundary
+render from 354.6 us to 114.1 us.
+
+The optional browser coordinator is also measured independently from the
+always-shipped framework entry:
+
+| Production bundle | Minified | Gzip |
+|-------------------|---------:|-----:|
+| Ordinary framework entry | 60,528 bytes | 18,993 bytes |
+| Streaming-only increment | 16,652 bytes | 5,928 bytes |
+
+The hydration matrix enforces absolute ordinary and incremental limits with
+4-5% headroom, so moving optional streaming code into the default entry cannot
+hide behind subtraction. These figures are workload and machine specific; use
+`examples/integration/streaming-browser-bench` and
+`streaming_hydration_bench` for changes to either hot path.
+
 ## Light DOM vs Shadow DOM
 
 Shadow DOM provides style encapsulation but has a performance cost. Benchmark
diff --git a/docs/guide/integrations/rust.md b/docs/guide/integrations/rust.md
index 570fb1ce7..04204fa6a 100644
--- a/docs/guide/integrations/rust.md
+++ b/docs/guide/integrations/rust.md
@@ -252,6 +252,12 @@ selected path has none. `resume` must use the currently pending
 terminal. The final returned status has `done == true`, no descriptor, and the
 writer already contains the tail and terminal.
 
+`WebUIHandler::render_streaming` uses one state value for the complete response:
+it projects and freezes that value once, then resumes each occurrence directly
+against the same snapshot. The lower-level `stream_response` API keeps the
+public `resume` overlay because hosts may supply newly resolved state for each
+occurrence.
+
 Every descriptor contains `instance_id`, `declaration_id`, `owner`, `name`, and
 an optional string or numeric `key`. A declaration inside a repeated path
 requires a key, and live keys must be unique.

From aba3a9bc3e88ddeb0a6389b137aa85ffa3a921a9 Mon Sep 17 00:00:00 2001
From: Mohamed Mansour <mmansour@microsoft.com>
Date: Thu, 20 Aug 2026 16:16:39 -0700
Subject: [PATCH 4/5] feat: separate boundary commits from continuation

Make resume return boundary-only bytes, add advance for parent and tail bytes, and reject boundaries reached from repeat bodies.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 DESIGN.md                                     | 302 ++++++---
 crates/webui-cli/README.md                    |  19 +-
 .../src/commands/serve/streaming_api.rs       | 149 ++++-
 crates/webui-ffi/README.md                    |  19 +-
 crates/webui-ffi/include/webui_ffi.h          |  30 +-
 crates/webui-ffi/src/lib.rs                   |  54 +-
 crates/webui-ffi/tests/ffi_test.rs            | 281 +++++---
 crates/webui-handler/README.md                |  45 +-
 .../benches/streaming_hydration_bench.rs      |  24 +-
 crates/webui-handler/src/streaming/error.rs   |  11 +
 crates/webui-handler/src/streaming/mod.rs     |  18 +-
 crates/webui-handler/src/streaming/owned.rs   | 209 ++++--
 crates/webui-handler/src/streaming/session.rs | 305 ++++++---
 crates/webui-handler/src/streaming/vm.rs      | 207 ++++--
 crates/webui-handler/tests/streaming_v2.rs    | 559 ++++++++++++----
 crates/webui-node/README.md                   |  33 +-
 crates/webui-node/src/lib.rs                  | 136 +++-
 crates/webui-parser/src/diagnostic.rs         |   9 +-
 crates/webui-parser/src/lib.rs                | 603 ++++++++++++++++--
 crates/webui-protocol/proto/webui.proto       |   4 +-
 crates/webui-protocol/src/gen_webui.rs        |   4 +-
 crates/webui-python/README.md                 |  30 +-
 .../benchmarks/benchmark_renderer.py          |   9 +-
 .../python/microsoft_webui/_api.py            |   6 +-
 .../python/microsoft_webui/_native.pyi        |   1 +
 crates/webui-python/src/lib.rs                |  11 +
 crates/webui-python/tests/conftest.py         |   9 +-
 .../tests/fixtures/streaming-app/index.html   |  15 +-
 .../tests/fixtures/streaming_protocol.bin     |  88 +--
 crates/webui-python/tests/test_streaming.py   | 102 ++-
 crates/webui-wasm/README.md                   |  31 +-
 crates/webui-wasm/src/handler.rs              | 121 +++-
 crates/webui/README.md                        |  37 ++
 docs/ai/SKILL.md                              |  62 +-
 docs/guide/cli/index.md                       |  17 +-
 docs/guide/concepts/directives/boundary.md    |  98 ++-
 docs/guide/concepts/hydration.md              |  15 +-
 docs/guide/concepts/performance.md            |  26 +-
 docs/guide/integrations/dotnet.md             |  48 +-
 docs/guide/integrations/ffi.md                |  61 +-
 docs/guide/integrations/node.md               |  37 +-
 docs/guide/integrations/python.md             |  73 ++-
 docs/guide/integrations/rust.md               |  92 ++-
 docs/guide/integrations/wasm.md               |  37 +-
 dotnet/src/Microsoft.WebUI/NativeBindings.cs  |  11 +
 dotnet/src/Microsoft.WebUI/README.md          |  41 ++
 .../src/Microsoft.WebUI/StreamingSession.cs   |  42 +-
 .../Microsoft.WebUI.Tests.csproj              |   8 +-
 .../StreamingSessionTests.cs                  |  99 ++-
 .../fixtures/streaming-app/index.html         |  12 +-
 examples/app/service-worker/README.md         |  16 +-
 .../service-worker/scripts/check-render.ts    |   8 +-
 .../app/service-worker/src/service-worker.ts  |   5 +
 .../src/wasm/handler/webui_wasm_handler.d.ts  |   1 +
 examples/app/streaming/README.md              |  28 +-
 .../app/streaming/server/src/pacing.test.ts   |   2 +-
 .../streaming/server/src/stream-protocol.ts   |   4 +
 examples/integration/node/README.md           |  35 +-
 examples/integration/node/streaming-server.js |  12 +-
 examples/integration/rust/README.md           |  14 +-
 examples/integration/rust/src/main.rs         |  21 +-
 packages/webui-framework/README.md            |  12 +-
 packages/webui/README.md                      |  30 +-
 packages/webui/src/index.ts                   |  24 +-
 packages/webui/test/integration.test.ts       | 114 +++-
 65 files changed, 3507 insertions(+), 1079 deletions(-)

diff --git a/DESIGN.md b/DESIGN.md
index 5547c556a..14bb4e942 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -135,7 +135,9 @@ pub struct WebUIFragmentBoundary {
     pub name: String,
     /// Optional expression evaluated for each runtime occurrence.
     pub key: Option<String>,
-    /// Conservative build-time result for declarations that may occur repeatedly.
+    /// Conservative build-time result for declarations rendered from more than
+    /// one static callsite. A `<for>` repeat never contributes: the build
+    /// rejects every boundary a repeat body reaches (`boundary-in-repeat`).
     pub may_repeat: bool,
     /// Whether this fragment opens or closes the declaration's body.
     pub phase: BoundaryPhase,
@@ -176,10 +178,11 @@ pub struct WebUIFragmentComponent {
 **inline tape**: a `Start` marker, the body fragments, and an `End` marker
 carrying the same `declaration_id`, all in the owner's own record. Ordinary
 rendering therefore walks the body without an extra record lookup and simply
-skips both markers, while streaming suspends at `Start` and resumes inside the
-record it is already traversing. It may be reached through entries, reusable
-components, conditions, loops, outlets, and the selected route. Runtime
-traversal, not declaration order, creates response-local occurrences.
+skips both markers. Streaming suspends at `Start`; public `resume` renders only
+the body and its checkpoint, then public `advance` continues the owning record.
+The declaration may be reached through entries, reusable components,
+conditions, outlets, and the selected route. Runtime traversal, not declaration
+order, creates response-local occurrences.
 
 Markers always pair within one record, because a `<boundary>`'s children are
 lexically inside it; constructs that own their own record (`<if>`, `<for>`,
@@ -1006,11 +1009,13 @@ impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
         state: &Value,
         mode: BoundaryMode,
     ) -> Result<StreamStatus>;
+    pub fn advance(&mut self) -> Result<StreamStatus>;
     pub fn update(
         &mut self,
         instance_id: BoundaryInstanceId,
         patch: &Value,
     ) -> Result<()>;
+    pub fn is_done(&self) -> bool;
 }
 
 impl StreamingSession {
@@ -1021,26 +1026,55 @@ impl StreamingSession {
         state: &Value,
         mode: BoundaryMode,
     ) -> Result<StreamStep>;
+    pub fn advance(&mut self) -> Result<StreamStep>;
     pub fn update(
         &mut self,
         instance_id: BoundaryInstanceId,
         patch: &Value,
     ) -> Result<Vec<u8>>;
+    pub fn is_done(&self) -> bool;
 }
 ```
 
-`start` renders until the first runtime occurrence or through the terminal.
-`resume` must target the descriptor currently returned by the session. It
-commits that occurrence, then continues until the next occurrence or terminal.
-The final successful call returns `done = true`, no boundary, and bytes that
-already contain the terminal record and document suffix. There is no separate
-terminal call.
+Every step is one independently writable, independently flushed segment:
+
+- `start` renders the shell prefix and stops **before** the first occurrence, or
+  runs through the terminal when the document declares none.
+- `resume` must target the descriptor the session currently reports. It renders
+  **only** that occurrence, through its checkpoint record, and returns
+  immediately. Its bytes contain the occurrence's `<!--wb:n-->` … `<!--/wb:n-->`
+  range and record, never the parent or tail bytes that follow it.
+- `advance` renders the ordinary parent/shell bytes that follow a committed
+  occurrence until the next occurrence suspends or the terminal record and
+  document suffix complete. It is valid only after `resume`.
+
+The `(boundary, done)` pair names exactly one state:
+
+| `boundary` | `done` | meaning |
+|------------|--------|---------|
+| `Some`     | `false`| the occurrence is waiting for `resume` |
+| `None`     | `false`| the committed occurrence flushed; call `advance` |
+| `None`     | `true` | the terminal record and document suffix completed |
+
+There is no separate terminal call. Out-of-order calls (`advance` before any
+`resume`, a second `resume` before `advance`, or any step after `done`) are
+rejected with an actionable `StreamingBoundary` error **before** any byte is
+written, so the response is not poisoned and the host can retry with the
+correct step.
 
 `update` accepts only an object patch and only a committed `Updatable`
-occurrence. It emits projected state bytes and no application markup. A
-borrowed `StreamingResponse` writes directly to its `FlushWriter`; an owned
+occurrence. It emits projected state bytes and no application markup, and is
+valid between `resume` and `advance` as well as afterwards, so a host can revise
+the occurrence it just committed while the response stays open. A borrowed
+`StreamingResponse` writes directly to its `FlushWriter`; an owned
 `StreamingSession` returns one complete byte vector per call for language
-bindings and host-controlled backpressure.
+bindings and host-controlled backpressure. Each owned step's bytes end exactly
+on the transport flush boundary that closed the step, so a host that writes and
+flushes once per step reproduces the borrowed writer's flush positions byte for
+byte.
+
+`WebUIHandler::render_streaming` drives the whole `start → resume → advance → …`
+cycle internally against one frozen state snapshot.
 
 ### Per-Render HTML Injection
 
@@ -2153,36 +2187,58 @@ regions while the document is still loading.
 ### Normative invariants
 
 1. **Runtime discovery.** `<boundary name>` is valid in entries and reusable
-   components, including runtime `<if>`, `<for>`, outlet, and selected-route
-   paths. A false branch, empty loop, or unselected route produces no
-   occurrence. Authored boundaries must not directly or transitively contain
-   another authored boundary in this version.
-2. **Local declaration identity.** `name` is static, non-empty, and unique only
+   components, including runtime `<if>`, outlet, and selected-route paths. A
+   false branch or unselected route produces no occurrence. Authored boundaries
+   must not directly or transitively contain another authored boundary in this
+   version.
+2. **Repeats are boundary-free.** A boundary must never execute inside a `<for>`
+   repeat body, directly or transitively behind `<if>`, a route, an outlet, or
+   a reusable component reached from the body. A repeat iteration cannot
+   suspend, so the build rejects the whole reachable set with
+   `boundary-in-repeat` and names the repeat, the declaration, and its owner.
+   The inverse is allowed and is the intended pattern: a `<for>` **inside** one
+   boundary makes the whole finite list one atomic independently paced region,
+   and a boundary may appear before or after a repeat. The continuation VM
+   therefore keeps no resumable repeat state: a repeat is walked to completion
+   inside the step that opens it, and a boundary discovered while a repeat is
+   open is rejected as a malformed protocol.
+3. **Local declaration identity.** `name` is static, non-empty, and unique only
    within its owning entry or component template. `declarationId` is a stable
    build-local integer. Each runtime occurrence receives a gapless
    response-local `instanceId` and the host receives
    `{ instanceId, declarationId, owner, name, key }`.
-3. **Repeated occurrence identity.** A declaration that can occur more than
-   once must author `key`. The expression must resolve in that occurrence's
-   lexical scope to a finite JSON number or string. Keys for simultaneously
-   live occurrences of one declaration must be unique.
-4. **Pull session.** `start(state)` renders until the first occurrence or
-   terminal. `resume(instanceId, state, mode)` must target the currently pending
-   descriptor, commits it, and renders until the next occurrence or terminal.
-   `update(instanceId, patch)` targets only a committed updatable occurrence and
-   returns or writes one markerless update record. A final step has
-   `done = true`, has no descriptor, and already includes the document tail,
-   terminal record, final flush, and writer end.
-5. **Frozen continuation state.** At `start`, the handler projects and freezes
+4. **Multiple static occurrences.** A declaration in a reusable component
+   reached from more than one static callsite in one entry traversal must author
+   `key`; the build rejects an unkeyed declaration with `missing-boundary-key`.
+   Independent entries that each reach the component once do not make the
+   declaration repeatable. A `<for>` never creates keyed boundary occurrences
+   because every boundary its body reaches is rejected. The expression must
+   resolve in that occurrence's lexical scope to a finite JSON number or string.
+   Keys for simultaneously live occurrences of one declaration must be unique.
+5. **Pull session.** `start(state)` renders the shell prefix and stops before the
+   first occurrence, or runs through the terminal when there is none.
+   `resume(instanceId, state, mode)` must target the currently pending
+   descriptor and renders **only** that occurrence, through its checkpoint;
+   its bytes contain no following parent or tail bytes. `advance()` renders the
+   ordinary parent bytes that follow a committed occurrence until the next
+   occurrence or the terminal, and is valid only after `resume`.
+   `update(instanceId, patch)` targets only a committed updatable occurrence,
+   returns or writes one markerless update record, and is valid between `resume`
+   and `advance`. Every step is one independently writable, independently
+   flushed segment; the final step has `done = true`, no descriptor, and
+   includes the document tail, terminal record, final flush, and writer end. An
+   out-of-order step is rejected before any byte is written and does not poison
+   the response.
+6. **Frozen continuation state.** At `start`, the handler projects and freezes
    only top-level state keys reachable by the continuation. It also preserves
    lexical locals, component attributes, route state, inventories, and
    continuation frames. Resume state overlays the frozen parent projection for
    selected keys. Expression resolution remains lexical first, then the
    boundary resume overlay, then frozen parent state. The one-shot
-   `WebUIHandler::render_streaming` helper resumes every occurrence directly
-   against its original start snapshot, avoiding redundant overlays when one
-   state value drives the complete response.
-6. **Generated component spans.** When traversal suspends inside a reusable
+   `WebUIHandler::render_streaming` helper drives `start → resume → advance → …`
+   directly against its original start snapshot, avoiding redundant overlays
+   when one state value drives the complete response.
+7. **Generated component spans.** When traversal suspends inside a reusable
    component, the handler opens a generated component span around its unfinished
    host. An early child checkpoint may bypass exactly its nearest unfinished
    spanning ancestor. Other descendants remain opaque behind that parent until
@@ -2190,28 +2246,28 @@ regions while the document is still loading.
    inner-first. This rule is identical for light and shadow DOM; the browser
    crosses open shadow roots, slots, and hosts without leaving the bounded
    range.
-7. **Exactly-once activation.** Streamed roots hydrate parent-first and
+8. **Exactly-once activation.** Streamed roots hydrate parent-first and
    `hydratedCallback()` runs exactly once after their first successful
    activation. Undefined roots wait by tag. An undefined or unfinished parent
    is an activation barrier except for a compiler-marked early child matching
    the nearest span ID.
-8. **Updates are state only.** An update applies the existing projected
+9. **Updates are state only.** An update applies the existing projected
    `setState()` path to roots retained by an updatable checkpoint. It never
    inserts, replaces, relocates, or reparses application markup and never
    re-runs hydration or `hydratedCallback()`. A patch that arrives before a
    retained root activates is shallow-merged and replayed after activation.
-9. **Ordered, self-sufficient wire.** Records use a gapless response-local
-   sequence starting at zero. Each checkpoint or span completion carries all
-   template, inventory, CSS, route, nonce, and projected-state deltas needed to
-   commit it after prior records. Global metadata merges additively. Boundary
-   state remains ephemeral and is not published to `window.__webui.state`.
-10. **Fail closed.** Version, tuple arity, record sequence, occurrence sequence,
+10. **Ordered, self-sufficient wire.** Records use a gapless response-local
+    sequence starting at zero. Each checkpoint or span completion carries all
+    template, inventory, CSS, route, nonce, and projected-state deltas needed to
+    commit it after prior records. Global metadata merges additively. Boundary
+    state remains ephemeral and is not published to `window.__webui.state`.
+11. **Fail closed.** Version, tuple arity, record sequence, occurrence sequence,
     target kind, marker closure, span ancestry, and all configured work and
     retention limits are mandatory. Malformed, truncated, stale, duplicate, or
     overflowing input halts the coordinator, suppresses successful completion,
     and releases discoverable scripts, sentinels, markers, waiters, span state,
     and update roots within fixed bounds.
-11. **Mode isolation.** Streaming is explicitly selected per response and
+12. **Mode isolation.** Streaming is explicitly selected per response and
     requires a `FlushWriter` or owned `StreamingSession`. Ordinary `render`,
     partial navigation, and component-template operations do not emit streaming
     markers or browser records.
@@ -2221,9 +2277,10 @@ regions while the document is still loading.
 `<boundary>` is a bare compile-time directive. The parser erases its tags and
 brackets its body with a `WebUIFragmentBoundary` start/end pair emitted inline
 in the owner's record. It is valid in an entry or reusable component and may be
-reached through conditions, loops, outlets, and route content. Component
-templates strip directive tags from their browser template HTML, while the
-server fragment graph retains the typed declaration.
+reached through conditions, outlets, and route content. A boundary may enclose
+a boundary-free `<for>`. Component templates strip directive tags from their
+browser template HTML, while the server fragment graph retains the typed
+declaration.
 
 ```html
 <!-- index.html -->
@@ -2258,8 +2315,14 @@ The compiler enforces:
 
 - `name` is required, static, non-empty, and unique within the current owner.
 - Direct and transitive authored boundary nesting is rejected.
-- A declaration that is lexically inside `<for>` requires `key`; graph analysis
-  conservatively marks declarations reached repeatedly through components too.
+- A boundary reachable from a `<for>` repeat body, directly or transitively
+  through `<if>`, a component, a route, or an outlet mount, is rejected with
+  `boundary-in-repeat`. Wrapping the whole `<for>` in one boundary is the
+  supported alternative.
+- A declaration in a reusable component reached from more than one static
+  callsite in one entry traversal requires `key`; graph analysis marks those
+  declarations conservatively. Independent entries that each call it once do
+  not.
 - `key` is a non-empty expression whose runtime value must be a string or finite
   JSON number.
 - Entry boundaries must be inside `<body>`. Component-local boundaries use the
@@ -2341,11 +2404,13 @@ produce:
    therefore before the async application entry `<script type="module">`.
 2. `start` writes the prefix and stops immediately before the first discovered
    occurrence, or writes through terminal if none occurs.
-3. Each `resume` writes the selected occurrence and any subsequent static bytes
-   and span completions, stopping before the next discovered occurrence or
-   after terminal.
-4. `update` records may interleave after their updatable target commits.
-5. The call that reaches `body_end` writes tail bytes, terminal, final flush,
+3. Each `resume` writes only the selected occurrence through its checkpoint and
+   returns before subsequent parent or tail bytes.
+4. `update` records may interleave after their updatable target commits,
+   including between that target's `resume` and `advance`.
+5. `advance` writes subsequent static bytes and span completions, stopping
+   before the next discovered occurrence or after terminal.
+6. The call that reaches `body_end` writes tail bytes, terminal, final flush,
    and writer end.
 
 The application entry imports
@@ -2458,13 +2523,14 @@ existing private `flush_buf` (`crates/webui/src/streaming.rs`) as a public
 rejected at the streaming-render entry point rather than silently buffering.
 
 When `resume` completes a checkpoint, it finishes all child markup, emits
-template/state deltas and the sentinel, then calls `flush()`. Span completion,
-update, and terminal records also flush. This sequence is atomic from the
-host's perspective. "Flush" means bytes were
-handed to the HTTP transport; intermediary proxies may still coalesce them,
-so production guidance must document disabling reverse-proxy response
-buffering where applicable (this is a deployment note, not something the
-library can enforce).
+template/state deltas and the sentinel, then calls `flush()` and returns
+immediately: the parent bytes that follow belong to the next `advance` step, so
+one checkpoint is exactly one host write. Span completion, update, and terminal
+records also flush. This sequence is atomic from the host's perspective.
+"Flush" means bytes were handed to the HTTP transport; intermediary proxies may
+still coalesce them, so production guidance must document disabling
+reverse-proxy response buffering where applicable (this is a deployment note,
+not something the library can enforce).
 
 Because each complete record and sentinel precedes its flush, a transport prefix
 can commit only complete records. Flush points control delivery timing, not
@@ -2492,9 +2558,10 @@ wire correctness.
 Stable parser diagnostics are `missing-boundary-name`,
 `invalid-boundary-name`, `duplicate-boundary-name`,
 `missing-boundary-key`, `invalid-boundary-key`, `too-many-boundaries`,
-`nested-boundary`, `boundary-crosses-scope`, `boundary-outside-body`,
-`boundary-in-foster-context`, `invalid-route-boundary-placement`, and
-`authored-webui-hydrate`. `streaming-without-projection` remains a warning.
+`nested-boundary`, `boundary-in-repeat`, `boundary-crosses-scope`,
+`boundary-outside-body`, `boundary-in-foster-context`,
+`invalid-route-boundary-placement`, and `authored-webui-hydrate`.
+`streaming-without-projection` remains a warning.
 
 Runtime ordering, key, continuation, span, and marker failures use
 `HandlerError::StreamingBoundary`. Missing or duplicate document initialization
@@ -2524,10 +2591,13 @@ poisoned.
 
 The continuation VM is iterative and retains bounded frames, lexical scopes,
 projected parent keys, occurrence-key sets, open-span captures, and reusable
-scratch buffers. It does not clone the complete parent state. Runtime discovery
-follows only the selected fragment path and uses `FragmentList::contains_boundary`
-to avoid probing boundary-free subgraphs. Capture buffers are swapped and
-recycled rather than rebuilt for nested spans.
+scratch buffers. It does not clone the complete parent state. Because a repeat
+can carry no boundary, it holds no resumable repeat iterator across host calls:
+a `<for>` is walked to completion inside the step that opens it, and closing one
+item and opening the next share a single frame. Runtime discovery follows only
+the selected fragment path and uses `FragmentList::contains_boundary` to avoid
+probing boundary-free subgraphs. Capture buffers are swapped and recycled rather
+than rebuilt for nested spans.
 
 The browser performs no `MutationObserver`, polling, or document-wide query on
 a valid path. It resolves root-local markers, walks each committed range once,
@@ -2541,9 +2611,12 @@ The primary scenario has one `<ntp-page>` in the entry. Its reusable component
 template owns `search-ready` around `<search-box>` and continues with a slow
 parent tail. `start` returns the component-local descriptor after writing the
 document prefix and the opening `ntp-page` span. Resuming that descriptor
-commits and hydrates `search-box`; traversal then writes the rest of
-`ntp-page`, completes the generated span, and emits terminal. The early child
-is interactive before the parent tail, without an authored outer boundary.
+commits and hydrates `search-box` and returns immediately, so the host's write
+for that step contains the `search-ready` checkpoint and nothing else. The
+following `advance` writes the rest of `ntp-page`, completes the generated span,
+and emits terminal. The early child is interactive before the parent tail,
+without an authored outer boundary and without a synthetic sibling boundary to
+separate the two writes.
 
 ### Server-driven response sessions
 
@@ -2552,23 +2625,33 @@ let mut page = handler.stream_response(&protocol, &options, writer)?;
 let mut step = page.start(&initial_state)?;
 
 while !step.done {
-    let boundary = step.boundary.as_ref().ok_or_else(missing_boundary)?;
-    let state = load_boundary_state(
-        &boundary.owner,
-        &boundary.name,
-        boundary.key.as_ref(),
-    )?;
-    step = page.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state = load_boundary_state(
+                &boundary.owner,
+                &boundary.name,
+                boundary.key.as_ref(),
+            )?;
+            // Writes only this occurrence, through its checkpoint.
+            page.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+        }
+        // Writes the parent bytes up to the next occurrence or terminal.
+        None => page.advance()?,
+    };
 }
 ```
 
 Each call is synchronous and borrows state only for that call. An asynchronous
 host may await between calls but must serialize one session onto one admitted
-worker. A stale or non-pending instance ID is rejected. A rendering or
-transport failure poisons the session because emitted bytes cannot be rewound.
+worker. A stale or non-pending instance ID, a `resume` before the previous
+commit was advanced past, or an `advance` with no committed occurrence is
+rejected before any byte is written and leaves the session usable. A rendering
+or transport failure poisons the session because emitted bytes cannot be
+rewound.
 
 An occurrence committed as `Updatable` may receive object patches before the
-terminal:
+terminal, including between its `resume` and the following `advance`, while
+the response is still open:
 
 ```rust
 page.update(search.instance_id, &search_patch)?;
@@ -2583,16 +2666,18 @@ boundaries use owned `StreamingSession`, which returns bytes:
 
 | Host | Step bytes | API spelling |
 |------|------------|--------------|
-| Rust | `Vec<u8>` | `start`, `resume`, `update` |
-| Node | `Buffer` | `start`, `resume`, `update` |
-| WASM | `Uint8Array` | `start`, `resume`, `update` |
-| C | `uint8_t *` plus length | `webui_streaming_session_start`, `_resume`, `_update` |
-| C# | `byte[]` | `Start`, `Resume`, `Update` |
-| Python | `bytes` | `start`, `resume`, `update` |
+| Rust | `Vec<u8>` | `start`, `resume`, `advance`, `update` |
+| Node | `Buffer` | `start`, `resume`, `advance`, `update` |
+| WASM | `Uint8Array` | `start`, `resume`, `advance`, `update` |
+| C | `uint8_t *` plus length | `webui_streaming_session_start`, `_resume`, `_advance`, `_update` |
+| C# | `byte[]` | `Start`, `Resume`, `Advance`, `Update` |
+| Python | `bytes` | `start`, `resume`, `advance`, `update` |
 
 Step results carry bytes, optional descriptor, and `done`. Descriptor fields
 preserve JSON key identity across bindings: string keys remain strings and
-finite numeric keys remain numbers. The host owns socket writes, flushing,
+finite numeric keys remain numbers. Each step's bytes are one semantic write
+segment ending on the transport flush that closed the step, so a host writes and
+flushes exactly once per step. The host owns socket writes, flushing,
 backpressure, cancellation, and one session per in-flight response.
 
 ### API-proxy host-control stream
@@ -2611,10 +2696,13 @@ The version-2 control vocabulary mirrors the session:
 `resume.boundary` must match the currently returned descriptor by `owner`,
 `name`, and `key`; omit `key` only when the descriptor has none. An optional
 `declarationId` can tighten the match. The CLI passes the descriptor's
-response-local `instanceId` to Rust. `update.boundary` uses the same identity to
-select one previously committed updatable occurrence; multiple matches fail.
-The control stream ends after the `start` or `resume` whose returned step is
-done. There is no end-control record.
+response-local `instanceId` to Rust and then drives `advance` itself to reach
+the next descriptor, so the control vocabulary needs no advance record and the
+backend still decides only per-occurrence state. `update.boundary` uses the same
+identity to select one previously committed updatable occurrence; multiple
+matches fail. After sending the resume for the final descriptor, the backend
+closes its control body; the CLI's internal `advance` reports done. There is no
+advance or end-control record.
 
 Resolved token CSS, `basePath`, and route parameters are injected into start
 and resume state. Update state receives no unrelated defaults. Each NDJSON
@@ -4141,8 +4229,9 @@ consumers only ship the parser and/or handler code they need:
   plugin at construction, and provides `render`, `renderStream`,
   `streamResponse`, `renderPartial`, `renderComponentTemplates`, and `tokens`.
   `streamResponse(entry, requestPath, options)` returns an owned session whose
-  `start` and `resume` methods return `{ bytes, done, boundary? }` and whose
-  `update` method returns bytes. Callback rendering
+  `start`, `resume`, and `advance` methods return
+  `{ bytes, done, boundary? }` and whose `update` method returns bytes. Callback
+  rendering
   coalesces handler fragments with a
   16 KiB target before crossing the WASM-to-JavaScript boundary.
 - `parser` builds `webui_wasm_parser.js` and exports `build_protocol`. It
@@ -4176,8 +4265,8 @@ The `@microsoft/webui` npm package follows the esbuild single-package model:
   `drain` and therefore does not provide backpressure
 - `Protocol.streamResponse()` returns an owned session. The public package
   accepts object or serialized state, converts once per call, and exposes
-  `start`, `resume`, and `update`; native steps carry `Buffer`, `done`, and an
-  optional camel-case descriptor
+  `start`, `resume`, `advance`, and `update`; native steps carry `Buffer`,
+  `done`, and an optional camel-case descriptor
 - render currently requires the native addon; no WASM render fallback is wired
 
 ### .NET / NuGet Distribution
@@ -4192,10 +4281,10 @@ token queries are protocol-owned operations exposed as `RenderPartial`,
 both decoded protocol data and reusable indices on dispose.
 
 `WebUIHandler.StreamResponse` returns a single-driver `StreamingSession`.
-`Start` and `Resume` return immutable `StreamingStep` values; `Update` returns a
-`byte[]`. `BoundaryDescriptor` exposes response-local and declaration IDs,
-owner, name, and a typed `BoundaryKey`. Native step handles are copied into
-managed values and disposed before each call returns.
+`Start`, `Resume`, and `Advance` return immutable `StreamingStep` values;
+`Update` returns a `byte[]`. `BoundaryDescriptor` exposes response-local and
+declaration IDs, owner, name, and a typed `BoundaryKey`. Native step handles are
+copied into managed values and disposed before each call returns.
 
 Native assets are split into `Microsoft.WebUI.Runtime.<rid>` packages for each supported RID. The runtime packages share `dotnet/runtime/README.md`, include NuGet release notes pointing to the GitHub release notes, and carry the matching `runtimes/<rid>/native` asset. The managed package references every runtime package so NuGet restores them transitively; .NET then resolves `webui_ffi` from the matching native asset. `WEBUI_LIB_PATH` remains the override for custom local native builds.
 
@@ -4253,8 +4342,9 @@ stall unrelated Python threads.
 | `renderer.tokens` | `tuple[str, ...]` of CSS token names in build order |
 | `renderer.stream_response(*, entry="index.html", request_path="/", nonce=None, head_inject=None, body_inject=None)` | Open a host-driven `StreamingSession` |
 
-`StreamingSession.start(state) -> StreamStep` and
-`StreamingSession.resume(instance_id, state, mode) -> StreamStep` return
+`StreamingSession.start(state) -> StreamStep`,
+`StreamingSession.resume(instance_id, state, mode) -> StreamStep`, and
+`StreamingSession.advance() -> StreamStep` return
 `bytes`, `done`, and an optional descriptor with `instance_id`,
 `declaration_id`, `owner`, `name`, and `key`.
 `StreamingSession.update(instance_id, patch) -> bytes` targets a committed
@@ -4355,8 +4445,9 @@ host, and lets the host apply its own backpressure policy.
 |----------|-------------|
 | `webui_streaming_session_create(handler, protocol, entry_id, request_path)` | Open a session. It inherits the handler's already-configured nonce (see `webui_handler_set_nonce`); head/body injection travels through the reserved `$webui` state key on `state_json` (see [Reserved State Inject Channel](#reserved-state-inject-channel)), not a create-time argument. The session clones its own references to the handler and protocol, so destruction order between the three is irrelevant. |
 | `webui_streaming_session_destroy(session)` | Destroy a session. `NULL` is a safe no-op. Destroying an unfinished session discards its pending output. |
-| `webui_streaming_session_start(session, state_json)` | Return an owned step through the first runtime occurrence or terminal, or `NULL`. |
-| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Commit the pending occurrence as mode `0` final or `1` updatable, then return the next owned step. |
+| `webui_streaming_session_start(session, state_json)` | Return an owned step through the shell prefix, stopping before the first runtime occurrence, or through the terminal when there is none, or `NULL`. |
+| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Commit the pending occurrence as mode `0` final or `1` updatable and return an owned step holding only that occurrence's bytes, through its checkpoint. |
+| `webui_streaming_session_advance(session)` | Return an owned step with the ordinary parent bytes following a committed occurrence, up to the next occurrence or the terminal. Valid only after resume. |
 | `webui_streaming_session_update(session, instance_id, patch_json, out_len)` | Produce a projected state patch for a committed updatable occurrence. |
 | `webui_streaming_step_bytes(step, out_len)` | Borrow the step's binary-safe bytes until destroy. |
 | `webui_streaming_step_done(step)` / `webui_streaming_step_has_boundary(step)` | Observe completion and descriptor presence. |
@@ -4371,7 +4462,8 @@ released with `webui_free`. A failing function returns `false` or `NULL`, and
 
 Host parity: the same session shape is available as `StreamingSession` from
 Rust (`webui-handler`), Node (`Protocol.streamResponse`), WASM
-(`Protocol.streamResponse`), and C# (`WebUIHandler.StreamResponse`).
+(`Protocol.streamResponse`), Python (`Renderer.stream_response`), and C#
+(`WebUIHandler.StreamResponse`).
 
 The C ABI uses a typed opaque `webui_protocol_t *` with explicit
 `webui_protocol_create` / `webui_protocol_destroy` ownership because C has no
diff --git a/crates/webui-cli/README.md b/crates/webui-cli/README.md
index d7010e4e9..37a5ca776 100644
--- a/crates/webui-cli/README.md
+++ b/crates/webui-cli/README.md
@@ -85,9 +85,22 @@ The control response uses version 2 and exactly three command types:
 the pending runtime descriptor's `owner`, `name`, and optional string-or-number
 `key`; `declarationId` may also be supplied for validation. The CLI retains
 committed descriptors, so `update` uses the same target without a reverse
-acknowledgement channel. Ambiguous unkeyed update targets are rejected. A
-`resume` automatically completes the response when its returned step is done;
-the backend then closes its NDJSON body. There is no terminal control command.
+acknowledgement channel. Ambiguous unkeyed update targets are rejected.
+
+The CLI drives the Rust step machine as follows:
+
+| Rust step state | CLI action |
+|---|---|
+| descriptor present | Wait for the matching backend `resume`, then call `resume` |
+| no descriptor and not done | Call `advance` internally |
+| done | Complete the browser response |
+
+Rust `resume` emits only the pending boundary through its checkpoint. The
+following internal `advance` emits parent or tail bytes through the next
+descriptor or terminal. The backend does not send an `advance` control record.
+It closes its NDJSON body after sending the resume for the final descriptor;
+the CLI's final `advance` completes the response. There is no terminal control
+command.
 
 ### `webui inspect`
 
diff --git a/crates/webui-cli/src/commands/serve/streaming_api.rs b/crates/webui-cli/src/commands/serve/streaming_api.rs
index 1066ae5b6..d1d1754f4 100644
--- a/crates/webui-cli/src/commands/serve/streaming_api.rs
+++ b/crates/webui-cli/src/commands/serve/streaming_api.rs
@@ -20,7 +20,7 @@ use tokio_stream::{Stream, StreamExt};
 use webui::streaming::{ChunkPool, StreamingWriter};
 use webui::{
     BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, HandlerError, Protocol,
-    RenderOptions,
+    RenderOptions, StreamStatus, StreamingResponse,
 };
 
 use super::create_handler;
@@ -275,7 +275,7 @@ enum RendererError {
     )]
     Truncated { pending: String },
     #[error(
-        "WebUI API stream record {record} sends {command} after the streaming response completed; close the response body after the resume that returns done"
+        "WebUI API stream record {record} sends {command} after the streaming response completed; close the response body after the final resume or update control"
     )]
     CommandAfterDone {
         record: usize,
@@ -641,6 +641,7 @@ fn run_renderer(
 
     loop {
         let Some(record) = commands.blocking_recv() else {
+            advance_committed_cursor(&mut response, &mut status)?;
             if status.done {
                 return Ok(());
             }
@@ -666,6 +667,13 @@ fn run_renderer(
                 mode,
                 state,
             } => {
+                advance_committed_cursor(&mut response, &mut status)?;
+                if status.done {
+                    return Err(RendererError::CommandAfterDone {
+                        record: record.index,
+                        command: "resume",
+                    });
+                }
                 let pending = status
                     .boundary
                     .as_ref()
@@ -690,6 +698,19 @@ fn run_renderer(
     }
 }
 
+fn advance_committed_cursor(
+    response: &mut StreamingResponse<'_, StreamingWriter>,
+    status: &mut StreamStatus,
+) -> Result<(), RendererError> {
+    // A following resume (or backend EOF) is the implicit advance control.
+    // Updates stay ahead of that point so they can target the just-committed
+    // occurrence before its separately flushed parent segment is rendered.
+    if !status.done && status.boundary.is_none() {
+        *status = response.advance()?;
+    }
+    Ok(())
+}
+
 struct CommittedBoundary {
     descriptor: BoundaryDescriptor,
     mode: BoundaryMode,
@@ -918,7 +939,7 @@ mod tests {
         boundary_names: &[&str],
     ) -> RenderConfig {
         let mut fragments =
-            Vec::with_capacity(precommit_fragments.len() + boundary_names.len() * 3 + 7);
+            Vec::with_capacity(precommit_fragments.len() + boundary_names.len() * 3 + 8);
         fragments.extend([
             WebUIFragment::raw("<html><head>"),
             structural("head_start"),
@@ -942,7 +963,11 @@ mod tests {
             )));
             fragments.push(WebUIFragment::boundary_end(declaration_id));
         }
-        fragments.extend([structural("body_end"), WebUIFragment::raw("</body></html>")]);
+        fragments.extend([
+            WebUIFragment::raw("<footer data-page-tail>tail</footer>"),
+            structural("body_end"),
+            WebUIFragment::raw("</body></html>"),
+        ]);
         records.insert(
             "index.html".to_owned(),
             FragmentList {
@@ -1010,7 +1035,7 @@ mod tests {
     fn run_commands(
         config: RenderConfig,
         commands: Vec<ApiStreamCommand>,
-    ) -> (Result<(), RendererError>, Vec<u8>) {
+    ) -> (Result<(), RendererError>, Vec<Bytes>) {
         let (command_tx, command_rx) = mpsc::channel(commands.len().max(1));
         for (index, command) in commands.into_iter().enumerate() {
             command_tx
@@ -1023,11 +1048,20 @@ mod tests {
         let (ready_tx, _ready_rx) = oneshot::channel();
         let result = run_renderer(config, command_rx, &mut writer, ready_tx);
         drop(writer);
-        let mut html = Vec::new();
+        let mut segments = Vec::new();
         while let Ok(chunk) = html_rx.try_recv() {
-            html.extend_from_slice(&chunk);
+            segments.push(chunk);
         }
-        (result, html)
+        (result, segments)
+    }
+
+    fn join_segments(segments: &[Bytes]) -> Vec<u8> {
+        let capacity = segments.iter().map(Bytes::len).sum();
+        let mut bytes = Vec::with_capacity(capacity);
+        for segment in segments {
+            bytes.extend_from_slice(segment);
+        }
+        bytes
     }
 
     #[test]
@@ -1167,7 +1201,7 @@ mod tests {
     }
 
     #[test]
-    fn renderer_uses_start_resume_update_and_completes_without_finish_command() {
+    fn renderer_writes_resume_update_and_advance_as_ordered_segments() {
         let commands = vec![
             ApiStreamCommand::Start {
                 version: VERSION,
@@ -1188,18 +1222,101 @@ mod tests {
                 state: serde_json::json!({}),
             },
         ];
-        let (result, html) = run_commands(
+        let (result, segments) = run_commands(
             valid_streaming_config(Vec::new(), &["content", "tail"]),
             commands,
         );
         result.unwrap_or_else(|error| panic!("renderer failed: {error}"));
-        let html = String::from_utf8(html)
+        let content = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"data-boundary=\"content\"".len())
+                    .any(|window| window == b"data-boundary=\"content\"")
+            })
+            .unwrap_or_else(|| panic!("content checkpoint segment is missing"));
+        let update = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"[2,1,2,0,".len())
+                    .any(|window| window == b"[2,1,2,0,")
+            })
+            .unwrap_or_else(|| panic!("update segment is missing"));
+        let tail = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"data-boundary=\"tail\"".len())
+                    .any(|window| window == b"data-boundary=\"tail\"")
+            })
+            .unwrap_or_else(|| panic!("tail checkpoint segment is missing"));
+        let terminal = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"[2,3,4,0,{}]".len())
+                    .any(|window| window == b"[2,3,4,0,{}]")
+            })
+            .unwrap_or_else(|| panic!("terminal segment is missing"));
+        assert!(content < update);
+        assert!(update < tail);
+        assert!(tail < terminal);
+        assert!(!segments[content]
+            .windows(b"data-boundary=\"tail\"".len())
+            .any(|window| window == b"data-boundary=\"tail\""));
+
+        let html = String::from_utf8(join_segments(&segments))
             .unwrap_or_else(|error| panic!("renderer produced invalid UTF-8: {error}"));
         assert!(html.contains("data-boundary=\"content\""));
         assert!(html.contains("data-boundary=\"tail\""));
         assert!(html.contains("[2,3,4,0,{}]"));
     }
 
+    #[test]
+    fn renderer_flushes_a_single_checkpoint_before_its_tail() {
+        let commands = vec![
+            ApiStreamCommand::Start {
+                version: VERSION,
+                state: serde_json::json!({}),
+            },
+            ApiStreamCommand::Resume {
+                boundary: target("index.html", "content"),
+                mode: ApiBoundaryMode::Final,
+                state: serde_json::json!({}),
+            },
+        ];
+        let (result, segments) =
+            run_commands(valid_streaming_config(Vec::new(), &["content"]), commands);
+        result.unwrap_or_else(|error| panic!("renderer failed: {error}"));
+
+        let checkpoint = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"data-boundary=\"content\"".len())
+                    .any(|window| window == b"data-boundary=\"content\"")
+            })
+            .unwrap_or_else(|| panic!("checkpoint segment is missing"));
+        let tail = segments
+            .iter()
+            .position(|segment| {
+                segment
+                    .windows(b"<footer data-page-tail>".len())
+                    .any(|window| window == b"<footer data-page-tail>")
+            })
+            .unwrap_or_else(|| panic!("tail segment is missing"));
+        assert!(checkpoint < tail);
+        assert!(!segments[checkpoint]
+            .windows(b"<footer data-page-tail>".len())
+            .any(|window| window == b"<footer data-page-tail>"));
+        assert!(!segments[checkpoint]
+            .windows(b"[2,1,4,0,{}]".len())
+            .any(|window| window == b"[2,1,4,0,{}]"));
+        assert!(segments[checkpoint].ends_with(b"<webui-hydrate></webui-hydrate>"));
+        assert!(segments[tail].starts_with(b"<footer data-page-tail>"));
+    }
+
     #[test]
     fn renderer_rejects_a_resume_that_does_not_match_the_current_cursor() {
         let commands = vec![
@@ -1231,7 +1348,7 @@ mod tests {
     }
 
     #[test]
-    fn renderer_rejects_commands_after_automatic_completion() {
+    fn renderer_rejects_resume_after_automatic_advance_completes() {
         let commands = vec![
             ApiStreamCommand::Start {
                 version: VERSION,
@@ -1242,8 +1359,9 @@ mod tests {
                 mode: ApiBoundaryMode::Final,
                 state: serde_json::json!({}),
             },
-            ApiStreamCommand::Update {
+            ApiStreamCommand::Resume {
                 boundary: target("index.html", "content"),
+                mode: ApiBoundaryMode::Final,
                 state: serde_json::json!({}),
             },
         ];
@@ -1252,7 +1370,7 @@ mod tests {
             result,
             Err(RendererError::CommandAfterDone {
                 record: 2,
-                command: "update"
+                command: "resume"
             })
         ));
     }
@@ -1263,8 +1381,9 @@ mod tests {
             version: VERSION,
             state: serde_json::json!({}),
         }];
-        let (result, html) = run_commands(valid_streaming_config(Vec::new(), &[]), commands);
+        let (result, segments) = run_commands(valid_streaming_config(Vec::new(), &[]), commands);
         result.unwrap_or_else(|error| panic!("boundary-free render failed: {error}"));
+        let html = join_segments(&segments);
         assert!(String::from_utf8_lossy(&html).contains("[2,0,4,0,{}]"));
     }
 
diff --git a/crates/webui-ffi/README.md b/crates/webui-ffi/README.md
index d5d20ee0c..adf1977dc 100644
--- a/crates/webui-ffi/README.md
+++ b/crates/webui-ffi/README.md
@@ -16,7 +16,8 @@ deterministic index construction on every request. Release the shared handle wit
 
 Create one `webui_streaming_session_t` per response. Drive it with
 `webui_streaming_session_start`, `webui_streaming_session_resume`, and
-`webui_streaming_session_update`. Start and resume return an opaque
+`webui_streaming_session_advance`, plus
+`webui_streaming_session_update`. Start, resume, and advance return an opaque
 `webui_streaming_step_t` with accessors for binary-safe bytes, `done`, and an
 optional runtime descriptor:
 
