diff --git a/.changeset/binding-slot-text-positions.md b/.changeset/binding-slot-text-positions.md
new file mode 100644
index 000000000..660b7c317
--- /dev/null
+++ b/.changeset/binding-slot-text-positions.md
@@ -0,0 +1,7 @@
+---
+"@solidjs/web": patch
+---
+
+Binding slots: a slot property placed as a child (`<strong>{list.remaining}</strong> items left`) is a text position. The server emits a comment pair around it, `<!--_s:t=<occurrence>:<key>-->…<!--/_s:t-->`, with the escaped t=0 value inside on the document face and nothing on the stream face; the client writes the text between the markers from the occurrence's render effect, and a refetch's morph keeps the client's text. Strings and numbers render; nullish and booleans render empty, as a client insert renders them. Any other value is a new client dev finding (`BINDING_SLOT_POSITION`, reason `text-shape`) and clears. The content of `<textarea>`, `<title>`, `<style>` and `<script>` is not a text position (a comment is literal text there); bind `value=` or a style property instead.
+
+Breaking: a slot property as a child used to render nothing and raise the `text` finding; it now renders and binds, and the `text` reason is retired.
diff --git a/documentation/plans/text-positions.md b/documentation/plans/text-positions.md
index 056418243..976df0c0e 100644
--- a/documentation/plans/text-positions.md
+++ b/documentation/plans/text-positions.md
@@ -1,9 +1,10 @@
 # Text positions
 
-Status: design for review, 2026-09-29. Gap G1 in
+Status: implemented 2026-09-29 (principles §9.2.5). Gap G1 in
 [`examples-grid-plan.md`](./examples-grid-plan.md); builds on
 [`binding-slot-execution.md`](./binding-slot-execution.md) (G2), and lands
-after it. Decisions recorded; ready for implementation review.
+after it. Where the build departed from this text it is corrected in place,
+marked _(as built)_.
 
 A binding slot's value placed as a child — `<a>{t.label}</a>`,
 `<strong>{list.remaining}</strong> items left` — becomes a position the
@@ -54,7 +55,11 @@ for the toggle's label; `todos-server`'s count wants it.
    marker. It never enters slot-range interiors or nested frames, so only
    server-owned markup can hold one. `consumersEqual` also compares
    `start`. No parent-element marker is needed: the walk that finds slot
-   ranges finds these at no extra traversal.
+   ranges finds these at no extra traversal. _(As built: the position
+   joins the parent's EXISTING consumer entry for the occurrence when its
+   attribute markers opened one. Two entries for one element each treat
+   the other's handler as released — a counter button,
+   `<button onClick={row.bump}>{row.count}</button>`, lost its handler.)_
 4. **Client write.** The occurrence's one value effect writes a text
    position as `node.data = String(v)` into the range's one text node,
    creating it between the markers when absent (the stream face, or an
@@ -82,7 +87,11 @@ for the toggle's label; `todos-server`'s count wants it.
 ## Checks made before writing
 
 - The compiled server template needs no change for ordinary parents: the
-  hole already reaches the resolver with the stand-in.
+  hole already reaches the resolver with the stand-in. _(As built: two
+  resolvers, not one. `resolveSSRNode` sees it under live holes and in
+  element children; `tryResolveString`, a `ssr()` hole's sync path, sees
+  it under `renderToString` and through a component's `children`, where
+  it fell to `unrecognizedInsert`. Both emit the pair.)_
 - Occurrence, key and encoding reuse `slotEntry`/`encodeSlotKey`
   (`server.ts:4794–4805`); the client decodes as `slotPositions` does.
 - Existing server spec to rewrite: `frame-binding-slots.spec.tsx:986`
@@ -131,7 +140,9 @@ for the toggle's label; `todos-server`'s count wants it.
    another occurrence taking the same position; server release; a
    non-primitive finding.
 2. Server: the resolver branch; `slotTextPosition` removed. No compiler
-   change.
+   change. The writer rides on the stand-in (`slotValue` sets it), so the
+   resolvers only call it: a server render with no binding slots does not
+   retain it (the `renderToString` floor, #3722).