@@ -24,11 +25,17 @@ optional runtime descriptor:
 { instance_id, declaration_id, owner, name, key }
 ```
 
-The completed step already contains terminal and document-tail bytes. Resume
-must target the currently pending instance. Update targets a previously
-committed updatable instance and emits state only, never markup. Release step
-storage with `webui_streaming_step_destroy`; its byte and descriptor string
-pointers are borrowed until that call. Free update byte buffers with `webui_free`.
+If the step has a descriptor, call `webui_streaming_session_resume`. If it has
+neither a descriptor nor `done`, call `webui_streaming_session_advance`. If
+`done` is true, the response is complete. Resume must target the currently
+pending instance and returns only that occurrence through its checkpoint.
+Advance returns the following parent or tail bytes through the next descriptor
+or terminal, so no sibling boundary workaround is needed.
+
+Update targets a previously committed updatable instance, is valid between its
+resume and advance, and emits state only, never markup. Release step storage
+with `webui_streaming_step_destroy`; its byte and descriptor string pointers are
+borrowed until that call. Free update byte buffers with `webui_free`.
 
 ## Documentation
 
diff --git a/crates/webui-ffi/include/webui_ffi.h b/crates/webui-ffi/include/webui_ffi.h
index 81022b9b7..a2ed1ecbe 100644
--- a/crates/webui-ffi/include/webui_ffi.h
+++ b/crates/webui-ffi/include/webui_ffi.h
@@ -14,7 +14,7 @@ typedef void webui_protocol_t;
 typedef void webui_streaming_session_t;
 
 /**
- * Opaque owned result from one streaming start or resume call.
+ * Opaque owned result from one streaming start, resume, or advance call.
  */
 typedef void webui_streaming_step_t;
 
@@ -221,9 +221,10 @@ char *webui_protocol_tokens(const webui_protocol_t *protocol_ptr);
  * Open a host-driven progressive response for a streaming entry.
  *
  * Unlike [`webui_handler_render`], which produces the whole document in one
- * call, the returned session advances through [`webui_streaming_session_start`]
- * and [`webui_streaming_session_resume`] so the host owns the socket, write
- * order, and backpressure. Any nonce previously set with
+ * call, the returned session advances through [`webui_streaming_session_start`],
+ * [`webui_streaming_session_resume`], and [`webui_streaming_session_advance`]
+ * so the host owns the socket, write order, and backpressure. Any nonce
+ * previously set with
  * [`webui_handler_set_nonce`] is captured for the life of the session.
  *
  * Returns `NULL` on error; call [`webui_last_error`] for details. The handle
@@ -276,7 +277,7 @@ webui_streaming_step_t *webui_streaming_session_start(webui_streaming_session_t
                                                       const char *state_json);
 
 /**
- * Commit the pending occurrence and advance to the next occurrence or terminal.
+ * Commit the pending occurrence through its checkpoint and stop.
  *
  * `mode` must be [`WEBUI_BOUNDARY_MODE_FINAL`] or
  * [`WEBUI_BOUNDARY_MODE_UPDATABLE`]. The returned owned step must be released
@@ -294,6 +295,20 @@ webui_streaming_step_t *webui_streaming_session_resume(webui_streaming_session_t
                                                        const char *state_json,
                                                        webui_boundary_mode_t mode);
 
+/**
+ * Advance through parent bytes to the next occurrence or terminal completion.
+ *
+ * This call is valid only after [`webui_streaming_session_resume`] commits the
+ * pending occurrence. The returned owned step follows the same ownership rules
+ * as start and resume and must be released with [`webui_streaming_step_destroy`].
+ * A `NULL` return indicates an error available through [`webui_last_error`].
+ *
+ * # Safety
+ *
+ * `session_ptr` must be a live session handle with no concurrent operation.
+ */
+webui_streaming_step_t *webui_streaming_session_advance(webui_streaming_session_t *session_ptr);
+
 /**
  * Emit a projected state patch for a committed updatable occurrence.
  *
@@ -323,8 +338,9 @@ char *webui_streaming_session_update(webui_streaming_session_t *session_ptr,
  * # Safety
  *
  * `step_ptr` must be a pointer returned by
- * [`webui_streaming_session_start`] or [`webui_streaming_session_resume`], or
- * `NULL` for a no-op. A non-null pointer must not be used after this call.
+ * [`webui_streaming_session_start`], [`webui_streaming_session_resume`], or
+ * [`webui_streaming_session_advance`], or `NULL` for a no-op. A non-null
+ * pointer must not be used after this call.
  */
 void webui_streaming_step_destroy(webui_streaming_step_t *step_ptr);
 
diff --git a/crates/webui-ffi/src/lib.rs b/crates/webui-ffi/src/lib.rs
index 8a1c7b476..1a12ede67 100644
--- a/crates/webui-ffi/src/lib.rs
+++ b/crates/webui-ffi/src/lib.rs
@@ -658,7 +658,7 @@ pub unsafe extern "C" fn webui_protocol_tokens(
 #[allow(non_camel_case_types)]
 pub type webui_streaming_session_t = c_void;
 
-/// Opaque owned result from one streaming start or resume call.
+/// Opaque owned result from one streaming start, resume, or advance call.
 #[allow(non_camel_case_types)]
 pub type webui_streaming_step_t = c_void;
 
@@ -699,9 +699,10 @@ struct StreamingStepContext {
 /// Open a host-driven progressive response for a streaming entry.
 ///
 /// Unlike [`webui_handler_render`], which produces the whole document in one
-/// call, the returned session advances through [`webui_streaming_session_start`]
-/// and [`webui_streaming_session_resume`] so the host owns the socket, write
-/// order, and backpressure. Any nonce previously set with
+/// call, the returned session advances through [`webui_streaming_session_start`],
+/// [`webui_streaming_session_resume`], and [`webui_streaming_session_advance`]
+/// so the host owns the socket, write order, and backpressure. Any nonce
+/// previously set with
 /// [`webui_handler_set_nonce`] is captured for the life of the session.
 ///
 /// Returns `NULL` on error; call [`webui_last_error`] for details. The handle
@@ -845,7 +846,7 @@ pub unsafe extern "C" fn webui_streaming_session_start(
     }
 }
 
-/// Commit the pending occurrence and advance to the next occurrence or terminal.
+/// Commit the pending occurrence through its checkpoint and stop.
 ///
 /// `mode` must be [`WEBUI_BOUNDARY_MODE_FINAL`] or
 /// [`WEBUI_BOUNDARY_MODE_UPDATABLE`]. The returned owned step must be released
@@ -898,6 +899,44 @@ pub unsafe extern "C" fn webui_streaming_session_resume(
     }
 }
 
+/// Advance through parent bytes to the next occurrence or terminal completion.
+///
+/// This call is valid only after [`webui_streaming_session_resume`] commits the
+/// pending occurrence. The returned owned step follows the same ownership rules
+/// as start and resume and must be released with [`webui_streaming_step_destroy`].
+/// A `NULL` return indicates an error available through [`webui_last_error`].
+///
+/// # Safety
+///
+/// `session_ptr` must be a live session handle with no concurrent operation.
+#[no_mangle]
+pub unsafe extern "C" fn webui_streaming_session_advance(
+    session_ptr: *mut webui_streaming_session_t,
+) -> *mut webui_streaming_step_t {
+    clear_last_error();
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        if session_ptr.is_null() {
+            set_last_error("session_ptr must not be null");
+            return std::ptr::null_mut();
+        }
+        // SAFETY: The caller guarantees exclusive access to a live session.
+        let context = unsafe { &mut *(session_ptr as *mut StreamingSessionContext) };
+        match context.session.advance() {
+            Ok(step) => owned_streaming_step(step),
+            Err(error) => {
+                set_last_error(error.to_string());
+                std::ptr::null_mut()
+            }
+        }
+    })) {
+        Ok(step) => step,
+        Err(_) => {
+            set_last_error("panic in webui_streaming_session_advance");
+            std::ptr::null_mut()
+        }
+    }
+}
+
 /// Emit a projected state patch for a committed updatable occurrence.
 ///
 /// Returns allocated bytes that must be freed with [`webui_free`]. On success,
@@ -971,8 +1010,9 @@ pub unsafe extern "C" fn webui_streaming_session_update(
 /// # Safety
 ///
 /// `step_ptr` must be a pointer returned by
-/// [`webui_streaming_session_start`] or [`webui_streaming_session_resume`], or
-/// `NULL` for a no-op. A non-null pointer must not be used after this call.
+/// [`webui_streaming_session_start`], [`webui_streaming_session_resume`], or
+/// [`webui_streaming_session_advance`], or `NULL` for a no-op. A non-null
+/// pointer must not be used after this call.
 #[no_mangle]
 pub unsafe extern "C" fn webui_streaming_step_destroy(step_ptr: *mut webui_streaming_step_t) {
     clear_last_error();
diff --git a/crates/webui-ffi/tests/ffi_test.rs b/crates/webui-ffi/tests/ffi_test.rs
index 987ac3b18..87ca5ec0e 100644
--- a/crates/webui-ffi/tests/ffi_test.rs
+++ b/crates/webui-ffi/tests/ffi_test.rs
@@ -21,19 +21,19 @@ use webui_ffi::{
     webui_free, webui_handler_create, webui_handler_create_with_plugin, webui_handler_destroy,
     webui_handler_render, webui_handler_set_nonce, webui_last_error, webui_protocol_create,
     webui_protocol_destroy, webui_protocol_render_partial, webui_protocol_tokens,
-    webui_streaming_session_create, webui_streaming_session_destroy,
-    webui_streaming_session_resume, webui_streaming_session_start, webui_streaming_session_update,
-    webui_streaming_step_boundary_declaration_id, webui_streaming_step_boundary_instance_id,
-    webui_streaming_step_boundary_key_number, webui_streaming_step_boundary_key_string,
-    webui_streaming_step_boundary_key_type, webui_streaming_step_boundary_name,
-    webui_streaming_step_boundary_owner, webui_streaming_step_bytes, webui_streaming_step_destroy,
-    webui_streaming_step_done, webui_streaming_step_has_boundary, WEBUI_BOUNDARY_KEY_NONE,
-    WEBUI_BOUNDARY_KEY_NUMBER, WEBUI_BOUNDARY_KEY_STRING, WEBUI_BOUNDARY_MODE_FINAL,
-    WEBUI_BOUNDARY_MODE_UPDATABLE,
+    webui_streaming_session_advance, webui_streaming_session_create,
+    webui_streaming_session_destroy, webui_streaming_session_resume, webui_streaming_session_start,
+    webui_streaming_session_update, webui_streaming_step_boundary_declaration_id,
+    webui_streaming_step_boundary_instance_id, webui_streaming_step_boundary_key_number,
+    webui_streaming_step_boundary_key_string, webui_streaming_step_boundary_key_type,
+    webui_streaming_step_boundary_name, webui_streaming_step_boundary_owner,
+    webui_streaming_step_bytes, webui_streaming_step_destroy, webui_streaming_step_done,
+    webui_streaming_step_has_boundary, WEBUI_BOUNDARY_KEY_NONE, WEBUI_BOUNDARY_KEY_NUMBER,
+    WEBUI_BOUNDARY_KEY_STRING, WEBUI_BOUNDARY_MODE_FINAL, WEBUI_BOUNDARY_MODE_UPDATABLE,
 };
 use webui_protocol::{
-    web_ui_fragment, FragmentList, InitialStateStrategy, StateProjectionMode, WebUIFragment,
-    WebUIProtocol, WebUiFragmentRoute,
+    FragmentList, InitialStateStrategy, StateProjectionMode, WebUIFragment, WebUIProtocol,
+    WebUiFragmentRoute,
 };
 
 // ---------------------------------------------------------------------------
@@ -963,47 +963,47 @@ fn protocol_destroy_null_is_safe() {
 // Tests: host-driven streaming sessions
 // ---------------------------------------------------------------------------
 
-/// Build one repeated declaration that discovers string and number keys.
+/// Build two static sibling declarations with string and number keys.
 fn build_streaming_protocol() -> Vec<u8> {
-    let mut row_boundary =
-        WebUIFragment::boundary(41, "index.html", "row", Some("{{item.id}}".to_string()));
-    if let Some(web_ui_fragment::Fragment::Boundary(boundary)) = row_boundary.fragment.as_mut() {
-        boundary.may_repeat = true;
-    }
-
-    let fragments = HashMap::from([
-        (
-            "index.html".to_string(),
-            FragmentList {
-                fragments: vec![
-                    WebUIFragment::raw("<!DOCTYPE html><html><head>"),
-                    structural_fragment("head_start"),
-                    structural_fragment("head_end"),
-                    WebUIFragment::raw("</head><body>"),
-                    structural_fragment("body_start"),
-                    WebUIFragment::for_loop("item", "items", "rows"),
-                    structural_fragment("body_end"),
-                    WebUIFragment::raw("</body></html>"),
-                ],
-                contains_boundary: true,
-            },
-        ),
-        (
-            "rows".to_string(),
-            FragmentList {
-                fragments: vec![
-                    row_boundary,
-                    WebUIFragment::raw("<p>"),
-                    WebUIFragment::signal("item.label", false),
-                    WebUIFragment::raw("/"),
-                    WebUIFragment::signal("count", false),
-                    WebUIFragment::raw("</p>"),
-                    WebUIFragment::boundary_end(41),
-                ],
-                contains_boundary: true,
-            },
-        ),
-    ]);
+    let fragments = HashMap::from([(
+        "index.html".to_string(),
+        FragmentList {
+            fragments: vec![
+                WebUIFragment::raw("<!DOCTYPE html><html><head>"),
+                structural_fragment("head_start"),
+                structural_fragment("head_end"),
+                WebUIFragment::raw("</head><body>"),
+                structural_fragment("body_start"),
+                WebUIFragment::boundary(
+                    41,
+                    "index.html",
+                    "string-row",
+                    Some("{{string_key}}".to_string()),
+                ),
+                WebUIFragment::raw("<p id=\"first\">"),
+                WebUIFragment::signal("first_label", false),
+                WebUIFragment::raw("/"),
+                WebUIFragment::signal("count", false),
+                WebUIFragment::raw("</p>"),
+                WebUIFragment::boundary_end(41),
+                WebUIFragment::raw("<p id=\"between\">between-boundaries</p>"),
+                WebUIFragment::boundary(
+                    42,
+                    "index.html",
+                    "number-row",
+                    Some("{{number_key}}".to_string()),
+                ),
+                WebUIFragment::raw("<p id=\"second\">"),
+                WebUIFragment::signal("second_label", false),
+                WebUIFragment::raw("</p>"),
+                WebUIFragment::boundary_end(42),
+                WebUIFragment::raw("<p id=\"tail\">tail-after-boundaries</p>"),
+                structural_fragment("body_end"),
+                WebUIFragment::raw("</body></html>"),
+            ],
+            contains_boundary: true,
+        },
+    )]);
     WebUIProtocol::new(fragments)
         .to_protobuf()
         .expect("streaming protocol must serialize")
@@ -1106,14 +1106,14 @@ unsafe fn open_streaming_session(handler: *mut c_void, protocol: *mut c_void) ->
 }
 
 #[test]
-fn streaming_session_discovers_typed_boundaries_resumes_updates_and_completes() {
+fn streaming_session_discovers_typed_boundaries_resumes_updates_advances_and_completes() {
     let proto_bytes = build_streaming_protocol();
     unsafe {
         let handler = webui_handler_create_with_plugin(CString::new("webui").unwrap().as_ptr());
         let protocol = prepare_protocol(&proto_bytes);
         let session = open_streaming_session(handler, protocol);
         let state = CString::new(
-            r#"{"items":[{"id":"alpha\u0000omega","label":"first"},{"id":7,"label":"second"}],"count":1}"#,
+            r#"{"string_key":"alpha\u0000omega","number_key":7,"first_label":"first","second_label":"second","count":1}"#,
         )
         .unwrap();
 
@@ -1147,7 +1147,7 @@ fn streaming_session_discovers_typed_boundaries_resumes_updates_and_completes()
         );
         assert_eq!(
             borrowed_step_string(first_step, webui_streaming_step_boundary_name),
-            "row"
+            "string-row"
         );
         assert_eq!(
             borrowed_step_string(first_step, webui_streaming_step_boundary_key_string),
@@ -1155,35 +1155,42 @@ fn streaming_session_discovers_typed_boundaries_resumes_updates_and_completes()
         );
 
         let mut document = step_bytes(first_step);
+        assert!(!document.contains("id=\"first\""), "start step: {document}");
         webui_streaming_step_destroy(first_step);
 
-        let second_step = webui_streaming_session_resume(
+        let first_commit = webui_streaming_session_resume(
             session,
             first_id,
             state.as_ptr(),
             WEBUI_BOUNDARY_MODE_UPDATABLE,
         );
-        assert!(!second_step.is_null());
-        let mut second_id = u32::MAX;
-        key_type = u32::MAX;
-        assert!(webui_streaming_step_boundary_instance_id(
-            second_step,
-            &mut second_id
-        ));
-        assert!(webui_streaming_step_boundary_key_type(
-            second_step,
-            &mut key_type
-        ));
-        assert_eq!(second_id, 1);
-        assert_eq!(key_type, WEBUI_BOUNDARY_KEY_NUMBER);
-        let mut number_key = f64::NAN;
-        assert!(webui_streaming_step_boundary_key_number(
-            second_step,
-            &mut number_key
-        ));
-        assert_eq!(number_key, 7.0);
-        document.push_str(&step_bytes(second_step));
-        webui_streaming_step_destroy(second_step);
+        assert!(!first_commit.is_null());
+        assert!(!webui_streaming_step_done(first_commit));
+        assert!(!webui_streaming_step_has_boundary(first_commit));
+        assert!(last_error_string().is_none());
+        let first_bytes = step_bytes(first_commit);
+        assert!(
+            first_bytes.contains("id=\"first\""),
+            "resume step: {first_bytes}"
+        );
+        assert!(
+            first_bytes.contains("first/1"),
+            "resume step: {first_bytes}"
+        );
+        assert!(
+            !first_bytes.contains("between-boundaries"),
+            "resume included parent bytes: {first_bytes}"
+        );
+        assert!(
+            !first_bytes.contains("id=\"second\""),
+            "resume included the next occurrence: {first_bytes}"
+        );
+        assert!(
+            !first_bytes.contains("tail-after-boundaries"),
+            "resume included document tail: {first_bytes}"
+        );
+        document.push_str(&first_bytes);
+        webui_streaming_step_destroy(first_commit);
 
         let patch = CString::new(r#"{"count":2}"#).unwrap();
         let mut untouched_len = usize::MAX;
@@ -1214,17 +1221,100 @@ fn streaming_session_discovers_typed_boundaries_resumes_updates_and_completes()
         assert!(update.contains(r#""count":2"#), "update: {update}");
         document.push_str(&update);
 
-        let final_step = webui_streaming_session_resume(
+        let second_discovery = webui_streaming_session_advance(session);
+        assert!(!second_discovery.is_null());
+        assert!(!webui_streaming_step_done(second_discovery));
+        assert!(webui_streaming_step_has_boundary(second_discovery));
+        assert!(last_error_string().is_none());
+        let between_bytes = step_bytes(second_discovery);
+        assert!(
+            between_bytes.contains("between-boundaries"),
+            "advance step: {between_bytes}"
+        );
+        assert!(
+            !between_bytes.contains("id=\"second\""),
+            "advance included pending occurrence: {between_bytes}"
+        );
+        assert!(
+            !between_bytes.contains("tail-after-boundaries"),
+            "advance included document tail: {between_bytes}"
+        );
+        document.push_str(&between_bytes);
+
+        let mut second_id = u32::MAX;
+        declaration_id = u32::MAX;
+        key_type = u32::MAX;
+        assert!(webui_streaming_step_boundary_instance_id(
+            second_discovery,
+            &mut second_id
+        ));
+        assert!(webui_streaming_step_boundary_declaration_id(
+            second_discovery,
+            &mut declaration_id
+        ));
+        assert!(webui_streaming_step_boundary_key_type(
+            second_discovery,
+            &mut key_type
+        ));
+        assert_eq!(second_id, 1);
+        assert_eq!(declaration_id, 42);
+        assert_eq!(key_type, WEBUI_BOUNDARY_KEY_NUMBER);
+        assert_eq!(
+            borrowed_step_string(second_discovery, webui_streaming_step_boundary_name),
+            "number-row"
+        );
+        let mut number_key = f64::NAN;
+        assert!(webui_streaming_step_boundary_key_number(
+            second_discovery,
+            &mut number_key
+        ));
+        assert_eq!(number_key, 7.0);
+        webui_streaming_step_destroy(second_discovery);
+
+        let second_commit = webui_streaming_session_resume(
             session,
             second_id,
             state.as_ptr(),
             WEBUI_BOUNDARY_MODE_FINAL,
         );
+        assert!(!second_commit.is_null());
+        assert!(!webui_streaming_step_done(second_commit));
+        assert!(!webui_streaming_step_has_boundary(second_commit));
+        let second_bytes = step_bytes(second_commit);
+        assert!(
+            second_bytes.contains("id=\"second\""),
+            "resume step: {second_bytes}"
+        );
+        assert!(
+            second_bytes.contains("second"),
+            "resume step: {second_bytes}"
+        );
+        assert!(
+            !second_bytes.contains("tail-after-boundaries"),
+            "resume included document tail: {second_bytes}"
+        );
+        assert!(
+            !second_bytes.contains("</html>"),
+            "resume completed the document: {second_bytes}"
+        );
+        document.push_str(&second_bytes);
+        webui_streaming_step_destroy(second_commit);
+
+        let final_step = webui_streaming_session_advance(session);
         assert!(!final_step.is_null());
         assert!(webui_streaming_step_done(final_step));
         assert!(!webui_streaming_step_has_boundary(final_step));
         assert!(last_error_string().is_none());
-        document.push_str(&step_bytes(final_step));
+        let tail_bytes = step_bytes(final_step);
+        assert!(
+            tail_bytes.contains("tail-after-boundaries"),
+            "final advance step: {tail_bytes}"
+        );
+        assert!(
+            tail_bytes.contains("</html>"),
+            "final advance step: {tail_bytes}"
+        );
+        document.push_str(&tail_bytes);
         webui_streaming_step_destroy(final_step);
 
         assert!(document.starts_with("<!DOCTYPE html>"));
@@ -1300,7 +1390,7 @@ fn streaming_step_reports_an_unkeyed_boundary_unambiguously() {
 }
 
 #[test]
-fn streaming_session_rejects_stale_resume_and_post_completion_calls() {
+fn streaming_session_rejects_out_of_order_calls_without_poisoning() {
     let proto_bytes = build_unkeyed_streaming_protocol();
     unsafe {
         let handler = webui_handler_create();
@@ -1317,6 +1407,11 @@ fn streaming_session_rejects_stale_resume_and_post_completion_calls() {
         ));
         webui_streaming_step_destroy(first);
 
+        assert!(webui_streaming_session_advance(session).is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("no committed boundary"));
+
         assert!(webui_streaming_session_resume(
             session,
             instance_id,
@@ -1334,14 +1429,22 @@ fn streaming_session_rejects_stale_resume_and_post_completion_calls() {
         let error = last_error_string().unwrap_or_default();
         assert!(error.contains("stale"), "error: {error}");
 
-        let final_step = webui_streaming_session_resume(
+        let commit = webui_streaming_session_resume(
             session,
             instance_id,
             empty.as_ptr(),
             WEBUI_BOUNDARY_MODE_FINAL,
         );
+        assert!(!commit.is_null());
+        assert!(!webui_streaming_step_done(commit));
+        assert!(!webui_streaming_step_has_boundary(commit));
+        webui_streaming_step_destroy(commit);
+
+        let final_step = webui_streaming_session_advance(session);
         assert!(!final_step.is_null());
         assert!(webui_streaming_step_done(final_step));
+        assert!(!webui_streaming_step_has_boundary(final_step));
+        assert!(last_error_string().is_none());
         webui_streaming_step_destroy(final_step);
 
         let after = webui_streaming_session_start(session, empty.as_ptr());
@@ -1351,6 +1454,10 @@ fn streaming_session_rejects_stale_resume_and_post_completion_calls() {
             error.contains("completed") || error.contains("started"),
             "error: {error}"
         );
+        assert!(webui_streaming_session_advance(session).is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("completed"));
 
         webui_streaming_session_destroy(session);
         webui_protocol_destroy(protocol);
@@ -1437,6 +1544,10 @@ fn streaming_session_null_arguments_are_safe() {
         )
         .is_null());
         assert!(webui_streaming_session_start(std::ptr::null_mut(), empty.as_ptr()).is_null());
+        assert!(webui_streaming_session_advance(std::ptr::null_mut()).is_null());
+        assert!(last_error_string()
+            .unwrap_or_default()
+            .contains("session_ptr"));
         assert!(webui_streaming_session_resume(
             std::ptr::null_mut(),
             0,
@@ -1511,13 +1622,21 @@ fn streaming_session_applies_the_handler_nonce() {
         let mut document = step_bytes(first);
         webui_streaming_step_destroy(first);
 
-        let final_step = webui_streaming_session_resume(
+        let commit = webui_streaming_session_resume(
             session,
             instance_id,
             empty.as_ptr(),
             WEBUI_BOUNDARY_MODE_FINAL,
         );
+        assert!(!commit.is_null());
+        assert!(!webui_streaming_step_done(commit));
+        assert!(!webui_streaming_step_has_boundary(commit));
+        document.push_str(&step_bytes(commit));
+        webui_streaming_step_destroy(commit);
+
+        let final_step = webui_streaming_session_advance(session);
         assert!(!final_step.is_null());
+        assert!(webui_streaming_step_done(final_step));
         document.push_str(&step_bytes(final_step));
         webui_streaming_step_destroy(final_step);
 
diff --git a/crates/webui-handler/README.md b/crates/webui-handler/README.md
index 23d30ddd0..b6c89856c 100644
--- a/crates/webui-handler/README.md
+++ b/crates/webui-handler/README.md
@@ -34,21 +34,46 @@ Available via all bindings: Rust (`Protocol::render_component_templates`), Node/
 let mut session = StreamingSession::new(handler, protocol, options)?;
 let mut step = session.start(&initial_state)?;
 
-while let Some(boundary) = step.boundary {
-    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
-    step = session.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+while !step.done {
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+            // Writes only this occurrence, through its checkpoint.
+            session.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+        }
+        // Writes the shell bytes up to the next occurrence or the terminal.
+        None => session.advance()?,
+    };
+    write_and_flush(&step.bytes)?;
 }
 ```
 
-`start` and `resume` return `StreamStep { bytes, boundary, done }`. A descriptor
-contains response-local `instance_id`, stable `declaration_id`, owner-local
-`name`, `owner`, and an optional string or numeric `key`. The done step includes
-terminal and document-tail bytes.
+`start`, `resume`, and `advance` return `StreamStep { bytes, boundary, done }`,
+and each step's bytes are one independently writable, independently flushed
+segment. A descriptor contains response-local `instance_id`, stable
+`declaration_id`, owner-local `name`, `owner`, and an optional string or numeric
+`key`. `boundary: Some` waits for `resume`; `boundary: None` with `done: false`
+means the committed occurrence flushed and the caller must `advance`; the done
+step includes terminal and document-tail bytes.
+
+`resume` is boundary-only: it writes the occurrence markers, body, checkpoint,
+and sentinel, then returns. `advance` writes the parent or shell bytes that
+follow through the next occurrence or terminal. This makes an early
+component-local child independently flushable without an authored sibling
+boundary.
 
 Commit an occurrence as `BoundaryMode::Updatable` to call
-`update(instance_id, patch)` later. Updates are projected state records and do
-not insert markup. Component-local occurrences use generated parent spans so an
-early child can hydrate before the parent tail.
+`update(instance_id, patch)` later, including between its `resume` and the
+following `advance`. Updates are projected state records and do not insert
+markup. Component-local occurrences use generated parent spans so an early child
+can hydrate before the parent tail.
+
+A `<boundary>` may not appear inside a `<for>` repeat body (directly or through
+a component, `<if>`, route, or outlet): the build rejects it with
+`boundary-in-repeat`. Wrap the whole `<for>` in one boundary to pace the list as
+a single region. Boundaries before and after a `<for>` are also valid. A
+component-owned declaration reached from multiple static callsites in one entry
+traversal still requires a unique string or numeric `key`.
 
 ## Documentation
 
diff --git a/crates/webui-handler/benches/streaming_hydration_bench.rs b/crates/webui-handler/benches/streaming_hydration_bench.rs
index af7b0838b..9588d9ff4 100644
--- a/crates/webui-handler/benches/streaming_hydration_bench.rs
+++ b/crates/webui-handler/benches/streaming_hydration_bench.rs
@@ -396,19 +396,27 @@ fn render_state_updates(
     let Some(first) = first else {
         panic!("benchmark response did not discover its first boundary");
     };
-    let second = match response.resume(first.instance_id, state, BoundaryMode::Updatable) {
-        Ok(status) => status.boundary,
-        Err(error) => panic!("writing benchmark boundary failed: {error}"),
-    };
-    let Some(second) = second else {
-        panic!("benchmark response completed before state updates");
-    };
+    if let Err(error) = response.resume(first.instance_id, state, BoundaryMode::Updatable) {
+        panic!("writing benchmark boundary failed: {error}");
+    }
+    // Updates land between the commit and the parent bytes that follow it, so
+    // the benchmark exercises the live-occurrence window a host actually uses.
     for _ in 0..updates {
         if let Err(error) = response.update(first.instance_id, state) {
             panic!("writing benchmark state update failed: {error}");
         }
     }
-    match response.resume(second.instance_id, state, BoundaryMode::Final) {
+    let second = match response.advance() {
+        Ok(status) => status.boundary,
+        Err(error) => panic!("advancing past the benchmark boundary failed: {error}"),
+    };
+    let Some(second) = second else {
+        panic!("benchmark response completed before its second boundary");
+    };
+    if let Err(error) = response.resume(second.instance_id, state, BoundaryMode::Final) {
+        panic!("writing the second benchmark boundary failed: {error}");
+    }
+    match response.advance() {
         Ok(status) if status.done => {}
         Ok(_) => panic!("benchmark response did not complete"),
         Err(error) => panic!("finishing benchmark response failed: {error}"),
diff --git a/crates/webui-handler/src/streaming/error.rs b/crates/webui-handler/src/streaming/error.rs
index 1b58d97fe..ec4b4b06a 100644
--- a/crates/webui-handler/src/streaming/error.rs
+++ b/crates/webui-handler/src/streaming/error.rs
@@ -163,6 +163,17 @@ pub(super) fn duplicate_boundary_key_error(
     )
 }
 
+#[cold]
+#[inline(never)]
+pub(super) fn boundary_in_repeat_error(name: &str) -> HandlerError {
+    streaming_boundary_error(
+        name,
+        "boundary declarations are not valid inside a <for> repeat body; rebuild the protocol \
+         with a parser that rejects boundary-in-repeat, then move the boundary outside the \
+         repeat or wrap the whole repeat in one boundary",
+    )
+}
+
 #[cold]
 #[inline(never)]
 pub(super) fn keyed_instance_limit_error(limit: usize) -> HandlerError {
diff --git a/crates/webui-handler/src/streaming/mod.rs b/crates/webui-handler/src/streaming/mod.rs
index 8ec63f9b8..ab59e16b8 100644
--- a/crates/webui-handler/src/streaming/mod.rs
+++ b/crates/webui-handler/src/streaming/mod.rs
@@ -335,11 +335,16 @@ impl WebUIHandler {
 
     /// Render every runtime boundary in document order as final.
     ///
-    /// The value is snapshotted once when the response starts and every
-    /// occurrence resumes against that snapshot, so a large state is projected
-    /// once per response rather than re-merged once per boundary. Hosts that
-    /// need asynchronous work — or genuinely new state — between occurrences
-    /// should use [`Self::stream_response`] or [`StreamingSession`].
+    /// Drives the same `start → resume → advance → …` cycle the public step
+    /// machine exposes, against one frozen snapshot: the value is snapshotted
+    /// when the response starts and every occurrence commits against that
+    /// snapshot, so a large state is projected once per response rather than
+    /// re-merged once per boundary. Having no host to hand bytes to between a
+    /// commit and the parent bytes that follow it, the helper fuses those two
+    /// goals into one continuation setup per boundary; the emitted bytes and
+    /// flush positions are identical to driving the steps separately. Hosts
+    /// that need asynchronous work — or genuinely new state — between
+    /// occurrences should use [`Self::stream_response`] or [`StreamingSession`].
     pub fn render_streaming<'a, W: FlushWriter + ?Sized>(
         &self,
         protocol: &'a Protocol,
@@ -355,7 +360,8 @@ impl WebUIHandler {
                     "unfinished streaming step has no pending boundary".to_string(),
                 ));
             };
-            status = response.resume_current(boundary.instance_id, BoundaryMode::Final)?;
+            status =
+                response.resume_current_and_advance(boundary.instance_id, BoundaryMode::Final)?;
         }
         Ok(())
     }
diff --git a/crates/webui-handler/src/streaming/owned.rs b/crates/webui-handler/src/streaming/owned.rs
index 6e858259f..f6aef6f7e 100644
--- a/crates/webui-handler/src/streaming/owned.rs
+++ b/crates/webui-handler/src/streaming/owned.rs
@@ -15,9 +15,21 @@ use crate::route_handler::Protocol;
 use crate::{FlushWriter, RenderOptions, ResponseWriter, Result, WebUIHandler};
 
 /// Reusable byte sink for host-owned sessions.
+///
+/// Records where the streaming transport flushed so a session can prove each
+/// returned step ends on a real flush boundary rather than silently merging a
+/// checkpoint with the bytes that follow it.
 #[derive(Default)]
 pub struct BufferSink {
     bytes: Vec<u8>,
+    last_flush: usize,
+}
+
+impl BufferSink {
+    fn reset(&mut self) {
+        self.bytes.clear();
+        self.last_flush = 0;
+    }
 }
 
 impl ResponseWriter for BufferSink {
@@ -33,6 +45,7 @@ impl ResponseWriter for BufferSink {
 
 impl FlushWriter for BufferSink {
     fn flush(&mut self) -> Result<()> {
+        self.last_flush = self.bytes.len();
         Ok(())
     }
 }
@@ -67,6 +80,11 @@ impl SessionOptions {
 }
 
 /// Bytes and continuation state returned by one owned semantic step.
+///
+/// The bytes are one semantic write segment ending on a transport flush
+/// boundary: the shell prefix, exactly one committed occurrence, the parent
+/// bytes between two occurrences, or the tail plus terminal. A host writes them
+/// with a single `write` + `flush`.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct StreamStep {
     /// Complete bytes produced by this call.
@@ -78,6 +96,11 @@ pub struct StreamStep {
 }
 
 /// A progressive response owned independently of any Rust borrow.
+///
+/// Exposes the same step machine as [`super::StreamingResponse`]:
+/// [`Self::start`] writes the shell prefix, [`Self::resume`] writes exactly one
+/// occurrence through its checkpoint, and [`Self::advance`] writes the parent
+/// bytes that follow it.
 pub struct StreamingSession {
     handler: Arc<WebUIHandler>,
     protocol: Arc<Protocol>,
@@ -105,58 +128,35 @@ impl StreamingSession {
 
     /// Render until the first runtime boundary occurrence or terminal.
     pub fn start(&mut self, state: &Value) -> Result<StreamStep> {
-        self.sink.bytes.clear();
-        let options = render_options(&self.options);
-        let mut sink = StreamingSink {
-            transport: &mut self.sink,
-            component_opening: None,
-            written: 0,
-            flushed: 0,
-        };
-        let status = self.core.start(
-            SessionCall {
-                handler: &self.handler,
-                protocol: &self.protocol,
-                options: &options,
-                writer: &mut sink,
-            },
-            state,
-        );
-        self.finish_step(status)
+        self.step(|core, call| core.start(call, state))
     }
 
-    /// Commit the pending occurrence and advance.
+    /// Commit the pending occurrence through its checkpoint, then stop.
+    ///
+    /// The returned bytes hold that occurrence's record and nothing that
+    /// follows it. Call [`Self::advance`] for the parent bytes.
     pub fn resume(
         &mut self,
         instance_id: BoundaryInstanceId,
         state: &Value,
         mode: BoundaryMode,
     ) -> Result<StreamStep> {
-        self.sink.bytes.clear();
-        let options = render_options(&self.options);
-        let mut sink = StreamingSink {
-            transport: &mut self.sink,
-            component_opening: None,
-            written: 0,
-            flushed: 0,
-        };
-        let status = self.core.resume(
-            SessionCall {
-                handler: &self.handler,
-                protocol: &self.protocol,
-                options: &options,
-                writer: &mut sink,
-            },
-            instance_id,
-            state,
-            mode,
-        );
-        self.finish_step(status)
+        self.step(|core, call| core.resume(call, instance_id, state, mode))
+    }
+
+    /// Write the ordinary parent bytes that follow a committed occurrence.
+    ///
+    /// Valid only after [`Self::resume`].
+    pub fn advance(&mut self) -> Result<StreamStep> {
+        self.step(SessionCore::advance)
     }
 
     /// Emit an update for one committed updatable runtime occurrence.
+    ///
+    /// Valid between [`Self::resume`] and [`Self::advance`], so a host can
+    /// revise the occurrence it just committed while the response stays open.
     pub fn update(&mut self, instance_id: BoundaryInstanceId, patch: &Value) -> Result<Vec<u8>> {
-        self.sink.bytes.clear();
+        self.sink.reset();
         let options = render_options(&self.options);
         let mut sink = StreamingSink {
             transport: &mut self.sink,
@@ -175,9 +175,12 @@ impl StreamingSession {
             patch,
         );
         match result {
-            Ok(()) => Ok(std::mem::take(&mut self.sink.bytes)),
+            Ok(()) => {
+                verify_flush_boundary(&self.sink)?;
+                Ok(std::mem::take(&mut self.sink.bytes))
+            }
             Err(error) => {
-                self.sink.bytes.clear();
+                self.sink.reset();
                 Err(error)
             }
         }
@@ -189,21 +192,65 @@ impl StreamingSession {
         self.core.done
     }
 
-    fn finish_step(&mut self, status: Result<StreamStatus>) -> Result<StreamStep> {
+    fn step(
+        &mut self,
+        operation: impl FnOnce(&mut SessionCore, SessionCall<'_, '_>) -> Result<StreamStatus>,
+    ) -> Result<StreamStep> {
+        self.sink.reset();
+        let options = render_options(&self.options);
+        let mut sink = StreamingSink {
+            transport: &mut self.sink,
+            component_opening: None,
+            written: 0,
+            flushed: 0,
+        };
+        let status = operation(
+            &mut self.core,
+            SessionCall {
+                handler: &self.handler,
+                protocol: &self.protocol,
+                options: &options,
+                writer: &mut sink,
+            },
+        );
         match status {
-            Ok(status) => Ok(StreamStep {
-                bytes: std::mem::take(&mut self.sink.bytes),
-                boundary: status.boundary,
-                done: status.done,
-            }),
+            Ok(status) => {
+                verify_flush_boundary(&self.sink)?;
+                Ok(StreamStep {
+                    bytes: std::mem::take(&mut self.sink.bytes),
+                    boundary: status.boundary,
+                    done: status.done,
+                })
+            }
             Err(error) => {
-                self.sink.bytes.clear();
+                self.sink.reset();
                 Err(error)
             }
         }
     }
 }
 
+/// Reject a step whose buffered bytes extend past the last transport flush.
+///
+/// A host-owned session hands the caller a byte buffer instead of a live
+/// transport, so a step that produced bytes after its checkpoint flushed would
+/// silently merge two semantic segments into one host write. The check is one
+/// integer compare per step.
+fn verify_flush_boundary(sink: &BufferSink) -> Result<()> {
+    if sink.last_flush == sink.bytes.len() {
+        return Ok(());
+    }
+    Err(unflushed_step_error())
+}
+
+#[cold]
+#[inline(never)]
+fn unflushed_step_error() -> crate::HandlerError {
+    crate::HandlerError::Invariant(
+        "a streaming step buffered bytes past its last flush boundary".to_string(),
+    )
+}
+
 fn render_options(options: &SessionOptions) -> RenderOptions<'_> {
     RenderOptions {
         entry_id: &options.entry_id,
@@ -218,8 +265,11 @@ fn render_options(options: &SessionOptions) -> RenderOptions<'_> {
 mod tests {
     use std::sync::{Arc, Mutex};
 
-    use super::StreamingSession;
-    use crate::WebUIHandler;
+    use serde_json::Value;
+
+    use super::{BufferSink, SessionOptions, StreamingSession};
+    use crate::route_handler::Protocol;
+    use crate::{BoundaryMode, FlushWriter, ResponseWriter, WebUIHandler};
 
     #[test]
     fn owned_streaming_session_supports_synchronized_hosts() {
@@ -230,4 +280,61 @@ mod tests {
         assert_send_sync::<Mutex<StreamingSession>>();
         assert_send_sync::<Arc<WebUIHandler>>();
     }
+
+    #[test]
+    fn buffer_sink_tracks_the_transport_flush_boundary() {
+        // The invariant every owned step is checked against: bytes written
+        // after the last flush would merge two semantic segments into one host
+        // write.
+        let mut sink = BufferSink::default();
+        sink.write("checkpoint").expect("write");
+        sink.flush().expect("flush");
+        assert!(super::verify_flush_boundary(&sink).is_ok());
+        sink.write("tail").expect("write");
+        assert!(super::verify_flush_boundary(&sink).is_err());
+        sink.reset();
+        assert!(super::verify_flush_boundary(&sink).is_ok());
+    }
+
+    #[test]
+    fn every_owned_step_ends_on_a_flush_boundary() {
+        let mut parser = webui_parser::HtmlParser::new();
+        parser
+            .parse(
+                "index.html",
+                concat!(
+                    "<html><head></head><body>",
+                    r#"<boundary name="first"><p>1</p></boundary>"#,
+                    "<hr>",
+                    r#"<boundary name="second"><p>2</p></boundary>"#,
+                    "<footer>tail</footer></body></html>",
+                ),
+            )
+            .expect("parse");
+        let protocol = Arc::new(Protocol::new(webui_protocol::WebUIProtocol::new(
+            parser.into_fragment_records(),
+        )));
+        let mut session = StreamingSession::new(
+            Arc::new(WebUIHandler::new()),
+            protocol,
+            SessionOptions::new("index.html", "/"),
+        )
+        .expect("session");
+
+        let state = Value::Object(serde_json::Map::new());
+        let mut step = session.start(&state).expect("start");
+        let mut steps = 1usize;
+        while !step.done {
+            step = match step.boundary.as_ref() {
+                Some(boundary) => session
+                    .resume(boundary.instance_id, &state, BoundaryMode::Final)
+                    .expect("resume"),
+                None => session.advance().expect("advance"),
+            };
+            steps += 1;
+        }
+        // start, commit, advance, commit, advance.
+        assert_eq!(steps, 5);
+        assert!(session.is_done());
+    }
 }
diff --git a/crates/webui-handler/src/streaming/session.rs b/crates/webui-handler/src/streaming/session.rs
index 81e740a84..1bce44a83 100644
--- a/crates/webui-handler/src/streaming/session.rs
+++ b/crates/webui-handler/src/streaming/session.rs
@@ -14,7 +14,7 @@ use super::state::{
     increment_streaming_record_sequence, overlay_full_state, overlay_selected_state,
     selected_state_snapshot, StreamingProgress, StreamingRenderState,
 };
-use super::vm::ContinuationVm;
+use super::vm::{ContinuationVm, StepGoal};
 use super::StreamingSink;
 use crate::plugin::HandlerPlugin;
 use crate::route_handler::Protocol;
@@ -136,6 +136,14 @@ pub enum BoundaryMode {
 }
 
 /// Borrowed-writer result of one semantic streaming step.
+///
+/// The pair of fields names exactly one state:
+///
+/// | `boundary` | `done` | meaning |
+/// |------------|--------|---------|
+/// | `Some`     | `false`| the occurrence is waiting for [`StreamingResponse::resume`] |
+/// | `None`     | `false`| the committed occurrence flushed; call [`StreamingResponse::advance`] |
+/// | `None`     | `true` | the terminal record and writer end completed |
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct StreamStatus {
     /// The next occurrence waiting for [`StreamingResponse::resume`].
@@ -145,6 +153,12 @@ pub struct StreamStatus {
 }
 
 /// A progressive response that writes directly through a [`FlushWriter`].
+///
+/// Steps alternate: [`Self::start`] writes the shell prefix and stops before
+/// the first occurrence, [`Self::resume`] writes exactly one occurrence through
+/// its checkpoint, and [`Self::advance`] writes the ordinary parent bytes that
+/// follow it until the next occurrence or the terminal. Every step is one
+/// independently writable, independently flushed segment.
 pub struct StreamingResponse<'a, W: FlushWriter + ?Sized> {
     handler: &'a WebUIHandler,
     protocol: &'a Protocol,
@@ -186,70 +200,56 @@ impl WebUIHandler {
 impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
     /// Render until the first runtime boundary occurrence or terminal.
     pub fn start(&mut self, state: &Value) -> Result<StreamStatus> {
-        self.core.start(
-            SessionCall {
-                handler: self.handler,
-                protocol: self.protocol,
-                options: &self.options,
-                writer: &mut self.sink,
-            },
-            state,
-        )
+        let (core, call) = self.parts();
+        core.start(call, state)
     }
 
-    /// Commit the pending occurrence, then advance to the next occurrence or terminal.
+    /// Commit the pending occurrence through its checkpoint, then stop.
+    ///
+    /// The bytes written by this call are exactly the occurrence's own record —
+    /// no parent or tail bytes follow it — so the host can release the
+    /// occurrence the moment it resolves. Call [`Self::advance`] next.
     pub fn resume(
         &mut self,
         instance_id: BoundaryInstanceId,
         state: &Value,
         mode: BoundaryMode,
     ) -> Result<StreamStatus> {
-        self.core.resume(
-            SessionCall {
-                handler: self.handler,
-                protocol: self.protocol,
-                options: &self.options,
-                writer: &mut self.sink,
-            },
-            instance_id,
-            state,
-            mode,
-        )
+        let (core, call) = self.parts();
+        core.resume(call, instance_id, state, mode)
+    }
+
+    /// Write the ordinary parent bytes that follow a committed occurrence.
+    ///
+    /// Valid only after [`Self::resume`]. Renders the shell until the next
+    /// occurrence suspends or the terminal record completes.
+    pub fn advance(&mut self) -> Result<StreamStatus> {
+        let (core, call) = self.parts();
+        core.advance(call)
     }
 
     /// Emit one projected state update for a committed updatable occurrence.
+    ///
+    /// Valid between [`Self::resume`] and [`Self::advance`] as well as after
+    /// the response has moved on, so a host can revise the occurrence it just
+    /// committed while the response is still open.
     pub fn update(&mut self, instance_id: BoundaryInstanceId, patch: &Value) -> Result<()> {
-        self.core.update(
-            SessionCall {
-                handler: self.handler,
-                protocol: self.protocol,
-                options: &self.options,
-                writer: &mut self.sink,
-            },
-            instance_id,
-            patch,
-        )
+        let (core, call) = self.parts();
+        core.update(call, instance_id, patch)
     }
 
-    /// Commit the pending occurrence without merging new state.
+    /// Commit the pending occurrence and continue to the next one.
     ///
-    /// Used by [`WebUIHandler::render_streaming`], which drives every
+    /// Used by [`WebUIHandler::render_streaming`], which has no host to hand
+    /// the checkpoint bytes to between the two steps and drives every
     /// occurrence from the single value it already snapshotted at start.
-    pub(crate) fn resume_current(
+    pub(crate) fn resume_current_and_advance(
         &mut self,
         instance_id: BoundaryInstanceId,
         mode: BoundaryMode,
     ) -> Result<StreamStatus> {
-        self.core.resume_current(
-            SessionCall {
-                handler: self.handler,
-                protocol: self.protocol,
-                options: &self.options,
-                writer: &mut self.sink,
-            },
-            instance_id,
-            mode,
-        )
+        let (core, call) = self.parts();
+        core.resume_current_and_advance(call, instance_id, mode)
     }
 
     /// Whether the response has emitted its terminal and ended its writer.
@@ -257,6 +257,27 @@ impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
     pub fn is_done(&self) -> bool {
         self.core.done
     }
+
+    /// Split the response into its continuation and one call's borrowed
+    /// runtime, so every entry point shares the same wiring.
+    fn parts(&mut self) -> (&mut SessionCore, SessionCall<'_, '_>) {
+        let Self {
+            handler,
+            protocol,
+            options,
+            sink,
+            core,
+        } = self;
+        (
+            core,
+            SessionCall {
+                handler,
+                protocol,
+                options,
+                writer: sink,
+            },
+        )
+    }
 }
 
 pub(crate) struct SessionCore {
@@ -267,6 +288,9 @@ pub(crate) struct SessionCore {
     started: bool,
     pub(crate) done: bool,
     failed: bool,
+    /// True between a committed occurrence and the `advance` that writes the
+    /// parent bytes following it.
+    awaiting_advance: bool,
     local_vars: HashMap<String, Value>,
     component_attrs: HashMap<String, Value>,
     route_base: Option<String>,
@@ -304,6 +328,7 @@ impl SessionCore {
             started: false,
             done: false,
             failed: false,
+            awaiting_advance: false,
             local_vars: HashMap::new(),
             component_attrs: HashMap::new(),
             route_base: None,
@@ -341,7 +366,7 @@ impl SessionCore {
             selected_state_snapshot(state, &self.frozen_keys)
         };
         self.started = true;
-        self.run_advance(call, None)
+        self.run_step(call, StepGoal::NextBoundary, None)
     }
 
     pub(crate) fn resume(
@@ -351,37 +376,42 @@ impl SessionCore {
         state: &Value,
         mode: BoundaryMode,
     ) -> Result<StreamStatus> {
-        self.require_usable("resume")?;
-        self.require_started("resume")?;
+        self.require_resumable()?;
         self.vm.validate_resume(instance_id)?;
         if self.requires_full_state {
             overlay_full_state(&mut self.frozen_state, state);
         } else {
             overlay_selected_state(&mut self.frozen_state, state, &self.frozen_keys);
         }
-        self.run_advance(call, Some((instance_id, mode)))
+        self.run_step(call, StepGoal::CommitBoundary, Some((instance_id, mode)))
     }
 
-    /// Commit the pending occurrence against the snapshot the response already
-    /// holds.
+    pub(crate) fn advance(&mut self, call: SessionCall<'_, '_>) -> Result<StreamStatus> {
+        self.require_advanceable()?;
+        self.run_step(call, StepGoal::NextBoundary, None)
+    }
+
+    /// Commit the pending occurrence and continue to the next one in a single
+    /// continuation setup.
     ///
-    /// Callers that never introduce new state between occurrences — the
-    /// one-shot [`WebUIHandler::render_streaming`] helper is the canonical one —
-    /// would otherwise re-merge an identical value into the retained snapshot
-    /// once per boundary, making a large state cost O(boundaries × state size)
-    /// for a result that is byte-for-byte what the previous step already held.
-    /// The public [`Self::resume`] entry point keeps the overlay for hosts that
-    /// genuinely resolve new data per occurrence.
-    pub(crate) fn resume_current(
+    /// The public step machine deliberately returns at the checkpoint so a host
+    /// can write and release that occurrence on its own. The one-shot
+    /// [`WebUIHandler::render_streaming`] helper has no host in between, and
+    /// splitting the work would cost a second continuation hand-off — every
+    /// retained scope map, inventory buffer, and scratch vector moving in and
+    /// back out — plus a re-resolution of the parked record the step-local
+    /// cache already holds. [`StepGoal::NextBoundary`] commits the active
+    /// occurrence and keeps walking, so the fused call emits exactly the bytes
+    /// and flushes the split steps would.
+    pub(crate) fn resume_current_and_advance(
         &mut self,
         call: SessionCall<'_, '_>,
         instance_id: BoundaryInstanceId,
         mode: BoundaryMode,
     ) -> Result<StreamStatus> {
-        self.require_usable("resume")?;
-        self.require_started("resume")?;
+        self.require_resumable()?;
         self.vm.validate_resume(instance_id)?;
-        self.run_advance(call, Some((instance_id, mode)))
+        self.run_step(call, StepGoal::NextBoundary, Some((instance_id, mode)))
     }
 
     pub(crate) fn update(
@@ -414,9 +444,10 @@ impl SessionCore {
         result
     }
 