 3. Client: discovery in `collectSlots`, `consumersEqual`, the write in the
    occurrence's computation, the morph skip.
 4. Docs in the same PR: §9.2.3 (text joins the position kinds; the finding
diff --git a/documentation/server-components/server-components-principles.md b/documentation/server-components/server-components-principles.md
index ed3e93aa0..c3405b143 100644
--- a/documentation/server-components/server-components-principles.md
+++ b/documentation/server-components/server-components-principles.md
@@ -3371,6 +3371,77 @@ object); it is an error today, so adding it later is not breaking.
   `STRICT_READ_UNTRACKED` ("an effect callback") for any fill with
   a ref; refs are read once, untracked, at bind now.
 
+#### 9.2.5 Amendment — binding slots: text positions (2026-09-29)
+
+Design: `documentation/plans/text-positions.md`. A binding-slot
+value placed as a child — `<strong>{list.remaining}</strong> items
+left` — is a position, like an attribute: the server writes the
+t = 0 value on the document face and nothing on the stream face,
+and the client owns the text from there.
+
+**The model.**
+
+- *A marker pair around the value.*
+  `<!--_s:t=<occurrence>:<key>-->` + text + `<!--/_s:t-->`. One
+  marker cannot work on either face: on the stream face the value is
+  empty, so there is no text node to find; on the document face it
+  merges with static text beside it (`3 items left`). The end marker
+  bounds the range on both. The entry is `slotEntry`'s encoding, and
+  occurrence ids are already encoded for comment contexts, so the
+  entry cannot close the comment. A child among siblings sits inside
+  the compiler's own `<!--$-->…<!--/-->` insert range, as any dynamic
+  child does.
+- *Primitives only, as a client insert renders them.* A string or
+  number renders (escaped on the server, `node.data` on the client);
+  `null`, `undefined` and booleans render empty. Anything else — an
+  object, an array, a node, a function — is the client's
+  `text-shape` finding and clears: markup belongs in a template
+  slot. A read off a fill that returned markup keeps the `markup`
+  finding and emits an empty pair.
+- *Both server walkers emit it.* `resolveSSRNode` (live holes,
+  element children) and `tryResolveString` (a `ssr()` hole's sync
+  path — `renderToString`, a component's `children`). The compiled
+  template is unchanged.
+- *Discovery rides the slot walk.* `collectSlots` already visits
+  every child of server-owned markup; a start marker registers
+  `{ pos: "text", key, start }` on its parent element's consumer
+  entry for the occurrence — the entry its attribute markers
+  opened, if any, so an element is one consumer however its
+  positions are spelled. Two entries for one element would each
+  treat the other's handler as released. `consumersEqual` compares
+  `start`: a pair the morph re-creates is a consumer change.
+- *The occurrence's one effect writes it.* Text values are read in
+  the compute phase beside the other value positions and written
+  into the range's one text node, created between the markers when
+  absent. A primitive-only write is attribute-shaped, so it needs
+  no effect of its own.
+- *The morph keeps a pair it meets again.* An incoming start marker
+  meeting an old one with the same data skips both ranges, keeping
+  the old interior — the text analogue of the same-slot-range
+  skip. Anything else reconciles as ordinary nodes; the consumer
+  change that follows rebinds the owner. No relocation index: the
+  interior is one text node the owner rewrites on rebind. A pair
+  the server stops emitting is the server's again and gets no final
+  write, as a released attribute.
+
+**The raw-text rule.** A binding value is never the content of a
+raw-text element — `<textarea>`, `<title>`, `<style>`, `<script>`
+— where a comment is literal text and the markers would land in the
+content. `<textarea>` binds `value=`; a style binds a style
+property. Stated, not checked: the resolver does not know the
+parent, and a compiler check would add a code path to every SSR
+output (the SSR compile is one compile; `serverComponents` is a
+setting on it) for a misuse only server components can make. In
+`<textarea>` and `<title>` a violation shows on first render; in
+`<style>` and `<script>` it can fail silently.
+
+This supersedes, in 9.2.3: text positions "deferred, not rejected"
+("Rules of the shape"), "a text child" among the coercions that
+render nothing, and the open item; in its build record, "placed as
+text" among the misuses. The `text` finding reason is retired. The
+rule's sentence widens with it: **a slot property is a JSX
+attribute value or a text child, whole, and nothing else.**
+
 ### 9.3 Stage 8 seed — connection-shaped transport (2026-08-17)
 
 Recorded from the design conversation; nothing here is built (the
diff --git a/documentation/solid-2.0/08-dev-diagnostics.md b/documentation/solid-2.0/08-dev-diagnostics.md
index b9b4a0808..632778f58 100644
--- a/documentation/solid-2.0/08-dev-diagnostics.md
+++ b/documentation/solid-2.0/08-dev-diagnostics.md
@@ -704,10 +704,10 @@ Unscoped allocation alone is not the finding: a function hole with nothing scope
 **Messages:**
 
 - "[BINDING_SLOT_POSITION] A slot (`row`) is spread onto a server-rendered <li>. A binding slot binds by position — name each one (`class={row.rowClass} onClick={row.remove}`) so the template shows what the client owns."
-- "[BINDING_SLOT_POSITION] `row`'s `done` is a binding-slot value and was stringified outside a bindable position — it must be the WHOLE value of an attribute, class name, style property, handler or ref (`class={row.done}`, not `class={`x ${row.done}`}`). If it is, the element was compiled without the `serverComponents` compiler option. Nothing renders here on either face."
-- "[BINDING_SLOT_POSITION] `row`'s `count` is a binding-slot value used in an expression (a comparison, arithmetic, or a branch on its result). The server does not have the value — the client owns it — so nothing can be computed from it here. It must be the WHOLE value of an attribute, class name, style property, handler or ref; a decision that depends on it belongs in the client fill (return the decided value) or in a markup slot."
+- "[BINDING_SLOT_POSITION] `row`'s `done` is a binding-slot value and was stringified outside a bindable position — it must be the WHOLE value of an attribute, class name, style property, handler, ref or text child (`class={row.done}`, not `class={`x ${row.done}`}`). If it is, the element was compiled without the `serverComponents` compiler option. Nothing renders here on either face."
+- "[BINDING_SLOT_POSITION] `row`'s `count` is a binding-slot value used in an expression (a comparison, arithmetic, or a branch on its result). The server does not have the value — the client owns it — so nothing can be computed from it here. It must be the WHOLE value of an attribute, class name, style property, handler, ref or text child; a decision that depends on it belongs in the client fill (return the decided value) or in a markup slot."
 - "[BINDING_SLOT_POSITION] A binding-slot value (`done` of `row`) reached `class` inside template quotes, where its position marker cannot be emitted — the element was compiled without the `serverComponents` compiler option. Nothing renders here on either face."
-- "[BINDING_SLOT_POSITION] `title` of slot `row` is placed as TEXT. Text is not a bindable position yet: nothing renders here on either face. Bind it to an attribute, or render the text in a markup slot."
+- "[BINDING_SLOT_POSITION] `title` of `row#1` is placed as text, but the fill returned an object for it. A text position renders a string or number; markup belongs in a template slot. The text is cleared."
 - "[BINDING_SLOT_POSITION] `class` reads `done` off slot `row`, but the client fill returned markup, not an object. A slot renders one or the other: return an object (`{ done: … }`) for positions, or place the slot as content."
 - "[BINDING_SLOT_POSITION] A `click` position on a server-rendered element received a server-local function — it can never run. Bind a slot's property there (`const row = props.row(args); onX={row.onX}`) so the client supplies it, or bind a mutation to `action=`."
 - "[BINDING_SLOT_POSITION] A `keydown` handler position on a server-rendered element received an array. A position marker names the slot's keys, never data, so a tuple's data cannot reach the client — nothing binds here. Return the tuple from the fill (`[handler, data]`) and bind that one property."