-    fn run_advance(
+    fn run_step(
         &mut self,
         call: SessionCall<'_, '_>,
+        goal: StepGoal,
         resume: Option<(BoundaryInstanceId, BoundaryMode)>,
     ) -> Result<StreamStatus> {
         let state = std::mem::replace(
@@ -429,7 +460,7 @@ impl SessionCore {
             if let Some((instance_id, mode)) = resume {
                 vm.begin_resume(instance_id, mode, context)?;
             }
-            let status = vm.advance(handler, protocol, context)?;
+            let status = vm.advance(goal, handler, protocol, context)?;
             if !status.done {
                 context.writer.stream_flush()?;
             }
@@ -439,6 +470,7 @@ impl SessionCore {
         match result {
             Ok(status) => {
                 self.done = status.done;
+                self.awaiting_advance = goal == StepGoal::CommitBoundary && !status.done;
                 Ok(status)
             }
             Err(error) => {
@@ -539,6 +571,50 @@ impl SessionCore {
         }
         Ok(())
     }
+
+    /// Reject a `resume` that is out of order without writing a byte.
+    ///
+    /// Ordering is checked before any render work, so a rejected call leaves
+    /// the response exactly as it was and the host can retry with the right
+    /// instance ID or the missing `advance`.
+    fn require_resumable(&self) -> Result<()> {
+        self.require_usable("resume")?;
+        self.require_started("resume")?;
+        if self.done {
+            return Err(boundary_order_error(
+                "resume",
+                "the streaming response has already completed",
+            ));
+        }
+        if self.awaiting_advance {
+            return Err(boundary_order_error(
+                "resume",
+                "the previously committed boundary has not been advanced past; call advance \
+                 before resuming the next occurrence",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Reject an `advance` that is out of order without writing a byte.
+    fn require_advanceable(&self) -> Result<()> {
+        self.require_usable("advance")?;
+        self.require_started("advance")?;
+        if self.done {
+            return Err(boundary_order_error(
+                "advance",
+                "the streaming response has already completed",
+            ));
+        }
+        if !self.awaiting_advance {
+            return Err(boundary_order_error(
+                "advance",
+                "there is no committed boundary to advance past; resume the pending occurrence \
+                 first",
+            ));
+        }
+        Ok(())
+    }
 }
 
 #[cold]
@@ -686,21 +762,29 @@ mod tests {
 
         let mut committed = 0usize;
         while !status.done {
-            let Some(boundary) = status.boundary.as_ref() else {
-                panic!("an unfinished step must carry a pending boundary");
+            status = match status.boundary.as_ref() {
+                Some(boundary) => {
+                    let next =
+                        response.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+                    committed += 1;
+                    assert!(
+                        next.boundary.is_none() && !next.done,
+                        "a commit step stops at its checkpoint and waits for advance"
+                    );
+                    assert_eq!(
+                        rows_address(&response.core.frozen_state),
+                        snapshot,
+                        "committing occurrence {committed} must not re-copy the retained snapshot"
+                    );
+                    next
+                }
+                None => response.advance()?,
             };
-            status = response.resume_current(boundary.instance_id, BoundaryMode::Final)?;
-            committed += 1;
-            assert_eq!(
-                rows_address(&response.core.frozen_state),
-                snapshot,
-                "committing occurrence {committed} must not re-copy the retained snapshot"
-            );
         }
         assert_eq!(committed, 8, "every authored boundary must commit");
 
-        // The one-shot helper drives exactly this loop, so its bytes must match
-        // the snapshot-only path it delegates to.
+        // The one-shot helper fuses commit and advance into one continuation
+        // setup, so its bytes must match the split steps it stands in for.
         let mut helper_sink = TestSink {
             output: String::new(),
         };
@@ -712,6 +796,63 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn fused_helper_matches_split_step_bytes_and_flushes() -> Result<()> {
+        // `render_streaming` skips the host hand-off between a commit and the
+        // parent bytes that follow it. That is a scheduling shortcut only: the
+        // emitted bytes and the positions at which they are flushed must match
+        // the split step machine exactly.
+        #[derive(Default)]
+        struct FlushSink {
+            output: String,
+            flushes: Vec<usize>,
+        }
+
+        impl ResponseWriter for FlushSink {
+            fn write(&mut self, content: &str) -> Result<()> {
+                self.output.push_str(content);
+                Ok(())
+            }
+
+            fn end(&mut self) -> Result<()> {
+                Ok(())
+            }
+        }
+
+        impl FlushWriter for FlushSink {
+            fn flush(&mut self) -> Result<()> {
+                self.flushes.push(self.output.len());
+                Ok(())
+            }
+        }
+
+        let protocol = boundary_protocol(4, StateProjectionMode::Keys);
+        let handler = WebUIHandler::new();
+        let state = test_json!({ "count": 3, "title": "fused" });
+        let render_options = options();
+
+        let mut split = FlushSink::default();
+        {
+            let mut response = handler.stream_response(&protocol, &render_options, &mut split)?;
+            let mut status = response.start(&state)?;
+            while !status.done {
+                status = match status.boundary.as_ref() {
+                    Some(boundary) => {
+                        response.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+                    }
+                    None => response.advance()?,
+                };
+            }
+        }
+
+        let mut fused = FlushSink::default();
+        handler.render_streaming(&protocol, &state, &render_options, &mut fused)?;
+
+        assert_eq!(fused.output, split.output, "bytes must match");
+        assert_eq!(fused.flushes, split.flushes, "flush positions must match");
+        Ok(())
+    }
+
     #[test]
     fn resume_overlays_new_state_and_reuses_unchanged_subtrees() -> Result<()> {
         // The public resume keeps its patch semantics: a changed key lands in
@@ -754,7 +895,14 @@ mod tests {
             snapshot,
             "an unchanged subtree must not be copied again"
         );
-        assert!(status.boundary.is_some(), "the second occurrence follows");
+        assert!(
+            status.boundary.is_none() && !status.done,
+            "the commit step stops at its checkpoint"
+        );
+        assert!(
+            response.advance()?.boundary.is_some(),
+            "the second occurrence follows the parent bytes"
+        );
         Ok(())
     }
 
@@ -776,9 +924,10 @@ mod tests {
         let mut retained: Option<(usize, usize)> = None;
         while !status.done {
             let Some(boundary) = status.boundary.as_ref() else {
-                panic!("an unfinished step must carry a pending boundary");
+                status = response.advance()?;
+                continue;
             };
-            status = response.resume_current(boundary.instance_id, BoundaryMode::Updatable)?;
+            status = response.resume(boundary.instance_id, &state, BoundaryMode::Updatable)?;
             let Some(progress) = response.core.streaming.as_ref() else {
                 panic!("a suspended response must retain its progress");
             };
diff --git a/crates/webui-handler/src/streaming/vm.rs b/crates/webui-handler/src/streaming/vm.rs
index b637ff2a6..153062781 100644
--- a/crates/webui-handler/src/streaming/vm.rs
+++ b/crates/webui-handler/src/streaming/vm.rs
@@ -16,7 +16,7 @@ use webui_protocol::{
 
 use super::checkpoint::RangeRecord;
 use super::error::{
-    boundary_limit_error, boundary_order_error, continuation_limit_error,
+    boundary_in_repeat_error, boundary_limit_error, boundary_order_error, continuation_limit_error,
     duplicate_boundary_key_error, invalid_boundary_key_error, keyed_instance_limit_error,
     malformed_span_signal_error, span_limit_error, span_nesting_error,
 };
@@ -104,6 +104,13 @@ pub(crate) struct ContinuationVm {
     committed_modes: Vec<BoundaryMode>,
     component_count: usize,
     pending_span_candidate: Option<Box<str>>,
+    /// Repeats currently being walked by this step.
+    ///
+    /// A boundary can never execute inside a repeat, so this is zero at every
+    /// point the VM hands control back to the host. Tracking it as a counter
+    /// makes that an O(1) checked invariant rather than an assumption about a
+    /// protocol the handler did not build.
+    open_repeats: usize,
 }
 
 /// Immutable per-entry projection surface shared by every response.
@@ -215,10 +222,7 @@ enum Frame {
     IfEnd {
         slot: u32,
     },
-    For(ForFrame),
-    RepeatEnd {
-        index: usize,
-    },
+    Repeat(RepeatFrame),
     GeneratedComponentStart {
         tag: Box<str>,
     },
@@ -239,11 +243,20 @@ struct FragmentFrame {
     best_route: Option<(String, RouteMatch)>,
 }
 
-struct ForFrame {
+/// One in-flight `<for>` repeat.
+///
+/// A repeat can never contain a boundary — the build rejects that with
+/// `boundary-in-repeat` and [`ContinuationVm::discover_boundary`] rejects a
+/// hand-built protocol that tries — so this frame is drained inside the step
+/// that created it and is never retained across a host call. Closing the
+/// previous item and opening the next share one frame, so a repeat costs two
+/// pushes per item instead of three without widening the frame: `index` is both
+/// the next item to open and, when non-zero, one past the item still open.
+struct RepeatFrame {
     slot: u32,
     item_name: Box<str>,
     items: std::vec::IntoIter<Value>,
-    next_index: usize,
+    index: usize,
     saved_value: Option<Value>,
 }
 
@@ -253,6 +266,23 @@ struct OutletFrame {
     best: Option<(usize, RouteMatch)>,
 }
 
+/// What the current [`ContinuationVm::advance`] call is walking toward.
+#[derive(Clone, Copy, Eq, PartialEq)]
+pub(crate) enum StepGoal {
+    /// Write ordinary parent/shell bytes until the next occurrence or terminal.
+    NextBoundary,
+    /// Write the pending occurrence through its checkpoint, then stop.
+    CommitBoundary,
+}
+
+/// Borrowed runtime shared by every record one step walks.
+#[derive(Clone, Copy)]
+struct StepRuntime<'call, 'data> {
+    goal: StepGoal,
+    handler: &'call WebUIHandler,
+    protocol: &'data crate::Protocol,
+}
+
 impl ContinuationVm {
     pub(crate) fn new(entry_id: &str, protocol: &crate::Protocol) -> Result<Self> {
         protocol_fragment(protocol.protocol(), entry_id)?;
@@ -274,6 +304,7 @@ impl ContinuationVm {
             committed_modes: Vec::new(),
             component_count: protocol.component_index().len(),
             pending_span_candidate: None,
+            open_repeats: 0,
         })
     }
 
@@ -335,29 +366,37 @@ impl ContinuationVm {
         Ok(())
     }
 
+    /// Walk the continuation until `goal` is met.
+    ///
+    /// [`StepGoal::CommitBoundary`] stops on the active occurrence's checkpoint
+    /// so its bytes are one independently writable step;
+    /// [`StepGoal::NextBoundary`] writes ordinary parent/shell bytes until the
+    /// next occurrence suspends or the terminal record completes.
     pub(crate) fn advance<'data>(
         &mut self,
+        goal: StepGoal,
         handler: &WebUIHandler,
         protocol: &'data crate::Protocol,
         context: &mut WebUIProcessContext<'data, '_, '_>,
     ) -> Result<StreamStatus> {
         let mut records = RecordCache::new();
+        let runtime = StepRuntime {
+            goal,
+            handler,
+            protocol,
+        };
         while let Some(frame) = self.frames.pop() {
             match frame {
                 Frame::EnterFragment(slot) => {
                     let list = records.record(protocol, slot)?;
                     let frame = open_fragment(slot, list, context);
-                    if let Some(status) =
-                        self.run_fragment(frame, list, (handler, protocol), context)?
-                    {
+                    if let Some(status) = self.run_fragment(frame, list, runtime, context)? {
                         return Ok(status);
                     }
                 }
                 Frame::Fragment(frame) => {
                     let list = records.record(protocol, frame.slot)?;
-                    if let Some(status) =
-                        self.run_fragment(frame, list, (handler, protocol), context)?
-                    {
+                    if let Some(status) = self.run_fragment(frame, list, runtime, context)? {
                         return Ok(status);
                     }
                 }
@@ -373,13 +412,7 @@ impl ContinuationVm {
                         plugin.on_if_end(fragment_id, context.writer)?;
                     }
                 }
-                Frame::For(frame) => self.step_for(frame, protocol, context)?,
-                Frame::RepeatEnd { index } => {
-                    if let Some(plugin) = context.plugin.as_mut() {
-                        plugin.pop_scope();
-                        plugin.on_repeat_item_end(index, context.writer)?;
-                    }
-                }
+                Frame::Repeat(frame) => self.step_repeat(frame, protocol, context)?,
                 Frame::GeneratedComponentStart { tag } => {
                     self.start_generated_component(tag, handler, protocol, context)?;
                 }
@@ -408,6 +441,11 @@ impl ContinuationVm {
                 "pending boundary lost its continuation".to_string(),
             ));
         }
+        if self.open_repeats != 0 {
+            return Err(HandlerError::Invariant(
+                "traversal completed while a repeat was still open".to_string(),
+            ));
+        }
         if !self.open_spans.is_empty() {
             return Err(malformed_span_signal_error(
                 "component span",
@@ -444,21 +482,26 @@ impl ContinuationVm {
         })
     }
 
-    /// Walk one fragment record until it descends, suspends, or ends.
+    /// Walk one fragment record until it descends, suspends, commits, or ends.
     ///
     /// The record is resolved by the caller — once per step for the whole
     /// descend/unwind cycle — and inert fragments never touch the frame stack,
     /// so a boundary body costs no record lookups at all. Only a construct that
-    /// owns a child record (component, condition, loop, route, outlet) or a
-    /// discovered boundary parks the frame and returns to the caller.
+    /// owns a child record (component, condition, loop, route, outlet), a
+    /// discovered boundary, or the checkpoint that ends a committed boundary
+    /// parks the frame and returns to the caller.
     fn run_fragment<'data>(
         &mut self,
         mut frame: FragmentFrame,
         list: &'data webui_protocol::FragmentList,
-        runtime: (&WebUIHandler, &'data crate::Protocol),
+        runtime: StepRuntime<'_, 'data>,
         context: &mut WebUIProcessContext<'data, '_, '_>,
     ) -> Result<Option<StreamStatus>> {
-        let (handler, protocol) = runtime;
+        let StepRuntime {
+            goal,
+            handler,
+            protocol,
+        } = runtime;
         loop {
             let index = frame.index;
             let Some(fragment) = list.fragments.get(index) else {
@@ -488,6 +531,16 @@ impl ContinuationVm {
                 Some(Fragment::Boundary(boundary)) => {
                     if boundary.phase() == BoundaryPhase::End {
                         self.finish_boundary(boundary, handler, context)?;
+                        if goal == StepGoal::CommitBoundary {
+                            // The checkpoint just flushed, so the committed
+                            // occurrence ends this step: the parent bytes that
+                            // follow belong to the caller's next `advance`.
+                            self.push(Frame::Fragment(frame))?;
+                            return Ok(Some(StreamStatus {
+                                boundary: None,
+                                done: false,
+                            }));
+                        }
                         continue;
                     }
                     let descriptor =
@@ -515,7 +568,7 @@ impl ContinuationVm {
                 }
                 Some(Fragment::ForLoop(for_loop)) => {
                     self.push(Frame::Fragment(frame))?;
-                    self.begin_for(for_loop, handler, protocol, context)?;
+                    self.begin_repeat(for_loop, handler, protocol, context)?;
                     return Ok(None);
                 }
                 Some(Fragment::Route(route)) => {
@@ -694,7 +747,12 @@ impl ContinuationVm {
         Ok(())
     }
 
-    fn begin_for(
+    /// Open a `<for>` repeat.
+    ///
+    /// The whole repeat is atomic: it can carry no boundary, so every frame it
+    /// pushes is drained before this step returns to the host and the repeat
+    /// never becomes resumable continuation state.
+    fn begin_repeat(
         &mut self,
         for_loop: &WebUIFragmentFor,
         handler: &WebUIHandler,
@@ -715,27 +773,37 @@ impl ContinuationVm {
                 .local_vars
                 .insert(for_loop.item.clone(), Value::Null);
         }
-        self.push(Frame::For(ForFrame {
+        self.open_repeats = self
+            .open_repeats
+            .checked_add(1)
+            .ok_or_else(|| continuation_limit_error(MAX_CONTINUATION_DEPTH))?;
+        self.push(Frame::Repeat(RepeatFrame {
             slot: fragment_slot(protocol, &for_loop.fragment_id)?,
             item_name: for_loop.item.clone().into(),
             items: items.into_iter(),
-            next_index: 0,
+            index: 0,
             saved_value,
         }))
     }
 
-    fn step_for(
+    /// Close the item the repeat just rendered, then open the next one.
+    fn step_repeat(
         &mut self,
-        mut frame: ForFrame,
+        mut frame: RepeatFrame,
         protocol: &crate::Protocol,
         context: &mut WebUIProcessContext<'_, '_, '_>,
     ) -> Result<()> {
+        // The frame is only re-pushed after an item opens, so a non-zero index
+        // means the previous item's body has just finished.
+        if let Some(open) = frame.index.checked_sub(1) {
+            if let Some(plugin) = context.plugin.as_mut() {
+                plugin.pop_scope();
+                plugin.on_repeat_item_end(open, context.writer)?;
+            }
+        }
         if let Some(item) = frame.items.next() {
-            let index = frame.next_index;
-            frame.next_index = frame
-                .next_index
-                .checked_add(1)
-                .ok_or_else(|| boundary_limit_error(MAX_BOUNDARY_OCCURRENCES))?;
+            let index = frame.index;
+            frame.index = index.wrapping_add(1);
             if let Some(plugin) = context.plugin.as_mut() {
                 plugin.on_repeat_item_start(index, context.writer)?;
                 plugin.push_scope();
@@ -744,8 +812,7 @@ impl ContinuationVm {
                 *entry = item;
             }
             let slot = frame.slot;
-            self.push(Frame::For(frame))?;
-            self.push(Frame::RepeatEnd { index })?;
+            self.push(Frame::Repeat(frame))?;
             self.push(Frame::EnterFragment(slot))?;
             return Ok(());
         }
@@ -757,6 +824,7 @@ impl ContinuationVm {
                 context.local_vars.remove(frame.item_name.as_ref());
             }
         }
+        self.open_repeats = self.open_repeats.saturating_sub(1);
         if let Some(plugin) = context.plugin.as_mut() {
             let fragment_id = protocol
                 .fragment_id(frame.slot)
@@ -785,6 +853,9 @@ impl ContinuationVm {
                 "a nested boundary occurrence is not valid",
             ));
         }
+        if self.open_repeats != 0 {
+            return Err(boundary_in_repeat_error(&boundary.name));
+        }
         let index = usize::try_from(self.next_boundary_id)
             .map_err(|_| boundary_limit_error(MAX_BOUNDARY_OCCURRENCES))?;
         if index >= MAX_BOUNDARY_OCCURRENCES {
@@ -1539,4 +1610,64 @@ mod tests {
         );
         Ok(())
     }
+
+    /// A hand-built protocol that puts a boundary in a repeat body is rejected
+    /// by the VM rather than retained as resumable repeat state.
+    ///
+    /// The parser rejects this at build time, but the handler decodes protocols
+    /// it did not build (FFI, WASM, cached artifacts), so the continuation
+    /// defends the invariant it relies on.
+    #[test]
+    fn boundary_discovered_inside_a_repeat_is_rejected() {
+        let fragments = HashMap::from([
+            (
+                "index.html".to_string(),
+                FragmentList {
+                    fragments: vec![
+                        WebUIFragment::signal("$structural:head_start", true),
+                        WebUIFragment {
+                            fragment: Some(Fragment::ForLoop(WebUIFragmentFor {
+                                item: "item".to_string(),
+                                collection: "items".to_string(),
+                                fragment_id: "for-1".to_string(),
+                            })),
+                        },
+                        WebUIFragment::signal("$structural:body_end", true),
+                    ],
+                    contains_boundary: true,
+                },
+            ),
+            (
+                "for-1".to_string(),
+                FragmentList {
+                    fragments: vec![WebUIFragment {
+                        fragment: Some(Fragment::Boundary(WebUIFragmentBoundary {
+                            declaration_id: 0,
+                            owner_fragment_id: "index.html".to_string(),
+                            name: "row".to_string(),
+                            key: None,
+                            may_repeat: false,
+                            phase: BoundaryPhase::Start as i32,
+                        })),
+                    }],
+                    contains_boundary: true,
+                },
+            ),
+        ]);
+        let protocol = crate::Protocol::new(WebUIProtocol::new(fragments));
+        let handler = WebUIHandler::new();
+        let mut sink = super::super::BufferSink::default();
+        let options = crate::RenderOptions::new("index.html", "/");
+        let mut response = match handler.stream_response(&protocol, &options, &mut sink) {
+            Ok(response) => response,
+            Err(error) => panic!("building the response failed: {error}"),
+        };
+        let error = response
+            .start(&serde_json::json!({ "items": [1, 2] }))
+            .expect_err("a boundary inside a repeat must be rejected");
+        assert!(
+            error.to_string().contains("<for> repeat body"),
+            "unexpected error: {error}"
+        );
+    }
 }
diff --git a/crates/webui-handler/tests/streaming_v2.rs b/crates/webui-handler/tests/streaming_v2.rs
index 7e844d093..4669b4b5b 100644
--- a/crates/webui-handler/tests/streaming_v2.rs
+++ b/crates/webui-handler/tests/streaming_v2.rs
@@ -68,118 +68,294 @@ fn component_local_boundary_suspends_and_emits_v2_span_contract() {
     assert!(shell.contains(r#"<!--ws:0--><shell-card title="frozen" data-ws data-ws-span="0">"#));
     assert!(!shell.contains("<!--wb:0-->"));
 
-    let end = session
+    let committed = session
         .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap();
-    assert!(end.done);
-    let html = String::from_utf8(end.bytes).unwrap();
+    assert!(!committed.done && committed.boundary.is_none());
+    let html = String::from_utf8(committed.bytes).unwrap();
     assert!(html.contains(r#"<!--wb:0--><child-box label="frozen" data-ws data-ws-enclosing="0">"#));
     assert!(html.contains(r#"<!--/wb:0--><script type="application/json" data-webui-boundary>[2,0,0,0,{"declarationId":0,"enclosingSpanInstanceId":0"#));
-    assert!(html.contains(
+    // The committed step stops at its checkpoint: the component tail and the
+    // span completion that follow belong to the next step.
+    assert!(!html.contains("<footer>tail</footer>"));
+    assert!(!html.contains("<!--/ws:0-->"));
+
+    let end = session.advance().unwrap();
+    assert!(end.done);
+    let tail = String::from_utf8(end.bytes).unwrap();
+    assert!(tail.contains("<footer>tail</footer>"));
+    assert!(tail.contains(
         r#"</shell-card><!--/ws:0--><script type="application/json" data-webui-boundary>[2,1,3,0,"#
     ));
-    assert!(html.contains("[2,2,4,0,{}]"));
-    assert!(html.contains("</script><webui-hydrate></webui-hydrate>"));
+    assert!(tail.contains("[2,2,4,0,{}]"));
+    assert!(tail.contains("</script><webui-hydrate></webui-hydrate>"));
 }
 
 #[test]
-fn false_if_discovers_no_occurrence_and_boundary_free_start_completes() {
+fn resume_writes_only_the_committed_boundary_and_advance_writes_the_tail() {
     let protocol = parsed_protocol(
-        &document(
-            r#"<if condition="show"><boundary name="hidden"><p>no</p></boundary></if><p>done</p>"#,
-        ),
+        &document(concat!(
+            r#"<boundary name="search"><p>results</p></boundary>"#,
+            "<footer>tail</footer>",
+        )),
         &[],
     );
     let mut session = new_session(protocol, "/");
-    let step = session.start(&test_json!({ "show": false })).unwrap();
 
-    assert!(step.done);
-    assert!(step.boundary.is_none());
-    let html = String::from_utf8(step.bytes).unwrap();
-    assert!(!html.contains("<!--wb:"));
-    assert!(html.contains("<p>done</p>"));
-    assert!(html.contains("[2,0,4,0,{}]"));
+    let start = session.start(&test_json!({})).unwrap();
+    let boundary = start.boundary.unwrap();
+    assert_eq!(boundary.name.as_ref(), "search");
+
+    let committed = session
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(!committed.done && committed.boundary.is_none());
+    let bytes = String::from_utf8(committed.bytes).unwrap();
+    // Exact segment: the occurrence markers, its body, its record, and nothing
+    // past the record's hydration sentinel.
+    assert!(bytes.starts_with("<!--wb:0--><p>results</p><!--/wb:0--><script"));
+    assert!(bytes.ends_with("<webui-hydrate></webui-hydrate>"));
+    assert!(!bytes.contains("<footer>tail</footer>"));
+    assert!(!bytes.contains("[2,1,4,0,{}]"));
+
+    let tail = session.advance().unwrap();
+    assert!(tail.done);
+    let tail = String::from_utf8(tail.bytes).unwrap();
+    assert!(tail.starts_with("<footer>tail</footer>"));
+    assert!(tail.contains("[2,1,4,0,{}]"));
+    assert!(!tail.contains("<!--wb:0-->"));
 }
 
 #[test]
-fn component_false_if_emits_generated_span_without_occurrence() {
+fn multiple_boundaries_alternate_descriptor_commit_and_advance() {
     let protocol = parsed_protocol(
-        &document(r#"<conditional-card show="{{show}}"></conditional-card>"#),
-        &[(
-            "conditional-card",
-            r#"<if condition="show"><boundary name="ready"><p>yes</p></boundary></if>"#,
-        )],
+        &document(concat!(
+            r#"<boundary name="first"><p>1</p></boundary>"#,
+            "<hr>",
+            r#"<boundary name="second"><p>2</p></boundary>"#,
+            "<footer>tail</footer>",
+        )),
+        &[],
     );
-    let mut hidden = new_session(Arc::clone(&protocol), "/");
-    let hidden = hidden.start(&test_json!({ "show": false })).unwrap();
-    assert!(hidden.done);
-    let hidden_html = String::from_utf8(hidden.bytes).unwrap();
-    assert!(!hidden_html.contains("<!--wb:"));
-    assert!(hidden_html.contains("<!--ws:0--><conditional-card"));
-    assert!(hidden_html.contains(r#"data-ws data-ws-span="0">"#));
-    assert!(hidden_html.contains(
-        r#"</conditional-card><!--/ws:0--><script type="application/json" data-webui-boundary>[2,0,3,0,"#
-    ));
-    assert!(hidden_html.contains("[2,1,4,0,{}]"));
+    let mut session = new_session(protocol, "/");
 
-    let mut shown = new_session(protocol, "/");
-    let shown = shown.start(&test_json!({ "show": true })).unwrap();
-    assert!(shown.boundary.is_some());
-    assert!(String::from_utf8(shown.bytes)
+    let start = session.start(&test_json!({})).unwrap();
+    let first = start.boundary.clone().unwrap();
+    assert_eq!(first.instance_id.raw(), 0);
+
+    let committed = session
+        .resume(first.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(committed.boundary.is_none() && !committed.done);
+
+    let between = session.advance().unwrap();
+    let second = between.boundary.clone().unwrap();
+    assert_eq!(second.instance_id.raw(), 1);
+    let between = String::from_utf8(between.bytes).unwrap();
+    assert!(between.starts_with("<hr>"), "{between}");
+    assert!(!between.contains("<!--wb:1-->"));
+
+    let committed = session
+        .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(committed.boundary.is_none() && !committed.done);
+    assert!(String::from_utf8(committed.bytes)
         .unwrap()
-        .contains("<!--ws:0--><conditional-card"));
+        .contains("<!--wb:1--><p>2</p><!--/wb:1-->"));
+
+    let end = session.advance().unwrap();
+    assert!(end.done && end.boundary.is_none());
+    assert!(String::from_utf8(end.bytes)
+        .unwrap()
+        .contains("<footer>tail</footer>"));
+    assert!(session.is_done());
+}
+
+#[test]
+fn out_of_order_steps_are_rejected_without_poisoning() {
+    let protocol = parsed_protocol(
+        &document(concat!(
+            r#"<boundary name="first"><p>1</p></boundary>"#,
+            r#"<boundary name="second"><p>2</p></boundary>"#,
+        )),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+
+    // advance before any commit is an ordering error, and writes nothing.
+    assert!(session
+        .advance()
+        .unwrap_err()
+        .to_string()
+        .contains("start must be called before this operation"));
+
+    let first = session.start(&test_json!({})).unwrap().boundary.unwrap();
+    assert!(session
+        .advance()
+        .unwrap_err()
+        .to_string()
+        .contains("no committed boundary to advance past"));
+
+    let committed = session
+        .resume(first.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap();
+    assert!(committed.boundary.is_none());
+
+    // Resuming again before advancing is rejected, and the response stays
+    // usable: the very next advance still produces the second descriptor.
+    assert!(session
+        .resume(first.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap_err()
+        .to_string()
+        .contains("has not been advanced past"));
+    let second = session.advance().unwrap().boundary.unwrap();
+    assert_eq!(second.instance_id.raw(), 1);
+    assert!(session
+        .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(session.advance().unwrap().done);
+    assert!(session
+        .advance()
+        .unwrap_err()
+        .to_string()
+        .contains("already completed"));
 }
 
 #[test]
-fn keyed_repeat_returns_gapless_descriptors_and_rejects_duplicates() {
+fn boundary_in_repeat_is_rejected_at_build_time() {
+    let mut parser = HtmlParser::new();
+    let error = parser
+        .parse(
+            "index.html",
+            &document(
+                r#"<for each="item in items"><boundary name="row" key="{{item.id}}"><p>{{item.label}}</p></boundary></for>"#,
+            ),
+        )
+        .expect_err("a boundary inside a repeat must be rejected before render");
+    assert!(
+        error.to_string().contains("<for>"),
+        "the diagnostic must name the repeat: {error}"
+    );
+}
+
+#[test]
+fn boundary_free_repeat_renders_atomically_inside_one_boundary() {
+    // The whole finite list is one atomic checkpoint: it renders in the commit
+    // step and leaves no resumable repeat state behind.
+    let protocol = parsed_protocol(
+        &document(concat!(
+            r#"<boundary name="feed"><for each="item in items"><p>{{item.label}}</p></for></boundary>"#,
+            "<footer>tail</footer>",
+        )),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let state = test_json!({ "items": [{ "label": "a" }, { "label": "b" }, { "label": "c" }] });
+
+    let boundary = session.start(&state).unwrap().boundary.unwrap();
+    let committed = session
+        .resume(boundary.instance_id, &state, BoundaryMode::Final)
+        .unwrap();
+    assert!(committed.boundary.is_none() && !committed.done);
+    let html = String::from_utf8(committed.bytes).unwrap();
+    assert!(html.contains("<p>a</p><p>b</p><p>c</p>"), "{html}");
+    assert!(!html.contains("<footer>tail</footer>"));
+
+    let end = session.advance().unwrap();
+    assert!(end.done);
+    assert!(String::from_utf8(end.bytes)
+        .unwrap()
+        .contains("<footer>tail</footer>"));
+}
+
+#[test]
+fn nested_repeats_and_components_inside_a_boundary_keep_loop_locals_and_capture() {
+    // Nested repeats exercise the frame-driven walk (no recursion) and a
+    // component inside a repeat body must still land in the enclosing
+    // checkpoint's capture, so its template arrives with that record.
     let protocol = parsed_protocol(
         &document(
-            r#"<for each="item in items"><boundary name="row" key="{{item.id}}"><p>{{item.label}}</p></boundary></for>"#,
+            r#"<boundary name="grid"><for each="row in rows"><section>{{row.name}}<for each="cell in row.cells"><cell-box label="{{cell}}" owner="{{row.name}}"></cell-box></for></section></for></boundary>"#,
         ),
-        &[],
+        &[("cell-box", "<span>{{owner}}:{{label}}</span>")],
     );
-    let mut session = new_session(Arc::clone(&protocol), "/");
+    let mut session = new_session(protocol, "/");
     let state = test_json!({
-        "items": [
-            { "id": 10, "label": "a" },
-            { "id": 20, "label": "b" }
+        "rows": [
+            { "name": "r1", "cells": ["a", "b"] },
+            { "name": "r2", "cells": ["c"] }
         ]
     });
+
+    let boundary = session.start(&state).unwrap().boundary.unwrap();
+    let html = String::from_utf8(
+        session
+            .resume(boundary.instance_id, &state, BoundaryMode::Final)
+            .unwrap()
+            .bytes,
+    )
+    .unwrap();
+    // The outer loop local stays visible inside the inner loop body, and the
+    // inner local does not leak between rows.
+    assert!(html.contains("<span>r1:a</span>"), "{html}");
+    assert!(html.contains("<span>r1:b</span>"), "{html}");
+    assert!(html.contains("<span>r2:c</span>"), "{html}");
+    assert_eq!(html.matches("<span>").count(), 3);
+    // The repeated component is captured by the enclosing checkpoint, so its
+    // inventory bit rides that record.
+    assert!(html.contains(r#""inventory":"01""#), "{html}");
+    assert!(session.advance().unwrap().done);
+}
+
+#[test]
+fn keyed_component_boundary_returns_gapless_descriptors_and_rejects_duplicates() {
+    // `<for>` can no longer repeat a declaration, but two static callsites of a
+    // boundary-bearing component still can, so keys stay live.
+    let protocol = parsed_protocol(
+        &document(
+            r#"<row-item row-id="{{first}}"></row-item><row-item row-id="{{second}}"></row-item>"#,
+        ),
+        &[(
+            "row-item",
+            r#"<boundary name="row" key="{{rowId}}"><p>{{rowId}}</p></boundary>"#,
+        )],
+    );
+    let mut session = new_session(Arc::clone(&protocol), "/");
+    let state = test_json!({ "first": 10, "second": 20 });
+
     let first = session.start(&state).unwrap().boundary.unwrap();
     assert_eq!(first.instance_id.raw(), 0);
     assert_eq!(first.key, Some(BoundaryKey::Number(10.into())));
-    let second = session
+    assert!(session
         .resume(first.instance_id, &state, BoundaryMode::Final)
         .unwrap()
         .boundary
-        .unwrap();
+        .is_none());
+
+    let second = session.advance().unwrap().boundary.unwrap();
     assert_eq!(second.instance_id.raw(), 1);
     assert_eq!(second.key, Some(BoundaryKey::Number(20.into())));
-    assert!(
-        session
-            .resume(second.instance_id, &state, BoundaryMode::Final)
-            .unwrap()
-            .done
-    );
+    assert!(session
+        .resume(second.instance_id, &state, BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(session.advance().unwrap().done);
 
     let mut duplicate = new_session(protocol, "/");
-    let duplicate_state = test_json!({
-        "items": [
-            { "id": 7, "label": "a" },
-            { "id": 7, "label": "b" }
-        ]
-    });
+    let duplicate_state = test_json!({ "first": 7, "second": 7 });
     let first = duplicate.start(&duplicate_state).unwrap().boundary.unwrap();
-    let error = duplicate
+    assert!(duplicate
         .resume(first.instance_id, &duplicate_state, BoundaryMode::Final)
-        .unwrap_err();
+        .unwrap()
+        .boundary
+        .is_none());
+    let error = duplicate.advance().unwrap_err();
     assert!(error.to_string().contains("duplicate key"));
     assert!(duplicate
-        .resume(
-            BoundaryInstanceId::from_raw(1),
-            &duplicate_state,
-            BoundaryMode::Final,
-        )
+        .advance()
         .unwrap_err()
         .to_string()
         .contains("poisoned"));
@@ -188,31 +364,77 @@ fn keyed_repeat_returns_gapless_descriptors_and_rejects_duplicates() {
 #[test]
 fn resume_overlays_boundary_state_on_frozen_parent_and_lexical_locals() {
     let protocol = parsed_protocol(
-        &document(
-            r#"<for each="item in items"><boundary name="row" key="{{item.id}}"><p>{{item.label}}/{{global}}</p></boundary></for>"#,
-        ),
-        &[],
+        &document(r#"<row-item label="local"></row-item>"#),
+        &[(
+            "row-item",
+            r#"<boundary name="row"><p>{{label}}/{{global}}</p></boundary>"#,
+        )],
     );
     let mut session = new_session(protocol, "/");
     let first = session
-        .start(&test_json!({
-            "items": [{ "id": "a", "label": "local" }],
-            "global": "frozen"
-        }))
+        .start(&test_json!({ "global": "frozen" }))
         .unwrap()
         .boundary
         .unwrap();
-    let end = session
+    let committed = session
         .resume(
             first.instance_id,
             &test_json!({ "global": "boundary" }),
             BoundaryMode::Final,
         )
         .unwrap();
-    assert!(end.done);
-    assert!(String::from_utf8(end.bytes)
+    assert!(String::from_utf8(committed.bytes)
         .unwrap()
         .contains("<p>local/boundary</p>"));
+    assert!(session.advance().unwrap().done);
+}
+
+#[test]
+fn false_if_discovers_no_occurrence_and_boundary_free_start_completes() {
+    let protocol = parsed_protocol(
+        &document(
+            r#"<if condition="show"><boundary name="hidden"><p>no</p></boundary></if><p>done</p>"#,
+        ),
+        &[],
+    );
+    let mut session = new_session(protocol, "/");
+    let step = session.start(&test_json!({ "show": false })).unwrap();
+
+    assert!(step.done);
+    assert!(step.boundary.is_none());
+    let html = String::from_utf8(step.bytes).unwrap();
+    assert!(!html.contains("<!--wb:"));
+    assert!(html.contains("<p>done</p>"));
+    assert!(html.contains("[2,0,4,0,{}]"));
+}
+
+#[test]
+fn component_false_if_emits_generated_span_without_occurrence() {
+    let protocol = parsed_protocol(
+        &document(r#"<conditional-card show="{{show}}"></conditional-card>"#),
+        &[(
+            "conditional-card",
+            r#"<if condition="show"><boundary name="ready"><p>yes</p></boundary></if>"#,
+        )],
+    );
+    let mut hidden = new_session(Arc::clone(&protocol), "/");
+    let hidden = hidden.start(&test_json!({ "show": false })).unwrap();
+    assert!(hidden.done);
+    let hidden_html = String::from_utf8(hidden.bytes).unwrap();
+    assert!(!hidden_html.contains("<!--wb:"));
+    assert!(hidden_html.contains("<!--ws:0--><conditional-card"));
+    assert!(hidden_html.contains(r#"data-ws data-ws-span="0">"#));
+    assert!(hidden_html.contains(
+        r#"</conditional-card><!--/ws:0--><script type="application/json" data-webui-boundary>[2,0,3,0,"#
+    ));
+    assert!(hidden_html.contains("[2,1,4,0,{}]"));
+
+    let mut shown = new_session(protocol, "/");
+    let shown = shown.start(&test_json!({ "show": true })).unwrap();
+    assert!(shown.boundary.is_some());
+    assert!(String::from_utf8(shown.bytes)
+        .unwrap()
+        .contains("<!--ws:0--><conditional-card"));
 }
 
 #[test]
@@ -314,11 +536,14 @@ fn selected_route_component_hydration_keys_survive_frozen_state() {
         }))
         .unwrap();
     let boundary = start.boundary.unwrap();
-    let completed = session
+    let committed = session
         .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap();
-    assert!(completed.done);
-    let html = String::from_utf8(completed.bytes).unwrap();
+    let end = session.advance().unwrap();
+    assert!(end.done);
+    // The route host's own hydration state rides its span-completion record,
+    // which the advance step writes after the boundary checkpoint.
+    let html = String::from_utf8([committed.bytes, end.bytes].concat()).unwrap();
     assert!(html.contains(r#""state":{"selectedHydration":"frozen"}"#));
     assert!(!html.contains("inactiveHydration"));
 }
@@ -346,11 +571,12 @@ fn route_component_all_projection_keeps_full_state_for_resume() {
         .start(&test_json!({ "opaqueRuntimeState": "frozen" }))
         .unwrap();
     let boundary = start.boundary.unwrap();
-    let completed = session
+    let committed = session
         .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap();
-    assert!(completed.done);
-    assert!(String::from_utf8(completed.bytes)
+    let end = session.advance().unwrap();
+    assert!(end.done);
+    assert!(String::from_utf8([committed.bytes, end.bytes].concat())
         .unwrap()
         .contains(r#""opaqueRuntimeState":"frozen""#));
 }
@@ -369,13 +595,13 @@ fn route_component_full_strategy_keeps_fast_state_for_resume() {
         .start(&test_json!({ "fastRuntimeState": "frozen" }))
         .unwrap();
     let boundary = start.boundary.unwrap();
-    let completed = session
+    let committed = session
         .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap();
-    assert!(completed.done);
-    assert!(String::from_utf8(completed.bytes)
+    assert!(String::from_utf8(committed.bytes)
         .unwrap()
         .contains(r#""fastRuntimeState":"frozen""#));
+    assert!(session.advance().unwrap().done);
 }
 
 #[test]
@@ -435,11 +661,15 @@ fn nested_component_spans_are_outer_first_and_complete_inner_first() {
     assert!(outer < inner);
 
     let boundary = start.boundary.unwrap();
-    let end = session
+    let committed = session
         .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap();
+    let commit = String::from_utf8(committed.bytes).unwrap();
+    assert!(commit.contains(r#""enclosingSpanInstanceId":1"#));
+
+    let end = session.advance().unwrap();
+    assert!(end.done);
     let html = String::from_utf8(end.bytes).unwrap();
-    assert!(html.contains(r#""enclosingSpanInstanceId":1"#));
     let inner_end = html.find("<!--/ws:1-->").unwrap();
     let outer_end = html.find("<!--/ws:0-->").unwrap();
     assert!(inner_end < outer_end);
@@ -466,9 +696,20 @@ fn update_targets_one_runtime_instance() {
             BoundaryMode::Updatable,
         )
         .unwrap();
-    assert!(committed.done);
+    assert!(!committed.done);
+    // An update lands between the commit and the tail: the response is still
+    // open, so the host can revise the occurrence it just wrote.
+    let update = String::from_utf8(
+        session
+            .update(boundary.instance_id, &test_json!({ "count": 2 }))
+            .unwrap(),
+    )
+    .unwrap();
+    assert!(update.contains("[2,1,2,0,{\"count\":2}]"));
+
+    assert!(session.advance().unwrap().done);
     assert!(session
-        .update(boundary.instance_id, &test_json!({ "count": 2 }))
+        .update(boundary.instance_id, &test_json!({ "count": 3 }))
         .unwrap_err()
         .to_string()
         .contains("already completed"));
@@ -489,7 +730,7 @@ fn update_before_terminal_targets_the_runtime_occurrence() {
         .unwrap()
         .boundary
         .unwrap();
-    let second = session
+    assert!(session
         .resume(
             first.instance_id,
             &test_json!({ "count": 1 }),
@@ -497,7 +738,8 @@ fn update_before_terminal_targets_the_runtime_occurrence() {
         )
         .unwrap()
         .boundary
-        .unwrap();
+        .is_none());
+    let second = session.advance().unwrap().boundary.unwrap();
     let update = String::from_utf8(
         session
             .update(first.instance_id, &test_json!({ "count": 2 }))
@@ -505,12 +747,12 @@ fn update_before_terminal_targets_the_runtime_occurrence() {
     )
     .unwrap();
     assert!(update.contains("[2,1,2,0,{\"count\":2}]"));
-    assert!(
-        session
-            .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
-            .unwrap()
-            .done
-    );
+    assert!(session
+        .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(session.advance().unwrap().done);
 }
 
 #[test]
@@ -524,11 +766,12 @@ fn update_rejects_final_and_uncommitted_occurrences_without_poisoning() {
     );
     let mut session = new_session(protocol, "/");
     let first = session.start(&test_json!({})).unwrap().boundary.unwrap();
-    let second = session
+    assert!(session
         .resume(first.instance_id, &test_json!({}), BoundaryMode::Final)
         .unwrap()
         .boundary
-        .unwrap();
+        .is_none());
+    let second = session.advance().unwrap().boundary.unwrap();
     assert!(session
         .update(first.instance_id, &test_json!({}))
         .unwrap_err()
@@ -539,12 +782,12 @@ fn update_rejects_final_and_uncommitted_occurrences_without_poisoning() {
         .unwrap_err()
         .to_string()
         .contains("has not committed"));
-    assert!(
-        session
-            .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
-            .unwrap()
-            .done
-    );
+    assert!(session
+        .resume(second.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(session.advance().unwrap().done);
 }
 
 #[test]
@@ -564,12 +807,12 @@ fn wrong_resume_id_is_recoverable_but_render_failure_poisons() {
         .unwrap_err()
         .to_string()
         .contains("stale"));
-    assert!(
-        session
-            .resume(pending.instance_id, &test_json!({}), BoundaryMode::Final)
-            .unwrap()
-            .done
-    );
+    assert!(session
+        .resume(pending.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(session.advance().unwrap().done);
 
     let protocol = parsed_protocol(
         &document(
@@ -658,7 +901,10 @@ fn adjacent_boundaries_do_not_flush_the_same_position_twice() {
 #[test]
 fn borrowed_api_flushes_each_returned_semantic_step() {
     let protocol = parsed_protocol(
-        &document(r#"<boundary name="ready"><p>ok</p></boundary>"#),
+        &document(concat!(
+            r#"<boundary name="ready"><p>ok</p></boundary>"#,
+            "<footer>tail</footer>",
+        )),
         &[],
     );
     let handler = WebUIHandler::new();
@@ -672,17 +918,88 @@ fn borrowed_api_flushes_each_returned_semantic_step() {
         .unwrap();
     let first = response.start(&test_json!({})).unwrap();
     let boundary = first.boundary.unwrap();
-    assert!(
-        response
-            .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
-            .unwrap()
-            .done
-    );
+    assert!(response
+        .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+        .unwrap()
+        .boundary
+        .is_none());
+    assert!(response.advance().unwrap().done);
     drop(response);
-    assert!(writer.flushes >= 3);
+
+    // Prefix, checkpoint, terminal: three flushes, each releasing new bytes,
+    // and the checkpoint flush lands exactly where the occurrence's record
+    // ends — before any tail byte.
+    assert_eq!(writer.flushes, 3);
+    assert!(writer.flush_positions.windows(2).all(|p| p[0] < p[1]));
+    let checkpoint = writer.flush_positions[1];
+    assert!(writer.output[..checkpoint].ends_with("<webui-hydrate></webui-hydrate>"));
+    assert!(!writer.output[..checkpoint].contains("<footer>tail</footer>"));
+    assert!(writer.output[checkpoint..].starts_with("<footer>tail</footer>"));
     assert!(writer.ended);
 }
 
+#[test]
+fn borrowed_and_owned_sessions_produce_identical_step_segments() {
+    let entry = document(concat!(
+        r#"<boundary name="first"><p>1</p></boundary>"#,
+        "<hr>",
+        r#"<boundary name="second"><p>2</p></boundary>"#,
+        "<footer>tail</footer>",
+    ));
+    let protocol = parsed_protocol(&entry, &[]);
+    let handler = WebUIHandler::new();
+
+    let mut owned = new_session(Arc::clone(&protocol), "/");
+    let mut segments: Vec<String> = Vec::new();
+    let mut step = owned.start(&test_json!({})).unwrap();
+    segments.push(String::from_utf8(step.bytes.clone()).unwrap());
+    while !step.done {
+        step = match step.boundary.as_ref() {
+            Some(boundary) => owned
+                .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+                .unwrap(),
+            None => owned.advance().unwrap(),
+        };
+        segments.push(String::from_utf8(step.bytes.clone()).unwrap());
+    }
+
+    let mut writer = FlushStringWriter::default();
+    let mut response = handler
+        .stream_response(
+            &protocol,
+            &RenderOptions::new("index.html", "/"),
+            &mut writer,
+        )
+        .unwrap();
+    let mut status = response.start(&test_json!({})).unwrap();
+    while !status.done {
+        status = match status.boundary.as_ref() {
+            Some(boundary) => response
+                .resume(boundary.instance_id, &test_json!({}), BoundaryMode::Final)
+                .unwrap(),
+            None => response.advance().unwrap(),
+        };
+    }
+    drop(response);
+
+    assert_eq!(
+        segments.concat(),
+        writer.output,
+        "owned steps must reassemble into the borrowed byte stream"
+    );
+    // Every non-empty owned step is one flushed segment, so the borrowed
+    // writer's flush positions are exactly the owned step offsets.
+    let mut offsets = Vec::new();
+    let mut position = 0usize;
+    for segment in &segments {
+        position += segment.len();
+        if !segment.is_empty() {
+            offsets.push(position);
+        }
+    }
+    assert_eq!(offsets, writer.flush_positions);
+}
+
 #[test]
 fn borrowed_disconnect_poisons_the_response() {
     let protocol = parsed_protocol(
diff --git a/crates/webui-node/README.md b/crates/webui-node/README.md
index f3aa73c70..08c05e350 100644
--- a/crates/webui-node/README.md
+++ b/crates/webui-node/README.md
@@ -9,9 +9,8 @@ Node.js native addon for the [WebUI](https://github.com/microsoft/webui) framewo
 ## Host-driven streaming
 
 `Protocol.streamResponse(entry, requestPath, options)` returns a
-`StreamingSession`. Call `start(stateJson)` once, then call
-`resume(instanceId, stateJson, mode)` for each discovered boundary. State and
-patch arguments are JSON strings. Both step methods return:
+`StreamingSession`. State and patch arguments are JSON strings. `start`,
+`resume`, and `advance` return:
 
 ```js
 {
@@ -21,12 +20,28 @@ patch arguments are JSON strings. Both step methods return:
 }
 ```
 
+| Method | Result |
+|---|---|
+| `start(stateJson)` | Shell bytes through the first descriptor or terminal |
+| `resume(instanceId, stateJson, mode)` | Only the pending occurrence's bytes through its checkpoint |
+| `advance()` | Following parent bytes through the next descriptor or terminal |
+| `update(instanceId, patchJson)` | Projected state bytes for an updatable occurrence |
+
+A descriptor means call `resume`; no descriptor with `done: false` means call
+`advance`; `done: true` means complete. Boundary-only `resume` lets the host
+flush the checkpoint immediately. `advance` renders following parent or tail
+bytes, so no sibling boundary workaround is needed.
+
 `mode` is `"final"` (the default) or `"updatable"`. A committed updatable
-occurrence accepts `update(instanceId, patch)`, which returns a `Buffer`.
-Boundary keys preserve JSON identity: string keys are JavaScript strings and
-finite numeric keys are JavaScript numbers. Boundaries are discovered through
-entries, reusable components, runtime branches, loops, and selected routes.
-The step with `done: true` already contains terminal and document-tail bytes.
+occurrence accepts `update(instanceId, patch)`, including between its `resume`
+and `advance`, and returns a `Buffer`. Optional boundary keys preserve JSON
+identity: string keys are JavaScript strings and finite numeric keys are
+JavaScript numbers. A key is required when one component-owned declaration is
+reached from multiple static callsites in one entry traversal. Boundaries are
+discovered through entries, reusable components, runtime branches, and selected
+routes. A boundary-bearing subtree under `<for>` fails with
+`boundary-in-repeat`; one boundary may wrap the whole `<for>`. The step with
+`done: true` already contains terminal and document-tail bytes.
 
 ## Benchmark
 
@@ -48,4 +63,4 @@ See the [WebUI repository](https://github.com/microsoft/webui) for full usage gu
 
 ## License
 
-MIT — Copyright (c) Microsoft Corporation.
+MIT - Copyright (c) Microsoft Corporation.
diff --git a/crates/webui-node/src/lib.rs b/crates/webui-node/src/lib.rs
index 308dba8dd..434cc78df 100644
--- a/crates/webui-node/src/lib.rs
+++ b/crates/webui-node/src/lib.rs
@@ -375,9 +375,10 @@ pub struct JsStreamOptions {
 
 /// A progressive HTML response driven one semantic step at a time from Node.
 ///
-/// `start()` and `resume()` return bytes, completion state, and the next runtime
-/// boundary occurrence (if any). Boundary keys retain their authored JSON type:
-/// strings are JavaScript strings and finite numbers are JavaScript numbers.
+/// `start()`, `resume()`, and `advance()` return bytes, completion state, and
+/// the next runtime boundary occurrence (if any). Boundary keys retain their
+/// authored JSON type: strings are JavaScript strings and finite numbers are
+/// JavaScript numbers.
 ///
 /// ```js
 /// const session = protocol.streamResponse('index.html', '/');
@@ -388,6 +389,8 @@ pub struct JsStreamOptions {
 ///   const state = await loadBoundary(name, key);
 ///   step = session.resume(instanceId, JSON.stringify(state), 'updatable');
 ///   res.write(step.bytes);
+///   step = session.advance();
+///   res.write(step.bytes);
 /// }
 /// ```
 #[napi]
@@ -406,11 +409,11 @@ pub struct JsBoundaryDescriptor {
     pub owner: String,
     /// Free-form authored boundary name.
     pub name: String,
-    /// Evaluated repeat key, preserving string-versus-number identity.
+    /// Evaluated boundary key, preserving string-versus-number identity.
     pub key: Option<Either<String, f64>>,
 }
 
-/// Bytes and continuation state returned by `start()` and `resume()`.
+/// Bytes and continuation state returned by one streaming session step.
 #[napi(object)]
 pub struct JsStreamStep {
     /// Complete bytes produced by this semantic step.
@@ -433,7 +436,7 @@ impl StreamingSession {
             .map_err(streaming_error)
     }
 
-    /// Commit the pending occurrence and advance to the next one or terminal.
+    /// Commit the pending occurrence through its checkpoint, then stop.
     ///
     /// `mode` is `"final"` (default) or `"updatable"`. Only updatable
     /// boundaries accept later `update()` calls.
@@ -452,6 +455,18 @@ impl StreamingSession {
             .map_err(streaming_error)
     }
 
+    /// Write the parent bytes after the committed occurrence.
+    ///
+    /// Valid only after `resume()`. Returns the next boundary occurrence or
+    /// completes the document tail.
+    #[napi]
+    pub fn advance(&mut self) -> napi::Result<JsStreamStep> {
+        self.inner
+            .advance()
+            .and_then(stream_step)
+            .map_err(streaming_error)
+    }
+
     /// Push a projected state patch to a committed updatable boundary.
     #[napi]
     pub fn update(&mut self, instance_id: u32, patch_json: String) -> napi::Result<Buffer> {
@@ -743,18 +758,20 @@ mod tests {
     }
 
     #[test]
-    fn streaming_start_and_resume_preserve_repeat_key_types() {
+    fn streaming_steps_preserve_key_types_and_checkpoint_segments() {
         let proto = build_protocol(concat!(
             "<html><head></head><body>",
-            r#"<for each="item in items"><boundary name="row" key="{{item.id}}">"#,
-            "<p>{{item.label}}</p></boundary></for>",
+            r#"<boundary name="first" key="{{firstId}}"><p>{{firstLabel}}</p></boundary>"#,
+            "<span>between</span>",
+            r#"<boundary name="second" key="{{secondId}}"><p>{{secondLabel}}</p></boundary>"#,
+            "<footer>tail</footer>",
             "</body></html>",
         ));
         let protocol = Protocol::new(Buffer::from(proto), None).expect("protocol should load");
         let mut session = protocol
             .stream_response("index.html".to_string(), "/".to_string(), None)
             .expect("session should open");
-        let state = r#"{"items":[{"id":"alpha","label":"a"},{"id":20,"label":"b"}]}"#;
+        let state = r#"{"firstId":"alpha","firstLabel":"a","secondId":20,"secondLabel":"b"}"#;
 
         let first = session
             .start(state.to_string())
@@ -765,33 +782,58 @@ mod tests {
         assert_eq!(first_boundary.instance_id, 0);
         assert_eq!(first_boundary.declaration_id, 0);
         assert_eq!(first_boundary.owner, "index.html");
-        assert_eq!(first_boundary.name, "row");
+        assert_eq!(first_boundary.name, "first");
         assert!(matches!(
             first_boundary.key,
             Some(Either::A(value)) if value == "alpha"
         ));
 
-        let second = session
+        let resumed = session
             .resume(
                 first_boundary.instance_id,
                 state.to_string(),
                 Some("final".to_string()),
             )
-            .expect("resume should discover second boundary");
-        assert!(!second.done);
-        let second_boundary = second.boundary.expect("second boundary should be returned");
+            .expect("resume should commit first boundary");
+        assert!(!resumed.done);
+        assert!(resumed.boundary.is_none());
+        let resumed_text =
+            std::str::from_utf8(&resumed.bytes).expect("resume output should be UTF-8");
+        assert!(resumed_text.contains(">a<"));
+        assert!(!resumed_text.contains("between"));
+
+        let next = session
+            .advance()
+            .expect("advance should discover second boundary");
+        assert!(!next.done);
+        let next_text = std::str::from_utf8(&next.bytes).expect("advance output should be UTF-8");
+        assert!(next_text.contains("between"));
+        assert!(!next_text.contains(">b<"));
+        let second_boundary = next.boundary.expect("second boundary should be returned");
         assert_eq!(second_boundary.instance_id, 1);
+        assert_eq!(second_boundary.declaration_id, 1);
+        assert_eq!(second_boundary.name, "second");
         assert!(matches!(
             second_boundary.key,
             Some(Either::B(value)) if value == 20.0
         ));
 
-        let done = session
+        let resumed = session
             .resume(second_boundary.instance_id, state.to_string(), None)
-            .expect("final resume should complete");
+            .expect("resume should commit second boundary");
+        assert!(!resumed.done);
+        assert!(resumed.boundary.is_none());
+        let resumed_text =
+            std::str::from_utf8(&resumed.bytes).expect("resume output should be UTF-8");
+        assert!(resumed_text.contains(">b<"));
+        assert!(!resumed_text.contains("tail"));
+
+        let done = session.advance().expect("final advance should complete");
         assert!(done.done);
         assert!(done.boundary.is_none());
-        assert!(!done.bytes.is_empty());
+        assert!(std::str::from_utf8(&done.bytes)
+            .expect("advance output should be UTF-8")
+            .contains("tail"));
     }
 
     #[test]
@@ -811,15 +853,15 @@ mod tests {
             .expect("start should discover first boundary")
             .boundary
             .expect("first boundary should be returned");
-        let second = session
+        let resumed = session
             .resume(
                 first.instance_id,
                 r#"{"count":1}"#.to_string(),
                 Some("updatable".to_string()),
             )
-            .expect("resume should commit updatable boundary")
-            .boundary
-            .expect("second boundary should be returned");
+            .expect("resume should commit updatable boundary");
+        assert!(!resumed.done);
+        assert!(resumed.boundary.is_none());
 
         let update = session
             .update(first.instance_id, r#"{"count":2}"#.to_string())
@@ -828,12 +870,58 @@ mod tests {
         let update_text = std::str::from_utf8(&update).expect("update should be UTF-8");
         assert!(update_text.contains(r#""count":2"#));
 
-        let done = session
+        let second = session
+            .advance()
+            .expect("advance should discover second boundary")
+            .boundary
+            .expect("second boundary should be returned");
+        let resumed = session
             .resume(second.instance_id, "{}".to_string(), None)
-            .expect("second resume should complete");
+            .expect("second resume should commit boundary");
+        assert!(!resumed.done);
+        assert!(resumed.boundary.is_none());
+        let done = session.advance().expect("final advance should complete");
         assert!(done.done);
     }
 
+    #[test]
+    fn streaming_advance_rejects_out_of_order_calls() {
+        let proto = build_protocol(concat!(
+            "<html><head></head><body>",
+            r#"<boundary name="first"><p>first</p></boundary>"#,
+            "</body></html>",
+        ));
+        let protocol = Protocol::new(Buffer::from(proto), None).expect("protocol should load");
+        let mut session = protocol
+            .stream_response("index.html".to_string(), "/".to_string(), None)
+            .expect("session should open");
+
+        let before_start = session
+            .advance()
+            .err()
+            .expect("advance before start should fail");
+        assert!(before_start
+            .to_string()
+            .contains("start must be called before this operation"));
+
+        let start = session
+            .start("{}".to_string())
+            .expect("start should succeed");
+        let before_resume = session
+            .advance()
+            .err()
+            .expect("advance before resume should fail");
+        assert!(before_resume
+            .to_string()
+            .contains("there is no committed boundary to advance past"));
+
+        let boundary = start.boundary.expect("first boundary should be returned");
+        session
+            .resume(boundary.instance_id, "{}".to_string(), None)
+            .expect("resume should still succeed after rejected advance");
+        assert!(session.advance().expect("advance should complete").done);
+    }
+
     #[test]
     fn streaming_start_returns_done_for_boundary_free_document() {
         let proto = build_protocol("<html><head></head><body><p>done</p></body></html>");
diff --git a/crates/webui-parser/src/diagnostic.rs b/crates/webui-parser/src/diagnostic.rs
index 105cac26b..386ec32e9 100644
--- a/crates/webui-parser/src/diagnostic.rs
+++ b/crates/webui-parser/src/diagnostic.rs
@@ -109,8 +109,15 @@ pub mod codes {
     pub const INVALID_BOUNDARY_NAME: &str = "invalid-boundary-name";
     /// Two `<boundary>` directives in the same owning template share a `name`.
     pub const DUPLICATE_BOUNDARY_NAME: &str = "duplicate-boundary-name";
-    /// A `<boundary>` lexically nested in `<for>` has no stable occurrence key.
+    /// A `<boundary>` declaration renders more than once — through repeated
+    /// static callsites of its owning component — without a stable occurrence
+    /// key.
     pub const MISSING_BOUNDARY_KEY: &str = "missing-boundary-key";
+    /// A `<boundary>` is reachable from a `<for>` repeat body, directly or
+    /// transitively through `<if>`, routes/outlets, or a reusable component.
+    /// A repeat iteration cannot suspend, so the declaration can never be paced
+    /// independently.
+    pub const BOUNDARY_IN_REPEAT: &str = "boundary-in-repeat";
     /// A `<boundary key>` is empty or has malformed binding delimiters.
     pub const INVALID_BOUNDARY_KEY: &str = "invalid-boundary-key";
     /// The protocol-wide boundary declaration identity space was exhausted.
diff --git a/crates/webui-parser/src/lib.rs b/crates/webui-parser/src/lib.rs
index f032f5857..662ec01ca 100644
--- a/crates/webui-parser/src/lib.rs
+++ b/crates/webui-parser/src/lib.rs
@@ -419,7 +419,46 @@ struct PendingBoundary {
 
 struct BoundaryGraphEdge {
     target: String,
-    repeats: bool,
+}
+
+/// A `<for>` callsite, used to name the offending repeat in a diagnostic.
+struct RepeatSite<'a> {
+    owner: &'a str,
+    item: &'a str,
+    collection: &'a str,
+}
+
+/// A boundary declaration a `<for>` repeat body can reach.
+struct RepeatBoundaryViolation {
+    repeat_owner: String,
+    each: String,
+    boundary_owner: String,
+    boundary_name: String,
+}
+
+/// Push every record a route subtree renders into `targets`.
+fn push_route_records<'a>(targets: &mut Vec<&'a str>, root: &'a WebUiFragmentRoute) {
+    let mut pending = vec![root];
+    while let Some(route) = pending.pop() {
+        targets.push(route.fragment_id.as_str());
+        targets.push(route.content_fragment_id.as_str());
+        targets.push(route.pending_component.as_str());
+        targets.push(route.error_component.as_str());
+        pending.extend(route.children.iter());
+    }
+}
+
+/// Push every record `list` renders through a lexical child edge.
+fn push_child_records<'a>(list: &'a FragmentList, targets: &mut Vec<&'a str>) {
+    for fragment in &list.fragments {
+        match fragment.fragment.as_ref() {
+            Some(Fragment::Component(component)) => targets.push(&component.fragment_id),
+            Some(Fragment::IfCond(if_cond)) => targets.push(&if_cond.fragment_id),
+            Some(Fragment::ForLoop(for_loop)) => targets.push(&for_loop.fragment_id),
+            Some(Fragment::Route(route)) => push_route_records(targets, route),
+            _ => {}
+        }
+    }
 }
 
 #[derive(Default)]
@@ -972,20 +1011,26 @@ impl HtmlParser {
     }
 
     /// Compute transitive boundary presence and conservative declaration
-    /// repeatability for the complete parsed fragment graph.
+    /// repeatability for the complete parsed fragment graph, and reject every
+    /// boundary a `<for>` repeat body can reach.
     ///
-    /// This runs only after a top-level parse succeeds. Both analyses are
-    /// iterative: presence propagates through reverse edges, while occurrence
-    /// counts use a two-value (once/many) fixed point. Cycles therefore converge
-    /// without recursion and are conservatively classified as repeatable.
+    /// This runs only after a top-level parse succeeds. Every analysis is
+    /// iterative: presence propagates through reverse edges, repeat
+    /// reachability is a multi-source forward walk, and occurrence counts use a
+    /// two-value (once/many) fixed point. Cycles therefore converge without
+    /// recursion and are conservatively classified as repeatable.
     #[cold]
     #[inline(never)]
     fn finalize_boundary_metadata(&mut self) -> Result<()> {
         if self.next_boundary_declaration_id != 0 {
             let (outgoing, direct_boundary_records) = self.boundary_graph();
             self.mark_boundary_records(&outgoing, direct_boundary_records);
+            if let Some(violation) = self.find_repeat_reachable_boundary() {
+                return Err(Self::repeat_reachable_boundary_error(&violation));
+            }
             let occurrence_counts = self.boundary_occurrence_counts(&outgoing);
 
+            let mut unkeyed_repeat: Option<(u32, String, String)> = None;
             for (fragment_id, list) in &mut self.fragment_records {
                 let repeated = occurrence_counts
                     .get(fragment_id)
@@ -997,10 +1042,24 @@ impl HtmlParser {
                     if let Some(Fragment::Boundary(boundary)) = fragment.fragment.as_mut() {
                         if boundary.phase() == BoundaryPhase::Start {
                             boundary.may_repeat = true;
+                            if boundary.key.is_none()
+                                && unkeyed_repeat
+                                    .as_ref()
+                                    .is_none_or(|(id, _, _)| boundary.declaration_id < *id)
+                            {
+                                unkeyed_repeat = Some((
+                                    boundary.declaration_id,
+                                    boundary.owner_fragment_id.clone(),
+                                    boundary.name.clone(),
+                                ));
+                            }
                         }
                     }
                 }
             }
+            if let Some((_, owner, name)) = unkeyed_repeat {
+                return Err(Self::missing_boundary_key_error(&owner, &name));
+            }
 
             if let Some((owner, name)) = self.find_transitively_nested_boundary() {
                 return Err(Self::transitively_nested_boundary_error(&owner, &name));
@@ -1062,13 +1121,13 @@ impl HtmlParser {
             for fragment in &list.fragments {
                 match fragment.fragment.as_ref() {
                     Some(Fragment::Component(component)) => {
-                        Self::push_boundary_edge(edges, &component.fragment_id, false);
+                        Self::push_boundary_edge(edges, &component.fragment_id);
                     }
                     Some(Fragment::ForLoop(for_loop)) => {
-                        Self::push_boundary_edge(edges, &for_loop.fragment_id, true);
+                        Self::push_boundary_edge(edges, &for_loop.fragment_id);
                     }
                     Some(Fragment::IfCond(if_cond)) => {
-                        Self::push_boundary_edge(edges, &if_cond.fragment_id, false);
+                        Self::push_boundary_edge(edges, &if_cond.fragment_id);
                     }
                     Some(Fragment::Boundary(boundary)) => {
                         if boundary.phase() == BoundaryPhase::Start {
@@ -1085,11 +1144,10 @@ impl HtmlParser {
         (outgoing, direct_boundary_records)
     }
 
-    fn push_boundary_edge(edges: &mut Vec<BoundaryGraphEdge>, target: &str, repeats: bool) {
+    fn push_boundary_edge(edges: &mut Vec<BoundaryGraphEdge>, target: &str) {
         if !target.is_empty() {
             edges.push(BoundaryGraphEdge {
                 target: target.to_string(),
-                repeats,
             });
         }
     }
@@ -1097,10 +1155,10 @@ impl HtmlParser {
     fn push_route_boundary_edges(edges: &mut Vec<BoundaryGraphEdge>, root: &WebUiFragmentRoute) {
         let mut pending = vec![root];
         while let Some(route) = pending.pop() {
-            Self::push_boundary_edge(edges, &route.fragment_id, false);
-            Self::push_boundary_edge(edges, &route.content_fragment_id, false);
-            Self::push_boundary_edge(edges, &route.pending_component, false);
-            Self::push_boundary_edge(edges, &route.error_component, false);
+            Self::push_boundary_edge(edges, &route.fragment_id);
+            Self::push_boundary_edge(edges, &route.content_fragment_id);
+            Self::push_boundary_edge(edges, &route.pending_component);
+            Self::push_boundary_edge(edges, &route.error_component);
             pending.extend(route.children.iter());
         }
     }
@@ -1143,13 +1201,13 @@ impl HtmlParser {
         &self,
         outgoing: &HashMap<String, Vec<BoundaryGraphEdge>>,
     ) -> HashMap<String, u8> {
-        let mut incoming: HashMap<&str, Vec<(&str, bool)>> = HashMap::new();
+        let mut incoming: HashMap<&str, Vec<&str>> = HashMap::new();
         for (parent, edges) in outgoing {
             for edge in edges {
                 incoming
                     .entry(edge.target.as_str())
                     .or_default()
-                    .push((parent.as_str(), edge.repeats));
+                    .push(parent.as_str());
             }
         }
 
@@ -1171,7 +1229,7 @@ impl HtmlParser {
         &self,
         root: &str,
         outgoing: &HashMap<String, Vec<BoundaryGraphEdge>>,
-        incoming: &HashMap<&str, Vec<(&str, bool)>>,
+        incoming: &HashMap<&str, Vec<&str>>,
     ) -> HashMap<String, u8> {
         let mut counts: HashMap<String, u8> = HashMap::with_capacity(self.fragment_records.len());
         counts.insert(root.to_string(), 1);
@@ -1200,21 +1258,16 @@ impl HtmlParser {
     fn recompute_boundary_occurrences(
         fragment_id: &str,
         root: &str,
-        incoming: &HashMap<&str, Vec<(&str, bool)>>,
+        incoming: &HashMap<&str, Vec<&str>>,
         counts: &HashMap<String, u8>,
     ) -> u8 {
         let mut count = u8::from(fragment_id == root);
         let Some(parents) = incoming.get(fragment_id) else {
             return count;
         };
-        for (parent, repeats) in parents {
+        for parent in parents {
             let parent_count = counts.get(*parent).copied().unwrap_or(0);
-            let contribution = if *repeats && parent_count != 0 {
-                2
-            } else {
-                parent_count
-            };
-            count = count.saturating_add(contribution).min(2);
+            count = count.saturating_add(parent_count).min(2);
             if count == 2 {
                 break;
             }
@@ -1222,6 +1275,192 @@ impl HtmlParser {
         count
     }
 
+    /// Locate the lowest-numbered declaration a `<for>` repeat body reaches.
+    ///
+    /// Reachability is a single multi-source forward walk seeded with every
+    /// repeat body record, so a graph with many loops still costs one pass. It
+    /// follows the same component/condition/loop/route edges the presence
+    /// analysis uses, plus the route-child records an enclosing route mounts at
+    /// its component's `<outlet />` — the one runtime edge that has no
+    /// lexical counterpart.
+    fn find_repeat_reachable_boundary(&self) -> Option<RepeatBoundaryViolation> {
+        let mut origin: HashMap<&str, &str> = HashMap::new();
+        let mut pending: Vec<&str> = Vec::new();
+        let mut repeats: HashMap<&str, RepeatSite<'_>> = HashMap::new();
+        let mut seeds: Vec<(&str, RepeatSite<'_>)> = Vec::new();
+
+        for (owner, list) in &self.fragment_records {
+            for fragment in &list.fragments {
+                let Some(Fragment::ForLoop(for_loop)) = fragment.fragment.as_ref() else {
+                    continue;
+                };
+                if for_loop.fragment_id.is_empty() {
+                    continue;
+                }
+                let body = for_loop.fragment_id.as_str();
+                seeds.push((
+                    body,
+                    RepeatSite {
+                        owner: owner.as_str(),
+                        item: for_loop.item.as_str(),
+                        collection: for_loop.collection.as_str(),
+                    },
+                ));
+            }
+        }
+        seeds.sort_unstable_by(|(left_body, left), (right_body, right)| {
+            (left.owner, left.item, left.collection, *left_body).cmp(&(
+                right.owner,
+                right.item,
+                right.collection,
+                *right_body,
+            ))
+        });
+        for (body, site) in seeds {
+            if !origin.contains_key(body) {
+                repeats.insert(body, site);
+                origin.insert(body, body);
+                pending.push(body);
+            }
+        }
+        // `pending` is a LIFO stack. Reverse the sorted seeds so the lowest
+        // repeat site owns every shared reachable record deterministically.
+        pending.reverse();
+        if pending.is_empty() {
+            return None;
+        }
+
+        let mounts = self.route_mount_targets();
+        let mut found: Option<(u32, &str, &WebUiFragmentBoundary)> = None;
+        let mut targets: Vec<&str> = Vec::new();
+        while let Some(id) = pending.pop() {
+            let Some(seed) = origin.get(id).copied() else {
+                continue;
+            };
+            let Some(list) = self.fragment_records.get(id) else {
+                continue;
+            };
+            for fragment in &list.fragments {
+                if let Some(Fragment::Boundary(boundary)) = fragment.fragment.as_ref() {
+                    if boundary.phase() == BoundaryPhase::Start
+                        && found
+                            .as_ref()
+                            .is_none_or(|(id, _, _)| boundary.declaration_id < *id)
+                    {
+                        found = Some((boundary.declaration_id, seed, boundary));
+                    }
+                }
+            }
+            targets.clear();
+            push_child_records(list, &mut targets);
+            if let Some(mounted) = mounts.get(id) {
+                targets.extend(mounted.iter().copied());
+            }
+            for target in targets.drain(..) {
+                if target.is_empty() {
+                    continue;
+                }
+                if !origin.contains_key(target) {
+                    origin.insert(target, seed);
+                    pending.push(target);
+                }
+            }
+        }
+
+        found.map(|(_, seed, boundary)| {
+            let site = repeats.get(seed);
+            RepeatBoundaryViolation {
+                repeat_owner: site.map_or_else(String::new, |site| site.owner.to_string()),
+                each: site.map_or_else(String::new, |site| {
+                    format!("{} in {}", site.item, site.collection)
+                }),
+                boundary_owner: boundary.owner_fragment_id.clone(),
+                boundary_name: boundary.name.clone(),
+            }
+        })
+    }
+
+    /// Map every `<outlet />`-hosting record to the child-route records a
+    /// route can mount there.
+    ///
+    /// `<outlet />` is the only render edge with no lexical counterpart: the
+    /// mounted record is chosen from the enclosing route's children at request
+    /// time. Resolving it needs the parent route's render closure, so the map
+    /// is built once and reused by the repeat walk instead of being recomputed
+    /// per outlet.
+    fn route_mount_targets(&self) -> HashMap<&str, Vec<&str>> {
+        let outlet_hosts = self.outlet_host_records();
+        if outlet_hosts.is_empty() {
+            return HashMap::new();
+        }
+
+        let mut mounts: HashMap<&str, Vec<&str>> = HashMap::new();
+        let mut children: Vec<&str> = Vec::new();
+        let mut closure: HashSet<&str> = HashSet::new();
+        let mut pending: Vec<&str> = Vec::new();
+        let mut targets: Vec<&str> = Vec::new();
+        for list in self.fragment_records.values() {
+            for fragment in &list.fragments {
+                let Some(Fragment::Route(root)) = fragment.fragment.as_ref() else {
+                    continue;
+                };
+                let mut routes = vec![root];
+                while let Some(route) = routes.pop() {
+                    routes.extend(route.children.iter());
+                    if route.children.is_empty() {
+                        continue;
+                    }
+                    children.clear();
+                    for child in &route.children {
+                        push_route_records(&mut children, child);
+                    }
+                    closure.clear();
+                    pending.clear();
+                    for host in [
+                        route.fragment_id.as_str(),
+                        route.content_fragment_id.as_str(),
+                    ] {
+                        if !host.is_empty() && closure.insert(host) {
+                            pending.push(host);
+                        }
+                    }
+                    while let Some(id) = pending.pop() {
+                        if outlet_hosts.contains(id) {
+                            mounts
+                                .entry(id)
+                                .or_default()
+                                .extend(children.iter().copied());
+                        }
+                        let Some(list) = self.fragment_records.get(id) else {
+                            continue;
+                        };
+                        targets.clear();
+                        push_child_records(list, &mut targets);
+                        for target in targets.drain(..) {
+                            if !target.is_empty() && closure.insert(target) {
+                                pending.push(target);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        mounts
+    }
+
+    /// Records that render an `<outlet />`.
+    fn outlet_host_records(&self) -> HashSet<&str> {
+        self.fragment_records
+            .iter()
+            .filter(|(_, list)| {
+                list.fragments
+                    .iter()
+                    .any(|fragment| matches!(fragment.fragment.as_ref(), Some(Fragment::Outlet(_))))
+            })
+            .map(|(id, _)| id.as_str())
+            .collect()
+    }
+
     /// Locate the lowest-numbered declaration whose inline body reaches another
     /// boundary through a component, condition, loop, or route record.
     ///
@@ -1310,6 +1549,33 @@ impl HtmlParser {
         .into()
     }
 
+    /// Build the error for a boundary a `<for>` repeat body reaches through a
+    /// component, condition, route, or outlet.
+    #[cold]
+    #[inline(never)]
+    fn repeat_reachable_boundary_error(violation: &RepeatBoundaryViolation) -> ParserError {
+        let RepeatBoundaryViolation {
+            repeat_owner,
+            each,
+            boundary_owner,
+            boundary_name,
+        } = violation;
+        Diagnostic::error(format!(
+            "boundary \"{boundary_name}\" in {boundary_owner} is reachable from a <for> repeat body"
+        ))
+        .code(codes::BOUNDARY_IN_REPEAT)
+        .component(repeat_owner)
+        .element("for")
+        .snippet(format!("each=\"{each}\""))
+        .help(
+            "a repeat iteration cannot suspend: move the boundary outside the <for>, or wrap the \
+             whole <for> in one <boundary> to render the list as a single independently paced \
+             region — this includes declarations reached through components, runtime branches, \
+             routes, and outlets",
+        )
+        .into()
+    }
+
     /// `src` of every authored `<script type="module">` outside any
     /// `<boundary>`, in document order, from the most recent top-level
     /// [`HtmlParser::parse`] call.
@@ -2486,8 +2752,8 @@ impl HtmlParser {
     /// - `name` is missing/empty ([`codes::MISSING_BOUNDARY_NAME`]), dynamic
     ///   ([`codes::INVALID_BOUNDARY_NAME`]), or a duplicate within its owner
     ///   ([`codes::DUPLICATE_BOUNDARY_NAME`]).
-    /// - a boundary lexically inside `<for>` omits `key`
-    ///   ([`codes::MISSING_BOUNDARY_KEY`]), or an authored key is malformed
+    /// - the boundary sits inside a `<for>` repeat body
+    ///   ([`codes::BOUNDARY_IN_REPEAT`]), or an authored key is malformed
     ///   ([`codes::INVALID_BOUNDARY_KEY`]).
     fn enter_boundary_directive<'a>(
         &mut self,
@@ -2502,6 +2768,9 @@ impl HtmlParser {
         if self.in_boundary {
             return Err(self.nested_boundary_error(element));
         }
+        if self.for_depth != 0 {
+            return Err(self.boundary_in_repeat_error(element));
+        }
         let owner_fragment_id = self.current_fragment_id.clone();
         let owner_is_component = self.component_registry.contains(&owner_fragment_id);
         if !owner_is_component && self.body_depth == 0 && self.route_depth == 0 {
@@ -2521,11 +2790,7 @@ impl HtmlParser {
             return Err(self.duplicate_boundary_name_error(element, &name));
         }
         let key = self.validate_boundary_key(element)?;
-        if self.for_depth != 0 && key.is_none() {
-            return Err(self.missing_boundary_key_error(element));
-        }
         let declaration_id = self.allocate_boundary_declaration_id(element)?;
-        let may_repeat = self.for_depth != 0;
         self.in_boundary = true;
         self.add_fragment(
             WebUIFragment {
@@ -2534,7 +2799,7 @@ impl HtmlParser {
                     owner_fragment_id,
                     name,
                     key,
-                    may_repeat,
+                    may_repeat: false,
                     phase: BoundaryPhase::Start as i32,
                 })),
             },
@@ -2644,14 +2909,39 @@ impl HtmlParser {
 
     #[cold]
     #[inline(never)]
-    fn missing_boundary_key_error(&self, element: &Element<'_>) -> ParserError {
+    fn missing_boundary_key_error(owner: &str, name: &str) -> ParserError {
+        Diagnostic::error(format!(
+            "boundary \"{name}\" renders more than once and has no key"
+        ))
+        .code(codes::MISSING_BOUNDARY_KEY)
+        .component(owner)
+        .element("boundary")
+        .snippet(format!("name=\"{name}\""))
+        .help(
+            "the owning template is rendered from more than one callsite, so every occurrence \
+             needs a distinct key, e.g. key=\"{{sectionId}}\" — or render the declaration from a \
+             single callsite",
+        )
+        .into()
+    }
+
+    /// Build the error for a `<boundary>` authored directly inside `<for>`.
+    #[cold]
+    #[inline(never)]
+    fn boundary_in_repeat_error(&self, element: &Element<'_>) -> ParserError {
+        let name = element.attr("name").unwrap_or_default();
         self.authoring_error_at(
-            codes::MISSING_BOUNDARY_KEY,
-            "<boundary> inside <for> requires a key",
+            codes::BOUNDARY_IN_REPEAT,
+            "<boundary> is not valid inside a <for> repeat",
             element,
         )
         .element("boundary")
-        .help("add a stable item-relative key, e.g. <boundary name=\"row\" key=\"item.id\">")
+        .snippet(format!("name=\"{name}\""))
+        .help(
+            "a repeat iteration cannot suspend: move the boundary outside the <for>, or wrap the \
+             whole <for> in one <boundary> to render the list as a single independently paced \
+             region",
+        )
         .into()
     }
 
@@ -7160,38 +7450,223 @@ mod tests {
     }
 
     #[test]
-    fn boundary_inside_for_requires_and_preserves_key() {
+    fn boundary_directly_inside_for_is_rejected() {
         let mut parser = HtmlParser::new();
         let err = parser
             .parse(
-                "missing.html",
-                r#"<body><for each="item in items"><boundary name="x"><p>x</p></boundary></for></body>"#,
+                "index.html",
+                r#"<body><for each="item in items"><boundary name="x" key="{{item.id}}"><p>x</p></boundary></for></body>"#,
             )
-            .expect_err("a repeated boundary without a key must error");
+            .expect_err("a boundary inside a repeat must error");
         let ParserError::Template(diag) = err else {
             panic!("expected ParserError::Template, got {err:?}");
         };
-        assert_eq!(diag.error_code(), Some(codes::MISSING_BOUNDARY_KEY));
+        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+        assert!(
+            diag.help_text()
+                .is_some_and(|help| help.contains("wrap the whole <for>")),
+            "{diag}"
+        );
+    }
 
+    #[test]
+    fn boundary_under_if_inside_for_is_rejected() {
+        let mut parser = HtmlParser::new();
+        let err = parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><if condition="item.ready"><boundary name="x" key="{{item.id}}"><p>x</p></boundary></if></for></body>"#,
+            )
+            .expect_err("a boundary behind a runtime branch in a repeat must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+    }
+
+    #[test]
+    fn component_boundary_used_inside_for_is_rejected() {
+        let mut parser = HtmlParser::new();
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "row-item",
+                r#"<boundary name="row-ready"><span>{{label}}</span></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
+        let err = parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><row-item></row-item></for></body>"#,
+            )
+            .expect_err("a component-local boundary reached from a repeat must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+        // The diagnostic names both ends of the chain: the repeat that would
+        // execute it and the template that declares it.
+        assert!(diag.to_string().contains("row-ready"), "{diag}");
+        assert_eq!(diag.component_name(), Some("index.html"));
+        assert!(diag.to_string().contains("item in items"), "{diag}");
+    }
+
+    #[test]
+    fn transitive_repeat_boundary_diagnostic_uses_lowest_repeat_site() {
+        for _ in 0..20 {
+            let mut parser = HtmlParser::new();
+            for (tag, template) in [
+                (
+                    "left-list",
+                    r#"<for each="a in xs"><row-card></row-card></for>"#,
+                ),
+                (
+                    "right-list",
+                    r#"<for each="b in ys"><row-card></row-card></for>"#,
+                ),
+                (
+                    "row-card",
+                    r#"<boundary name="row-ready"><p>row</p></boundary>"#,
+                ),
+            ] {
+                parser
+                    .component_registry
+                    .register_component(ComponentRegistration::new(tag, template, None, true))
+                    .expect("register");
+            }
+            let err = parser
+                .parse(
+                    "index.html",
+                    r#"<body><left-list></left-list><right-list></right-list></body>"#,
+                )
+                .expect_err("both repeats reach the same boundary declaration");
+            let ParserError::Template(diag) = err else {
+                panic!("expected ParserError::Template, got {err:?}");
+            };
+            assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+            assert_eq!(diag.component_name(), Some("left-list"));
+            assert!(diag.to_string().contains("a in xs"), "{diag}");
+        }
+    }
+
+    #[test]
+    fn route_boundary_reached_from_for_is_rejected() {
+        let mut parser = HtmlParser::with_options(DomStrategy::Light);
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "row-page",
+                r#"<boundary name="row-ready"><p>row</p></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
+        let err = parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><route path="/" component="row-page"></route></for></body>"#,
+            )
+            .expect_err("a route-mounted boundary inside a repeat must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+    }
+
+    #[test]
+    fn outlet_mounted_boundary_reached_from_for_is_rejected() {
+        // The child route renders at the parent component's <outlet />, which
+        // the repeat body reaches through <shell-page>. That edge is a runtime
+        // mount with no lexical nesting, so only the mount analysis catches it.
+        let mut parser = HtmlParser::with_options(DomStrategy::Light);
+        for (tag, template) in [
+            (
+                "shell-page",
+                r#"<div><for each="item in items"><outlet></outlet></for></div>"#,
+            ),
+            (
+                "child-page",
+                r#"<boundary name="child-ready"><p>child</p></boundary>"#,
+            ),
+        ] {
+            parser
+                .component_registry
+                .register_component(ComponentRegistration::new(tag, template, None, true))
+                .expect("register");
+        }
+        let err = parser
+            .parse(
+                "index.html",
+                r#"<body><route path="/" component="shell-page"><route path="child" component="child-page"></route></route></body>"#,
+            )
+            .expect_err("an outlet-mounted boundary inside a repeat must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::BOUNDARY_IN_REPEAT));
+        assert!(diag.to_string().contains("child-ready"), "{diag}");
+    }
+
+    #[test]
+    fn for_inside_one_boundary_is_allowed_and_stays_atomic() {
+        // The whole finite list is one atomic checkpoint, so the repeat body
+        // record must not be marked as carrying a boundary of its own.
         let mut parser = HtmlParser::new();
         parser
             .parse(
                 "index.html",
-                r#"<body><for each="item in items"><boundary name="x" key="{{item.id}}"><p>{{item.name}}</p></boundary></for></body>"#,
+                r#"<body><boundary name="feed"><for each="item in items"><p>{{item.label}}</p></for></boundary></body>"#,
             )
-            .expect("a keyed repeated boundary parses");
+            .expect("a repeat inside one boundary parses");
         let records = parser.into_fragment_records();
-        let boundary = records["for-1"]
+        assert!(records["index.html"].contains_boundary);
+        assert!(
+            !records["for-1"].contains_boundary,
+            "the repeat body itself declares no boundary"
+        );
+        let boundary = records["index.html"]
             .fragments
             .iter()
             .find_map(|fragment| match fragment.fragment.as_ref() {
                 Some(Fragment::Boundary(boundary)) => Some(boundary),
                 _ => None,
             })
-            .expect("boundary in for body");
-        assert_eq!(boundary.key.as_deref(), Some("{{item.id}}"));
-        assert!(boundary.may_repeat);
+            .expect("boundary");
+        assert!(!boundary.may_repeat);
+    }
 
+    #[test]
+    fn boundary_after_for_is_allowed() {
+        let mut parser = HtmlParser::new();
+        parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><p>{{item.label}}</p></for><boundary name="tail"><p>tail</p></boundary></body>"#,
+            )
+            .expect("a boundary following a repeat parses");
+        let records = parser.into_fragment_records();
+        assert!(records["index.html"].contains_boundary);
+        assert!(!records["for-1"].contains_boundary);
+    }
+
+    #[test]
+    fn boundary_free_for_still_renders_without_boundary_metadata() {
+        let mut parser = HtmlParser::new();
+        parser
+            .parse(
+                "index.html",
+                r#"<body><for each="item in items"><p>{{item.label}}</p></for></body>"#,
+            )
+            .expect("an ordinary repeat parses");
+        let records = parser.into_fragment_records();
+        assert!(!records["index.html"].contains_boundary);
+        assert!(!records["for-1"].contains_boundary);
+    }
+
+    #[test]
+    fn empty_boundary_key_is_still_rejected() {
         let mut parser = HtmlParser::new();
         let err = parser
             .parse(
@@ -7251,7 +7726,10 @@ mod tests {
     }
 
     #[test]
-    fn component_boundary_is_marked_repeatable_from_for_callsite() {
+    fn component_boundary_repeated_from_static_callsites_requires_a_key() {
+        // `<for>` can no longer produce multiple occurrences, but two static
+        // callsites of the same boundary-bearing component still can, so the
+        // declaration keeps its key requirement.
         let mut parser = HtmlParser::new();
         parser
             .component_registry
@@ -7262,12 +7740,34 @@ mod tests {
                 true,
             ))
             .expect("register");
+        let err = parser
+            .parse(
+                "index.html",
+                r#"<body><row-item></row-item><row-item></row-item></body>"#,
+            )
+            .expect_err("a repeated declaration without a key must error");
+        let ParserError::Template(diag) = err else {
+            panic!("expected ParserError::Template, got {err:?}");
+        };
+        assert_eq!(diag.error_code(), Some(codes::MISSING_BOUNDARY_KEY));
+        assert_eq!(diag.component_name(), Some("row-item"));
+
+        let mut parser = HtmlParser::new();
+        parser
+            .component_registry
+            .register_component(ComponentRegistration::new(
+                "row-item",
+                r#"<boundary name="row-ready" key="{{rowId}}"><span>{{label}}</span></boundary>"#,
+                None,
+                true,
+            ))
+            .expect("register");
         parser
             .parse(
                 "index.html",
-                r#"<body><for each="item in items"><row-item></row-item></for></body>"#,
+                r#"<body><row-item row-id="a"></row-item><row-item row-id="b"></row-item></body>"#,
             )
-            .expect("component callsite parses");
+            .expect("a keyed repeated declaration parses");
         let records = parser.into_fragment_records();
         let boundary = records["row-item"]
             .fragments
@@ -7278,6 +7778,7 @@ mod tests {
             })
             .expect("component boundary");
         assert!(boundary.may_repeat);
+        assert_eq!(boundary.key.as_deref(), Some("{{rowId}}"));
     }
 