@@ -716,7 +716,7 @@ Unscoped allocation alone is not the finding: a function hole with nothing scope
 - "[BINDING_SLOT_POSITION] Server markup binds `row#9` at 2 elements (positions: hidden, checked), but no client fill resolves for slot `row` — those positions never bind and the elements are inert. Pass `row` to the server component on the client (a function returning the object the markup reads), or check that the prop name matches on both sides."
 - "[BINDING_SLOT_POSITION] Server markup binds `row#9` at 2 elements (positions: hidden, checked), but no args record for it arrived and none can — the fill mounts with empty args. A called slot always emits its record ahead of the markup that reads it, so this is the frame protocol out of step, not the fill: a client and server from different builds (a stale dev prebundle, a cached asset), or a runtime bug minting the marker and the record under different ids."
 
-Check (dev only; server components — server-components-principles.md §9.2.3). A binding slot's property (`const row = props.row(args); row.done`) is a stand-in the server template binds at a **position** — the whole value of an attribute, a class name's condition or style property's value inside `class`/`style` object form, a handler, a ref — and the position's marker (`_s:hidden`, `_s:class="row#1:done=completed"`, `_s:on:click`, `_s:ref`) is what tells the client which positions it owns. The rule in one sentence: **a slot property is a JSX attribute value, whole, and nothing else.** The finding fires where a stand-in landed somewhere it cannot bind. `data.reason` says which: `"spread"` (`error`, throws) — the slot's whole return spread onto an element, the retired shape (the client would decide what it owns and the template could not show it); `"stringified"` (`warn`) — the stand-in was coerced to a string (a template literal, a concatenation, `String()`), so it is not the whole value; `"coerced"` (`warn`) — the stand-in was used in an expression (a comparison, arithmetic, `==`; `Symbol.toPrimitive` with a `number`/`default` hint), which the server cannot evaluate because it does not have the value — the decision belongs in the client fill, which returns the decided value; `"inline"` (`warn`) — it reached `ssrClassName`/`ssrStyle` inside template quotes, which happens only when the element was compiled without the `serverComponents` compiler option (the option makes a dynamic `class`/`style` a whole-attribute hole); `"text"` (`warn`) — placed as text content, a position not bindable yet; `"markup"` (`warn`) — read off a slot whose client fill returned content, not an object (a slot renders markup **or** data); `"server-local"` (`warn`) — a `ref`/`on*` position on a server intrinsic received a plain server function, which can never run; `"tuple"` (`warn`) — an `on*` position received an array (`onKeyDown={[row.key, 1]}`): a marker names keys, never data, so nothing binds — return the tuple from the fill instead, where the client binds it as client JSX does (only a `ref` position takes an array, whose refs merge); `"reserved-key"` (`warn`, document face) — the fill's object used a key the slot's range occupies (beginning with `$` or a digit, `length`, `slice`, `t`/`h`/`p`, `then`, `constructor`/`toString`/`valueOf`/`toJSON` — the explicit set; every other key, `filter` or `map` included, is a property read), so a read of it is the range, not a value; `"arg"` (`warn`) — a stand-in was passed in another slot call's argument (`props.child({ parentId: parent.id })`, or nested in plain objects and arrays: `{ nested: { x: row.done } }`, `[row.done]` — a `Map`, `Set` or class instance is not walked), data the server does not have; the arg carries `undefined` at that path on both faces — the record and the document face's t=0 fill (`data.from`/`data.fromKey` name the stand-in, `data.path` the position inside the arg when nested; a stand-in reachable at two paths is reported once, at the first); `"prop"` (`warn`) — a stand-in at a `prop:*` key of a runtime spread, a property position the server cannot bind (the compiled form drops `prop:*` as SSR always has, silently); `"fill-shape"` (`warn`, kind `render`, client) — the client side has the wrong shape: the fill returned something other than a plain object (`null`, an array, a DOM node, an async value, a primitive — `data.shape`), or the prop the markup reads as data is not a function; nothing binds until it is; `"orphan"` (`warn`, kind `render` — from the frame client's