     #[test]
diff --git a/crates/webui-protocol/proto/webui.proto b/crates/webui-protocol/proto/webui.proto
index b4cab5751..946d32ed7 100644
--- a/crates/webui-protocol/proto/webui.proto
+++ b/crates/webui-protocol/proto/webui.proto
@@ -193,7 +193,9 @@ message WebUIFragmentBoundary {
   reserved 5;
   reserved "fragment_id";
   // Conservative graph result: this declaration may produce multiple runtime
-  // occurrences through a loop or repeated component callsite.
+  // occurrences through repeated component callsites. A `<for>` repeat can no
+  // longer contribute: the build rejects every boundary a repeat body reaches
+  // (`boundary-in-repeat`), because a repeat iteration cannot suspend.
   bool may_repeat = 6;
   // Whether this fragment opens or closes the declaration's body.
   BoundaryPhase phase = 7;
diff --git a/crates/webui-protocol/src/gen_webui.rs b/crates/webui-protocol/src/gen_webui.rs
index ab8aea6ab..547862d51 100644
--- a/crates/webui-protocol/src/gen_webui.rs
+++ b/crates/webui-protocol/src/gen_webui.rs
@@ -206,7 +206,9 @@ pub struct WebUiFragmentBoundary {
     #[prost(string, optional, tag = "4")]
     pub key: ::core::option::Option<::prost::alloc::string::String>,
     /// Conservative graph result: this declaration may produce multiple runtime
-    /// occurrences through a loop or repeated component callsite.
+    /// occurrences through repeated component callsites. A `<for>` repeat can no
+    /// longer contribute: the build rejects every boundary a repeat body reaches
+    /// (`boundary-in-repeat`), because a repeat iteration cannot suspend.
     #[prost(bool, tag = "6")]
     pub may_repeat: bool,
     /// Whether this fragment opens or closes the declaration's body.
diff --git a/crates/webui-python/README.md b/crates/webui-python/README.md
index 1445480f6..e4830d45b 100644
--- a/crates/webui-python/README.md
+++ b/crates/webui-python/README.md
@@ -37,20 +37,30 @@ session = renderer.stream_response()
 step = session.start({"title": "Home", "items": [{"id": 7}]})
 while not step.done:
     boundary = step.boundary
-    assert boundary is not None
     send(step.bytes)
-    step = session.resume(
-        boundary.instance_id,
-        {"title": "Home"},
-        mode=BoundaryMode.FINAL,
-    )
+    if boundary is not None:
+        step = session.resume(
+            boundary.instance_id,
+            {"title": "Home"},
+            mode=BoundaryMode.FINAL,
+        )
+    else:
+        step = session.advance()
 send(step.bytes)
 ```
 
-`start()` and `resume()` return immutable `StreamStep` values containing the
-bytes produced by that call, a `done` flag, and the optional next
-`BoundaryDescriptor`. Repeated boundary keys remain Python strings, integers,
-or floats. `update(instance_id, patch)` returns the update record as `bytes`.
+`start()`, `resume()`, and `advance()` return immutable `StreamStep` values
+containing the bytes produced by that call, a `done` flag, and an optional
+`BoundaryDescriptor`. A descriptor means call `resume()`; no descriptor with
+`done == False` means call `advance()`; `done == True` means complete.
+`resume()` returns only the pending occurrence through its checkpoint, while
+`advance()` returns following parent or tail bytes. No sibling boundary
+workaround is required.
+
+Optional boundary keys are Python strings, integers, or floats. They are
+required only when one component-owned declaration is reached from multiple
+static callsites in one entry traversal. `update(instance_id, patch)` returns
+the update record as `bytes` and is valid between `resume()` and `advance()`.
 
 The first release targets regular CPython 3.11+ builds on Windows, macOS, and
 manylinux, on x64 and ARM64. PyPy, free-threaded CPython, and Alpine/musllinux
diff --git a/crates/webui-python/benchmarks/benchmark_renderer.py b/crates/webui-python/benchmarks/benchmark_renderer.py
index acd6235fc..ee1f41a95 100644
--- a/crates/webui-python/benchmarks/benchmark_renderer.py
+++ b/crates/webui-python/benchmarks/benchmark_renderer.py
@@ -24,7 +24,10 @@
 STREAMING_STATE = {
     **STATE,
     "show": True,
-    "items": [{"id": 1, "label": "one"}, {"id": 2, "label": "two"}],
+    "integerKey": 1,
+    "floatKey": 2.5,
+    "stringKey": "last",
+    "summary": "All ready",
 }
 STATE_BYTES = json.dumps(STATE, separators=(",", ":")).encode()
 STREAMING_STATE_BYTES = json.dumps(STREAMING_STATE, separators=(",", ":")).encode()
@@ -100,14 +103,16 @@ def _stream_once(renderer: Renderer) -> bytes:
         boundary = step.boundary
         assert boundary is not None
         mode = BoundaryMode.UPDATABLE if first else BoundaryMode.FINAL
-        step = session.resume(
+        committed = session.resume(
             boundary.instance_id,
             STREAMING_STATE_BYTES,
             mode=mode,
         )
+        chunks.append(committed.bytes)
         if first:
             chunks.append(session.update(boundary.instance_id, STREAMING_STATE_BYTES))
             first = False
+        step = session.advance()
     chunks.append(step.bytes)
     return b"".join(chunks)
 
diff --git a/crates/webui-python/python/microsoft_webui/_api.py b/crates/webui-python/python/microsoft_webui/_api.py
index bd671325a..d9e4cfbe6 100644
--- a/crates/webui-python/python/microsoft_webui/_api.py
+++ b/crates/webui-python/python/microsoft_webui/_api.py
@@ -224,7 +224,7 @@ def resume(
         *,
         mode: BoundaryMode | str = BoundaryMode.FINAL,
     ) -> StreamStep:
-        """Commit the pending occurrence and advance to the next step."""
+        """Commit only the pending occurrence through its checkpoint."""
         parsed_mode = BoundaryMode(mode)
         return _stream_step(
             self._inner.resume(
@@ -234,6 +234,10 @@ def resume(
             )
         )
 
+    def advance(self) -> StreamStep:
+        """Render parent bytes until the next occurrence or completion."""
+        return _stream_step(self._inner.advance())
+
     def update(self, instance_id: int, patch: StateInput) -> bytes:
         """Push a projected state patch to an updatable occurrence."""
         return self._inner.update(_state_json(patch), instance_id)
diff --git a/crates/webui-python/python/microsoft_webui/_native.pyi b/crates/webui-python/python/microsoft_webui/_native.pyi
index 73229cdd4..8d6dd397b 100644
--- a/crates/webui-python/python/microsoft_webui/_native.pyi
+++ b/crates/webui-python/python/microsoft_webui/_native.pyi
@@ -68,6 +68,7 @@ class _StreamingSession:
         instance_id: int,
         updatable: bool,
     ) -> _StreamStep: ...
+    def advance(self) -> _StreamStep: ...
     def update(self, state_json: _JsonInput, instance_id: int) -> bytes: ...
 
 __version__: str
diff --git a/crates/webui-python/src/lib.rs b/crates/webui-python/src/lib.rs
index d245ee39e..28c681bb8 100644
--- a/crates/webui-python/src/lib.rs
+++ b/crates/webui-python/src/lib.rs
@@ -394,6 +394,17 @@ impl NativeStreamingSession {
         stream_step_dict(py, step)
     }
 
+    fn advance<'py>(&self, py: Python<'py>) -> PyResult<Bound<'py, PyDict>> {
+        let step = py
+            .detach(|| {
+                self.session_binding()?
+                    .advance()
+                    .map_err(streaming_binding_error)
+            })
+            .map_err(BindingError::into_py_error)?;
+        stream_step_dict(py, step)
+    }
+
     fn update<'py>(
         &self,
         py: Python<'py>,
diff --git a/crates/webui-python/tests/conftest.py b/crates/webui-python/tests/conftest.py
index 93ab71112..4e946e247 100644
--- a/crates/webui-python/tests/conftest.py
+++ b/crates/webui-python/tests/conftest.py
@@ -19,11 +19,10 @@
 STREAMING_STATE = {
     **STATE,
     "show": True,
-    "items": [
-        {"id": 10, "label": "ten"},
-        {"id": 2.5, "label": "two-point-five"},
-        {"id": "last", "label": "last"},
-    ],
+    "integerKey": 10,
+    "floatKey": 2.5,
+    "stringKey": "last",
+    "summary": "All ready",
 }
 
 
diff --git a/crates/webui-python/tests/fixtures/streaming-app/index.html b/crates/webui-python/tests/fixtures/streaming-app/index.html
index 22ea7cc4e..78ac0101b 100644
--- a/crates/webui-python/tests/fixtures/streaming-app/index.html
+++ b/crates/webui-python/tests/fixtures/streaming-app/index.html
@@ -6,17 +6,18 @@
   </head>
   <body>
     <if condition="show">
-      <boundary name="greeting">
+      <boundary name="greeting" key="{{integerKey}}">
         <p class="greeting">Hello, {{name}}!</p>
       </boundary>
-      <boundary name="status">
+      <p id="greeting-tail">Greeting committed.</p>
+      <boundary name="status" key="{{floatKey}}">
         <p id="status">{{status}}</p>
       </boundary>
-      <for each="item in items">
-        <boundary name="row" key="{{item.id}}">
-          <p class="row">{{item.label}}</p>
-        </boundary>
-      </for>
+      <p id="status-tail">Status committed.</p>
+      <boundary name="summary" key="{{stringKey}}">
+        <p id="summary">{{summary}}</p>
+      </boundary>
+      <footer>Streaming complete.</footer>
     </if>
   </body>
 </html>
diff --git a/crates/webui-python/tests/fixtures/streaming_protocol.bin b/crates/webui-python/tests/fixtures/streaming_protocol.bin
index 8732e800a..1340fea79 100644
--- a/crates/webui-python/tests/fixtures/streaming_protocol.bin
+++ b/crates/webui-python/tests/fixtures/streaming_protocol.bin
@@ -1,4 +1,49 @@
 
+�
+if-1�
+(R&
+index.htmlgreeting"{{integerKey}}
+
+
+<p class="greeting">Hello, 
+"
+name
+	
+
+!</p>
+R8

+1
+/
+-<p id="greeting-tail">Greeting committed.</p>
+&R$

+index.htmlstatus"{{floatKey}}
+
+
+<p id="status">
+
+"
+status
+
+
+</p>
+R
8

+-
++
+)<p id="status-tail">Status committed.</p>
+(R&
+index.htmlsummary"
{{stringKey}}
+
+
+<p id="summary">
+"	
+summary
+
+
+</p>
+R8

+(
+&
+$<footer>Streaming complete.</footer>

 �
 
 index.html�
@@ -30,45 +75,4 @@ index.html
 }}}webui:body_end

 
 
-</body></html>

-�

-if-1�

-R
-index.htmlgreeting
-
-
-<p class="greeting">Hello, 
-"
-name
-	
-
-!</p>
-R8

-R

-index.htmlstatus
-
-
-<p id="status">
-
-"
-status
-
-
-</p>
-R
8

-
-itemitemsfor-1

-h
-for-1_
-$R"
-index.htmlrow"{{item.id}}0

-
-
-<p class="row">
-"
-
-item.label
-
-
-</p>
-R8


\ No newline at end of file
+</body></html>

\ No newline at end of file
diff --git a/crates/webui-python/tests/test_streaming.py b/crates/webui-python/tests/test_streaming.py
index b57aa16f0..02796b9d4 100644
--- a/crates/webui-python/tests/test_streaming.py
+++ b/crates/webui-python/tests/test_streaming.py
@@ -14,6 +14,7 @@
     Renderer,
     StateError,
     StreamingError,
+    StreamingSession,
     StreamStep,
 )
 
@@ -24,6 +25,16 @@ def require_boundary(step: StreamStep) -> BoundaryDescriptor:
     return step.boundary
 
 
+def finish_stream(session: StreamingSession, step: StreamStep) -> StreamStep:
+    while not step.done:
+        boundary = require_boundary(step)
+        committed = session.resume(boundary.instance_id, STREAMING_STATE)
+        assert not committed.done
+        assert committed.boundary is None
+        step = session.advance()
+    return step
+
+
 def test_legacy_streaming_surface_is_removed(streaming_renderer: Renderer) -> None:
     session = streaming_renderer.stream_response()
 
@@ -50,45 +61,78 @@ def test_discovers_resumes_updates_and_completes(streaming_renderer: Renderer) -
         declaration_id=0,
         owner="index.html",
         name="greeting",
-        key=None,
+        key=10,
     )
 
-    greeting_step = session.resume(
+    greeting_commit = session.resume(
         greeting.instance_id,
         STREAMING_STATE,
         mode=BoundaryMode.UPDATABLE,
     )
-    assert b"Hello, Ada!" in greeting_step.bytes
-    assert require_boundary(greeting_step).name == "status"
+    assert not greeting_commit.done
+    assert greeting_commit.boundary is None
+    assert b"Hello, Ada!" in greeting_commit.bytes
+    assert greeting_commit.bytes.endswith(b"<webui-hydrate></webui-hydrate>")
+    assert b"greeting-tail" not in greeting_commit.bytes
+    assert b'id="status"' not in greeting_commit.bytes
 
     update = session.update(greeting.instance_id, {"name": "Grace"})
     assert isinstance(update, bytes)
     assert b"Grace" in update
 
-    chunks = [start.bytes, greeting_step.bytes, update]
-    step = greeting_step
-    while not step.done:
-        boundary = require_boundary(step)
-        step = session.resume(boundary.instance_id, STREAMING_STATE)
-        chunks.append(step.bytes)
+    status_prefix = session.advance()
+    assert b"greeting-tail" in status_prefix.bytes
+    assert b'id="status"' not in status_prefix.bytes
+    status = require_boundary(status_prefix)
+    assert status.name == "status"
+
+    status_commit = session.resume(status.instance_id, STREAMING_STATE)
+    assert status_commit.boundary is None
+    assert b'id="status">ready</p>' in status_commit.bytes
+    assert b"status-tail" not in status_commit.bytes
+    assert b'id="summary"' not in status_commit.bytes
+
+    summary_prefix = session.advance()
+    assert b"status-tail" in summary_prefix.bytes
+    summary = require_boundary(summary_prefix)
+    assert summary.name == "summary"
+
+    summary_commit = session.resume(summary.instance_id, STREAMING_STATE)
+    assert summary_commit.boundary is None
+    assert b'id="summary">All ready</p>' in summary_commit.bytes
+    assert b"Streaming complete." not in summary_commit.bytes
+
+    step = session.advance()
+    chunks = [
+        start.bytes,
+        greeting_commit.bytes,
+        update,
+        status_prefix.bytes,
+        status_commit.bytes,
+        summary_prefix.bytes,
+        summary_commit.bytes,
+        step.bytes,
+    ]
 
     assert step.done
     assert step.boundary is None
     assert b"</html>" in step.bytes
+    assert b"Streaming complete." in step.bytes
     assert b'nonce="stream-nonce"' in b"".join(chunks)
 
 
-def test_repeated_boundary_keys_preserve_python_types(streaming_renderer: Renderer) -> None:
+def test_static_boundary_keys_preserve_python_types(streaming_renderer: Renderer) -> None:
     session = streaming_renderer.stream_response()
     step = session.start(STREAMING_STATE)
     keys: list[str | int | float] = []
 
     while not step.done:
         boundary = require_boundary(step)
-        if boundary.name == "row":
-            assert boundary.key is not None
-            keys.append(boundary.key)
-        step = session.resume(boundary.instance_id, STREAMING_STATE)
+        assert boundary.key is not None
+        keys.append(boundary.key)
+        committed = session.resume(boundary.instance_id, STREAMING_STATE)
+        assert committed.boundary is None
+        step = session.advance()
 
     assert keys == [10, 2.5, "last"]
     assert type(keys[0]) is int
@@ -133,13 +177,24 @@ def test_updates_require_committed_updatable_occurrence(
     with pytest.raises(StreamingError, match=r"not.*committed"):
         session.update(greeting.instance_id, {"name": "Grace"})
 
-    step = session.resume(greeting.instance_id, STREAMING_STATE)
+    committed = session.resume(greeting.instance_id, STREAMING_STATE)
     with pytest.raises(StreamingError, match="final"):
         session.update(greeting.instance_id, {"name": "Grace"})
 
-    while not step.done:
-        boundary = require_boundary(step)
-        step = session.resume(boundary.instance_id, STREAMING_STATE)
+    assert committed.boundary is None
+    finish_stream(session, session.advance())
+
+
+def test_advance_requires_a_committed_boundary(streaming_renderer: Renderer) -> None:
+    session = streaming_renderer.stream_response()
+    greeting = require_boundary(session.start(STREAMING_STATE))
+
+    with pytest.raises(StreamingError, match="pending"):
+        session.advance()
+
+    committed = session.resume(greeting.instance_id, STREAMING_STATE)
+    assert committed.boundary is None
+    assert require_boundary(session.advance()).name == "status"
 
 
 def test_resume_rejects_wrong_instance_without_advancing(
@@ -151,7 +206,9 @@ def test_resume_rejects_wrong_instance_without_advancing(
     with pytest.raises(StreamingError, match="pending"):
         session.resume(greeting.instance_id + 1, STREAMING_STATE)
 
-    assert require_boundary(session.resume(greeting.instance_id, STREAMING_STATE)).name == "status"
+    committed = session.resume(greeting.instance_id, STREAMING_STATE)
+    assert committed.boundary is None
+    assert require_boundary(session.advance()).name == "status"
 
 
 def test_session_outlives_renderer_reference(streaming_renderer: Renderer) -> None:
@@ -160,10 +217,7 @@ def test_session_outlives_renderer_reference(streaming_renderer: Renderer) -> No
     del renderer
     gc.collect()
 
-    step = session.start(STREAMING_STATE)
-    while not step.done:
-        boundary = require_boundary(step)
-        step = session.resume(boundary.instance_id, STREAMING_STATE)
+    step = finish_stream(session, session.start(STREAMING_STATE))
 
     assert b"</html>" in step.bytes
 
diff --git a/crates/webui-wasm/README.md b/crates/webui-wasm/README.md
index 373aab20e..b9089619c 100644
--- a/crates/webui-wasm/README.md
+++ b/crates/webui-wasm/README.md
@@ -21,9 +21,8 @@ Streaming callbacks are coalesced around a 16 KiB target before crossing into
 JavaScript.
 
 `Protocol.streamResponse(entry, requestPath, options)` returns a host-driven
-`StreamingSession`. Call `start(stateJson)` once, then
-`resume(instanceId, stateJson, mode)` for every discovered occurrence. State
-and patch arguments are JSON strings. Both step methods return:
+`StreamingSession`. State and patch arguments are JSON strings. `start`,
+`resume`, and `advance` return:
 
 ```js
 {
@@ -33,12 +32,28 @@ and patch arguments are JSON strings. Both step methods return:
 }
 ```
 
+| Method | Result |
+|---|---|
+| `start(stateJson)` | Shell bytes through the first descriptor or terminal |
+| `resume(instanceId, stateJson, mode)` | Only the pending occurrence's bytes through its checkpoint |
+| `advance()` | Following parent bytes through the next descriptor or terminal |
+| `update(instanceId, patchJson)` | Projected state bytes for an updatable occurrence |
+
+A descriptor means call `resume`; no descriptor with `done: false` means call
+`advance`; `done: true` means complete. Boundary-only `resume` lets the host
+enqueue the checkpoint immediately. `advance` renders following parent or tail
+bytes, so no sibling boundary workaround is needed.
+
 `mode` is `"final"` (the default) or `"updatable"`. A committed updatable
-occurrence accepts `update(instanceId, patch)`, which returns a `Uint8Array`.
-Boundary keys preserve JSON identity: string keys are JavaScript strings and
-finite numeric keys are JavaScript numbers. Boundaries are discovered through
-entries, reusable components, runtime branches, loops, and selected routes.
-The step with `done: true` already contains terminal and document-tail bytes.
+occurrence accepts `update(instanceId, patch)`, including between its `resume`
+and `advance`, and returns a `Uint8Array`. Optional boundary keys preserve JSON
+identity: string keys are JavaScript strings and finite numeric keys are
+JavaScript numbers. A key is required when one component-owned declaration is
+reached from multiple static callsites in one entry traversal. Boundaries are
+discovered through entries, reusable components, runtime branches, and selected
+routes. A boundary-bearing subtree under `<for>` fails with
+`boundary-in-repeat`; one boundary may wrap the whole `<for>`. The step with
+`done: true` already contains terminal and document-tail bytes.
 
 ## Building
 
diff --git a/crates/webui-wasm/src/handler.rs b/crates/webui-wasm/src/handler.rs
index 5f748a1f6..56e09f7e8 100644
--- a/crates/webui-wasm/src/handler.rs
+++ b/crates/webui-wasm/src/handler.rs
@@ -239,8 +239,8 @@ impl Protocol {
 
 /// A progressive HTML response driven one semantic step at a time from JavaScript.
 ///
-/// `start()` and `resume()` return `{ bytes, done, boundary? }`, where `bytes`
-/// is a `Uint8Array` and a boundary is
+/// `start()`, `resume()`, and `advance()` return
+/// `{ bytes, done, boundary? }`, where `bytes` is a `Uint8Array` and a boundary is
 /// `{ instanceId, declarationId, owner, name, key }`. Boundary keys retain
 /// their authored JSON type: strings are JavaScript strings and finite numbers
 /// are JavaScript numbers.
@@ -254,6 +254,8 @@ impl Protocol {
 ///   const state = await loadBoundary(name, key);
 ///   step = session.resume(instanceId, JSON.stringify(state), 'updatable');
 ///   controller.enqueue(step.bytes);
+///   step = session.advance();
+///   controller.enqueue(step.bytes);
 /// }
 /// ```
 #[wasm_bindgen]
@@ -271,7 +273,7 @@ impl StreamingSession {
         stream_step_object(step)
     }
 
-    /// Commit the pending occurrence and advance to the next one or terminal.
+    /// Commit the pending occurrence through its checkpoint, then stop.
     ///
     /// `mode` is `"final"` (default) or `"updatable"`. Only updatable
     /// boundaries accept later `update()` calls.
@@ -291,6 +293,16 @@ impl StreamingSession {
         stream_step_object(step)
     }
 
+    /// Write the parent bytes after the committed occurrence.
+    ///
+    /// Valid only after `resume()`. Returns the next boundary occurrence or
+    /// completes the document tail.
+    #[wasm_bindgen(js_name = advance)]
+    pub fn advance(&mut self) -> Result<Object, JsValue> {
+        let step = self.inner.advance().map_err(streaming_error)?;
+        stream_step_object(step)
+    }
+
     /// Push a projected state patch to a committed updatable boundary.
     #[wasm_bindgen(js_name = update)]
     pub fn update(&mut self, instance_id: u32, patch_json: &str) -> Result<Vec<u8>, JsValue> {
@@ -646,14 +658,17 @@ mod tests {
         }
 
         #[test]
-        fn streaming_start_and_resume_preserve_repeat_key_types() {
+        fn streaming_steps_preserve_key_types_and_checkpoint_segments() {
             let mut session = session(concat!(
                 "<html><head></head><body>",
-                r#"<for each="item in items"><boundary name="row" key="{{item.id}}">"#,
-                "<p>{{item.label}}</p></boundary></for>",
+                r#"<boundary name="first" key="{{firstId}}"><p>{{firstLabel}}</p></boundary>"#,
+                "<span>between</span>",
+                r#"<boundary name="second" key="{{secondId}}"><p>{{secondLabel}}</p></boundary>"#,
+                "<footer>tail</footer>",
                 "</body></html>",
             ));
-            let state = state(r#"{"items":[{"id":"alpha","label":"a"},{"id":20,"label":"b"}]}"#);
+            let state =
+                state(r#"{"firstId":"alpha","firstLabel":"a","secondId":20,"secondLabel":"b"}"#);
 
             let first = session
                 .start(&state)
@@ -664,26 +679,52 @@ mod tests {
             assert_eq!(first_boundary.instance_id.raw(), 0);
             assert_eq!(first_boundary.declaration_id, 0);
             assert_eq!(first_boundary.owner.as_ref(), "index.html");
-            assert_eq!(first_boundary.name.as_ref(), "row");
+            assert_eq!(first_boundary.name.as_ref(), "first");
             assert_eq!(
                 first_boundary.key,
                 Some(BoundaryKey::String("alpha".to_string()))
             );
 
-            let second = session
+            let resumed = session
                 .resume(first_boundary.instance_id, &state, BoundaryMode::Final)
-                .expect("resume should discover second boundary");
-            assert!(!second.done);
-            let second_boundary = second.boundary.expect("second boundary should be returned");
+                .expect("resume should commit first boundary");
+            assert!(!resumed.done);
+            assert!(resumed.boundary.is_none());
+            let resumed_text =
+                std::str::from_utf8(&resumed.bytes).expect("resume output should be UTF-8");
+            assert!(resumed_text.contains(">a<"));
+            assert!(!resumed_text.contains("between"));
+
+            let next = session
+                .advance()
+                .expect("advance should discover second boundary");
+            assert!(!next.done);
+            let next_text =
+                std::str::from_utf8(&next.bytes).expect("advance output should be UTF-8");
+            assert!(next_text.contains("between"));
+            assert!(!next_text.contains(">b<"));
+            let second_boundary = next.boundary.expect("second boundary should be returned");
             assert_eq!(second_boundary.instance_id.raw(), 1);
+            assert_eq!(second_boundary.declaration_id, 1);
+            assert_eq!(second_boundary.name.as_ref(), "second");
             assert_eq!(second_boundary.key, Some(BoundaryKey::Number(20.into())));
 
-            let done = session
+            let resumed = session
                 .resume(second_boundary.instance_id, &state, BoundaryMode::Final)
-                .expect("final resume should complete");
+                .expect("resume should commit second boundary");
+            assert!(!resumed.done);
+            assert!(resumed.boundary.is_none());
+            let resumed_text =
+                std::str::from_utf8(&resumed.bytes).expect("resume output should be UTF-8");
+            assert!(resumed_text.contains(">b<"));
+            assert!(!resumed_text.contains("tail"));
+
+            let done = session.advance().expect("final advance should complete");
             assert!(done.done);
             assert!(done.boundary.is_none());
-            assert!(!done.bytes.is_empty());
+            assert!(std::str::from_utf8(&done.bytes)
+                .expect("advance output should be UTF-8")
+                .contains("tail"));
         }
 
         #[test]
@@ -700,11 +741,11 @@ mod tests {
                 .expect("start should discover first boundary")
                 .boundary
                 .expect("first boundary should be returned");
-            let second = session
+            let resumed = session
                 .resume(first.instance_id, &initial, BoundaryMode::Updatable)
-                .expect("resume should commit updatable boundary")
-                .boundary
-                .expect("second boundary should be returned");
+                .expect("resume should commit updatable boundary");
+            assert!(!resumed.done);
+            assert!(resumed.boundary.is_none());
 
             let update = session
                 .update(first.instance_id, &state(r#"{"count":2}"#))
@@ -714,12 +755,50 @@ mod tests {
                 .expect("update should be UTF-8")
                 .contains(r#""count":2"#));
 
-            let done = session
+            let second = session
+                .advance()
+                .expect("advance should discover second boundary")
+                .boundary
+                .expect("second boundary should be returned");
+            let resumed = session
                 .resume(second.instance_id, &state("{}"), BoundaryMode::Final)
-                .expect("second resume should complete");
+                .expect("second resume should commit boundary");
+            assert!(!resumed.done);
+            assert!(resumed.boundary.is_none());
+            let done = session.advance().expect("final advance should complete");
             assert!(done.done);
         }
 
+        #[test]
+        fn streaming_advance_rejects_out_of_order_calls() {
+            let mut session = session(concat!(
+                "<html><head></head><body>",
+                r#"<boundary name="first"><p>first</p></boundary>"#,
+                "</body></html>",
+            ));
+
+            let before_start = session
+                .advance()
+                .expect_err("advance before start should fail");
+            assert!(before_start
+                .to_string()
+                .contains("start must be called before this operation"));
+
+            let start = session.start(&state("{}")).expect("start should succeed");
+            let before_resume = session
+                .advance()
+                .expect_err("advance before resume should fail");
+            assert!(before_resume
+                .to_string()
+                .contains("there is no committed boundary to advance past"));
+
+            let boundary = start.boundary.expect("first boundary should be returned");
+            session
+                .resume(boundary.instance_id, &state("{}"), BoundaryMode::Final)
+                .expect("resume should still succeed after rejected advance");
+            assert!(session.advance().expect("advance should complete").done);
+        }
+
         #[test]
         fn streaming_start_returns_done_for_boundary_free_document() {
             let mut session = session("<html><head></head><body><p>done</p></body></html>");
diff --git a/crates/webui/README.md b/crates/webui/README.md
index 8e083840f..c4b89b007 100644
--- a/crates/webui/README.md
+++ b/crates/webui/README.md
@@ -114,6 +114,43 @@ use webui_handler::plugin::webui::WebUIHydrationPlugin;
 let handler = WebUIHandler::with_plugin(|| Box::new(WebUIHydrationPlugin::new()));
 ```
 
+### Progressive Responses
+
+For host-paced `<boundary>` rendering, drive the four-state session directly:
+
+```rust
+use webui::{BoundaryMode, RenderOptions};
+
+let options = RenderOptions::new("index.html", "/");
+let mut response =
+    handler.stream_response(&protocol, &options, &mut writer)?;
+let mut step = response.start(&initial_state)?;
+
+while !step.done {
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state =
+                load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+            response.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+        }
+        None => response.advance()?,
+    };
+}
+```
+
+| Method | Result |
+|---|---|
+| `start(state)` | Shell bytes through the first descriptor or terminal |
+| `resume(instance_id, state, mode)` | Only the pending occurrence through its checkpoint |
+| `advance()` | Following parent bytes through the next descriptor or terminal |
+| `update(instance_id, patch)` | Projected state for an updatable occurrence |
+
+A descriptor means call `resume`; no descriptor with `done == false` means call
+`advance`; `done == true` means complete. Boundary-only `resume` makes a
+checkpoint independently flushable. `advance` writes following parent or tail
+bytes, so no sibling boundary is needed. An update is valid between `resume` and
+`advance`.
+
 ### Inspect
 
 ```rust
diff --git a/docs/ai/SKILL.md b/docs/ai/SKILL.md
index a32d21800..14aeff7fc 100644
--- a/docs/ai/SKILL.md
+++ b/docs/ai/SKILL.md
@@ -722,7 +722,7 @@ removal, or reordering shifts compiled element indices.
 
 `<boundary>` is a compile-time checkpoint directive for progressive sessions.
 It is valid in entries and reusable components, including runtime conditions,
-loops, outlets, and selected route content.
+outlets, and selected route content.
 
 ```html
 <!-- index.html -->
@@ -747,21 +747,33 @@ loops, outlets, and selected route content.
 - `name` is required, non-empty, static, and unique within its entry or
   component owner. It
   cannot contain a <code v-pre>{{binding}}</code>.
-- Boundaries may appear inside reusable components, true `<if>` paths, each
-  `<for>` iteration, and selected route content. Authored boundaries may not
-  contain another authored boundary directly or transitively.
-- A declaration that can repeat requires `key`; it must resolve to a unique live
-  string or finite number.
+- Boundaries may appear inside reusable components, true `<if>` paths, and
+  selected route content. Authored boundaries may not contain another authored
+  boundary directly or transitively.
+- A boundary-bearing subtree reached from a `<for>` body fails with
+  `boundary-in-repeat`, including declarations reached through a component,
+  condition, route, or outlet. A `<for>` may be wholly inside one boundary, and
+  boundaries before or after a `<for>` are valid.
+- A component-owned declaration reached from multiple static callsites in one
+  entry traversal requires `key`; it must resolve to a unique live string or
+  finite number. Independent entries that each reach it once do not.
 - Never author `<webui-hydrate>`. It is reserved generated runtime output.
 - Put the async application module in `<head>` before boundary content and
   import `@microsoft/webui-framework/streaming.js` before component
   registration modules.
-- `start(state)` and `resume(instanceId, state, mode)` return the next runtime
-  descriptor `{ instanceId, declarationId, owner, name, key }` plus `done`.
-  The done step already includes terminal and parent tail bytes.
+- `start(state)`, `resume(instanceId, state, mode)`, and `advance()` return a
+  step with bytes, optional runtime descriptor
+  `{ instanceId, declarationId, owner, name, key }`, and `done`.
+- Drive the step state exactly: descriptor present means `resume`; no descriptor
+  with `done == false` means `advance`; `done == true` means complete.
+- `resume` writes only the pending occurrence through its checkpoint.
+  `advance` writes the following parent or shell bytes through the next
+  occurrence or terminal. No sibling boundary is needed to split an early
+  component child from its parent tail.
 - `update(instanceId, patch)` accepts only a committed updatable occurrence.
-  It calls `setState()` without inserting markup, rerunning hydration, or
-  rerunning `hydratedCallback()`.
+  It is valid between that occurrence's `resume` and `advance`, and calls
+  `setState()` without inserting markup, rerunning hydration, or rerunning
+  `hydratedCallback()`.
 - State resolution across a suspension is lexical locals, resume state, then
   the frozen projected parent state.
 - `render_streaming` projects its one state value once for the complete
@@ -787,9 +799,10 @@ loops, outlets, and selected route content.
 Malformed directives use stable diagnostics:
 `missing-boundary-name`, `invalid-boundary-name`,
 `duplicate-boundary-name`, `missing-boundary-key`,
-`invalid-boundary-key`, `nested-boundary`, `boundary-crosses-scope`, and
-`authored-webui-hydrate`. Malformed browser records fail closed and release
-discoverable deferred state within fixed bounds.
+`invalid-boundary-key`, `nested-boundary`, `boundary-in-repeat`,
+`boundary-crosses-scope`, and `authored-webui-hydrate`. Malformed browser
+records fail closed and release discoverable deferred state within fixed
+bounds.
 
 ### Lazy component mounting
 
@@ -1211,9 +1224,14 @@ renders before spawning it, and configure the transport's flush timeout.
 let mut page = handler.stream_response(&protocol, &options, &mut writer)?;
 let mut step = page.start(&initial_state)?;
 while !step.done {
-    let boundary = step.boundary.as_ref().ok_or_else(missing_boundary)?;
-    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
-    step = page.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state =
+                load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+            page.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+        }
+        None => page.advance()?,
+    };
 }
 ```
 
@@ -1227,12 +1245,14 @@ newline-delimited control records instead:
 ```
 
 Honor HTTP write backpressure and cap concurrent streams. The CLI uses a
-capacity-one command channel and matches each nested `boundary` target by
+capacity-one command channel and matches each `boundary` target by
 descriptor `owner`, `name`, and optional `key` (plus optional
 `declarationId`). It keeps response-local instance IDs, the compiled protocol,
-and browser-facing bytes in Rust. The control stream ends after the start or
-resume that completes the response. Returning JSON keeps the buffered state
-path.
+and browser-facing bytes in Rust. A resume control commits boundary-only bytes;
+the CLI then calls `advance` internally for the following parent bytes. The
+control stream needs no advance record. After the backend sends the resume for
+the final descriptor and closes its body, the CLI's final `advance` completes
+the response. Returning JSON keeps the buffered state path.
 
 If the backend refuses a stream request (non-success status such as a `503`
 from its own concurrency cap), no response bytes were sent, so `webui serve` logs
diff --git a/docs/guide/cli/index.md b/docs/guide/cli/index.md
index a5139629b..a02f39fb6 100644
--- a/docs/guide/cli/index.md
+++ b/docs/guide/cli/index.md
@@ -312,9 +312,20 @@ that occurrence and `mode` is `final` by default or `updatable`.
 `update.boundary` uses the same identity to target one previously committed
 updatable occurrence and requires object-valued `state`.
 
-The stream ends after the `start` or `resume` that completes the response. The
-final bytes already contain the terminal record, so there is no separate end
-command.
+The control stream has no `advance` record because the CLI drives that core
+operation:
+
+| Core step state | CLI action |
+|---|---|
+| descriptor present | Wait for the matching `resume` control and call core `resume` |
+| no descriptor and not done | Call core `advance` |
+| done | Complete the browser response |
+
+Core `resume` emits only the pending occurrence through its checkpoint. Core
+`advance` emits the following parent or tail bytes through the next descriptor
+or terminal. After the backend sends the resume for the final descriptor and
+closes its NDJSON body, the CLI's final `advance` emits the terminal. There is
+no separate end command.
 
 The CLI owns response-local instance IDs and the browser transport. A
 capacity-one command channel preserves backpressure, and each record is capped
diff --git a/docs/guide/concepts/directives/boundary.md b/docs/guide/concepts/directives/boundary.md
index 483c733b2..c2f8d4dd0 100644
--- a/docs/guide/concepts/directives/boundary.md
+++ b/docs/guide/concepts/directives/boundary.md
@@ -37,7 +37,9 @@ checkpoint:
 The server discovers `search-ready` while rendering `<ntp-page>`. It can commit
 and hydrate `<search-box>` before the remaining parent content arrives. WebUI
 creates the required parent span automatically. Do not add an outer boundary
-around `<ntp-page>`.
+around `<ntp-page>`, and do not add a sibling boundary merely to separate the
+checkpoint from the parent tail. `resume` returns after the checkpoint;
+`advance` renders the following parent bytes.
 
 Load the coordinator before component registrations:
 
@@ -58,10 +60,14 @@ are allowed in:
 - entry templates
 - reusable component templates
 - true `<if>` branches
-- each `<for>` iteration
 - selected route content and outlets
 
-False conditions, empty loops, and unselected routes produce no occurrence.
+False conditions and unselected routes produce no occurrence. A boundary is
+not allowed in a `<for>` body, directly or through a component, condition,
+route, or outlet reached from that body. The build fails with
+`boundary-in-repeat`. A `<for>` may be wholly inside one boundary, and
+boundaries before or after a `<for>` are valid.
+
 The host receives the next occurrence as:
 
 ```text
@@ -72,38 +78,60 @@ The host receives the next occurrence as:
 - `declarationId` identifies the compiled declaration.
 - `owner` is the entry or component template that authored it.
 - `name` is unique only within that owner.
-- `key` identifies a repeated occurrence.
+- `key` distinguishes multiple static occurrences of one component-owned
+  declaration when required.
 
 Use `owner`, `name`, and `key` to decide what state to load. Pass `instanceId`
 back to the session.
 
-### Repeated boundaries need keys
+### Keys for multiple static callsites
 
 ```html
-<for each="result in results">
-  <boundary name="result-actions" key="{{result.id}}">
-    <result-actions result-id="{{result.id}}"></result-actions>
-  </boundary>
-</for>
+<!-- result-card.html -->
+<boundary name="result-actions" key="{{resultId}}">
+  <result-actions result-id="{{resultId}}"></result-actions>
+</boundary>
+
+<!-- index.html -->
+<result-card result-id="first"></result-card>
+<result-card result-id="second"></result-card>
 ```
 
-A repeated declaration must have a key. At runtime the key must resolve to a
-string or finite JSON number, and live occurrences of that declaration must
-have unique keys. This also applies when a component containing a boundary is
-rendered more than once.
+When one entry traversal reaches a boundary-bearing component from more than one
+static callsite, that component's declaration must have a key. Independent
+entries that each call the component once do not trigger this rule. At runtime
+the key must resolve to a string or finite JSON number, and simultaneously live
+occurrences of that declaration must have unique keys. `<for>` is not a source
+of multiple boundary occurrences because boundary-bearing subtrees under its
+body are rejected.
 
 ## Drive the response
 
-Every host binding exposes the same three operations:
+Every host binding exposes the same four operations:
 
 | Operation | Result |
 |---|---|
 | `start(state)` | Bytes through the first occurrence, or a completed step |
-| `resume(instanceId, state, mode)` | Commit that pending occurrence and continue |
+| `resume(instanceId, state, mode)` | Bytes for only the pending occurrence through its checkpoint |
+| `advance()` | Following parent bytes through the next occurrence or completion |
 | `update(instanceId, patch)` | State-only bytes for a committed updatable occurrence |
 
-`start` and `resume` return bytes, `done`, and the next optional descriptor.
-When `done` is true, those bytes already include the parent tail, terminal
+`start`, `resume`, and `advance` return bytes, `done`, and an optional
+descriptor. Interpret each step in this order:
+
+| Step state | Required action |
+|---|---|
+| descriptor present | Call `resume` with that descriptor's `instanceId` |
+| no descriptor and `done` is false | Call `advance` |
+| `done` is true | The response is complete |
+
+`resume` is boundary-only so the host can write and flush a resolved occurrence
+without waiting for its parent or document tail. Its step contains the
+occurrence markers, body, checkpoint record, and sentinel, but no bytes that
+follow the occurrence. `advance` renders those following parent or shell bytes
+until discovery pauses again or the terminal completes. This split handles a
+boundary inside an unfinished component directly, so no sibling boundary
+workaround is required. A completed step includes the parent tail, terminal
 record, and document close.
 
 ```rust
@@ -112,18 +140,24 @@ let mut response =
 let mut step = response.start(&initial_state)?;
 
 while !step.done {
-    let boundary = step.boundary.as_ref().expect("pending descriptor");
-    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref());
-    step = response.resume(
-        boundary.instance_id,
-        &state,
-        BoundaryMode::Final,
-    )?;
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state =
+                load_state(&boundary.owner, &boundary.name, boundary.key.as_ref());
+            response.resume(
+                boundary.instance_id,
+                &state,
+                BoundaryMode::Final,
+            )?
+        }
+        None => response.advance()?,
+    };
 }
 ```
 
-The example uses `expect` only for brevity. Production code should return an
-error if an unfinished step has no descriptor.
+`update` is also valid after a boundary-only `resume` and before its matching
+`advance`. This lets the host flush a checkpoint, emit a state-only patch, and
+then continue the parent.
 
 ### Final or updatable
 
@@ -139,21 +173,23 @@ hydration or `hydratedCallback()`.
 ## State at a suspension
 
 WebUI freezes only the projected parent keys needed to continue, plus lexical
-locals such as the current loop item and component attributes. Resume state
+locals such as component attributes and selected route context. Resume state
 overlays that frozen parent state. Resolution order remains:
 
 1. lexical locals
 2. state supplied to `resume`
 3. frozen parent state
 
-This lets a loop body keep `item` while a host supplies fresh boundary data.
-
 ## Authoring rules
 
 - `name` is required, static, non-empty, and unique within its owner.
 - Authored boundaries cannot contain another boundary, directly or through a
   component or runtime branch.
-- A repeated declaration requires `key`.
+- A boundary-bearing subtree reached from a `<for>` body is rejected with
+  `boundary-in-repeat`. A boundary may wrap a complete `<for>` or sit before or
+  after one.
+- A component-owned declaration reached from multiple static callsites in one
+  entry traversal requires `key`.
 - Do not place a boundary in component host children, raw or inert elements,
   authored `<template>`, or table/select foster-parenting contexts.
 - Never author `<webui-hydrate>` or the `data-ws*` attributes. WebUI owns them.
diff --git a/docs/guide/concepts/hydration.md b/docs/guide/concepts/hydration.md
index 130cadfa6..f8c747e7a 100644
--- a/docs/guide/concepts/hydration.md
+++ b/docs/guide/concepts/hydration.md
@@ -210,10 +210,17 @@ import './search-box.js';
 ```
 
 The entry uses one `<ntp-page>`. When traversal reaches its internal boundary,
-WebUI pauses and returns a runtime descriptor to the host. Resuming that
-occurrence commits `<search-box>`, which can become interactive before the
-remaining parent section arrives. Boundaries can also occur in true
-conditions, loop iterations, and selected route content.
+WebUI pauses and returns a runtime descriptor to the host. `resume` commits only
+`<search-box>` through its checkpoint, so it can become interactive
+immediately. `advance` then renders the remaining parent section, generated
+span completion, and later shell bytes. This boundary-only resume means a
+sibling boundary is not needed to separate the early child from the parent
+tail.
+
+Boundaries can also occur in true conditions and selected route content. A
+boundary-bearing subtree reached from a `<for>` body fails the build with
+`boundary-in-repeat`. A complete `<for>` may instead sit inside one boundary,
+and boundaries before or after a `<for>` are valid.
 
 ### Timing and lifecycle
 
diff --git a/docs/guide/concepts/performance.md b/docs/guide/concepts/performance.md
index f6446e093..7642ec7bd 100644
--- a/docs/guide/concepts/performance.md
+++ b/docs/guide/concepts/performance.md
@@ -195,10 +195,12 @@ Each layer of the architecture contributes to the overall performance profile:
   per request.
 
 - **Runtime-discovered streaming.** The continuation VM walks only the selected
-  entry, component, condition, loop, and route path. It is iterative and keeps
-  bounded frames, projected parent keys, lexical locals, occurrence keys, and
+  entry, component, condition, and route path. It is iterative and keeps bounded
+  frames, projected parent keys, lexical locals, static-occurrence keys, and
   generated component spans instead of cloning full state for every boundary or
-  prebuilding a request plan. Full-state fallback snapshots once per response;
+  prebuilding a request plan. A repeat body cannot reach a boundary, so each
+  `<for>` finishes inside its current step and no repeat iterator survives a
+  host call. Full-state fallback snapshots once per response;
   `render_streaming` reuses that snapshot for every occurrence. Boundary-free
   fragment records are skipped through a build-time `contains_boundary` bit.
   Capture and projection scratch buffers retain capacity across checkpoints.
@@ -210,10 +212,12 @@ Each layer of the architecture contributes to the overall performance profile:
   document-wide selector; only fatal cleanup may perform one bounded sweep.
 - **Host-owned backpressure.** `StreamingWriter` uses a bounded `tokio::mpsc`
   channel, reusable `ChunkPool`, and configurable flush deadline. Owned
-  `StreamingSession` calls return one byte chunk for `start`, `resume`, or
-  `update`, so Node, WASM, Python, C, and .NET hosts write through their native
-  backpressure APIs. `webui serve --api-port` uses a capacity-one version-2
-  control channel over the same session.
+  `StreamingSession` calls return one byte chunk for `start`, `resume`,
+  `advance`, or `update`, so Node, WASM, Python, C, and .NET hosts write through
+  their native backpressure APIs. A boundary-only `resume` can flush immediately;
+  `advance` carries the following parent and tail bytes. `webui serve
+  --api-port` uses a capacity-one version-2 control channel over the same
+  session.
   Hosts must also bound concurrent blocking renders before calling
   `spawn_blocking`; channel backpressure bounds bytes after a task starts, not
   the runtime's queued blocking-task count. Reject saturation before spawning
@@ -231,10 +235,10 @@ Each layer of the architecture contributes to the overall performance profile:
 
 ### Progressive streaming cost profile
 
-The progressive path does more work than the former fixed entry-boundary model:
-it discovers runtime occurrences, preserves continuation state, and completes
-generated component spans. Interleaved release-mode measurements against that
-fixed model produced:
+The progressive path discovers runtime occurrences, preserves continuation
+state, and completes generated component spans. A fixed entry-boundary
+benchmark provides a lower-feature baseline for these interleaved release-mode
+measurements:
 
 | Boundaries | Fixed model | Runtime-discovered model |
 |-----------:|------------:|-------------------------:|
diff --git a/docs/guide/integrations/dotnet.md b/docs/guide/integrations/dotnet.md
index b2f5cce0a..f170c9509 100644
--- a/docs/guide/integrations/dotnet.md
+++ b/docs/guide/integrations/dotnet.md
@@ -25,9 +25,9 @@ string html = handler.Render(
 
 ## Progressive streaming
 
-`StreamResponse` creates a single-driver session. `Start` and `Resume` return a
-`StreamingStep` containing `Bytes`, `Done`, and an optional `Boundary`
-descriptor.
+`StreamResponse` creates a single-driver session. `Start`, `Resume`, and
+`Advance` return a `StreamingStep` containing `Bytes`, `Done`, and an optional
+`Boundary` descriptor.
 
 ```csharp
 using var session = handler.StreamResponse(protocol, "index.html", "/");
@@ -41,19 +41,36 @@ while (true)
     await Response.Body.FlushAsync();
     if (step.Done) break;
 
-    BoundaryDescriptor boundary = step.Boundary
-        ?? throw new InvalidOperationException("Missing boundary descriptor");
-    string state = await LoadBoundaryStateAsync(
-        boundary.Owner,
-        boundary.Name,
-        boundary.Key);
-    step = session.Resume(
-        boundary.InstanceId,
-        state,
-        BoundaryMode.Final);
+    if (step.Boundary is BoundaryDescriptor boundary)
+    {
+        string state = await LoadBoundaryStateAsync(
+            boundary.Owner,
+            boundary.Name,
+            boundary.Key);
+        step = session.Resume(
+            boundary.InstanceId,
+            state,
+            BoundaryMode.Final);
+    }
+    else
+    {
+        step = session.Advance();
+    }
 }
 ```
 
+| Member | Result |
+|---|---|
+| `Start(stateJson)` | Shell bytes through the first descriptor or terminal |
+| `Resume(instanceId, stateJson, mode)` | Only the pending occurrence's bytes through its checkpoint |
+| `Advance()` | Following parent bytes through the next descriptor or terminal |
+| `Update(instanceId, patchJson)` | Projected state bytes for an updatable occurrence |
+
+A descriptor requires `Resume`; no descriptor with `Done == false` requires
+`Advance`; `Done == true` means complete. `Resume` is boundary-only so the host
+can flush that checkpoint before parent or tail bytes. `Advance` renders those
+following bytes, so no sibling boundary workaround is required.
+
 The descriptor contains:
 
 - `InstanceId`, unique within this response
@@ -73,8 +90,9 @@ await Response.Body.FlushAsync();
 ```
 
 Updates apply projected state to existing roots. They do not insert markup or
-rerun hydration. The step that reports `Done` already includes the response
-tail and terminal record.
+rerun hydration, and are valid between an occurrence's `Resume` and `Advance`.
+The step that reports `Done` already includes the response tail and terminal
+record.
 
 Drive one session from one request flow at a time. Independent sessions may run
 concurrently against the same handler and protocol. `WebUIException` carries
diff --git a/docs/guide/integrations/ffi.md b/docs/guide/integrations/ffi.md
index 20c97a788..1b079ffc9 100644
--- a/docs/guide/integrations/ffi.md
+++ b/docs/guide/integrations/ffi.md
@@ -206,9 +206,9 @@ erase the startup-only performance model.
 ### Progressive streaming sessions
 
 A streaming session lets a C host render one response in chunks it writes
-itself. Start and resume return owned step handles with borrowed byte slices;
-update returns an owned byte buffer. WebUI never touches your socket, so
-backpressure and cancellation stay yours.
+itself. Start, resume, and advance return owned step handles with borrowed byte
+slices; update returns an owned byte buffer. WebUI never touches your socket,
+so backpressure and cancellation stay yours.
 
 ```c
 webui_streaming_session_t *session = webui_streaming_session_create(
@@ -229,17 +229,22 @@ while (step != NULL) {
         break;
     }
 
-    /* Copies owner, name, typed key, and IDs from the step accessors. */
-    struct app_boundary target = copy_boundary_descriptor(step);
-    webui_streaming_step_destroy(step);
-
-    const char *state_json = load_state(&target);
-    step = webui_streaming_session_resume(
-        session,
-        target.instance_id,
-        state_json,
-        WEBUI_BOUNDARY_MODE_FINAL);
-    free_boundary_descriptor(&target);
+    if (webui_streaming_step_has_boundary(step)) {
+        /* Copies owner, name, typed key, and IDs from the step accessors. */
+        struct app_boundary target = copy_boundary_descriptor(step);
+        webui_streaming_step_destroy(step);
+
+        const char *state_json = load_state(&target);
+        step = webui_streaming_session_resume(
+            session,
+            target.instance_id,
+            state_json,
+            WEBUI_BOUNDARY_MODE_FINAL);
+        free_boundary_descriptor(&target);
+    } else {
+        webui_streaming_step_destroy(step);
+        step = webui_streaming_session_advance(session);
+    }
     if (step == NULL) {
         fprintf(stderr, "%s\n", webui_last_error());
         break;
@@ -254,7 +259,8 @@ webui_streaming_session_destroy(session);
 | `webui_streaming_session_create(handler, protocol, entry_id, request_path)` | Session handle, or `NULL`. Inherits the handler's nonce (set with `webui_handler_set_nonce`); head/body injection travels through the reserved `$webui` state key on `state_json`, not through this call. |
 | `webui_streaming_session_destroy(session)` | Releases the session. `NULL` is a safe no-op. |
 | `webui_streaming_session_start(session, state_json)` | Owned step through the first runtime occurrence or terminal, or `NULL` |
-| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Commit the pending occurrence, then return the next owned step |
+| `webui_streaming_session_resume(session, instance_id, state_json, mode)` | Owned step containing only the pending occurrence through its checkpoint |
+| `webui_streaming_session_advance(session)` | Owned step containing following parent bytes through the next occurrence or terminal |
 | `webui_streaming_session_update(session, instance_id, patch_json, out_len)` | Projected state bytes for a committed updatable occurrence |
 | `webui_streaming_step_bytes(step, out_len)` | Borrow binary-safe step bytes until destroy |
 | `webui_streaming_step_done(step)` / `webui_streaming_step_has_boundary(step)` | Read completion and descriptor presence |
@@ -267,6 +273,12 @@ none, string, or number; numeric keys are returned as `double`. Copy any
 descriptor values needed after destroying the step. Free update bytes with
 `webui_free`.
 
+If a step has a descriptor, call `resume`. If it has neither a descriptor nor
+`done`, call `advance`. If `done` is true, the response is complete. `resume`
+is boundary-only so the host can send that checkpoint immediately; `advance`
+renders the following parent or document-tail bytes. No sibling boundary is
+needed. An update may be emitted between `resume` and `advance`.
+
 The session clones its own references to the handler and protocol, so you may
 destroy them in any order. Drive a session from one thread at a time. See
 [Streaming Boundaries](/guide/concepts/directives/boundary) for the authoring
@@ -488,13 +500,18 @@ while (true)
     await Response.Body.FlushAsync();
     if (step.Done) break;
 
-    BoundaryDescriptor boundary = step.Boundary
-        ?? throw new InvalidOperationException("Missing boundary descriptor");
-    string state = await LoadStateAsync(
-        boundary.Owner,
-        boundary.Name,
-        boundary.Key);
-    step = session.Resume(boundary.InstanceId, state, BoundaryMode.Final);
+    if (step.Boundary is BoundaryDescriptor boundary)
+    {
+        string state = await LoadStateAsync(
+            boundary.Owner,
+            boundary.Name,
+            boundary.Key);
+        step = session.Resume(boundary.InstanceId, state, BoundaryMode.Final);
+    }
+    else
+    {
+        step = session.Advance();
+    }
 }
 ```
 
diff --git a/docs/guide/integrations/node.md b/docs/guide/integrations/node.md
index 1759f257b..899550141 100644
--- a/docs/guide/integrations/node.md
+++ b/docs/guide/integrations/node.md
@@ -237,14 +237,16 @@ await write(res, step.bytes);
 
 while (!step.done) {
   const boundary = step.boundary;
-  if (!boundary) throw new Error('unfinished step has no boundary');
-
-  const state = await loadBoundaryState(
-    boundary.owner,
-    boundary.name,
-    boundary.key,
-  );
-  step = session.resume(boundary.instanceId, state, 'final');
+  if (boundary) {
+    const state = await loadBoundaryState(
+      boundary.owner,
+      boundary.name,
+      boundary.key,
+    );
+    step = session.resume(boundary.instanceId, state, 'final');
+  } else {
+    step = session.advance();
+  }
   await write(res, step.bytes);
 }
 res.end();
@@ -269,21 +271,29 @@ async function write(res, chunk) {
 ```
 
 The same shape works behind Express, Fastify, Hapi, or a raw socket. Boundaries
-are discovered at runtime through entries, reusable components, conditions,
-loops, and the selected route.
+are discovered at runtime through entries, reusable components, conditions, and
+the selected route. A boundary-bearing subtree under `<for>` fails the build
+with `boundary-in-repeat`; a whole `<for>` may sit inside one boundary.
 
 ### StreamingSession
 
 | Member | Description |
 |--------|-------------|
 | `start(state)` | Return `{ bytes, done, boundary? }` through the first occurrence or terminal |
-| `resume(instanceId, state, mode?)` | Commit the pending occurrence, then return the next step |
+| `resume(instanceId, state, mode?)` | Return only the pending occurrence's bytes through its checkpoint |
+| `advance()` | Return following parent bytes through the next occurrence or terminal |
 | `update(instanceId, patch)` | Return projected state bytes for a committed updatable occurrence |
 
 A descriptor contains `instanceId`, `declarationId`, `owner`, `name`, and an
 optional string or numeric `key`. Use those fields to load state, then pass
-`instanceId` back to `resume`. The final step already contains tail and terminal
-bytes. `mode` is `"final"` by default or `"updatable"`.
+`instanceId` back to `resume`. A descriptor means call `resume`; no descriptor
+with `done: false` means call `advance`; `done: true` means complete.
+
+`resume` is boundary-only so its bytes can be written and flushed without
+waiting for following parent content. `advance` carries that parent content and
+the document tail. No sibling boundary workaround is needed. The final step
+already contains tail and terminal bytes. `mode` is `"final"` by default or
+`"updatable"`.
 
 An update never inserts markup or reruns hydration:
 
@@ -292,5 +302,6 @@ const patch = session.update(searchInstanceId, { query: 'webui' });
 await write(res, patch);
 ```
 
+An update may be written between the occurrence's `resume` and `advance`.
 Sessions are single-driver and independent. Hold one per in-flight request and
 stop driving it after a rendering or transport failure.
diff --git a/docs/guide/integrations/python.md b/docs/guide/integrations/python.md
index ad6691890..3b5ed9d53 100644
--- a/docs/guide/integrations/python.md
+++ b/docs/guide/integrations/python.md
@@ -142,18 +142,19 @@ def app(environ, start_response):
         yield step.bytes
         while not step.done:
             boundary = step.boundary
-            if boundary is None:
-                raise RuntimeError("unfinished step has no boundary")
-            state = load_boundary_state(
-                boundary.owner,
-                boundary.name,
-                boundary.key,
-            )
-            step = session.resume(
-                boundary.instance_id,
-                state,
-                mode="final",
-            )
+            if boundary is not None:
+                state = load_boundary_state(
+                    boundary.owner,
+                    boundary.name,
+                    boundary.key,
+                )
+                step = session.resume(
+                    boundary.instance_id,
+                    state,
+                    mode="final",
+                )
+            else:
+                step = session.advance()
             yield step.bytes
 
     start_response("200 OK", [
@@ -180,29 +181,38 @@ async def index(request):
         yield step.bytes
         while not step.done:
             boundary = step.boundary
-            if boundary is None:
-                raise RuntimeError("unfinished step has no boundary")
-            state = await load_boundary_state(
-                boundary.owner,
-                boundary.name,
-                boundary.key,
-            )
-            step = await anyio.to_thread.run_sync(
-                lambda: session.resume(
-                    boundary.instance_id,
-                    state,
-                    mode="final",
-                ),
-            )
+            if boundary is not None:
+                state = await load_boundary_state(
+                    boundary.owner,
+                    boundary.name,
+                    boundary.key,
+                )
+                step = await anyio.to_thread.run_sync(
+                    lambda: session.resume(
+                        boundary.instance_id,
+                        state,
+                        mode="final",
+                    ),
+                )
+            else:
+                step = await anyio.to_thread.run_sync(session.advance)
             yield step.bytes
 
     return StreamingResponse(body(), media_type="text/html; charset=utf-8")
 ```
 
-`start()` and `resume()` return a `StreamStep` with `bytes`, `done`, and an
-optional descriptor. The descriptor provides `instance_id`, `declaration_id`,
-`owner`, `name`, and `key`. The completed step already includes the tail and
-terminal bytes.
+`start()`, `resume()`, and `advance()` return a `StreamStep` with `bytes`,
+`done`, and an optional descriptor. The descriptor provides `instance_id`,
+`declaration_id`, `owner`, `name`, and `key`. A descriptor means call
+`resume()`; no descriptor with `done == False` means call `advance()`; a true
+`done` value means complete.
+
+`resume()` returns only the pending occurrence through its checkpoint.
+`advance()` returns the following parent or tail bytes through the next
+descriptor or terminal. This separation lets the host yield the checkpoint
+immediately, with no sibling boundary workaround. `update()` is valid between
+the occurrence's `resume()` and `advance()`. The completed step already includes
+the tail and terminal bytes.
 
 Sessions are **not** multi-driver - drive one session from one thread at a time;
 independent sessions on the same `Renderer` may run concurrently.
@@ -225,7 +235,8 @@ independent sessions on the same `Renderer` may run concurrently.
 | Member | Description |
 |--------|-------------|
 | `start(state) -> StreamStep` | Bytes through the first runtime occurrence or terminal |
-| `resume(instance_id, state, mode=BoundaryMode.FINAL) -> StreamStep` | Commit the pending occurrence and continue |
+| `resume(instance_id, state, mode=BoundaryMode.FINAL) -> StreamStep` | Bytes for only the pending occurrence through its checkpoint |
+| `advance() -> StreamStep` | Following parent bytes through the next occurrence or terminal |
 | `update(instance_id, patch) -> bytes` | Projected state for a committed updatable occurrence |
 
 ### `Plugin` and `BoundaryMode`
diff --git a/docs/guide/integrations/rust.md b/docs/guide/integrations/rust.md
index 04204fa6a..2c112fc51 100644
--- a/docs/guide/integrations/rust.md
+++ b/docs/guide/integrations/rust.md
@@ -221,36 +221,44 @@ HttpResponse::Ok()
 occurrences as it renders:
 
 ```rust
-use webui::{BoundaryMode, HandlerError, RenderOptions, WebUIHandler};
+use webui::{BoundaryMode, RenderOptions, WebUIHandler};
 
 let options = RenderOptions::new("index.html", "/");
 let mut response = handler.stream_response(&protocol, &options, &mut writer)?;
 let mut step = response.start(&initial_state)?;
 
 while !step.done {
-    let boundary = step.boundary.as_ref().ok_or_else(|| {
-        HandlerError::Invariant(
-            "unfinished streaming step has no descriptor".to_string(),
-        )
-    })?;
-    let state = load_state(
-        &boundary.owner,
-        &boundary.name,
-        boundary.key.as_ref(),
-    )?;
-    step = response.resume(
-        boundary.instance_id,
-        &state,
-        BoundaryMode::Final,
-    )?;
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state = load_state(
+                &boundary.owner,
+                &boundary.name,
+                boundary.key.as_ref(),
+            )?;
+            response.resume(
+                boundary.instance_id,
+                &state,
+                BoundaryMode::Final,
+            )?
+        }
+        None => response.advance()?,
+    };
 }
 ```
 
-`start` writes through the first occurrence, or completes immediately when the
-selected path has none. `resume` must use the currently pending
-`BoundaryInstanceId`, commits that occurrence, and continues to the next one or
-terminal. The final returned status has `done == true`, no descriptor, and the
-writer already contains the tail and terminal.
+`start` writes the shell prefix through the first descriptor, or completes
+immediately when the selected path has none. `resume` must use the currently
+pending `BoundaryInstanceId` and writes only that occurrence through its
+checkpoint. Its result normally has no descriptor and `done == false`.
+`advance` writes the following parent or shell bytes until the next descriptor
+or terminal. This boundary-only resume lets the host flush an early component
+child independently; no sibling boundary is needed to separate it from the
+parent tail.
+
+The status states are exact: a descriptor requires `resume`; no descriptor with
+`done == false` requires `advance`; `done == true` completes the response. The
+completed status has no descriptor, and the writer already contains the tail
+and terminal.
 
 `WebUIHandler::render_streaming` uses one state value for the complete response:
 it projects and freezes that value once, then resumes each occurrence directly
@@ -259,8 +267,11 @@ public `resume` overlay because hosts may supply newly resolved state for each
 occurrence.
 
 Every descriptor contains `instance_id`, `declaration_id`, `owner`, `name`, and
-an optional string or numeric `key`. A declaration inside a repeated path
-requires a key, and live keys must be unique.
+an optional string or numeric `key`. A component-owned declaration reached from
+multiple static callsites in one entry traversal requires a key, and
+simultaneously live keys must be unique. A boundary-bearing subtree under
+`<for>` is rejected with `boundary-in-repeat`; a complete `<for>` may instead be
+inside one boundary.
 
 To send later state, resume the occurrence as `BoundaryMode::Updatable`, retain
 its instance ID, then call:
@@ -270,7 +281,8 @@ response.update(search_instance, &json!({ "query": "webui" }))?;
 ```
 
 `update` accepts an object patch, emits a projected markerless state record, and
-flushes immediately. It inserts no markup and does not rerun hydration.
+flushes immediately. It is valid between the occurrence's `resume` and
+`advance`, inserts no markup, and does not rerun hydration.
 
 The session borrows each state value only for its call. It does not await,
 allocate a task, or synchronize concurrent callers. An async server should use a
@@ -286,10 +298,11 @@ pub trait FlushWriter: ResponseWriter {
 ```
 
 `render_streaming` and `stream_response` accept a `FlushWriter`;
-`StreamingWriter` implements that trait. Each resumed occurrence is followed by
-its hydration checkpoint and a semantic flush. Generated component span
-completions, state updates, and terminal records also flush. The normal
-`render` method still accepts any `ResponseWriter`.
+`StreamingWriter` implements that trait. `resume` flushes immediately after the
+occurrence's hydration checkpoint. The matching `advance` separately flushes
+the following parent bytes through the next descriptor or terminal. Generated
+component span completions, state updates, and terminal records also flush. The
+normal `render` method still accepts any `ResponseWriter`.
 
 The entry template must load its application module with an early
 `<script type="module" async>` in `<head>`, before boundary content. See
@@ -461,7 +474,8 @@ component.
 |---|---|
 | `WebUIHandler::stream_response(protocol, options, writer)` | Create one progressive response session |
 | `StreamingResponse::start(state)` | Render and flush through the first runtime occurrence or terminal |
-| `StreamingResponse::resume(instance_id, state, mode)` | Commit the pending occurrence and continue |
+| `StreamingResponse::resume(instance_id, state, mode)` | Render and flush only the pending occurrence through its checkpoint |
+| `StreamingResponse::advance()` | Render following parent bytes through the next occurrence or terminal |
 | `StreamingResponse::update(instance_id, patch)` | Send projected object state to a committed updatable occurrence |
 | `StreamingResponse::is_done()` | Report whether terminal and writer end completed |
 
@@ -471,7 +485,7 @@ same language.
 
 When you would rather own the bytes - for example to feed a channel, a test
 harness, or a transport whose writer cannot be borrowed for that long —
-`StreamingSession` offers the same three operations and returns a `Vec<u8>` per
+`StreamingSession` offers the same four operations and returns a `Vec<u8>` per
 call instead:
 
 ```rust
@@ -481,11 +495,19 @@ let mut session = StreamingSession::new(
     SessionOptions::new("index.html", "/"),
 )?;
 let mut step = session.start(&initial_state)?;
-sink.send(step.bytes)?;
-while let Some(boundary) = step.boundary {
-    let state = load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
-    step = session.resume(boundary.instance_id, &state, BoundaryMode::Final)?;
-    sink.send(step.bytes)?;
+loop {
+    sink.send(std::mem::take(&mut step.bytes))?;
+    if step.done {
+        break;
+    }
+    step = match step.boundary.as_ref() {
+        Some(boundary) => {
+            let state =
+                load_state(&boundary.owner, &boundary.name, boundary.key.as_ref())?;
+            session.resume(boundary.instance_id, &state, BoundaryMode::Final)?
+        }
+        None => session.advance()?,
+    };
 }
 ```
 
diff --git a/docs/guide/integrations/wasm.md b/docs/guide/integrations/wasm.md
index bfc36a9b0..916422308 100644
--- a/docs/guide/integrations/wasm.md
+++ b/docs/guide/integrations/wasm.md
@@ -69,17 +69,20 @@ const body = new ReadableStream({
     controller.enqueue(step.bytes);
     while (!step.done) {
       const boundary = step.boundary;
-      if (!boundary) throw new Error('unfinished step has no boundary');
-      const state = await loadBoundaryState(
-        boundary.owner,
-        boundary.name,
-        boundary.key,
-      );
-      step = session.resume(
-        boundary.instanceId,
-        JSON.stringify(state),
-        'final',
-      );
+      if (boundary) {
+        const state = await loadBoundaryState(
+          boundary.owner,
+          boundary.name,
+          boundary.key,
+        );
+        step = session.resume(
+          boundary.instanceId,
+          JSON.stringify(state),
+          'final',
+        );
+      } else {
+        step = session.advance();
+      }
       controller.enqueue(step.bytes);
     }
     controller.close();
@@ -90,12 +93,18 @@ const body = new ReadableStream({
 | Member | Description |
 |--------|-------------|
 | `start(stateJson)` | Return `{ bytes, done, boundary? }` through the first occurrence or terminal |
-| `resume(instanceId, stateJson, mode?)` | Commit the pending occurrence and return the next step |
+| `resume(instanceId, stateJson, mode?)` | Return only the pending occurrence's bytes through its checkpoint |
+| `advance()` | Return following parent bytes through the next occurrence or terminal |
 | `update(instanceId, patchJson)` | Return projected state bytes for an updatable occurrence |
 
 Descriptors contain `instanceId`, `declarationId`, `owner`, `name`, and an
-optional string or numeric `key`. The final step's `Uint8Array` includes tail
-and terminal bytes. The contract is identical on Node, Python, C, and .NET.
+optional string or numeric `key`. A descriptor means `resume`; no descriptor
+with `done: false` means `advance`; `done: true` means complete. `resume`
+returns only the occurrence and checkpoint so it can be enqueued immediately.
+`advance` returns the following parent or tail bytes, with no sibling boundary
+workaround required. An update is valid between `resume` and `advance`. The
+final step's `Uint8Array` includes tail and terminal bytes. The contract is
+identical on Node, Python, C, and .NET.
 
 ## Parser-only API
 
diff --git a/dotnet/src/Microsoft.WebUI/NativeBindings.cs b/dotnet/src/Microsoft.WebUI/NativeBindings.cs
index 57b42e077..ffe1484ab 100644
--- a/dotnet/src/Microsoft.WebUI/NativeBindings.cs
+++ b/dotnet/src/Microsoft.WebUI/NativeBindings.cs
@@ -214,6 +214,10 @@ private static extern IntPtr webui_streaming_session_resume_raw(
         [MarshalAs(UnmanagedType.LPUTF8Str)] string stateJson,
         uint mode);
 
+    [DllImport(LibName, CallingConvention = CallingConvention.Cdecl, EntryPoint = "webui_streaming_session_advance")]
+    private static extern IntPtr webui_streaming_session_advance_raw(
+        WebUIStreamingSessionSafeHandle sessionPtr);
+
     [DllImport(LibName, CallingConvention = CallingConvention.Cdecl)]
     internal static extern IntPtr webui_streaming_session_update(
         WebUIStreamingSessionSafeHandle sessionPtr,
@@ -314,6 +318,13 @@ internal static WebUIStreamingStepSafeHandle ResumeStreamingSession(
         return new WebUIStreamingStepSafeHandle(handle);
     }
 
+    internal static WebUIStreamingStepSafeHandle AdvanceStreamingSession(
+        WebUIStreamingSessionSafeHandle session)
+    {
+        IntPtr handle = webui_streaming_session_advance_raw(session);
+        return new WebUIStreamingStepSafeHandle(handle);
+    }
+
     internal static WebUIHandlerSafeHandle CreateHandler(string? pluginId)
     {
         IntPtr handle = pluginId is null
diff --git a/dotnet/src/Microsoft.WebUI/README.md b/dotnet/src/Microsoft.WebUI/README.md
index fb0ca961f..fcfc1ce07 100644
--- a/dotnet/src/Microsoft.WebUI/README.md
+++ b/dotnet/src/Microsoft.WebUI/README.md
@@ -51,6 +51,47 @@ The response is a JSON string — pipe it directly to the HTTP response. No dese
 payload for on-demand component loading. `protocol.Tokens()` returns CSS token
 names in build order.
 
+## Progressive Streaming
+
+`WebUIHandler.StreamResponse` returns one host-owned, single-driver session:
+
+```csharp
+using var session = handler.StreamResponse(protocol, "index.html", "/");
+StreamingStep step = session.Start(initialStateJson);
+
+while (true)
+{
+    await response.Body.WriteAsync(step.Bytes);
+    await response.Body.FlushAsync();
+    if (step.Done) break;
+
+    if (step.Boundary is BoundaryDescriptor boundary)
+    {
+        string state = await LoadBoundaryStateAsync(boundary);
+        step = session.Resume(
+            boundary.InstanceId,
+            state,
+            BoundaryMode.Final);
+    }
+    else
+    {
+        step = session.Advance();
+    }
+}
+```
+
+| Member | Result |
+|---|---|
+| `Start(stateJson)` | Shell bytes through the first descriptor or terminal |
+| `Resume(instanceId, stateJson, mode)` | Only the pending occurrence's bytes through its checkpoint |
+| `Advance()` | Following parent bytes through the next descriptor or terminal |
+| `Update(instanceId, patchJson)` | Projected state bytes for an updatable occurrence |
+
+A descriptor requires `Resume`; no descriptor with `Done == false` requires
+`Advance`; `Done == true` means complete. `Resume` is boundary-only and
+`Advance` carries following parent or tail bytes, so no sibling boundary is
+needed. `Update` is valid between an occurrence's `Resume` and `Advance`.
+
 ## Installation
 
 ```bash
diff --git a/dotnet/src/Microsoft.WebUI/StreamingSession.cs b/dotnet/src/Microsoft.WebUI/StreamingSession.cs
index 2e5e4d860..700725923 100644
--- a/dotnet/src/Microsoft.WebUI/StreamingSession.cs
+++ b/dotnet/src/Microsoft.WebUI/StreamingSession.cs
@@ -114,7 +114,7 @@ internal BoundaryDescriptor(
 }
 
 /// <summary>
-/// The immutable managed result of one streaming start or resume operation.
+/// The immutable managed result of one streaming start, resume, or advance operation.
 /// </summary>
 public sealed class StreamingStep
 {
@@ -145,9 +145,9 @@ internal StreamingStep(byte[] bytes, bool done, BoundaryDescriptor? boundary)
 /// A progressive HTML response advanced one semantic step at a time.
 /// </summary>
 /// <remarks>
-/// <para><see cref="Start"/> and <see cref="Resume"/> eagerly copy native step
-/// bytes and descriptors into managed objects. The caller owns the transport
-/// and applies its own backpressure.</para>
+/// <para><see cref="Start"/>, <see cref="Resume"/>, and <see cref="Advance"/>
+/// eagerly copy native step bytes and descriptors into managed objects. The
+/// caller owns the transport and applies its own backpressure.</para>
 /// <para>This type is <b>not</b> thread-safe. Drive one session from one request
 /// at a time; independent sessions may run concurrently.</para>
 /// <example>
@@ -158,11 +158,12 @@ internal StreamingStep(byte[] bytes, bool done, BoundaryDescriptor? boundary)
 /// {
 ///     await response.Body.WriteAsync(step.Bytes);
 ///     if (step.Done) break;
-///     BoundaryDescriptor boundary = step.Boundary!;
-///     step = session.Resume(
-///         boundary.InstanceId,
-///         await LoadBoundaryState(boundary),
-///         BoundaryMode.Final);
+///     step = step.Boundary is BoundaryDescriptor boundary
+///         ? session.Resume(
+///             boundary.InstanceId,
+///             await LoadBoundaryState(boundary),
+///             BoundaryMode.Final)
+///         : session.Advance();
 /// }
 /// </code>
 /// </example>
@@ -211,12 +212,15 @@ public StreamingStep Start(string stateJson)
     }
 
     /// <summary>
-    /// Commits the pending occurrence and advances to the next occurrence or terminal.
+    /// Commits the pending occurrence and returns immediately after its checkpoint.
     /// </summary>
     /// <param name="instanceId">The pending descriptor's response-local instance ID.</param>
     /// <param name="stateJson">JSON-encoded state used while rendering this occurrence.</param>
     /// <param name="mode">Whether this occurrence may receive later updates.</param>
-    /// <returns>Produced bytes, completion state, and the next boundary descriptor.</returns>
+    /// <returns>
+    /// The occurrence bytes with no boundary descriptor and <see cref="StreamingStep.Done"/>
+    /// set to <c>false</c>.
+    /// </returns>
     /// <exception cref="ObjectDisposedException">Thrown after disposal.</exception>
     /// <exception cref="ArgumentOutOfRangeException">Thrown for an unknown boundary mode.</exception>
     /// <exception cref="WebUIException">Thrown for a stale ID or rendering failure.</exception>
@@ -241,6 +245,22 @@ public StreamingStep Resume(
             nameof(Resume));
     }
 
+    /// <summary>
+    /// Advances through parent bytes to the next occurrence or terminal completion.
+    /// </summary>
+    /// <returns>Produced bytes, completion state, and the next boundary descriptor.</returns>
+    /// <exception cref="ObjectDisposedException">Thrown after disposal.</exception>
+    /// <exception cref="WebUIException">
+    /// Thrown when called out of order or when rendering fails.
+    /// </exception>
+    public StreamingStep Advance()
+    {
+        ThrowIfDisposed();
+        return TakeStep(
+            NativeBindings.AdvanceStreamingSession(_handle),
+            nameof(Advance));
+    }
+
     /// <summary>
     /// Emits a projected patch for a committed updatable runtime occurrence.
     /// </summary>
diff --git a/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj b/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
index 71006b143..bc4181c15 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
+++ b/dotnet/test/Microsoft.WebUI.Tests/Microsoft.WebUI.Tests.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFrameworks>net8.0;net9.0</TargetFrameworks>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
@@ -23,6 +23,7 @@
     invokes the CLI when the app sources change or the output is missing.
   -->
   <Target Name="BuildFixtureProtocol"
+          Condition="'$(TargetFramework)' != ''"
           BeforeTargets="Build"
           Inputs="fixtures/projection-app/index.html;fixtures/projection-app/kept-widget.html;fixtures/projection-app/kept-widget.ts"
           Outputs="$(OutDir)fixtures/projection-app/protocol.bin">
@@ -32,12 +33,13 @@
   </Target>
 
   <!--
-    Compile the streaming fixture app the same way. Its keyed declaration
-    produces string and numeric runtime occurrences and can be skipped entirely
+    Compile the streaming fixture app the same way. Its static keyed sibling
+    declarations cover string and numeric runtime keys and can both be skipped
     for boundary-free completion. No projection manifest is supplied, so every
     checkpoint falls back to the whole state object.
   -->
   <Target Name="BuildStreamingFixtureProtocol"
+          Condition="'$(TargetFramework)' != ''"
           BeforeTargets="Build"
           Inputs="fixtures/streaming-app/index.html;fixtures/streaming-app/stream-item.html;fixtures/streaming-app/stream-item.ts"
           Outputs="$(OutDir)fixtures/streaming-app/protocol.bin">
diff --git a/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs b/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
index 2b25a6a02..f8f352c59 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
+++ b/dotnet/test/Microsoft.WebUI.Tests/StreamingSessionTests.cs
@@ -11,7 +11,7 @@ namespace Microsoft.WebUI.Tests;
 public class StreamingSessionTests
 {
     private const string StreamingState =
-        """{"show":true,"items":[{"id":"alpha\u0000omega","label":"first"},{"id":7,"label":"second"}]}""";
+        """{"show":true,"stringKey":"alpha\u0000omega","numberKey":7,"firstLabel":"first","secondLabel":"second"}""";
 
     private static byte[] StreamingProtocolBytes() =>
         File.ReadAllBytes(Path.Combine(
@@ -23,7 +23,7 @@ private static byte[] StreamingProtocolBytes() =>
     private static string Text(byte[] chunk) => Encoding.UTF8.GetString(chunk);
 
     [Fact]
-    public void Session_StartResumeAndUpdateExposeTypedDescriptorsAndComplete()
+    public void Session_StartResumeUpdateAndAdvanceExposeTypedDescriptorsAndComplete()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
@@ -34,35 +34,64 @@ public void Session_StartResumeAndUpdateExposeTypedDescriptorsAndComplete()
         BoundaryDescriptor firstBoundary = Assert.IsType<BoundaryDescriptor>(first.Boundary);
         Assert.Equal(0u, firstBoundary.InstanceId);
         Assert.Equal("index.html", firstBoundary.Owner);
-        Assert.Equal("row", firstBoundary.Name);
+        Assert.Equal("string-row", firstBoundary.Name);
         Assert.Equal(BoundaryKeyType.String, firstBoundary.Key.Type);
         Assert.Equal("alpha\0omega", firstBoundary.Key.StringValue);
         Assert.Null(firstBoundary.Key.NumberValue);
 
-        StreamingStep second = session.Resume(
+        StreamingStep firstCommit = session.Resume(
             firstBoundary.InstanceId,
             StreamingState,
             BoundaryMode.Updatable);
+        Assert.False(firstCommit.Done);
+        Assert.Null(firstCommit.Boundary);
+        string firstCommitText = Text(firstCommit.Bytes);
+        Assert.Contains("label=\"first\"", firstCommitText, StringComparison.Ordinal);
+        Assert.DoesNotContain("between-boundaries", firstCommitText, StringComparison.Ordinal);
+        Assert.DoesNotContain("label=\"second\"", firstCommitText, StringComparison.Ordinal);
+        Assert.DoesNotContain("always-complete", firstCommitText, StringComparison.Ordinal);
+
+        byte[] update = session.Update(firstBoundary.InstanceId, """{"firstLabel":"updated"}""");
+        Assert.NotEmpty(update);
+        Assert.Contains(@"""firstLabel"":""updated""", Text(update), StringComparison.Ordinal);
+
+        StreamingStep second = session.Advance();
         Assert.False(second.Done);
         BoundaryDescriptor secondBoundary = Assert.IsType<BoundaryDescriptor>(second.Boundary);
         Assert.Equal(1u, secondBoundary.InstanceId);
-        Assert.Equal(firstBoundary.DeclarationId, secondBoundary.DeclarationId);
+        Assert.NotEqual(firstBoundary.DeclarationId, secondBoundary.DeclarationId);
+        Assert.Equal("number-row", secondBoundary.Name);
         Assert.Equal(BoundaryKeyType.Number, secondBoundary.Key.Type);
         Assert.Null(secondBoundary.Key.StringValue);
         Assert.Equal(7.0, secondBoundary.Key.NumberValue);
+        string secondDiscoveryText = Text(second.Bytes);
+        Assert.Contains("between-boundaries", secondDiscoveryText, StringComparison.Ordinal);
+        Assert.DoesNotContain("label=\"second\"", secondDiscoveryText, StringComparison.Ordinal);
+        Assert.DoesNotContain("always-complete", secondDiscoveryText, StringComparison.Ordinal);
 
-        byte[] update = session.Update(firstBoundary.InstanceId, """{"label":"updated"}""");
-        Assert.NotEmpty(update);
-        Assert.Contains(@"""label"":""updated""", Text(update), StringComparison.Ordinal);
-
-        StreamingStep done = session.Resume(
+        StreamingStep secondCommit = session.Resume(
             secondBoundary.InstanceId,
             StreamingState,
             BoundaryMode.Final);
+        Assert.False(secondCommit.Done);
+        Assert.Null(secondCommit.Boundary);
+        string secondCommitText = Text(secondCommit.Bytes);
+        Assert.Contains("label=\"second\"", secondCommitText, StringComparison.Ordinal);
+        Assert.DoesNotContain("always-complete", secondCommitText, StringComparison.Ordinal);
+        Assert.DoesNotContain("</html>", secondCommitText, StringComparison.OrdinalIgnoreCase);
+
+        StreamingStep done = session.Advance();
         Assert.True(done.Done);
         Assert.Null(done.Boundary);
-
-        string document = Text(first.Bytes) + Text(second.Bytes) + Text(update) + Text(done.Bytes);
+        Assert.Contains("always-complete", Text(done.Bytes), StringComparison.Ordinal);
+
+        string document =
+            Text(first.Bytes) +
+            firstCommitText +
+            Text(update) +
+            secondDiscoveryText +
+            secondCommitText +
+            Text(done.Bytes);
         Assert.StartsWith("<!DOCTYPE html>", document, StringComparison.OrdinalIgnoreCase);
         Assert.Contains("first", document, StringComparison.Ordinal);
         Assert.Contains("second", document, StringComparison.Ordinal);
@@ -77,7 +106,7 @@ public void Session_BoundaryFreeStateCompletesFromStart()
         using var handler = new WebUIHandler("webui");
         using StreamingSession session = handler.StreamResponse(protocol, "index.html", "/");
 
-        StreamingStep step = session.Start("""{"show":false,"items":[]}""");
+        StreamingStep step = session.Start("""{"show":false}""");
 
         Assert.True(step.Done);
         Assert.Null(step.Boundary);
@@ -85,7 +114,7 @@ public void Session_BoundaryFreeStateCompletesFromStart()
     }
 
     [Fact]
-    public void Session_StaleResumeThrowsAndLeavesPendingBoundaryUsable()
+    public void Session_OutOfOrderCallsThrowAndLeavePendingBoundaryUsable()
     {
         using var protocol = new Protocol(StreamingProtocolBytes());
         using var handler = new WebUIHandler("webui");
@@ -94,11 +123,17 @@ public void Session_StaleResumeThrowsAndLeavesPendingBoundaryUsable()
         StreamingStep first = session.Start(StreamingState);
         BoundaryDescriptor boundary = Assert.IsType<BoundaryDescriptor>(first.Boundary);
 
+        WebUIException advanceError = Assert.Throws<WebUIException>(() => session.Advance());
+        Assert.Contains("no committed boundary", advanceError.Message, StringComparison.OrdinalIgnoreCase);
+
         WebUIException error = Assert.Throws<WebUIException>(() =>
             session.Resume(99, StreamingState));
         Assert.Contains("stale", error.Message, StringComparison.OrdinalIgnoreCase);
 
-        StreamingStep second = session.Resume(boundary.InstanceId, StreamingState);
+        StreamingStep commit = session.Resume(boundary.InstanceId, StreamingState);
+        Assert.False(commit.Done);
+        Assert.Null(commit.Boundary);
+        StreamingStep second = session.Advance();
         Assert.NotNull(second.Boundary);
     }
 
@@ -111,13 +146,19 @@ public void Session_UpdateToFinalBoundaryThrows()
 
         BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
             session.Start(StreamingState).Boundary);
-        StreamingStep secondStep = session.Resume(first.InstanceId, StreamingState);
-        BoundaryDescriptor second = Assert.IsType<BoundaryDescriptor>(secondStep.Boundary);
+        StreamingStep firstCommit = session.Resume(first.InstanceId, StreamingState);
+        Assert.False(firstCommit.Done);
+        Assert.Null(firstCommit.Boundary);
 
         Assert.Throws<WebUIException>(() =>
             session.Update(first.InstanceId, """{"label":"ignored"}"""));
 
-        Assert.True(session.Resume(second.InstanceId, StreamingState).Done);
+        StreamingStep secondStep = session.Advance();
+        BoundaryDescriptor second = Assert.IsType<BoundaryDescriptor>(secondStep.Boundary);
+        StreamingStep secondCommit = session.Resume(second.InstanceId, StreamingState);
+        Assert.False(secondCommit.Done);
+        Assert.Null(secondCommit.Boundary);
+        Assert.True(session.Advance().Done);
     }
 
     [Fact]
@@ -169,13 +210,20 @@ public void Session_CallAfterDoneThrows()
 
         BoundaryDescriptor first = Assert.IsType<BoundaryDescriptor>(
             session.Start(StreamingState).Boundary);
+        StreamingStep firstCommit = session.Resume(first.InstanceId, StreamingState);
+        Assert.False(firstCommit.Done);
+        Assert.Null(firstCommit.Boundary);
         BoundaryDescriptor second = Assert.IsType<BoundaryDescriptor>(
-            session.Resume(first.InstanceId, StreamingState).Boundary);
-        Assert.True(session.Resume(second.InstanceId, StreamingState).Done);
+            session.Advance().Boundary);
+        StreamingStep secondCommit = session.Resume(second.InstanceId, StreamingState);
+        Assert.False(secondCommit.Done);
+        Assert.Null(secondCommit.Boundary);
+        Assert.True(session.Advance().Done);
 
         Assert.Throws<WebUIException>(() => session.Start(StreamingState));
         Assert.Throws<WebUIException>(() =>
             session.Resume(second.InstanceId, StreamingState));
+        Assert.Throws<WebUIException>(() => session.Advance());
     }
 
     [Fact]
@@ -188,13 +236,15 @@ public void Session_ConcurrentSessionsAreIndependent()
 
         BoundaryDescriptor firstA = Assert.IsType<BoundaryDescriptor>(
             a.Start(StreamingState).Boundary);
+        string stateB = StreamingState.Replace(
+            @"""first""",
+            @"""from-b""",
+            StringComparison.Ordinal);
         BoundaryDescriptor firstB = Assert.IsType<BoundaryDescriptor>(
-            b.Start(StreamingState.Replace("first", "from-b", StringComparison.Ordinal)).Boundary);
+            b.Start(stateB).Boundary);
 
         string chunkA = Text(a.Resume(firstA.InstanceId, StreamingState).Bytes);
-        string chunkB = Text(b.Resume(
-            firstB.InstanceId,
-            StreamingState.Replace("first", "from-b", StringComparison.Ordinal)).Bytes);
+        string chunkB = Text(b.Resume(firstB.InstanceId, stateB).Bytes);
 
         Assert.Contains("first", chunkA, StringComparison.Ordinal);
         Assert.DoesNotContain("from-b", chunkA, StringComparison.Ordinal);
@@ -225,6 +275,7 @@ public void Session_UseAfterDisposeThrowsObjectDisposedException()
         session.Dispose();
 
         Assert.Throws<ObjectDisposedException>(() => session.Start(StreamingState));
+        Assert.Throws<ObjectDisposedException>(() => session.Advance());
         Assert.Throws<ObjectDisposedException>(() => session.Update(0, "{}"));
     }
 
diff --git a/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html b/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
index c2623169f..e8a859041 100644
--- a/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
+++ b/dotnet/test/Microsoft.WebUI.Tests/fixtures/streaming-app/index.html
@@ -7,11 +7,13 @@
   </head>
   <body>
     <if condition="show">
-      <for each="item in items">
-        <boundary name="row" key="{{item.id}}">
-          <stream-item label="{{item.label}}"></stream-item>
-        </boundary>
-      </for>
+      <boundary name="string-row" key="{{stringKey}}">
+        <stream-item label="{{firstLabel}}"></stream-item>
+      </boundary>
+      <p>between-boundaries</p>
+      <boundary name="number-row" key="{{numberKey}}">
+        <stream-item label="{{secondLabel}}"></stream-item>
+      </boundary>
     </if>
     <p>always-complete</p>
   </body>
diff --git a/examples/app/service-worker/README.md b/examples/app/service-worker/README.md
index 7f9473bb0..2011bd1da 100644
--- a/examples/app/service-worker/README.md
+++ b/examples/app/service-worker/README.md
@@ -12,9 +12,10 @@ The browser loads only static assets:
 
 No application server is required. The service worker fetches public API state,
 constructs one `webui_wasm_handler.Protocol`, opens a
-`Protocol.streamResponse()` session, and enqueues every `start()` / `resume()`
-step into a `ReadableStream`. API fetches run concurrently, while each resume
-uses the runtime descriptor returned by the previous `StreamStep`.
+`Protocol.streamResponse()` session, and enqueues every `start()`, `resume()`,
+and `advance()` step into a `ReadableStream`. API fetches run concurrently,
+while each resume uses the runtime descriptor returned by the previous
+descriptor-bearing `StreamStep`.
 
 Because the example renders public API data, the service worker validates URL
 fields before calling the handler. Keep that boundary in copied code so
@@ -91,8 +92,13 @@ from public APIs. The serverless edge path can be:
 2. Browser service worker loads `protocol.bin`.
 3. Public APIs return JSON state concurrently.
 4. `start()` returns the first pending boundary descriptor.
-5. The worker resumes each descriptor with its matching state and streams the
-   returned bytes to the page; the final resume emits the terminal automatically.
+5. The worker calls `resume()` for a descriptor, `advance()` for a step with
+   neither a descriptor nor `done`, and stops when `done` is true.
+
+`resume()` enqueues only the resolved occurrence through its checkpoint.
+`advance()` enqueues following parent or tail bytes through the next descriptor
+or terminal. The final `advance()` emits the terminal, and no sibling boundary
+is needed to split a checkpoint from its parent tail.
 
 ## Source layout
 
diff --git a/examples/app/service-worker/scripts/check-render.ts b/examples/app/service-worker/scripts/check-render.ts
index 43a49524a..3875a74c6 100644
--- a/examples/app/service-worker/scripts/check-render.ts
+++ b/examples/app/service-worker/scripts/check-render.ts
@@ -52,10 +52,12 @@ let html = "";
 let step = session.start("{}") as WasmStreamStep;
 html += decoder.decode(step.bytes);
 while (!step.done) {
-  const boundary = step.boundary;
-  if (!boundary) {
-    throw new Error("Streaming session returned no pending boundary");
+  if (!step.boundary) {
+    step = session.advance() as WasmStreamStep;
+    html += decoder.decode(step.bytes);
+    continue;
   }
+  const boundary = step.boundary;
   const payload = payloads.get(boundary.name);
   if (!payload || boundary.owner !== "index.html") {
     throw new Error(`Unexpected boundary ${boundary.owner}/${boundary.name}`);
diff --git a/examples/app/service-worker/src/service-worker.ts b/examples/app/service-worker/src/service-worker.ts
index e8f1e4969..75b7755fa 100644
--- a/examples/app/service-worker/src/service-worker.ts
+++ b/examples/app/service-worker/src/service-worker.ts
@@ -73,6 +73,11 @@ async function streamHtml(controller: ReadableStreamDefaultController<Uint8Array
   let step = session.start('{}');
   controller.enqueue(step.bytes);
   while (!step.done) {
+    if (!step.boundary) {
+      step = session.advance();
+      controller.enqueue(step.bytes);
+      continue;
+    }
     const boundary = pendingBoundary(step);
     const result = await pending.get(boundary.name);
     if (!result) {
diff --git a/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts b/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
index d7ffbe313..3bfecb290 100644
--- a/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
+++ b/examples/app/service-worker/src/wasm/handler/webui_wasm_handler.d.ts
@@ -38,5 +38,6 @@ export interface StreamStep {
 export class StreamingSession {
   start(stateJson: string): StreamStep;
   resume(instanceId: number, stateJson: string, mode?: 'final' | 'updatable'): StreamStep;
+  advance(): StreamStep;
   update(instanceId: number, stateJson: string): Uint8Array;
 }
diff --git a/examples/app/streaming/README.md b/examples/app/streaming/README.md
index ed88d7522..88a836dbf 100644
--- a/examples/app/streaming/README.md
+++ b/examples/app/streaming/README.md
@@ -14,7 +14,8 @@ batch's `feed-item` islands hydrating independently as their own
 `<boundary>` commits. The document entry contains only one
 `<streaming-page>` host. Its component template owns all five boundaries, so
 the composer becomes interactive before the parent page's final tail and span
-completion arrive.
+completion arrive. Each declaration is static; no boundary executes from a
+`<for>` body.
 
 ```bash
 # Install JS dependencies
@@ -48,8 +49,9 @@ The Node API feed gaps are bounded by `--feed-delay-min-ms` (500) and
 `--feed-delay-max-ms` (1000) and are re-rolled per request, so repeated loads
 do not look mechanically identical. The forecast resolves independently, so its
 state record can appear between any two feed checkpoints. If it is still
-pending at the last gap, the API sends the update before the final resume,
-because that resume completes the session and closes its update window:
+pending at the last gap, the API sends the update before the resume control for
+the final descriptor, because the CLI follows that boundary-only resume with
+the final `advance`, which completes the session:
 
 ```bash
 pnpm start:api -- --feed-delay-min-ms 200 --feed-delay-max-ms 400
@@ -72,10 +74,17 @@ typed key. The one-way channel has no acknowledgement carrying instance IDs, so
 the CLI validates that selector against the current `StreamStep`, remembers the
 committed descriptor-to-instance mapping for later updates, and rejects stale or
 ambiguous targets. `declarationId` may be included as an extra validation field.
-The final `resume` returns `done`, writes the terminal automatically, and the API
-closes its NDJSON body; there is no finish control. A capacity-one command
-channel and Node's `response.write()` / `drain` contract propagate backpressure
-across the loopback bridge.
+Core `resume` writes only that occurrence through its checkpoint. The CLI then
+calls core `advance` to write following parent bytes through the next
+descriptor or terminal. The backend sends no `advance` control. After it sends
+the resume for the final descriptor, it closes its NDJSON body; the CLI's final
+`advance` writes the tail and terminal. A capacity-one command channel and
+Node's `response.write()` / `drain` contract propagate backpressure across the
+loopback bridge.
+
+This split is why the component-local composer needs no synthetic sibling
+boundary. Its resume step can flush the child checkpoint, and advance later
+writes the unfinished parent tail and span completion.
 
 **This is one of two supported topologies.** This example uses the
 **API-proxy** topology, which is the right fit when you want the CLI to own
@@ -194,8 +203,9 @@ by the application bundle, not by CSS. See
 `server/src/pacing.ts` races weather readiness against each feed delay and
 writes controls in completion order. `server/src/stream-protocol.ts` emits one
 record per semantic write, honors Node HTTP backpressure, and closes the body
-after the final resume. The API caps concurrent admitted streams before sending
-a 200 response.
+after the resume control for the final descriptor. The CLI then performs the
+final advance. The API caps concurrent admitted streams before sending a 200
+response.
 
 Inside `webui serve`, one blocking worker owns the real
 `WebUIHandler::stream_response` and `StreamingWriter` for the response
diff --git a/examples/app/streaming/server/src/pacing.test.ts b/examples/app/streaming/server/src/pacing.test.ts
index fe29c66eb..d9f6f95f0 100644
--- a/examples/app/streaming/server/src/pacing.test.ts
+++ b/examples/app/streaming/server/src/pacing.test.ts
@@ -98,7 +98,7 @@ test('ready weather can arrive between feed boundaries', async () => {
   );
 });
 
-test('a late weather update is sent before the final resume completes the stream', async () => {
+test('a late weather update is sent before the final boundary control closes the stream', async () => {
   const controls = new TestControls();
   const session = controls.session('late-weather');
   assert.ok(session);
diff --git a/examples/app/streaming/server/src/stream-protocol.ts b/examples/app/streaming/server/src/stream-protocol.ts
index b7248370a..0ab941deb 100644
--- a/examples/app/streaming/server/src/stream-protocol.ts
+++ b/examples/app/streaming/server/src/stream-protocol.ts
@@ -37,6 +37,10 @@ type StreamRecord =
     }
   | { type: 'update'; boundary: BoundaryTarget; state: JsonObject };
 
+/**
+ * Backend controls intentionally omit `advance`: the CLI advances its Rust
+ * session after intervening updates, before the next resume or at stream EOF.
+ */
 export interface StreamSink {
   start(state: JsonObject): Promise<void>;
   resume(
diff --git a/examples/integration/node/README.md b/examples/integration/node/README.md
index a257f841d..75cd5bd78 100644
--- a/examples/integration/node/README.md
+++ b/examples/integration/node/README.md
@@ -70,12 +70,16 @@ await write(res, step.bytes);
 const status = step.boundary; // runtime descriptor discovered by start()
 step = session.resume(status.instanceId, statusState, 'updatable');
 await write(res, step.bytes);
-// ... later, on the same response:
+// The checkpoint is committed, but parent bytes have not advanced yet.
 await write(res, session.update(status.instanceId, { jobState: 'succeeded' }));
 
 while (!step.done) {
   const boundary = step.boundary;
-  step = session.resume(boundary.instanceId, await stateFor(boundary));
+  if (boundary) {
+    step = session.resume(boundary.instanceId, await stateFor(boundary));
+  } else {
+    step = session.advance();
+  }
   await write(res, step.bytes);
 }
 res.end();
@@ -108,12 +112,13 @@ client to see the chunk timing:
 
 ```
 status 200 at   7 ms
-step 1             start (<head> ships before any work finishes)
-step 2             resume job-status as updatable
-step 3             resume log batch 1
-step 4             resume log batch 2
-update             patch job-status on this same response
-step 5             resume log batch 3 and emit the terminal automatically
+start              <head> ships and job-status is discovered
+resume             commit job-status only, as updatable
+update             patch job-status before advancing its parent
+advance            write parent bytes and discover log batch 1
+resume / advance   commit log batch 1, then discover log batch 2
+resume / advance   commit log batch 2, then discover log batch 3
+resume / advance   commit log batch 3, then write the tail and terminal
 ```
 
 The update is the interesting one: the slow job finishes *after* its boundary was
@@ -122,7 +127,15 @@ record instead of forcing a client-side fetch or replacing DOM.
 
 The host never resolves authored names before `start()`. Every runtime
 descriptor comes from the preceding `StreamStep`, which also covers boundaries
-discovered through loops, routes, conditions, or component templates.
+discovered through routes, conditions, or component templates. A
+boundary-bearing subtree under `<for>` fails with `boundary-in-repeat`; a whole
+`<for>` may sit inside one boundary.
+
+The state machine has no ambiguous unfinished step: a descriptor means
+`resume`, neither a descriptor nor `done` means `advance`, and `done` means
+complete. Boundary-only `resume` makes each checkpoint independently writable.
+`advance` carries the following parent or tail bytes, so no sibling boundary is
+needed.
 
 ### Scope
 
@@ -131,6 +144,6 @@ updates, and backpressure. Its components are scriptless, so hydration comes
 from the framework's streaming entry loaded straight from
 `@microsoft/webui-framework`, with no bundler step.
 
-For the full picture — interactive islands, boundary-carried module loading,
-`modulepreload` scheduling, and the measured performance story — see
+For the full picture - interactive islands, boundary-carried module loading,
+`modulepreload` scheduling, and the measured performance story - see
 [`examples/app/streaming`](../../app/streaming/README.md).
diff --git a/examples/integration/node/streaming-server.js b/examples/integration/node/streaming-server.js
index e84adc679..da4213582 100644
--- a/examples/integration/node/streaming-server.js
+++ b/examples/integration/node/streaming-server.js
@@ -84,9 +84,9 @@ async function handleRequest(request, response) {
 /**
  * Render one progressive response, one chunk per call.
  *
- * `start()` discovers the first runtime occurrence. Every `resume()` uses the
- * descriptor returned by the previous step, so loops, conditions, component
- * boundaries, and routes need no pre-resolved name table.
+ * `start()` discovers the first runtime occurrence. `resume()` commits only
+ * that occurrence, and `advance()` writes the following parent bytes while
+ * discovering the next descriptor, so runtime paths need no name table.
  */
 async function streamPage(response) {
   const session = protocol.streamResponse({ entry: "index.html", requestPath: "/" });
@@ -134,6 +134,8 @@ async function streamPage(response) {
       await write(response, session.update(jobStatus.instanceId, await job));
       jobPending = false;
     }
+    step = session.advance();
+    await write(response, step.bytes);
     const boundary = pendingBoundary(step, `log-batch-${index + 1}`);
     step = session.resume(boundary.instanceId, {
       [`batch${index + 1}`]: LOG_BATCHES[index],
@@ -141,8 +143,10 @@ async function streamPage(response) {
     await write(response, step.bytes);
   }
 
+  step = session.advance();
+  await write(response, step.bytes);
   if (!step.done) {
-    throw new Error("streaming session did not complete after the final log batch");
+    throw new Error("streaming session did not complete after advancing the final log batch");
   }
   response.end();
 }
diff --git a/examples/integration/rust/README.md b/examples/integration/rust/README.md
index ddee92d02..317082ae5 100644
--- a/examples/integration/rust/README.md
+++ b/examples/integration/rust/README.md
@@ -25,9 +25,11 @@ cursor API directly:
 cargo run -- streaming-protocol.bin state.json --plugin=webui --streaming
 ```
 
-The example calls `StreamingResponse::start()`, then resumes each
-`BoundaryDescriptor::instance_id` returned by the preceding step. The final
-resume emits the terminal automatically when `StreamStatus::done` becomes true;
-there is no separate finish call. Real servers can commit an occurrence as
-`BoundaryMode::Updatable` and call `update(instance_id, patch)` before the final
-step.
+The example calls `StreamingResponse::start()`, then follows the step state
+exactly: a descriptor requires `resume`, no descriptor with `done == false`
+requires `advance`, and `done == true` completes the response. `resume` emits
+only that boundary through its checkpoint. `advance` emits the following parent
+or tail bytes through the next descriptor or terminal, so no sibling boundary
+is needed. The final `advance` emits the terminal; there is no separate finish
+call. Real servers can commit an occurrence as `BoundaryMode::Updatable` and
+call `update(instance_id, patch)` between its `resume` and `advance`.
diff --git a/examples/integration/rust/src/main.rs b/examples/integration/rust/src/main.rs
index f5a874d0a..932f21555 100644
--- a/examples/integration/rust/src/main.rs
+++ b/examples/integration/rust/src/main.rs
@@ -104,16 +104,17 @@ fn render_streaming(
         .context("Failed to open streaming session")?;
     let mut step = session.start(state).context("Failed to start stream")?;
     while !step.done {
-        let boundary = step
-            .boundary
-            .as_ref()
-            .context("Streaming step is unfinished but has no boundary descriptor")?;
-        let instance_id = boundary.instance_id;
-        let owner = boundary.owner.clone();
-        let name = boundary.name.clone();
-        step = session
-            .resume(instance_id, state, BoundaryMode::Final)
-            .with_context(|| format!("Failed to resume boundary {owner}/{name}"))?;
+        step = match step.boundary.as_ref() {
+            Some(boundary) => {
+                let instance_id = boundary.instance_id;
+                let owner = boundary.owner.clone();
+                let name = boundary.name.clone();
+                session
+                    .resume(instance_id, state, BoundaryMode::Final)
+                    .with_context(|| format!("Failed to resume boundary {owner}/{name}"))?
+            }
+            None => session.advance().context("Failed to advance stream")?,
+        };
     }
     Ok(())
 }
diff --git a/packages/webui-framework/README.md b/packages/webui-framework/README.md
index 7b90e0b2b..39875f8d3 100644
--- a/packages/webui-framework/README.md
+++ b/packages/webui-framework/README.md
@@ -200,10 +200,14 @@ authored `<boundary>` directives through
 normal applications pay no streaming bundle or initialization cost.
 