slot sync) — an element carries `_s:*` markers for an occurrence whose positions can never bind: `data.why` is `"fill"` when no client fill resolves for the prop (the prop was not passed, or its name differs between the sides), or `"record"` when a **called** occurrence (`prop#n`) has no args record once records can no longer arrive (the producer emits the record ahead of the markup that reads it, so a missing one is the protocol out of step — a client and server from different builds, or a runtime id mismatch — never a fill mistake; a bare occurrence named by the prop alone has no record by design and never reports); `data.elements` are the marked elements, reported once per occurrence per frame. The orphan is the one failure in this model that is otherwise silent — a handler that never fires, a class that never updates, indistinguishable from nothing happening. For `stringified`, `coerced`, `inline` and `text` **nothing renders at the position on either face**: the document face never shows a t=0 value the stream face could not reproduce, so the misuse is visible on the first render rather than on the first refetch. Truthiness (`if (row.done)`, `row.x && …`) has no runtime hook — a stand-in is an object and always truthy — and is the one misuse only the rule catches. Once per (occurrence, key, reason, position) per render; a server-local function on a spread element's handler position is judged where the client would bind it — a later spread that owns the position (source order, as `mergeProps` reads it) leaves an earlier named handler unread and unreported. `data.occurrence` names the occurrence, `data.key` the property, `data.position` the position where it applies.
+Check (dev only; server components — server-components-principles.md §9.2.3, text positions §9.2.5). A binding slot's property (`const row = props.row(args); row.done`) is a stand-in the server template binds at a **position** — the whole value of an attribute, a class name's condition or style property's value inside `class`/`style` object form, a handler, a ref, a text child — and the position's marker (`_s:hidden`, `_s:class="row#1:done=completed"`, `_s:on:click`, `_s:ref`, the comment pair `<!--_s:t=row#1:count-->…<!--/_s:t-->`) is what tells the client which positions it owns. The rule in one sentence: **a slot property is a JSX attribute value, whole, and nothing else.** The finding fires where a stand-in landed somewhere it cannot bind. `data.reason` says which: `"spread"` (`error`, throws) — the slot's whole return spread onto an element, the retired shape (the client would decide what it owns and the template could not show it); `"stringified"` (`warn`) — the stand-in was coerced to a string (a template literal, a concatenation, `String()`), so it is not the whole value; `"coerced"` (`warn`) — the stand-in was used in an expression (a comparison, arithmetic, `==`; `Symbol.toPrimitive` with a `number`/`default` hint), which the server cannot evaluate because it does not have the value — the decision belongs in the client fill, which returns the decided value; `"inline"` (`warn`) — it reached `ssrClassName`/`ssrStyle` inside template quotes, which happens only when the element was compiled without the `serverComponents` compiler option (the option makes a dynamic `class`/`style` a whole-attribute hole); `"markup"` (`warn`) — read off a slot whose client fill returned content, not an object (a slot renders markup **or** data); `"server-local"` (`warn`) — a `ref`/`on*` position on a server intrinsic received a plain server function, which can never run; `"tuple"` (`warn`) — an `on*` position received an array (`onKeyDown={[row.key, 1]}`): a marker names keys, never data, so nothing binds — return the tuple from the fill instead, where the client binds it as client JSX does (only a `ref` position takes an array, whose refs merge); `"reserved-key"` (`warn`, document face) — the fill's object used a key the slot's range occupies (beginning with `$` or a digit, `length`, `slice`, `t`/`h`/`p`, `then`, `constructor`/`toString`/`valueOf`/`toJSON` — the explicit set; every other key, `filter` or `map` included, is a property read), so a read of it is the range, not a value; `"arg"` (`warn`) — a stand-in was passed in another slot call's argument (`props.child({ parentId: parent.id })`, or nested in plain objects and arrays: `{ nested: { x: row.done } }`, `[row.done]` — a `Map`, `Set` or class instance is not walked), data the server does not have; the arg