 Boundaries may be authored in entries and reusable components, including
-runtime conditions, loops, outlets, and selected routes. A component-local
-boundary uses a generated parent span, so an early compiler-marked child can
-hydrate before the opaque parent tail in light or shadow DOM. Authored
-boundaries cannot nest.
+runtime conditions, outlets, and selected routes. A boundary-bearing subtree
+reached from a `<for>` body fails the build with `boundary-in-repeat`. A whole
+`<for>` may sit inside one boundary, and boundaries before or after a `<for>`
+are valid. A component-local boundary uses a generated parent span, so an early
+compiler-marked child can hydrate before the opaque parent tail in light or
+shadow DOM. The server's boundary-only `resume` emits that checkpoint first;
+`advance` emits the following parent tail, with no sibling boundary workaround.
+Authored boundaries cannot nest.
 
 Span resolution is entirely coordinator-owned: the generated `data-ws-span` and
 `data-ws-enclosing` attributes, and the open-span registry that pairs them, live
diff --git a/packages/webui/README.md b/packages/webui/README.md
index 0dd9b3e32..608ea7169 100644
--- a/packages/webui/README.md
+++ b/packages/webui/README.md
@@ -180,13 +180,16 @@ await write(res, step.bytes);
 
 while (!step.done) {
   const boundary = step.boundary;
-  if (!boundary) throw new Error('unfinished step has no boundary');
-  const state = await loadBoundaryState(
-    boundary.owner,
-    boundary.name,
-    boundary.key,
-  );
-  step = session.resume(boundary.instanceId, state, 'final');
+  if (boundary) {
+    const state = await loadBoundaryState(
+      boundary.owner,
+      boundary.name,
+      boundary.key,
+    );
+    step = session.resume(boundary.instanceId, state, 'final');
+  } else {
+    step = session.advance();
+  }
   await write(res, step.bytes);
 }
 res.end();
@@ -213,13 +216,18 @@ async function write(res, chunk) {
 | Member | Returns | Description |
 |--------|---------|-------------|
 | `start(state)` | `StreamStep` | Bytes through the first occurrence or terminal |
-| `resume(instanceId, state, mode?)` | `StreamStep` | Commit the pending occurrence and continue (`'final'` \| `'updatable'`) |
+| `resume(instanceId, state, mode?)` | `StreamStep` | Only the pending occurrence's bytes through its checkpoint (`'final'` \| `'updatable'`) |
+| `advance()` | `StreamStep` | Following parent bytes through the next occurrence or terminal |
 | `update(instanceId, patch)` | `Buffer` | Projected state for a committed updatable occurrence |
 
 `StreamStep` contains `bytes`, `done`, and optional
-`{ instanceId, declarationId, owner, name, key }`. The completed step already
-contains tail and terminal bytes. Updates insert no markup and never rerun
-hydration. Sessions are single-driver and independent; hold one per request.
+`{ instanceId, declarationId, owner, name, key }`. A descriptor requires
+`resume`; no descriptor with `done: false` requires `advance`; `done: true`
+means complete. `resume` is boundary-only, while `advance` carries following
+parent or tail bytes. No sibling boundary workaround is required. The completed
+step already contains tail and terminal bytes. Updates are valid between
+`resume` and `advance`, insert no markup, and never rerun hydration. Sessions
+are single-driver and independent; hold one per request.
 
 ### `inspect(protocol: Buffer): string`
 
diff --git a/packages/webui/src/index.ts b/packages/webui/src/index.ts
index 649106c7d..945b49415 100644
--- a/packages/webui/src/index.ts
+++ b/packages/webui/src/index.ts
@@ -106,17 +106,17 @@ export interface BoundaryDescriptor {
   owner: string;
   /** Free-form authored boundary name. */
   name: string;
-  /** Evaluated repeat key, preserving its authored JSON type. */
+  /** Evaluated boundary key, preserving its authored JSON type. */
   key?: string | number;
 }
 
-/** Bytes and continuation state produced by `start()` and `resume()`. */
+/** Bytes and continuation state produced by a streaming session step. */
 export interface StreamStep {
   /** Complete bytes produced by this semantic step. */
   bytes: Buffer;
   /** Whether the document tail and terminal record have been emitted. */
   done: boolean;
-  /** Next runtime boundary occurrence, absent when `done` is true. */
+  /** Runtime occurrence waiting for `resume()`, present only at a boundary. */
   boundary?: BoundaryDescriptor;
 }
 
@@ -215,6 +215,7 @@ interface NativeProtocol {
 interface NativeStreamingSession {
   start(stateJson: string): NativeStreamStep;
   resume(instanceId: number, stateJson: string, mode?: BoundaryMode): NativeStreamStep;
+  advance(): NativeStreamStep;
   update(instanceId: number, patchJson: string): Buffer;
 }
 
@@ -393,10 +394,10 @@ export class Protocol {
  * caller decides when they reach the socket and can await `drain` between
  * chunks. The session holds no transport and never blocks on one.
  *
- * `start()` discovers the first runtime occurrence. Each `resume()` commits the
- * pending occurrence and discovers the next one, or returns a completed step
- * containing the document tail and terminal record. `update()` targets a
- * previously committed `updatable` occurrence.
+ * `start()` discovers the first runtime occurrence. Each `resume()` commits
+ * only the pending occurrence. An optional `update()` may follow for an
+ * `updatable` occurrence, then `advance()` discovers the next occurrence or
+ * returns the document tail and terminal record.
  *
  * ```js
  * const session = protocol.streamResponse({ requestPath: req.url });
@@ -408,6 +409,8 @@ export class Protocol {
  *   const state = await loadBoundary(boundary.owner, boundary.name, boundary.key);
  *   step = session.resume(boundary.instanceId, state);
  *   res.write(step.bytes);
+ *   step = session.advance();
+ *   res.write(step.bytes);
  * }
  * res.end();
  * ```
@@ -425,7 +428,7 @@ export class StreamingSession {
     return toStreamStep(this.#native.start(toStateJson(state)));
   }
 
-  /** Commit the pending occurrence and advance to the next one or terminal. */
+  /** Commit the pending occurrence through its checkpoint, then stop. */
   resume(
     instanceId: number,
     state: object | string,
@@ -434,6 +437,11 @@ export class StreamingSession {
     return toStreamStep(this.#native.resume(instanceId, toStateJson(state), mode));
   }
 
+  /** Write following parent bytes and discover the next boundary or terminal. */
+  advance(): StreamStep {
+    return toStreamStep(this.#native.advance());
+  }
+
   /** Push a projected state patch to a committed `updatable` occurrence. */
   update(instanceId: number, patch: object | string): Buffer {
     return this.#native.update(instanceId, toStateJson(patch));
diff --git a/packages/webui/test/integration.test.ts b/packages/webui/test/integration.test.ts
index d0c0fd042..69f68382f 100644
--- a/packages/webui/test/integration.test.ts
+++ b/packages/webui/test/integration.test.ts
@@ -76,22 +76,26 @@ before(() => {
   <boundary name="first">
     <stream-item label="{{firstLabel}}"></stream-item>
   </boundary>
+  <p>between</p>
   <boundary name="second">
     <stream-item label="{{secondLabel}}"></stream-item>
   </boundary>
 </body>
 </html>
 `);
-  writeFileSync(join(appDir, 'index-stream-repeat.html'), `
+  writeFileSync(join(appDir, 'index-stream-keys.html'), `
 <!DOCTYPE html>
 <html>
 <head><script type="module" async src="./index.js"></script></head>
 <body>
-  <for each="item in items">
-    <boundary name="row" key="{{item.id}}">
-      <stream-item label="{{item.label}}"></stream-item>
-    </boundary>
-  </for>
+  <boundary name="string-key" key="{{stringId}}">
+    <stream-item label="{{firstLabel}}"></stream-item>
+  </boundary>
+  <p>between</p>
+  <boundary name="number-key" key="{{numberId}}">
+    <stream-item label="{{secondLabel}}"></stream-item>
+  </boundary>
+  <footer>tail</footer>
 </body>
 </html>
 `);
@@ -299,24 +303,46 @@ describe('streamResponse', () => {
     assert.equal(boundary.key, undefined);
   });
 
-  test('resume discovers the next boundary and returns a completed final step', () => {
+  test('resume stops at the checkpoint and advance discovers the next boundary', () => {
     const session = streamingProtocol().streamResponse(streamOptions);
     const start = session.start({});
     const first = boundaryOf(start);
-    const next = session.resume(first.instanceId, { firstLabel: 'alpha' });
+    const resumedFirst = session.resume(first.instanceId, { firstLabel: 'alpha' });
+    assert.ok(Buffer.isBuffer(resumedFirst.bytes));
+    assert.equal(resumedFirst.done, false);
+    assert.equal(resumedFirst.boundary, undefined);
+    assert.match(resumedFirst.bytes.toString('utf8'), /alpha/);
+    assert.doesNotMatch(resumedFirst.bytes.toString('utf8'), /second/);
+
+    const next = session.advance();
     const second = boundaryOf(next);
 
     assert.ok(Buffer.isBuffer(next.bytes));
     assert.equal(next.done, false);
     assert.equal(second.instanceId, 1);
     assert.equal(second.name, 'second');
+    assert.match(next.bytes.toString('utf8'), /between/);
+    assert.doesNotMatch(next.bytes.toString('utf8'), /beta/);
 
-    const done = session.resume(second.instanceId, { secondLabel: 'beta' });
+    const resumedSecond = session.resume(second.instanceId, { secondLabel: 'beta' });
+    assert.ok(Buffer.isBuffer(resumedSecond.bytes));
+    assert.equal(resumedSecond.done, false);
+    assert.equal(resumedSecond.boundary, undefined);
+    assert.match(resumedSecond.bytes.toString('utf8'), /beta/);
+    assert.doesNotMatch(resumedSecond.bytes.toString('utf8'), /<\/html>/);
+
+    const done = session.advance();
     assert.ok(Buffer.isBuffer(done.bytes));
     assert.equal(done.done, true);
     assert.equal(done.boundary, undefined);
 
-    const html = Buffer.concat([start.bytes, next.bytes, done.bytes]).toString('utf8');
+    const html = Buffer.concat([
+      start.bytes,
+      resumedFirst.bytes,
+      next.bytes,
+      resumedSecond.bytes,
+      done.bytes,
+    ]).toString('utf8');
     assert.ok(html.includes('<!DOCTYPE html>'));
     assert.ok(html.includes('alpha'));
     assert.ok(html.includes('beta'));
@@ -324,42 +350,55 @@ describe('streamResponse', () => {
     assert.ok(html.includes('</html>'));
   });
 
-  test('preserves string and number repeat keys', () => {
-    const entry = 'index-stream-repeat.html';
+  test('preserves string and number keys on static sibling occurrences', () => {
+    const entry = 'index-stream-keys.html';
     const session = streamingProtocol(entry).streamResponse({
       entry,
       requestPath: '/',
     });
     const state = {
-      items: [
-        { id: 'alpha', label: 'first' },
-        { id: 20, label: 'second' },
-      ],
+      stringId: 'alpha',
+      firstLabel: 'first',
+      numberId: 20,
+      secondLabel: 'second',
     };
 
     const start = session.start(state);
     const first = boundaryOf(start);
     assert.equal(first.key, 'alpha');
 
-    const next = session.resume(first.instanceId, {});
+    const resumedFirst = session.resume(first.instanceId, state);
+    assert.equal(resumedFirst.done, false);
+    assert.equal(resumedFirst.boundary, undefined);
+    assert.doesNotMatch(resumedFirst.bytes.toString('utf8'), /between/);
+
+    const next = session.advance();
     const second = boundaryOf(next);
     assert.equal(second.instanceId, 1);
-    assert.equal(second.declarationId, first.declarationId);
+    assert.notEqual(second.declarationId, first.declarationId);
     assert.equal(second.key, 20);
+    assert.match(next.bytes.toString('utf8'), /between/);
 
-    const done = session.resume(second.instanceId, {});
+    const resumedSecond = session.resume(second.instanceId, state);
+    assert.equal(resumedSecond.done, false);
+    assert.equal(resumedSecond.boundary, undefined);
+    assert.doesNotMatch(resumedSecond.bytes.toString('utf8'), /tail/);
+    const done = session.advance();
     assert.equal(done.done, true);
+    assert.match(done.bytes.toString('utf8'), /tail/);
   });
 
   test('updates a committed updatable occurrence', () => {
     const session = streamingProtocol().streamResponse(streamOptions);
     const start = session.start({});
     const first = boundaryOf(start);
-    const next = session.resume(
+    const resumed = session.resume(
       first.instanceId,
       { firstLabel: 'alpha' },
       'updatable',
     );
+    assert.equal(resumed.done, false);
+    assert.equal(resumed.boundary, undefined);
     const update = session.update(first.instanceId, {
       firstLabel: 'alpha-2',
     });
@@ -367,11 +406,35 @@ describe('streamResponse', () => {
     assert.ok(Buffer.isBuffer(update));
     assert.match(update.toString('utf8'), /alpha-2/);
 
+    const next = session.advance();
     const second = boundaryOf(next);
-    const done = session.resume(second.instanceId, { secondLabel: 'beta' });
+    const resumedSecond = session.resume(second.instanceId, { secondLabel: 'beta' });
+    assert.equal(resumedSecond.done, false);
+    assert.equal(resumedSecond.boundary, undefined);
+    const done = session.advance();
     assert.equal(done.done, true);
   });
 
+  test('rejects advance before a boundary has been resumed', () => {
+    const session = streamingProtocol().streamResponse(streamOptions);
+    assert.throws(
+      () => session.advance(),
+      /start must be called before this operation/,
+    );
+
+    const start = session.start({});
+    assert.throws(
+      () => session.advance(),
+      /there is no committed boundary to advance past/,
+    );
+
+    const first = boundaryOf(start);
+    const resumed = session.resume(first.instanceId, { firstLabel: 'alpha' });
+    assert.equal(resumed.done, false);
+    assert.equal(resumed.boundary, undefined);
+    assert.equal(boundaryOf(session.advance()).name, 'second');
+  });
+
   test('start completes a boundary-free document', () => {
     const entry = 'index-stream-empty.html';
     const session = streamingProtocol(entry).streamResponse({
@@ -434,12 +497,20 @@ describe('streamResponse over node:http', () => {
         assert.ok(step.boundary);
         step = session.resume(step.boundary.instanceId, { firstLabel: 'alpha' });
         await write(response, step.bytes);
+        assert.equal(step.done, false);
+        assert.equal(step.boundary, undefined);
 
         // Only reached if the client already has the bytes above.
         await clientSawFirstBoundary;
 
+        step = session.advance();
         assert.ok(step.boundary);
+        await write(response, step.bytes);
         step = session.resume(step.boundary.instanceId, { secondLabel: 'beta' });
+        assert.equal(step.done, false);
+        assert.equal(step.boundary, undefined);
+        await write(response, step.bytes);
+        step = session.advance();
         assert.equal(step.done, true);
         response.end(step.bytes);
       })().catch((error: unknown) => {
@@ -476,6 +547,7 @@ describe('streamResponse over node:http', () => {
       // The tail arrived only after the client acknowledged the head.
       assert.equal(sawTailBeforeRelease, false);
       assert.ok(received.includes('alpha'));
+      assert.ok(received.includes('between'));
       assert.ok(received.includes('beta'));
       assert.ok(received.includes('</html>'));
     } finally {

From d0d3eaf3163bbba8f5a316cde61f45846d62150d Mon Sep 17 00:00:00 2001
From: Mohamed Mansour <mmansour@microsoft.com>
Date: Fri, 21 Aug 2026 13:10:42 -0700
Subject: [PATCH 5/5] fix: harden streaming boundary invariants

Preserve literal boundary text, align updatable limits, remove dead span limits, avoid route capture allocations, and centralize activation outcomes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 DESIGN.md                                     |   4 +-
 crates/webui-handler/README.md                |   6 +-
 crates/webui-handler/src/lib.rs               |   3 +-
 crates/webui-handler/src/streaming/error.rs   |  20 +-
 .../webui-handler/src/streaming/inventory.rs  | 245 +++++++++++--
 crates/webui-handler/src/streaming/mod.rs     |   2 +-
 crates/webui-handler/src/streaming/owned.rs   |   5 +
 crates/webui-handler/src/streaming/session.rs | 206 ++++++++++-
 crates/webui-handler/src/streaming/vm.rs      |  35 +-
 crates/webui-parser/src/plugin/webui.rs       | 196 ++++++++++-
 .../webui-framework/src/streaming-deferred.ts |  83 ++++-
 .../src/streaming-mode.test.ts                |  92 ++++-
 .../webui-framework/src/streaming-mode.ts     |  52 ++-
 .../src/streaming-pipeline.test.ts            | 332 ++++++++++++++++--
 .../webui-framework/src/streaming-spans.ts    |  14 +-
 .../src/template-element.test.ts              |  20 +-
 .../webui-framework/src/template-element.ts   |  27 +-
 17 files changed, 1203 insertions(+), 139 deletions(-)

diff --git a/DESIGN.md b/DESIGN.md
index 14bb4e942..6c1d18860 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -2539,9 +2539,9 @@ wire correctness.
 ### Limits, errors, and malformed input
 
 - Server limits are 256 continuation frames, 512 runtime boundary occurrences,
-  512 keyed occurrences, 128 open generated spans, 32 nested generated spans,
+  512 keyed occurrences, 128 updatable occurrences, 32 nested generated spans,
   and 1,024 frozen top-level state keys.
-- Browser limits are 512 queued records, 128 updatable boundaries, 50,000
+- Browser limits are 512 queued records, 128 updatable occurrences, 50,000
   retained update roots, 50,000 pending undefined roots, 50,000 pending
   ancestor-barrier roots, 10,000 elements per checkpoint, 50,000 marker-scan
   nodes, and an eight-element payload-script lookback.
diff --git a/crates/webui-handler/README.md b/crates/webui-handler/README.md
index b6c89856c..e940c7aa7 100644
--- a/crates/webui-handler/README.md
+++ b/crates/webui-handler/README.md
@@ -66,7 +66,11 @@ Commit an occurrence as `BoundaryMode::Updatable` to call
 `update(instance_id, patch)` later, including between its `resume` and the
 following `advance`. Updates are projected state records and do not insert
 markup. Component-local occurrences use generated parent spans so an early child
-can hydrate before the parent tail.
+can hydrate before the parent tail. One response may commit at most 128
+updatable occurrences, matching what the browser retains; a `resume` past that
+is refused before any byte is written, so the same pending occurrence can be
+committed as `BoundaryMode::Final` instead. Final occurrences release their
+roots at hydration and never count against the cap.
 
 A `<boundary>` may not appear inside a `<for>` repeat body (directly or through
 a component, `<if>`, route, or outlet): the build rejects it with
diff --git a/crates/webui-handler/src/lib.rs b/crates/webui-handler/src/lib.rs
index 2170fbfca..9cb10b4d2 100644
--- a/crates/webui-handler/src/lib.rs
+++ b/crates/webui-handler/src/lib.rs
@@ -46,8 +46,7 @@ use streaming::{
 pub use streaming::{
     BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, BufferSink, SessionOptions,
     SpanInstanceId, StreamStatus, StreamStep, StreamingResponse, StreamingSession,
-    MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH, MAX_KEYED_INSTANCES, MAX_OPEN_SPANS,
-    MAX_SPAN_NESTING,
+    MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH, MAX_KEYED_INSTANCES, MAX_SPAN_NESTING,
 };
 use thiserror::Error;
 use webui_expressions::{evaluate_with_resolver, ExpressionError};
diff --git a/crates/webui-handler/src/streaming/error.rs b/crates/webui-handler/src/streaming/error.rs
index ec4b4b06a..61e73be69 100644
--- a/crates/webui-handler/src/streaming/error.rs
+++ b/crates/webui-handler/src/streaming/error.rs
@@ -113,12 +113,11 @@ pub(super) fn boundary_limit_error(limit: usize) -> HandlerError {
 
 #[cold]
 #[inline(never)]
-pub(super) fn span_limit_error(limit: usize) -> HandlerError {
+pub(super) fn span_id_overflow_error() -> HandlerError {
     streaming_boundary_error(
         "component span",
-        &format!(
-            "open component span count exceeds {limit}; reduce boundary-bearing component nesting"
-        ),
+        "component span IDs exhausted the response-local 32-bit range; split the page into \
+         several responses or reduce boundary-bearing component hosts",
     )
 }
 
@@ -131,6 +130,19 @@ pub(super) fn span_nesting_error(limit: usize) -> HandlerError {
     )
 }
 
+#[cold]
+#[inline(never)]
+pub(super) fn updatable_limit_error(limit: usize) -> HandlerError {
+    streaming_boundary_error(
+        "resume",
+        &format!(
+            "this response already committed {limit} updatable boundary occurrences, the most the \
+             browser retains; resume this occurrence with BoundaryMode::Final, or split the page \
+             so fewer occurrences need later updates"
+        ),
+    )
+}
+
 #[cold]
 #[inline(never)]
 pub(super) fn invalid_boundary_key_error(
diff --git a/crates/webui-handler/src/streaming/inventory.rs b/crates/webui-handler/src/streaming/inventory.rs
index d53086550..c24cd06e4 100644
--- a/crates/webui-handler/src/streaming/inventory.rs
+++ b/crates/webui-handler/src/streaming/inventory.rs
@@ -24,38 +24,16 @@ pub(crate) fn record_checkpoint_tag(
     let Some(&index) = context.component_index.get(fragment_id) else {
         return;
     };
-    let route_dependent = context.streaming.as_ref().is_some_and(|streaming| {
-        streaming.component_reachability.is_route_dependent(index) == Some(true)
-    });
-    let route_base = route_dependent.then(|| context.route_base.as_ref().into());
-    let Some(streaming) = context.streaming.as_mut() else {
+    // Borrowed for the whole capture: the base is only ever compared against
+    // what the checkpoint already holds, so the owned copy is created inside
+    // the miss path rather than once per rendered tag.
+    let route_base: &str = context.route_base.as_ref();
+    let Some(streaming) = context.streaming.as_deref_mut() else {
         return;
     };
-    if let Some(route_base) = route_base {
-        let route_base: Box<str> = route_base;
-        let already_recorded = streaming.checkpoint_walk_roots.iter().any(|(root, base)| {
-            *root == index
-                && base
-                    .as_ref()
-                    .is_some_and(|base| base.as_ref() == route_base.as_ref())
-        });
-        if !already_recorded {
-            if streaming.checkpoint_walk_roots.is_empty() {
-                streaming
-                    .checkpoint_walk_roots
-                    .reserve(streaming.checkpoint_tags.len() + 1);
-                streaming.checkpoint_walk_roots.extend(
-                    streaming
-                        .checkpoint_tags
-                        .iter()
-                        .copied()
-                        .map(|root| (root, None)),
-                );
-            }
-            streaming
-                .checkpoint_walk_roots
-                .push((index, Some(route_base)));
-        }
+    let route_dependent = streaming.component_reachability.is_route_dependent(index) == Some(true);
+    if route_dependent {
+        record_route_dependent_root(streaming, index, route_base);
     }
     let byte_index = (index / 8) as usize;
     let bit = 1u8 << (index % 8);
@@ -74,6 +52,44 @@ pub(crate) fn record_checkpoint_tag(
     }
 }
 
+/// Capture one route-dependent root under the base it rendered against.
+///
+/// A route-dependent component reaches a different surface per route base, so
+/// the capture keeps `(component, base)` pairs rather than the bare index the
+/// bitset holds. Membership is decided against the borrowed base — one slice
+/// compare per already-captured entry — so the owned base is built only for a
+/// pair the checkpoint has not seen, instead of once per rendered tag.
+fn record_route_dependent_root(
+    streaming: &mut StreamingRenderState<'_>,
+    index: u32,
+    route_base: &str,
+) {
+    if streaming
+        .checkpoint_walk_roots
+        .iter()
+        .any(|(root, base)| *root == index && base.as_deref() == Some(route_base))
+    {
+        return;
+    }
+    // The first route-dependent root promotes the plain bitset capture into
+    // base-carrying pairs, so every tag already recorded is carried over.
+    if streaming.checkpoint_walk_roots.is_empty() {
+        streaming
+            .checkpoint_walk_roots
+            .reserve(streaming.checkpoint_tags.len() + 1);
+        streaming.checkpoint_walk_roots.extend(
+            streaming
+                .checkpoint_tags
+                .iter()
+                .copied()
+                .map(|root| (root, None)),
+        );
+    }
+    streaming
+        .checkpoint_walk_roots
+        .push((index, Some(route_base.into())));
+}
+
 /// Commit the exact rendered tags to the cumulative DOM inventory and encode
 /// this checkpoint's delta. Template delivery is tracked separately because a
 /// reachable-but-unrendered descendant needs metadata without claiming live DOM.
@@ -302,4 +318,173 @@ mod tests {
             "checkpoint tag buffer capacity must be reused, not reallocated"
         );
     }
+
+    /// A sink for capture-only tests: recording a tag never writes a byte.
+    struct NullSink;
+
+    impl crate::ResponseWriter for NullSink {
+        fn write(&mut self, _content: &str) -> Result<()> {
+            Ok(())
+        }
+
+        fn end(&mut self) -> Result<()> {
+            Ok(())
+        }
+    }
+
+    /// Component index and heap address of the first captured walk root's
+    /// owned base, so a repeat can prove the retained base was neither
+    /// duplicated nor rebuilt.
+    fn first_captured_base(streaming: &StreamingRenderState<'_>) -> Option<(u32, usize)> {
+        streaming
+            .checkpoint_walk_roots
+            .first()
+            .and_then(|(root, base)| base.as_ref().map(|base| (*root, base.as_ptr().addr())))
+    }
+
+    #[test]
+    fn repeated_route_dependent_capture_keeps_one_owned_base() -> Result<()> {
+        // A route-dependent component rendered repeatedly under the same base
+        // is one capture entry, and that entry keeps the very allocation it was
+        // first captured with: membership is decided against the borrowed base,
+        // so a repeat builds no owned base it would immediately drop. A genuine
+        // new base still captures a second root, because the request-aware walk
+        // must visit the component once per base it rendered under.
+        let protocol = Protocol::new(WebUIProtocol::new(HashMap::from([
+            (
+                "route-shell".to_string(),
+                FragmentList {
+                    fragments: vec![webui_protocol::WebUIFragment::route(
+                        "details",
+                        "detail-page",
+                    )],
+                    contains_boundary: false,
+                },
+            ),
+            (
+                "detail-page".to_string(),
+                FragmentList {
+                    fragments: vec![webui_protocol::WebUIFragment::raw("<p>detail</p>")],
+                    contains_boundary: false,
+                },
+            ),
+        ])));
+        let component_index = protocol.component_index();
+        let Some(&shell) = component_index.get("route-shell") else {
+            panic!("the route-bearing component must be indexed");
+        };
+        assert_eq!(
+            protocol.component_reachability().is_route_dependent(shell),
+            Some(true),
+            "a component that hosts a route is route dependent"
+        );
+
+        let mut streaming = StreamingRenderState::from_progress(
+            super::super::state::StreamingProgress::new(component_index.len()),
+            protocol.component_reachability(),
+        );
+        let state = serde_json::Value::Object(serde_json::Map::new());
+        let mut writer = NullSink;
+        let mut context = WebUIProcessContext {
+            protocol: protocol.protocol(),
+            component_asset_style_manifest: protocol.component_asset_style_manifest()?,
+            component_asset_style_links: protocol.component_asset_style_links(),
+            state: &state,
+            writer: &mut writer,
+            local_vars: HashMap::new(),
+            component_attrs: HashMap::new(),
+            request_path: "/account/details",
+            route_base: std::borrow::Cow::Borrowed("/account"),
+            rendered_components: std::collections::HashSet::new(),
+            plugin: None,
+            route_children: Vec::new(),
+            entry_id: "index.html",
+            nonce: None,
+            component_index,
+            head_inject: None,
+            body_inject: None,
+            state_inject: crate::StateInject::resolve(&state),
+            head_end_emitted: false,
+            body_start_emitted: false,
+            component_asset_styles_emitted: false,
+            body_end_emitted: false,
+            route_index: protocol.route_index(),
+            route_chain_index: 0,
+            streaming: Some(&mut streaming),
+            json_scratch: Vec::new(),
+            scope_pool: Vec::new(),
+        };
+
+        record_checkpoint_tag(&mut context, "route-shell");
+        let Some(state_after_first) = context.streaming.as_deref() else {
+            panic!("the capture must retain its streaming state");
+        };
+        let captured = first_captured_base(state_after_first);
+        assert_eq!(
+            state_after_first.checkpoint_walk_roots.len(),
+            1,
+            "the first render of a route-dependent component captures one root"
+        );
+        assert!(
+            captured.is_some(),
+            "the root retains the base it rendered at"
+        );
+        let capture_buffer = (
+            state_after_first.checkpoint_walk_roots.capacity(),
+            state_after_first.checkpoint_walk_roots.as_ptr().addr(),
+        );
+
+        record_checkpoint_tag(&mut context, "route-shell");
+        let Some(state_after_repeat) = context.streaming.as_deref() else {
+            panic!("the capture must retain its streaming state");
+        };
+        assert_eq!(
+            (
+                state_after_repeat.checkpoint_walk_roots.capacity(),
+                state_after_repeat.checkpoint_walk_roots.as_ptr().addr(),
+            ),
+            capture_buffer,
+            "a repeat must touch neither the capture buffer nor its capacity"
+        );
+        assert_eq!(
+            state_after_repeat.checkpoint_walk_roots.len(),
+            1,
+            "the same component under the same base must not capture a second root"
+        );
+        assert_eq!(
+            first_captured_base(state_after_repeat),
+            captured,
+            "the retained base must be the original allocation, not a rebuilt copy"
+        );
+        assert_eq!(
+            state_after_repeat.checkpoint_tags,
+            vec![shell],
+            "the component-index bitset still records the tag exactly once"
+        );
+
+        context.route_base = std::borrow::Cow::Borrowed("/other");
+        record_checkpoint_tag(&mut context, "route-shell");
+        let Some(state_after_rebase) = context.streaming.as_deref() else {
+            panic!("the capture must retain its streaming state");
+        };
+        assert_eq!(
+            state_after_rebase.checkpoint_walk_roots.len(),
+            2,
+            "a genuinely new base captures the component a second time"
+        );
+        assert_eq!(
+            first_captured_base(state_after_rebase),
+            captured,
+            "capturing a new base must not disturb the base already retained"
+        );
+        assert_eq!(
+            state_after_rebase.checkpoint_walk_roots[1]
+                .1
+                .as_deref()
+                .map(str::to_string),
+            Some("/other".to_string()),
+            "the second root carries the base it rendered under"
+        );
+        Ok(())
+    }
 }
diff --git a/crates/webui-handler/src/streaming/mod.rs b/crates/webui-handler/src/streaming/mod.rs
index ab59e16b8..d66d1511d 100644
--- a/crates/webui-handler/src/streaming/mod.rs
+++ b/crates/webui-handler/src/streaming/mod.rs
@@ -31,7 +31,7 @@ pub(crate) use root::{
 pub use session::{
     BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, SpanInstanceId,
     StreamStatus, StreamingResponse, MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH,
-    MAX_KEYED_INSTANCES, MAX_OPEN_SPANS, MAX_SPAN_NESTING,
+    MAX_KEYED_INSTANCES, MAX_SPAN_NESTING,
 };
 pub(crate) use state::StreamingRenderState;
 pub(crate) use vm::PreparedContinuationStatePlan;
diff --git a/crates/webui-handler/src/streaming/owned.rs b/crates/webui-handler/src/streaming/owned.rs
index f6aef6f7e..ac1c76eab 100644
--- a/crates/webui-handler/src/streaming/owned.rs
+++ b/crates/webui-handler/src/streaming/owned.rs
@@ -135,6 +135,11 @@ impl StreamingSession {
     ///
     /// The returned bytes hold that occurrence's record and nothing that
     /// follows it. Call [`Self::advance`] for the parent bytes.
+    ///
+    /// [`BoundaryMode::Updatable`] is refused once the response has committed
+    /// as many updatable occurrences as the browser retains. The refusal
+    /// produces no bytes and leaves the occurrence pending, so it can be
+    /// committed with [`BoundaryMode::Final`] instead.
     pub fn resume(
         &mut self,
         instance_id: BoundaryInstanceId,
diff --git a/crates/webui-handler/src/streaming/session.rs b/crates/webui-handler/src/streaming/session.rs
index 1bce44a83..4db90fc4c 100644
--- a/crates/webui-handler/src/streaming/session.rs
+++ b/crates/webui-handler/src/streaming/session.rs
@@ -25,12 +25,17 @@ use crate::{
 
 /// Maximum continuation frames retained by one response.
 pub const MAX_CONTINUATION_DEPTH: usize = 256;
-/// Maximum unfinished component spans retained by one response.
-pub const MAX_OPEN_SPANS: usize = 128;
 /// Maximum nested unfinished component spans.
 pub const MAX_SPAN_NESTING: usize = 32;
 /// Maximum runtime boundary occurrences in one response.
 pub const MAX_BOUNDARY_OCCURRENCES: usize = 512;
+/// Maximum runtime boundary occurrences one response may commit as
+/// [`BoundaryMode::Updatable`].
+///
+/// Mirrors the browser coordinator's retained-boundary cap: the client refuses
+/// to retain a 129th updatable occurrence, so the server refuses to emit one
+/// rather than stream a checkpoint the page would fail on.
+pub(crate) const MAX_UPDATABLE_OCCURRENCES: usize = 128;
 /// Maximum keyed runtime occurrences tracked for uniqueness.
 pub const MAX_KEYED_INSTANCES: usize = 512;
 /// Maximum top-level state keys retained by a continuation snapshot.
@@ -209,6 +214,11 @@ impl<W: FlushWriter + ?Sized> StreamingResponse<'_, W> {
     /// The bytes written by this call are exactly the occurrence's own record —
     /// no parent or tail bytes follow it — so the host can release the
     /// occurrence the moment it resolves. Call [`Self::advance`] next.
+    ///
+    /// [`BoundaryMode::Updatable`] is refused once the response has committed
+    /// as many updatable occurrences as the browser retains. The refusal is
+    /// raised before any byte or state moves, so the same occurrence stays
+    /// pending and can be committed with [`BoundaryMode::Final`] instead.
     pub fn resume(
         &mut self,
         instance_id: BoundaryInstanceId,
@@ -378,6 +388,7 @@ impl SessionCore {
     ) -> Result<StreamStatus> {
         self.require_resumable()?;
         self.vm.validate_resume(instance_id)?;
+        self.vm.validate_resume_mode(mode)?;
         if self.requires_full_state {
             overlay_full_state(&mut self.frozen_state, state);
         } else {
@@ -411,6 +422,7 @@ impl SessionCore {
     ) -> Result<StreamStatus> {
         self.require_resumable()?;
         self.vm.validate_resume(instance_id)?;
+        self.vm.validate_resume_mode(mode)?;
         self.run_step(call, StepGoal::NextBoundary, Some((instance_id, mode)))
     }
 
@@ -654,6 +666,28 @@ mod tests {
         }
     }
 
+    /// A sink whose bytes stay readable while the response holds it, so a test
+    /// can prove a refused step wrote nothing.
+    #[derive(Clone, Default)]
+    struct SharedSink(std::rc::Rc<std::cell::RefCell<String>>);
+
+    impl ResponseWriter for SharedSink {
+        fn write(&mut self, content: &str) -> Result<()> {
+            self.0.borrow_mut().push_str(content);
+            Ok(())
+        }
+
+        fn end(&mut self) -> Result<()> {
+            Ok(())
+        }
+    }
+
+    impl FlushWriter for SharedSink {
+        fn flush(&mut self) -> Result<()> {
+            Ok(())
+        }
+    }
+
     /// Build a parser-produced entry with `boundaries` runtime occurrences,
     /// each hosting one island component.
     fn boundary_protocol(boundaries: usize, hydration_mode: StateProjectionMode) -> Protocol {
@@ -998,4 +1032,172 @@ mod tests {
         );
         Ok(())
     }
+
+    /// Drive `count` occurrences to completion in `mode`, returning the status
+    /// the response stopped on.
+    fn commit_occurrences<W: FlushWriter + ?Sized>(
+        response: &mut StreamingResponse<'_, W>,
+        status: StreamStatus,
+        state: &Value,
+        count: usize,
+        mode: BoundaryMode,
+    ) -> Result<StreamStatus> {
+        let mut status = status;
+        for committed in 0..count {
+            let Some(boundary) = status.boundary.as_ref() else {
+                panic!("occurrence {committed} must suspend before it can commit");
+            };
+            let instance_id = boundary.instance_id;
+            response.resume(instance_id, state, mode)?;
+            status = response.advance()?;
+        }
+        Ok(status)
+    }
+
+    #[test]
+    fn updatable_commits_stop_at_the_browser_retention_cap() -> Result<()> {
+        // The browser retains every updatable occurrence for the life of the
+        // response and refuses the one past its cap, so the server refuses to
+        // emit that checkpoint at all. The refusal lands before a byte is
+        // written and before the caller's state reaches the snapshot, leaving
+        // the same occurrence pending so the host can commit it as final.
+        let protocol = boundary_protocol(MAX_UPDATABLE_OCCURRENCES + 1, StateProjectionMode::Keys);
+        let handler = WebUIHandler::new();
+        let state = test_json!({ "count": 1, "title": "retained" });
+        let render_options = options();
+        let mut sink = SharedSink::default();
+        let written = SharedSink::clone(&sink).0;
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let status = response.start(&state)?;
+        let status = commit_occurrences(
+            &mut response,
+            status,
+            &state,
+            MAX_UPDATABLE_OCCURRENCES,
+            BoundaryMode::Updatable,
+        )?;
+
+        let Some(boundary) = status.boundary.as_ref() else {
+            panic!("the occurrence past the cap must suspend like any other");
+        };
+        let instance_id = boundary.instance_id;
+        let bytes_before = written.borrow().len();
+        let refused = test_json!({ "count": 2, "title": "refused" });
+        let rejected = response.resume(instance_id, &refused, BoundaryMode::Updatable);
+        match rejected {
+            Err(HandlerError::StreamingBoundary(error)) => {
+                assert_eq!(error.signal, "resume");
+                assert!(
+                    error.reason.contains("BoundaryMode::Final"),
+                    "the refusal must name the recovery: {}",
+                    error.reason
+                );
+            }
+            _ => panic!("committing past the cap must fail with a typed boundary error"),
+        }
+        assert_eq!(
+            written.borrow().len(),
+            bytes_before,
+            "a refused commit must not write a byte"
+        );
+        assert_eq!(
+            response.core.frozen_state.get("title"),
+            Some(&Value::String("retained".to_string())),
+            "a refused commit must not merge its state into the snapshot"
+        );
+
+        // The occurrence is untouched, so the same ID commits as final.
+        let status = response.resume(instance_id, &state, BoundaryMode::Final)?;
+        assert!(
+            status.boundary.is_none() && !status.done,
+            "the retried commit stops at its own checkpoint"
+        );
+        assert!(
+            written.borrow().len() > bytes_before,
+            "the retry writes its checkpoint"
+        );
+        assert!(
+            response.advance()?.done,
+            "the response still reaches its terminal"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn final_commits_do_not_consume_the_updatable_cap() -> Result<()> {
+        // Only occurrences the browser retains count against the cap: a final
+        // boundary releases its roots at hydration, so a response may commit
+        // any number of them and still use its full updatable budget.
+        let protocol = boundary_protocol(MAX_UPDATABLE_OCCURRENCES + 2, StateProjectionMode::Keys);
+        let handler = WebUIHandler::new();
+        let state = test_json!({ "count": 1, "title": "mixed" });
+        let render_options = options();
+        let mut sink = TestSink {
+            output: String::new(),
+        };
+        let mut response = handler.stream_response(&protocol, &render_options, &mut sink)?;
+
+        let status = response.start(&state)?;
+        let status = commit_occurrences(&mut response, status, &state, 2, BoundaryMode::Final)?;
+        let status = commit_occurrences(
+            &mut response,
+            status,
+            &state,
+            MAX_UPDATABLE_OCCURRENCES,
+            BoundaryMode::Updatable,
+        )?;
+        assert!(
+            status.done && response.is_done(),
+            "final commits must leave the whole updatable budget available"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn owned_sessions_enforce_the_same_updatable_cap() -> Result<()> {
+        // The owned session shares the borrowed session's continuation, so the
+        // cap, the refusal, and the final-mode retry behave identically.
+        let protocol = Arc::new(boundary_protocol(
+            MAX_UPDATABLE_OCCURRENCES + 1,
+            StateProjectionMode::Keys,
+        ));
+        let mut session = crate::streaming::StreamingSession::new(
+            Arc::new(WebUIHandler::new()),
+            protocol,
+            crate::streaming::SessionOptions::new("index.html", "/"),
+        )?;
+        let state = test_json!({ "count": 1, "title": "owned" });
+
+        let mut step = session.start(&state)?;
+        for committed in 0..MAX_UPDATABLE_OCCURRENCES {
+            let Some(boundary) = step.boundary.as_ref() else {
+                panic!("occurrence {committed} must suspend before it can commit");
+            };
+            let instance_id = boundary.instance_id;
+            session.resume(instance_id, &state, BoundaryMode::Updatable)?;
+            step = session.advance()?;
+        }
+
+        let Some(boundary) = step.boundary.as_ref() else {
+            panic!("the occurrence past the cap must suspend like any other");
+        };
+        let instance_id = boundary.instance_id;
+        assert!(
+            session
+                .resume(instance_id, &state, BoundaryMode::Updatable)
+                .is_err(),
+            "an owned session refuses the occurrence past the cap"
+        );
+        let step = session.resume(instance_id, &state, BoundaryMode::Final)?;
+        assert!(
+            !step.bytes.is_empty(),
+            "the retried commit still delivers its checkpoint bytes"
+        );
+        assert!(
+            session.advance()?.done,
+            "the owned response still reaches its terminal"
+        );
+        Ok(())
+    }
 }
diff --git a/crates/webui-handler/src/streaming/vm.rs b/crates/webui-handler/src/streaming/vm.rs
index 153062781..d82b21d33 100644
--- a/crates/webui-handler/src/streaming/vm.rs
+++ b/crates/webui-handler/src/streaming/vm.rs
@@ -18,13 +18,13 @@ use super::checkpoint::RangeRecord;
 use super::error::{
     boundary_in_repeat_error, boundary_limit_error, boundary_order_error, continuation_limit_error,
     duplicate_boundary_key_error, invalid_boundary_key_error, keyed_instance_limit_error,
-    malformed_span_signal_error, span_limit_error, span_nesting_error,
+    malformed_span_signal_error, span_id_overflow_error, span_nesting_error, updatable_limit_error,
 };
 use super::root::ComponentHostOrigin;
 use super::session::{
     BoundaryDescriptor, BoundaryInstanceId, BoundaryKey, BoundaryMode, SpanInstanceId,
     StreamStatus, MAX_BOUNDARY_OCCURRENCES, MAX_CONTINUATION_DEPTH, MAX_KEYED_INSTANCES,
-    MAX_OPEN_SPANS, MAX_SPAN_NESTING,
+    MAX_SPAN_NESTING, MAX_UPDATABLE_OCCURRENCES,
 };
 use super::state::{increment_streaming_record_sequence, protocol_fragment, RecordCapture};
 use super::{
@@ -102,6 +102,13 @@ pub(crate) struct ContinuationVm {
     keyed_instances: HashMap<u32, HashSet<BoundaryKey>>,
     keyed_instance_count: usize,
     committed_modes: Vec<BoundaryMode>,
+    /// Occurrences already committed as [`BoundaryMode::Updatable`].
+    ///
+    /// The browser retains every updatable occurrence for the life of the
+    /// response, so the cap is a running total rather than a live count.
+    /// Keeping it as a counter makes the pre-commit check one integer compare
+    /// instead of a scan of every mode already committed.
+    updatable_count: usize,
     component_count: usize,
     pending_span_candidate: Option<Box<str>>,
     /// Repeats currently being walked by this step.
@@ -302,6 +309,7 @@ impl ContinuationVm {
             keyed_instances: HashMap::new(),
             keyed_instance_count: 0,
             committed_modes: Vec::new(),
+            updatable_count: 0,
             component_count: protocol.component_index().len(),
             pending_span_candidate: None,
             open_repeats: 0,
@@ -324,6 +332,19 @@ impl ContinuationVm {
         Ok(())
     }
 
+    /// Reject an `Updatable` commit the browser could not retain.
+    ///
+    /// Checked before the resume writes a byte or takes the pending
+    /// occurrence, so a rejected attempt leaves the response exactly as it was
+    /// and the host can commit the same occurrence as
+    /// [`BoundaryMode::Final`] instead.
+    pub(crate) fn validate_resume_mode(&self, mode: BoundaryMode) -> Result<()> {
+        if mode == BoundaryMode::Updatable && self.updatable_count >= MAX_UPDATABLE_OCCURRENCES {
+            return Err(updatable_limit_error(MAX_UPDATABLE_OCCURRENCES));
+        }
+        Ok(())
+    }
+
     pub(crate) fn validate_update(&self, instance_id: BoundaryInstanceId) -> Result<usize> {
         let index = instance_id.index()?;
         let Some(mode) = self.committed_modes.get(index) else {
@@ -986,6 +1007,11 @@ impl ContinuationVm {
                 "committed boundary IDs are not gapless".to_string(),
             ));
         }
+        // Counted here, not at resume: only an occurrence whose checkpoint
+        // actually reached the client consumes the browser's retention budget.
+        if active.mode == BoundaryMode::Updatable {
+            self.updatable_count = self.updatable_count.saturating_add(1);
+        }
         self.committed_modes.push(active.mode);
         Ok(())
     }
@@ -1012,9 +1038,6 @@ impl ContinuationVm {
                 "component span start is missing its tag",
             ));
         }
-        if self.open_spans.len() >= MAX_OPEN_SPANS {
-            return Err(span_limit_error(MAX_OPEN_SPANS));
-        }
         if self.open_spans.len() >= MAX_SPAN_NESTING {
             return Err(span_nesting_error(MAX_SPAN_NESTING));
         }
@@ -1022,7 +1045,7 @@ impl ContinuationVm {
         self.next_span_id = self
             .next_span_id
             .checked_add(1)
-            .ok_or_else(|| span_limit_error(MAX_OPEN_SPANS))?;
+            .ok_or_else(span_id_overflow_error)?;
         if write_marker {
             super::write_range_marker(context.writer, "<!--ws:", id.raw())?;
         }
diff --git a/crates/webui-parser/src/plugin/webui.rs b/crates/webui-parser/src/plugin/webui.rs
index 21d6e734c..682552c38 100644
--- a/crates/webui-parser/src/plugin/webui.rs
+++ b/crates/webui-parser/src/plugin/webui.rs
@@ -68,8 +68,8 @@ use crate::component_policy::{parse_component_render_policy, ComponentRenderPoli
 use crate::component_registry::Component;
 use crate::diagnostic::{codes, Diagnostic};
 use crate::html_parser::{
-    find_element_end, find_tag_close, is_void_element, leading_content, parse_tag,
-    style_element_bounds,
+    find_comment_close, find_declaration_close, find_element_end, find_tag_close, is_void_element,
+    leading_content, parse_tag, style_element_bounds,
 };
 use crate::{ConditionParser, DomStrategy, ParserOptions, Result};
 use std::borrow::Cow;
@@ -241,28 +241,107 @@ impl WebUIParserPlugin {
             return Cow::Borrowed(template);
         }
 
-        let mut output = String::with_capacity(template.len());
+        let mut output: Option<String> = None;
+        let mut copied_until = 0usize;
         let mut index = 0usize;
         while index < template.len() {
+            let Some(relative) = template[index..].find('<') else {
+                break;
+            };
+            index += relative;
             let remaining = &template[index..];
-            if remaining.starts_with('<') {
-                if let Some(tag) = parse_tag(remaining) {
-                    if tag.name == "boundary" {
-                        index += tag.close + 1;
-                        continue;
-                    }
-                }
+
+            if remaining.starts_with("<!--") {
+                index += find_comment_close(remaining).unwrap_or(remaining.len());
+                continue;
             }
-            let Some(ch) = remaining.chars().next() else {
-                break;
+            if remaining.starts_with("<!") {
+                index += find_declaration_close(remaining).unwrap_or(remaining.len());
+                continue;
+            }
+
+            let Some(tag) = parse_tag(remaining) else {
+                let Some(close) = find_tag_close(remaining) else {
+                    break;
+                };
+                index += close + 1;
+                continue;
             };
-            output.push(ch);
-            index += ch.len_utf8();
+            let tag_end = index + tag.close + 1;
+
+            let is_boundary = if tag.closing {
+                remaining.starts_with("</boundary")
+            } else {
+                remaining.starts_with("<boundary")
+            };
+            if is_boundary && tag.name == "boundary" {
+                let output = output.get_or_insert_with(|| String::with_capacity(template.len()));
+                output.push_str(&template[copied_until..index]);
+                copied_until = tag_end;
+                index = tag_end;
+                continue;
+            }
+
+            if !tag.closing && !tag.self_closing && is_raw_text_or_rcdata_element(tag.name) {
+                index += raw_text_element_end(remaining, tag.name, tag.close + 1);
+            } else {
+                index = tag_end;
+            }
         }
+
+        let Some(mut output) = output else {
+            return Cow::Borrowed(template);
+        };
+        output.push_str(&template[copied_until..]);
         Cow::Owned(output)
     }
 }
 
+#[inline]
+fn is_raw_text_or_rcdata_element(tag_name: &str) -> bool {
+    // Reuse the parser's canonical raw/RCDATA scope set. Style has a separate
+    // parser path, while template content remains traversable markup here.
+    tag_name.eq_ignore_ascii_case("style")
+        || (!tag_name.eq_ignore_ascii_case("template")
+            && crate::boundary_parent_scope(tag_name).is_some())
+}
+
+fn raw_text_element_end(source: &str, tag_name: &str, mut cursor: usize) -> usize {
+    if tag_name.eq_ignore_ascii_case("plaintext") {
+        return source.len();
+    }
+
+    while cursor < source.len() {
+        let Some(relative) = source[cursor..].find('<') else {
+            break;
+        };
+        cursor += relative;
+        if let Some(close_len) = raw_text_closing_tag_len(&source[cursor..], tag_name) {
+            return cursor + close_len;
+        }
+        cursor += 1;
+    }
+    source.len()
+}
+
+#[inline]
+fn raw_text_closing_tag_len(input: &str, tag_name: &str) -> Option<usize> {
+    let name_end = 2 + tag_name.len();
+    if !input.as_bytes().starts_with(b"</")
+        || !input.get(2..name_end)?.eq_ignore_ascii_case(tag_name)
+    {
+        return None;
+    }
+
+    let delimiter = *input.as_bytes().get(name_end)?;
+    if !delimiter.is_ascii_whitespace() && delimiter != b'/' && delimiter != b'>' {
+        return None;
+    }
+
+    let tag = parse_tag(input)?;
+    (tag.closing && tag.name.eq_ignore_ascii_case(tag_name)).then_some(tag.close + 1)
+}
+
 impl Default for WebUIParserPlugin {
     fn default() -> Self {
         Self::new()
@@ -3377,6 +3456,95 @@ mod tests {
         assert!(!metadata.contains("</boundary>"));
     }
 
+    #[test]
+    fn boundary_directive_tags_preserve_style_content_strings() {
+        let source = r#"<style>.card::before { content: "<boundary name='css'>literal</boundary>"; }</style>"#;
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert!(matches!(&stripped, Cow::Borrowed(_)));
+        assert_eq!(stripped, source);
+    }
+
+    #[test]
+    fn boundary_directive_tags_preserve_script_strings() {
+        let source =
+            r#"<script>const marker = '<boundary name="script">literal</boundary>';</script>"#;
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert!(matches!(&stripped, Cow::Borrowed(_)));
+        assert_eq!(stripped, source);
+    }
+
+    #[test]
+    fn boundary_directive_tags_preserve_quoted_attribute_values() {
+        let source = r#"<div data-double="<boundary name='double' data-end='>'></boundary>" data-single='<boundary name="single" data-end=">"></boundary>'></div>"#;
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert!(matches!(&stripped, Cow::Borrowed(_)));
+        assert_eq!(stripped, source);
+    }
+
+    #[test]
+    fn boundary_directive_tags_preserve_parser_raw_text_and_rcdata() {
+        let source = concat!(
+            "<textarea><boundary name=\"textarea\">literal</boundary></textarea>",
+            "<title><boundary name=\"title\">literal</boundary></title>",
+            "<xmp><boundary name=\"xmp\">literal</boundary></xmp>",
+            "<iframe><boundary name=\"iframe\">literal</boundary></iframe>",
+            "<noembed><boundary name=\"noembed\">literal</boundary></noembed>",
+            "<noframes><boundary name=\"noframes\">literal</boundary></noframes>",
+            "<noscript><boundary name=\"noscript\">literal</boundary></noscript>",
+            "<plaintext><boundary name=\"plaintext\">literal</boundary></plaintext>",
+        );
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert!(matches!(&stripped, Cow::Borrowed(_)));
+        assert_eq!(stripped, source);
+    }
+
+    #[test]
+    fn boundary_directive_tags_preserve_comments_and_near_matches() {
+        let source = concat!(
+            "<!-- <boundary name=\"comment\">literal</boundary> -->",
+            "<p>&lt;boundary&gt; is text</p>",
+            "<boundary-ish>near match</boundary-ish>",
+            "<Boundary>case-sensitive near match</Boundary>",
+            "< boundary>spaced near match</ boundary>",
+            "<boundary",
+        );
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert!(matches!(&stripped, Cow::Borrowed(_)));
+        assert_eq!(stripped, source);
+    }
+
+    #[test]
+    fn component_metadata_boundary_directive_tags_erase_real_wrapper_only() {
+        let source = concat!(
+            "<template shadowrootmode=\"open\">",
+            "<boundary name=\"ready\">",
+            r#"<style>.x::before { content: "<boundary>style</boundary>"; }</style>"#,
+            r#"<script>const marker = '<boundary>script</boundary>';</script>"#,
+            r#"<div data-marker="<boundary>attribute</boundary>">child</div>"#,
+            "</boundary>",
+            "</template>",
+        );
+        let expected = concat!(
+            "<template shadowrootmode=\"open\">",
+            r#"<style>.x::before { content: "<boundary>style</boundary>"; }</style>"#,
+            r#"<script>const marker = '<boundary>script</boundary>';</script>"#,
+            r#"<div data-marker="<boundary>attribute</boundary>">child</div>"#,
+            "</template>",
+        );
+        let stripped = WebUIParserPlugin::strip_boundary_directive_tags(source);
+
+        assert_eq!(stripped, expected);
+        let metadata = generate_compiled_template("my-card", &stripped);
+        assert_eq!(metadata.matches("<boundary>").count(), 3);
+        assert_eq!(metadata.matches("</boundary>").count(), 3);
+        assert!(!metadata.contains("ready"));
+    }
+
     /// Test helper: compile a template and unwrap. The vast majority of tests
     /// exercise valid templates; tests that assert on authoring errors call
     /// [`super::generate_compiled_template`] directly and inspect the `Result`.
diff --git a/packages/webui-framework/src/streaming-deferred.ts b/packages/webui-framework/src/streaming-deferred.ts
index 106f9e03e..adff13b0f 100644
--- a/packages/webui-framework/src/streaming-deferred.ts
+++ b/packages/webui-framework/src/streaming-deferred.ts
@@ -20,25 +20,34 @@ import {
   streamingErrorMessage,
 } from './streaming-dom.js';
 import {
+  ACTIVATION_ACTIVATED,
+  ACTIVATION_ANCESTOR_BARRIER,
+  ACTIVATION_MISSING_TEMPLATE,
+  ACTIVATION_STATIC_HOST_OPT_OUT,
   PENDING_ROOT_CONNECTED,
   STREAMED_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
 import { applyStateUpdate } from './streaming-state.js';
 
-const ACTIVATION_ACTIVATED = 1;
-const ACTIVATION_STATIC_HOST_OPT_OUT = 2;
-export const ACTIVATION_MISSING_TEMPLATE = 3;
-const ACTIVATION_ANCESTOR_BARRIER = 4;
-export const ELEMENT_IGNORED = 0;
-export const ELEMENT_DEFERRED = 4;
-export const ELEMENT_LIMIT_FAILURE = 5;
-const ELEMENT_ACTIVATED_FROM_PENDING = 6;
-const ELEMENT_BARRIER_LIMIT_FAILURE = 7;
+// Coordinator-internal walk results, deliberately in a decade disjoint from the
+// shared `ACTIVATION_*` outcomes (1..4) declared in `streaming-mode.ts`. Both
+// spaces travel through the same `number`, so overlapping them once made an
+// ancestor barrier indistinguishable from a definition-deferred element.
+export const ELEMENT_IGNORED = 10;
+export const ELEMENT_DEFERRED = 11;
+export const ELEMENT_LIMIT_FAILURE = 12;
+export const ELEMENT_ACTIVATED_FROM_PENDING = 13;
+export const ELEMENT_BARRIER_LIMIT_FAILURE = 14;
+/** A hook returned something outside the shared activation contract. */
+export const ELEMENT_INVALID_OUTCOME = 15;
 export const MAX_PENDING_UNDEFINED_ROOTS = 50_000;
 export const MAX_PENDING_BARRIER_ROOTS = 50_000;
 
 type BoundaryActivatable = Element & {
+  // Typed as `number`, not `ActivationOutcome`: the hook may belong to a
+  // foreign element that never saw this contract, so the value is validated
+  // once in `invokeActivationHook` instead of being trusted by the type.
   [STREAMING_BOUNDARY_ACTIVATE]?: (
     state?: Record<string, unknown>,
     bypassAncestor?: Element,
@@ -83,6 +92,14 @@ const pendingBarrierRoots = new Set<Element>();
 let pendingUndefinedRoots = 0;
 let activationGeneration = 0;
 let failureHandler: ((reason: string) => void) | null = null;
+/**
+ * The offending value behind the most recent `ELEMENT_INVALID_OUTCOME`.
+ *
+ * A scalar rather than a carried payload so the rejection costs no allocation
+ * on a path the coordinator takes for every marked root. Every caller reads it
+ * in the same turn it observes the result, before any further hook can run.
+ */
+let invalidActivationOutcome: unknown;
 
 const PENDING_RECORD = Symbol();
 
@@ -149,6 +166,20 @@ function missingTemplateReason(tag: string): string {
   return `template metadata missing while activating <${tag}>`;
 }
 
+/**
+ * Report a hook that answered outside the shared activation contract.
+ *
+ * Kept distinct from `missingTemplateReason` on purpose: folding an
+ * unrecognized code into "missing template" sends every reader looking for
+ * absent metadata when the real defect is a hook returning a code this
+ * coordinator cannot decode.
+ */
+function invalidOutcomeReason(tag: string): string {
+  return `<${tag}> returned an unrecognized streaming activation outcome ${
+    String(invalidActivationOutcome)
+  }`;
+}
+
 function barrierLimitReason(): string {
   return `pending ancestor-barrier root count exceeds ${MAX_PENDING_BARRIER_ROOTS}`;
 }
@@ -262,7 +293,8 @@ function activatePendingBarrierRoot(el: Element): number {
   try {
     const outcome = resumeRetainedRoot(el, record, updates);
     if (outcome === ACTIVATION_ANCESTOR_BARRIER) return ELEMENT_DEFERRED;
-    return outcome === ACTIVATION_MISSING_TEMPLATE
+    return outcome === ACTIVATION_MISSING_TEMPLATE ||
+        outcome === ELEMENT_INVALID_OUTCOME
       ? outcome
       : ELEMENT_ACTIVATED_FROM_PENDING;
   } finally {
@@ -304,6 +336,9 @@ function resumeBarrierRoot(this: Element): void {
     if (outcome === ACTIVATION_MISSING_TEMPLATE) {
       abandonDeferredTree(this);
       fail(missingTemplateReason(tagOf(this)));
+    } else if (outcome === ELEMENT_INVALID_OUTCOME) {
+      abandonDeferredTree(this);
+      fail(invalidOutcomeReason(tagOf(this)));
     }
   } catch (error) {
     abandonDeferredDescendants(this);
@@ -377,6 +412,11 @@ function activatePendingRoot(
       fail(missingTemplateReason(tag));
       return;
     }
+    if (outcome === ELEMENT_INVALID_OUTCOME) {
+      abandonDeferredTree(el);
+      fail(invalidOutcomeReason(tag));
+      return;
+    }
     if (outcome === ACTIVATION_ANCESTOR_BARRIER) {
       // Re-retained by `resumeRetainedRoot`; only the budget is enforced here.
       if (pendingBarrierRoots.size > MAX_PENDING_BARRIER_ROOTS) {
@@ -470,6 +510,9 @@ export function activateDeferredTree(
           if (outcome === ACTIVATION_MISSING_TEMPLATE) {
             return missingTemplateReason(tagOf(el));
           }
+          if (outcome === ELEMENT_INVALID_OUTCOME) {
+            return invalidOutcomeReason(tagOf(el));
+          }
           if (outcome === ELEMENT_LIMIT_FAILURE) {
             return `pending undefined root count exceeds ${MAX_PENDING_UNDEFINED_ROOTS}`;
           }
@@ -596,15 +639,23 @@ function invokeActivationHook(
     removeStreamingAttributes(el);
     throw error;
   }
-  if (outcome === ACTIVATION_ANCESTOR_BARRIER) return outcome;
+  // Only a genuinely finished root gives up its markers. A barrier still owns
+  // its root, and a root that could not hydrate keeps them for fatal cleanup.
   if (
-    outcome !== ACTIVATION_ACTIVATED &&
-    outcome !== ACTIVATION_STATIC_HOST_OPT_OUT
+    outcome === ACTIVATION_ACTIVATED ||
+    outcome === ACTIVATION_STATIC_HOST_OPT_OUT
   ) {
-    return ACTIVATION_MISSING_TEMPLATE;
+    removeStreamingAttributes(el);
+    return outcome;
   }
-  removeStreamingAttributes(el);
-  return outcome;
+  if (
+    outcome === ACTIVATION_ANCESTOR_BARRIER ||
+    outcome === ACTIVATION_MISSING_TEMPLATE
+  ) {
+    return outcome;
+  }
+  invalidActivationOutcome = outcome;
+  return ELEMENT_INVALID_OUTCOME;
 }
 
 /** Reset retained activation state and invalidate uncancellable waiters. */
diff --git a/packages/webui-framework/src/streaming-mode.test.ts b/packages/webui-framework/src/streaming-mode.test.ts
index 5ab8453ee..c64de84ce 100644
--- a/packages/webui-framework/src/streaming-mode.test.ts
+++ b/packages/webui-framework/src/streaming-mode.test.ts
@@ -4,7 +4,23 @@
 import { strict as assert } from 'node:assert';
 import { describe, test } from 'node:test';
 
-import { isStreamingHydrationMode, resetStreamingModeForTests } from './streaming-mode.js';
+import {
+  ACTIVATION_ACTIVATED,
+  ACTIVATION_ANCESTOR_BARRIER,
+  ACTIVATION_MISSING_TEMPLATE,
+  ACTIVATION_STATIC_HOST_OPT_OUT,
+  isStreamingHydrationMode,
+  resetStreamingModeForTests,
+} from './streaming-mode.js';
+import type { ActivationOutcome } from './streaming-mode.js';
+import {
+  ELEMENT_ACTIVATED_FROM_PENDING,
+  ELEMENT_BARRIER_LIMIT_FAILURE,
+  ELEMENT_DEFERRED,
+  ELEMENT_IGNORED,
+  ELEMENT_INVALID_OUTCOME,
+  ELEMENT_LIMIT_FAILURE,
+} from './streaming-deferred.js';
 
 function withDocument<T>(meta: string | null, run: () => T): T {
   const previousDocument = Object.getOwnPropertyDescriptor(globalThis, 'document');
@@ -67,3 +83,77 @@ describe('streaming-mode detection', () => {
     });
   });
 });
+
+/**
+ * The `STREAMING_BOUNDARY_ACTIVATE` outcome contract.
+ *
+ * These codes are the wire between the producer (`template-element.ts`) and the
+ * consumer (`streaming-deferred.ts`). They used to be declared twice, so the
+ * two copies could drift silently, and the activation space overlapped the
+ * coordinator's own element-walk results — `ACTIVATION_ANCESTOR_BARRIER` and
+ * `ELEMENT_DEFERRED` were both `4`. Both spaces still travel through one
+ * `number`, so the disjointness below is what keeps them decodable.
+ */
+describe('activation outcome contract', () => {
+  const ACTIVATION_OUTCOMES: ReadonlyArray<readonly [string, ActivationOutcome]> = [
+    ['ACTIVATION_ACTIVATED', ACTIVATION_ACTIVATED],
+    ['ACTIVATION_STATIC_HOST_OPT_OUT', ACTIVATION_STATIC_HOST_OPT_OUT],
+    ['ACTIVATION_MISSING_TEMPLATE', ACTIVATION_MISSING_TEMPLATE],
+    ['ACTIVATION_ANCESTOR_BARRIER', ACTIVATION_ANCESTOR_BARRIER],
+  ];
+
+  const ELEMENT_RESULTS: ReadonlyArray<readonly [string, number]> = [
+    ['ELEMENT_IGNORED', ELEMENT_IGNORED],
+    ['ELEMENT_DEFERRED', ELEMENT_DEFERRED],
+    ['ELEMENT_LIMIT_FAILURE', ELEMENT_LIMIT_FAILURE],
+    ['ELEMENT_ACTIVATED_FROM_PENDING', ELEMENT_ACTIVATED_FROM_PENDING],
+    ['ELEMENT_BARRIER_LIMIT_FAILURE', ELEMENT_BARRIER_LIMIT_FAILURE],
+    ['ELEMENT_INVALID_OUTCOME', ELEMENT_INVALID_OUTCOME],
+  ];
+
+  test('every activation outcome is a distinct non-zero integer', () => {
+    const seen = new Map<number, string>();
+    for (const [name, value] of ACTIVATION_OUTCOMES) {
+      assert.ok(
+        Number.isInteger(value) && value > 0,
+        `${name} must be a non-zero integer so a hook returning nothing is rejected`,
+      );
+      const previous = seen.get(value);
+      assert.equal(previous, undefined, `${name} duplicates ${previous} (${value})`);
+      seen.set(value, name);
+    }
+    assert.equal(seen.size, ACTIVATION_OUTCOMES.length);
+  });
+
+  test('the activation space never collides with an element-walk result', () => {
+    const activationValues = new Set<number>(
+      ACTIVATION_OUTCOMES.map(([, value]) => value),
+    );
+    const collisions = ELEMENT_RESULTS
+      .filter(([, value]) => activationValues.has(value))
+      .map(([name]) => name);
+    assert.deepEqual(
+      collisions,
+      [],
+      'an element-walk result reusing an activation code makes the two indistinguishable',
+    );
+  });
+
+  test('every element-walk result is itself distinct', () => {
+    const seen = new Map<number, string>();
+    for (const [name, value] of ELEMENT_RESULTS) {
+      const previous = seen.get(value);
+      assert.equal(previous, undefined, `${name} duplicates ${previous} (${value})`);
+      seen.set(value, name);
+    }
+    assert.equal(seen.size, ELEMENT_RESULTS.length);
+  });
+
+  test('an ancestor barrier stays distinguishable from a deferred element', () => {
+    assert.notEqual(
+      ACTIVATION_ANCESTOR_BARRIER,
+      ELEMENT_DEFERRED,
+      'the coordinator branches on both from the same value; sharing 4 conflated them',
+    );
+  });
+});
diff --git a/packages/webui-framework/src/streaming-mode.ts b/packages/webui-framework/src/streaming-mode.ts
index f4ce86db8..6bd93d89d 100644
--- a/packages/webui-framework/src/streaming-mode.ts
+++ b/packages/webui-framework/src/streaming-mode.ts
@@ -11,11 +11,13 @@
  * `streaming.ts` would close that cycle.
  *
  * It carries only what the always-shipped bundle genuinely needs: mode
- * detection, the two shared hook symbols, and the single `data-ws` dormancy
- * marker. Everything span-shaped — the `data-ws-span` / `data-ws-enclosing`
- * attribute names and the open-span registry that resolves them — lives in the
- * opt-in streaming graph (`streaming-dom.ts`, `streaming-spans.ts`), so a
- * non-streaming app never downloads a byte of it.
+ * detection, the two shared hook symbols, the single `data-ws` dormancy
+ * marker, and the numeric activation-outcome codes both sides of the
+ * `STREAMING_BOUNDARY_ACTIVATE` contract speak. Everything span-shaped — the
+ * `data-ws-span` / `data-ws-enclosing` attribute names and the open-span
+ * registry that resolves them — lives in the opt-in streaming graph
+ * (`streaming-dom.ts`, `streaming-spans.ts`), so a non-streaming app never
+ * downloads a byte of it.
  */
 
 let cached: boolean | undefined;
@@ -31,6 +33,46 @@ export const PENDING_ROOT_CONNECTED = Symbol.for(
 /** Compiler-owned marker for an uncommitted streamed host. */
 export const STREAMED_HOST_ATTR = 'data-ws';
 
+// ── Activation outcomes ─────────────────────────────────────────
+//
+// The producer (`template-element.ts`) and the consumer
+// (`streaming-deferred.ts`) both import these, so the contract has exactly one
+// definition and `ActivationOutcome` makes TypeScript reject a producer that
+// invents a code the consumer cannot decode.
+//
+// Numeric codes rather than result objects: the coordinator classifies every
+// marked root on the boundary walk, and a per-root object there would allocate
+// once per streamed component.
+//
+// The range is `1..4` on purpose. The coordinator's own element-walk results
+// (`ELEMENT_*` in `streaming-deferred.ts`) occupy a disjoint decade, so the two
+// spaces can flow through one `number` without a code from either side ever
+// being mistaken for the other. Codes are also non-zero so a hook that returns
+// nothing is rejected rather than decoded.
+
+/** The root hydrated, or was already live and needed no work. */
+export const ACTIVATION_ACTIVATED = 1;
+/** A compiler-owned static host declined activation on purpose. */
+export const ACTIVATION_STATIC_HOST_OPT_OUT = 2;
+/** Template metadata was unavailable; the root cannot hydrate. */
+export const ACTIVATION_MISSING_TEMPLATE = 3;
+/** An unfinished ancestor owns this root until its barrier lifts. */
+export const ACTIVATION_ANCESTOR_BARRIER = 4;
+
+/**
+ * Every code `STREAMING_BOUNDARY_ACTIVATE` is allowed to return.
+ *
+ * Typing the hook with this union is what enforces producer/consumer parity at
+ * compile time. It deliberately does not describe what a *foreign* element may
+ * hand back at runtime: the coordinator still validates the returned value and
+ * fails closed on anything outside this set.
+ */
+export type ActivationOutcome =
+  | typeof ACTIVATION_ACTIVATED
+  | typeof ACTIVATION_STATIC_HOST_OPT_OUT
+  | typeof ACTIVATION_MISSING_TEMPLATE
+  | typeof ACTIVATION_ANCESTOR_BARRIER;
+
 /**
  * Whether this document was served in streaming-hydration mode.
  *
diff --git a/packages/webui-framework/src/streaming-pipeline.test.ts b/packages/webui-framework/src/streaming-pipeline.test.ts
index c1c7d86b5..9211d38f5 100644
--- a/packages/webui-framework/src/streaming-pipeline.test.ts
+++ b/packages/webui-framework/src/streaming-pipeline.test.ts
@@ -158,7 +158,7 @@ function element(tagName: string, spec: ElementSpec = {}): FakeElement {
       const outcome = spec.hook!(state, bypassAncestor);
       return typeof outcome === 'number'
         ? outcome
-        : spec.activationOutcome ?? 1;
+        : spec.activationOutcome ?? ACTIVATION_ACTIVATED;
     };
   }
   if (spec.abandon) node[ABANDON] = spec.abandon;
@@ -308,7 +308,7 @@ function defineTag(
   tag: string,
   supportsDetachedResume = true,
   hook: (state?: Record<string, unknown>) => void = () => {},
-  outcome = 1,
+  outcome: number = ACTIVATION_ACTIVATED,
 ): void {
   class DefinedElement {}
   if (supportsDetachedResume) {
@@ -372,6 +372,19 @@ const {
   pendingBarrierRootCountForTests: __pendingBarrierRootCountForTests,
 } = await import('./streaming-coordinator.js');
 
+/**
+ * The shared activation-outcome contract (`streaming-mode.ts`).
+ *
+ * Fake hooks below return these instead of bare numbers so a renumbering
+ * cannot leave the tests asserting a code the coordinator no longer speaks.
+ */
+const {
+  ACTIVATION_ACTIVATED,
+  ACTIVATION_ANCESTOR_BARRIER,
+  ACTIVATION_MISSING_TEMPLATE,
+  ACTIVATION_STATIC_HOST_OPT_OUT,
+} = await import('./streaming-mode.js');
+
 const {
   beginStreamingGate,
   __resetLifecycleForTests,
@@ -409,6 +422,38 @@ function predefine(...tags: string[]): void {
   for (const tag of tags) definedTags.set(tag, class {});
 }
 
+/**
+ * Collect the coordinator's fatal-failure log instead of silencing it.
+ *
+ * A halt is only correct if it names the right defect, so these tests assert on
+ * the reason text rather than on the halt flag alone.
+ */
+function captureErrors(): {
+  readonly messages: string[];
+  restore(): void;
+} {
+  const messages: string[] = [];
+  const previous = console.error;
+  console.error = (...args: unknown[]): void => {
+    messages.push(args.map((arg) => String(arg)).join(' '));
+  };
+  return {
+    messages,
+    restore(): void {
+      console.error = previous;
+    },
+  };
+}
+
+function assertLogged(messages: readonly string[], fragment: string): void {
+  assert.ok(
+    messages.some((message) => message.includes(fragment)),
+    `expected a failure mentioning "${fragment}", got: ${
+      messages.join(' | ') || '(nothing logged)'
+    }`,
+  );
+}
+
 /** Patches queued for late activation accumulate in a null-prototype object
  *  (network-supplied keys must never reach `Object.prototype`), so copy them
  *  into plain objects before strict deep-equality assertions. Keys are defined
@@ -1295,7 +1340,7 @@ describe('streaming coordinator pipeline', () => {
     // and the immediate commit path already writes to it.
     const staticHost = element('static-panel', {
       hook() {},
-      activationOutcome: 2,
+      activationOutcome: ACTIVATION_STATIC_HOST_OPT_OUT,
       setState(state) {
         updates.push(state);
       },
@@ -1711,9 +1756,9 @@ describe('streaming coordinator pipeline', () => {
     let outerActive = false;
     const inner = element('zero-inner-host', {
       hook() {
-        if (!outerActive) return 4;
+        if (!outerActive) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('inner');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     const outer = element('zero-outer-host', {
@@ -1837,9 +1882,9 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('later-span-child', {
       hook(_state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('later-span-parent', {
@@ -1881,10 +1926,10 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('early-child', {
       hook(state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
         childStates.push(state);
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('spanning-parent', {
@@ -1935,9 +1980,9 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('mismatch-child', {
       hook(_state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('mismatch-parent', {
@@ -1951,9 +1996,9 @@ describe('streaming coordinator pipeline', () => {
     });
     const unmarked = element('unmarked-child', {
       hook() {
-        if (!parentActive) return 4;
+        if (!parentActive) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('unmarked');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     unmarked.setAttribute('data-ws', '');
@@ -1992,15 +2037,15 @@ describe('streaming coordinator pipeline', () => {
     const nested = element('barrier-nested-root', {
       hook() {
         order.push('nested');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     nested.setAttribute('data-ws', '');
     const child = element('barrier-outer-root', {
       hook() {
-        if (!parentActive) return 4;
+        if (!parentActive) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
       children: [nested],
     });
@@ -2046,9 +2091,9 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('updatable-early-child', {
       hook(state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         activations.push(state);
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
       setState(state) {
         updates.push(state);
@@ -2095,9 +2140,9 @@ describe('streaming coordinator pipeline', () => {
     child = element('late-early-child', {
       hook(state, bypassAncestor) {
         bypasses.push(bypassAncestor);
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         childActivations.push(state);
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
       setState(state) {
         childUpdates.push(state);
@@ -2160,9 +2205,9 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('light-span-child', {
       hook(_state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('light-span-parent', {
@@ -2195,17 +2240,17 @@ describe('streaming coordinator pipeline', () => {
     child = element('nested-span-child', {
       hook(_state, bypassAncestor) {
         const bypassesInner = bypassAncestor === inner;
-        if ((!innerActive && !bypassesInner) || !outerActive) return 4;
+        if ((!innerActive && !bypassesInner) || !outerActive) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     inner = element('nested-inner-parent', {
       hook() {
-        if (!outerActive) return 4;
+        if (!outerActive) return ACTIVATION_ANCESTOR_BARRIER;
         innerActive = true;
         order.push('inner');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     const outer = element('nested-outer-parent', {
@@ -2319,9 +2364,9 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('shadow-span-child', {
       hook(_state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
         order.push('child');
-        return 1;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('shadow-span-parent', {
@@ -2352,8 +2397,8 @@ describe('streaming coordinator pipeline', () => {
     let child!: FakeElement;
     child = element('truncated-span-child', {
       hook(_state, bypassAncestor) {
-        if (!parentActive && bypassAncestor !== parent) return 4;
-        return 1;
+        if (!parentActive && bypassAncestor !== parent) return ACTIVATION_ANCESTOR_BARRIER;
+        return ACTIVATION_ACTIVATED;
       },
     });
     parent = element('truncated-span-parent', {
@@ -3228,7 +3273,7 @@ describe('streaming coordinator pipeline', () => {
   test('an explicit missing-template activation outcome halts without completion', async () => {
     const root = element('my-missing-meta', {
       attrs: { 'data-ws': '' },
-      activationOutcome: 3,
+      activationOutcome: ACTIVATION_MISSING_TEMPLATE,
       hook() {},
     });
     const b = buildBoundary(0, 0, [root], { state: {} });
@@ -3284,7 +3329,7 @@ describe('streaming coordinator pipeline', () => {
     let called = false;
     const host = element('my-optout', {
       attrs: { 'data-ws': '' },
-      activationOutcome: 2,
+      activationOutcome: ACTIVATION_STATIC_HOST_OPT_OUT,
       hook() {
         called = true; // opts out: records the call but performs no activation
       },
@@ -3300,4 +3345,227 @@ describe('streaming coordinator pipeline', () => {
     assert.equal(hasWs(host), false, 'data-ws stripped from a committed opt-out root');
     assert.equal(host.parentNode, b.root, 'the opt-out root is retained');
   });
+
+  // ── Shared activation-outcome contract (`streaming-mode.ts`) ─────────
+
+  test('every shared activation outcome drives its own coordinator behavior', async () => {
+    interface OutcomeCase {
+      readonly label: string;
+      readonly outcome: number;
+      readonly halts: boolean;
+      readonly keepsMarker: boolean;
+      readonly retainedBehindBarrier: number;
+    }
+    // One table so a new outcome cannot be added to `streaming-mode.ts` with
+    // only one of the two sides taught how to handle it.
+    const cases: readonly OutcomeCase[] = [
+      {
+        label: 'activated',
+        outcome: ACTIVATION_ACTIVATED,
+        halts: false,
+        keepsMarker: false,
+        retainedBehindBarrier: 0,
+      },
+      {
+        label: 'static-host opt-out',
+        outcome: ACTIVATION_STATIC_HOST_OPT_OUT,
+        halts: false,
+        keepsMarker: false,
+        retainedBehindBarrier: 0,
+      },
+      {
+        label: 'missing template',
+        outcome: ACTIVATION_MISSING_TEMPLATE,
+        halts: true,
+        keepsMarker: false,
+        retainedBehindBarrier: 0,
+      },
+      {
+        label: 'ancestor barrier',
+        outcome: ACTIVATION_ANCESTOR_BARRIER,
+        halts: false,
+        keepsMarker: true,
+        retainedBehindBarrier: 1,
+      },
+    ];
+
+    for (const [index, spec] of cases.entries()) {
+      // A halting case would reject every later boundary, so each case gets the
+      // same fresh coordinator `beforeEach` hands the other tests.
+      __resetStreamingCoordinatorForTests();
+      __resetLifecycleForTests();
+      beginStreamingGate();
+
+      const tag = `outcome-case-${index}`;
+      let invoked = 0;
+      const root = element(tag, {
+        attrs: { 'data-ws': '' },
+        activationOutcome: spec.outcome,
+        hook() {
+          invoked++;
+        },
+      });
+      const b = buildBoundary(0, 0, [root], { state: {} });
+      predefine(tag);
+
+      const previousError = console.error;
+      console.error = () => {};
+      try {
+        enqueue(b.sentinel);
+        await flush();
+      } finally {
+        console.error = previousError;
+      }
+
+      assert.equal(invoked, 1, `${spec.label}: the hook runs exactly once`);
+      assert.equal(
+        __isHaltedForTests(),
+        spec.halts,
+        `${spec.label}: only an undecodable root may halt the stream`,
+      );
+      assert.equal(
+        hasWs(root),
+        spec.keepsMarker,
+        `${spec.label}: a root still owned by a barrier keeps its marker`,
+      );
+      assert.equal(
+        __pendingBarrierRootCountForTests(),
+        spec.retainedBehindBarrier,
+        `${spec.label}: only an ancestor barrier retains the root`,
+      );
+      assert.equal(
+        __pendingTagWaiterCountForTests(),
+        0,
+        `${spec.label}: an already-defined tag never opens a definition waiter`,
+      );
+    }
+  });
+
+  test('an ancestor barrier is retained separately from a definition deferral', async () => {
+    // Both outcomes stop the walk from descending, and both once shared the
+    // value 4. The two retention sets are what tell them apart.
+    const barrier = element('shared-code-barrier', {
+      attrs: { 'data-ws': '' },
+      activationOutcome: ACTIVATION_ANCESTOR_BARRIER,
+      hook() {},
+    });
+    const undefinedRoot = element('shared-code-undefined', {
+      attrs: { 'data-ws': '' },
+      hook() {},
+    });
+    const b = buildBoundary(0, 0, [barrier, undefinedRoot], { state: {} });
+    predefine('shared-code-barrier');
+
+    enqueue(b.sentinel);
+    await flush();
+
+    assert.equal(__isHaltedForTests(), false);
+    assert.equal(
+      __pendingBarrierRootCountForTests(),
+      1,
+      'the barrier root is held by the barrier set, not by a tag waiter',
+    );
+    assert.equal(
+      __pendingTagWaiterCountForTests(),
+      1,
+      'the undefined root is held by a tag waiter, not by the barrier set',
+    );
+    assert.equal(__pendingUndefinedRootCountForTests(), 1);
+    assert.equal(hasWs(barrier), true, 'a barrier still owns its root');
+    assert.equal(hasWs(undefinedRoot), true, 'an undefined root stays dormant');
+  });
+
+  test('an unrecognized activation outcome fails closed with its own reason', async () => {
+    const root = element('my-bogus-outcome', {
+      attrs: { 'data-ws': '' },
+      activationOutcome: 99,
+      hook() {},
+    });
+    const b = buildBoundary(0, 0, [root], { state: {} });
+    predefine('my-bogus-outcome');
+
+    const logged = captureErrors();
+    try {
+      enqueue(b.sentinel);
+      await flush();
+    } finally {
+      logged.restore();
+    }
+
+    assert.equal(
+      __isHaltedForTests(),
+      true,
+      'an outcome the coordinator cannot decode must not be silently absorbed',
+    );
+    assertLogged(logged.messages, 'unrecognized streaming activation outcome 99');
+    assert.equal(
+      logged.messages.some((m) => m.includes('template metadata missing')),
+      false,
+      'an unknown outcome must not masquerade as missing metadata',
+    );
+    assert.equal(hasWs(root), false, 'fatal cleanup strips the marker');
+    assert.equal(__getLifecycleStateForTests().completed, false);
+  });
+
+  test('an unrecognized outcome from a late definition resume fails closed', async () => {
+    const root = element('my-late-bogus', {
+      activationOutcome: 42,
+      hook() {},
+    });
+    const b = buildBoundary(0, 0, [root], { state: {} });
+
+    enqueue(b.sentinel);
+    await flush();
+    assert.equal(__pendingTagWaiterCountForTests(), 1, 'the undefined tag defers first');
+    assert.equal(__isHaltedForTests(), false);
+
+    const logged = captureErrors();
+    try {
+      defineTag('my-late-bogus');
+      await flush();
+    } finally {
+      logged.restore();
+    }
+
+    assert.equal(__isHaltedForTests(), true);
+    assertLogged(logged.messages, 'unrecognized streaming activation outcome 42');
+    assert.equal(hasWs(root), false, 'the abandoned root loses its marker');
+    assert.equal(__getLifecycleStateForTests().completed, false);
+  });
+
+  test('an unrecognized outcome from a barrier release fails closed', async () => {
+    let parentActive = false;
+    const child = element('barrier-bogus-child', {
+      hook() {
+        return parentActive ? 77 : ACTIVATION_ANCESTOR_BARRIER;
+      },
+    });
+    const parent = element('barrier-bogus-parent', {
+      hook() {
+        parentActive = true;
+      },
+    });
+    // `enclosingMarker: 1` mismatches span 0, so the child has no bypass and is
+    // genuinely retained until the span completes.
+    const scenario = buildSpanScenario(parent, child, { enclosingMarker: 1 });
+    predefine('barrier-bogus-child', 'barrier-bogus-parent');
+
+    enqueue(scenario.boundarySentinel);
+    await flush();
+    assert.equal(__pendingBarrierRootCountForTests(), 1);
+    assert.equal(__isHaltedForTests(), false);
+
+    const logged = captureErrors();
+    try {
+      enqueue(scenario.spanSentinel);
+      await flush();
+    } finally {
+      logged.restore();
+    }
+
+    assert.equal(__isHaltedForTests(), true);
+    assertLogged(logged.messages, 'unrecognized streaming activation outcome 77');
+    assert.equal(__pendingBarrierRootCountForTests(), 0, 'the retained root is released');
+    assert.equal(hasStreamingAttrs(child), false, 'fatal cleanup strips its markers');
+  });
 });
diff --git a/packages/webui-framework/src/streaming-spans.ts b/packages/webui-framework/src/streaming-spans.ts
index 30a8c4137..c95c71d55 100644
--- a/packages/webui-framework/src/streaming-spans.ts
+++ b/packages/webui-framework/src/streaming-spans.ts
@@ -10,8 +10,6 @@ import {
 } from './streaming-dom.js';
 import type { HydrationRange } from './streaming-dom.js';
 
-/** Maximum unfinished component hosts retained by one response. */
-export const MAX_OPEN_SPANS = 128;
 /** Maximum runtime component ancestry crossed by one early boundary. */
 export const MAX_SPAN_NESTING = 32;
 
@@ -25,6 +23,15 @@ interface OpenSpan {
   openChildren: number;
 }
 
+/**
+ * Unfinished component hosts, keyed by SpanInstanceId.
+ *
+ * This is the *current* ancestor chain, not a growing pool: a span is only ever
+ * registered as part of one boundary's spanning ancestry, and the server opens
+ * and closes spans as a strict stack, so an entry is dropped by `completeSpan`
+ * before any span outside that chain can register. `MAX_SPAN_NESTING` bounds
+ * the chain — and therefore this map — on the one walk that fills it.
+ */
 const openSpans = new Map<number, OpenSpan>();
 // Reused by the single-record pump while it validates one ancestor chain.
 const hostScratch: Element[] = [];
@@ -149,9 +156,6 @@ function registerSpan(
   if (id !== nextExpectedSpanInstanceId) {
     return `expected span instance ${nextExpectedSpanInstanceId}, received ${id}`;
   }
-  if (openSpans.size >= MAX_OPEN_SPANS) {
-    return `open component span count exceeds ${MAX_OPEN_SPANS}`;
-  }
   const marker = host.previousSibling;
   if (
     marker?.nodeType !== 8 /* COMMENT_NODE */ ||
diff --git a/packages/webui-framework/src/template-element.test.ts b/packages/webui-framework/src/template-element.test.ts
index ce95773e3..5dc45f4eb 100644
--- a/packages/webui-framework/src/template-element.test.ts
+++ b/packages/webui-framework/src/template-element.test.ts
@@ -77,7 +77,13 @@ Object.defineProperty(globalThis, 'customElements', {
 
 const { TemplateElement } = await import('./template-element.js');
 const { registerTemplateData } = await import('./template.js');
-const { resetStreamingModeForTests } = await import('./streaming-mode.js');
+const {
+  ACTIVATION_ACTIVATED,
+  ACTIVATION_ANCESTOR_BARRIER,
+  ACTIVATION_MISSING_TEMPLATE,
+  ACTIVATION_STATIC_HOST_OPT_OUT,
+  resetStreamingModeForTests,
+} = await import('./streaming-mode.js');
 const {
   beginStreamingGate,
   markBoundaryPending,
@@ -231,7 +237,7 @@ describe('TemplateElement.connectedCallback — streamed-host (data-ws) deferral
       received = { status: 'ready' };
       assert.equal(
         raw[STREAMING_BOUNDARY_ACTIVATE](received),
-        1,
+        ACTIVATION_ACTIVATED,
       );
       raw.removeAttribute('data-ws');
     };
@@ -430,7 +436,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
         { child: true },
         parent as unknown as Element,
       ),
-      1,
+      ACTIVATION_ACTIVATED,
     );
     assert.equal(childRaw.$deferredSSR, false);
   });
@@ -475,7 +481,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
         { child: true },
         unrelated as unknown as Element,
       ),
-      4,
+      ACTIVATION_ANCESTOR_BARRIER,
     );
     assert.equal(childRaw.$deferredSSR, true);
   });
@@ -530,7 +536,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
         { child: true },
         inner as unknown as Element,
       ),
-      4,
+      ACTIVATION_ANCESTOR_BARRIER,
     );
     assert.equal(childRaw.$deferredSSR, true);
   });
@@ -555,7 +561,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
     raw.setAttribute('data-ws', '');
     el.connectedCallback();
 
-    assert.equal(raw[STREAMING_BOUNDARY_ACTIVATE](), 3);
+    assert.equal(raw[STREAMING_BOUNDARY_ACTIVATE](), ACTIVATION_MISSING_TEMPLATE);
     assert.equal(raw.$deferredSSR, true);
 
     raw[STREAMING_BOUNDARY_ABANDON]();
@@ -590,7 +596,7 @@ describe('TemplateElement — streamed-host activation ownership', () => {
     raw.setAttribute('data-ws', '');
     el.connectedCallback();
 
-    assert.equal(raw[STREAMING_BOUNDARY_ACTIVATE](), 2);
+    assert.equal(raw[STREAMING_BOUNDARY_ACTIVATE](), ACTIVATION_STATIC_HOST_OPT_OUT);
     assert.ok(raw.$meta, 'boundary commit caches metadata without mounting');
     el.setState({ message: 'wake' });
     assert.equal(activationMeta, raw.$meta, 'the later state write can activate from cached metadata');
diff --git a/packages/webui-framework/src/template-element.ts b/packages/webui-framework/src/template-element.ts
index c58cedf47..8a215bb63 100644
--- a/packages/webui-framework/src/template-element.ts
+++ b/packages/webui-framework/src/template-element.ts
@@ -58,11 +58,16 @@ import type {
 } from './template.js';
 import { hydrationStart, hydrationEnd } from './lifecycle.js';
 import {
+  ACTIVATION_ACTIVATED,
+  ACTIVATION_ANCESTOR_BARRIER,
+  ACTIVATION_MISSING_TEMPLATE,
+  ACTIVATION_STATIC_HOST_OPT_OUT,
   isStreamingHydrationMode,
   PENDING_ROOT_CONNECTED,
   STREAMED_HOST_ATTR,
   STREAMING_BOUNDARY_ACTIVATE,
 } from './streaming-mode.js';
+import type { ActivationOutcome } from './streaming-mode.js';
 import {
   createRepeatKeyState,
   seedHydratedRepeatKeys,
@@ -186,10 +191,6 @@ const EMPTY_SET: Set<string> = Object.freeze(new Set<string>()) as Set<string>;
 const WEBUI_SET_STATE_KEY = Symbol.for('microsoft.webui.setStateKey');
 /** Branded fatal-stream cleanup hook, invoked before `data-ws` is removed. */
 const STREAMING_BOUNDARY_ABANDON = Symbol.for('microsoft.webui.boundaryAbandon');
-const ACTIVATION_ACTIVATED = 1;
-const ACTIVATION_STATIC_HOST_OPT_OUT = 2;
-const ACTIVATION_MISSING_TEMPLATE = 3;
-const ACTIVATION_ANCESTOR_BARRIER = 4;
 
 const templateMetaByCtor = new WeakMap<Function, TemplateMeta>();
 const pendingAncestorDescendants = new WeakMap<Element, TemplateElement[]>();
@@ -418,12 +419,16 @@ export class TemplateElement extends HTMLElement {
 
   /**
    * Internal hook invoked by the streaming coordinator (`streaming.ts`) once
-   * a boundary containing this element has committed. Returns a numeric outcome
-   * so the allocation-sensitive coordinator can distinguish activation, an
-   * intentional static-host opt-out, and missing metadata without per-root
-   * result objects. The optional `state` is this element's boundary-local SSR
-   * state, handed straight through to hydration instead of via the global
-   * `window.__webui.state` handoff.
+   * a boundary containing this element has committed. Returns one of the
+   * shared `ActivationOutcome` codes (`streaming-mode.ts`) so the
+   * allocation-sensitive coordinator can distinguish activation, an
+   * intentional static-host opt-out, missing metadata, and an unfinished
+   * ancestor without per-root result objects. The union is the contract: a
+   * code this method invents but the coordinator cannot decode is a compile
+   * error here, and a runtime one on the coordinator side. The optional
+   * `state` is this element's boundary-local SSR state, handed straight
+   * through to hydration instead of via the global `window.__webui.state`
+   * handoff.
    *
    * `bypassAncestor`, when supplied, is one already-resolved ancestor element
    * this root may skip exactly once while looking for its hydration barrier.
@@ -435,7 +440,7 @@ export class TemplateElement extends HTMLElement {
   [STREAMING_BOUNDARY_ACTIVATE](
     state?: Record<string, unknown>,
     bypassAncestor?: Element,
-  ): number {
+  ): ActivationOutcome {
     // `customElements.upgrade()` installs this class on detached roots without
     // invoking connectedCallback(). Preserve the same marker-driven dormant
     // state those roots would have entered while connected before activation.