carries `undefined` at that path on both faces — the record and the document face's t=0 fill (`data.from`/`data.fromKey` name the stand-in, `data.path` the position inside the arg when nested; a stand-in reachable at two paths is reported once, at the first); `"prop"` (`warn`) — a stand-in at a `prop:*` key of a runtime spread, a property position the server cannot bind (the compiled form drops `prop:*` as SSR always has, silently); `"fill-shape"` (`warn`, kind `render`, client) — the client side has the wrong shape: the fill returned something other than a plain object (`null`, an array, a DOM node, an async value, a primitive — `data.shape`), or the prop the markup reads as data is not a function; nothing binds until it is; `"text-shape"` (`warn`, kind `render`, client) — a text position's value is not a string, number, nullish or boolean (an object, an array, a DOM node, a function, an async value — `data.shape`, with `data.key`): a text position renders a primitive as a client insert does, markup belongs in a template slot, and the text clears; `"orphan"` (`warn`, kind `render` — from the frame client's slot sync) — an element carries `_s:*` markers for an occurrence whose positions can never bind: `data.why` is `"fill"` when no client fill resolves for the prop (the prop was not passed, or its name differs between the sides), or `"record"` when a **called** occurrence (`prop#n`) has no args record once records can no longer arrive (the producer emits the record ahead of the markup that reads it, so a missing one is the protocol out of step — a client and server from different builds, or a runtime id mismatch — never a fill mistake; a bare occurrence named by the prop alone has no record by design and never reports); `data.elements` are the marked elements, reported once per occurrence per frame. The orphan is the one failure in this model that is otherwise silent — a handler that never fires, a class that never updates, indistinguishable from nothing happening. For `stringified`, `coerced` and `inline` **nothing renders at the position on either face**: the document face never shows a t=0 value the stream face could not reproduce, so the misuse is visible on the first render rather than on the first refetch. Truthiness (`if (row.done)`, `row.x && …`) has no runtime hook — a stand-in is an object and always truthy — and is the one misuse only the rule catches. Once per (occurrence, key, reason, position) per render; a server-local function on a spread element's handler position is judged where the client would bind it — a later spread that owns the position (source order, as `mergeProps` reads it) leaves an earlier named handler unread and unreported. `data.occurrence` names the occurrence, `data.key` the property, `data.position` the position where it applies.
 
 ## Programmatic diagnostics API
 
diff --git a/packages/web/frames/src/client.ts b/packages/web/frames/src/client.ts
index a58fac5c4..90a6b8a02 100644
--- a/packages/web/frames/src/client.ts
+++ b/packages/web/frames/src/client.ts
@@ -408,19 +408,9 @@ function bindDataOccurrence(
   const node = typeof Node === "function" && raw instanceof Node;
   const pending = isAsyncValue(raw);
   if (IS_DEV && (raw == null || typeof raw !== "object" || Array.isArray(raw) || node || pending)) {
-    const shape =
-      raw === null
-        ? "null"
-        : node
-          ? "a DOM node"
-          : Array.isArray(raw)
-            ? "an array"
-            : pending
-              ? "an async value"
-              : typeof raw;
+    const shape = shapeOf(raw);
     slotShapeFinding(
-      ctx.key,
-      shape,
+      { reason: "fill-shape", occurrence: ctx.key, shape },
       `[BINDING_SLOT_POSITION] The fill for \`${ctx.key}\` returned ${shape}; server markup reads ` +
         `its properties at bound positions, so it must return an object (\`{ done, onToggle, … }\`). ` +
         `Nothing binds.`
@@ -434,17 +424,13 @@ function bindDataOccurrence(
   // released so its handlers unbind.
   let bound = new Set<Element>();
   createRenderEffect(
-    () =>
-      consumers().map(({ element, positions }) => ({
-        element,
-        positions,
-        values: valuesFor(positions)
-      })),
+    () => consumers().map(valuesFor),
     writes => {
       const next = new Set<Element>();
-      for (const { element, positions, values } of writes) {
+      for (const { element, positions, values, texts } of writes) {
         next.add(element);
         write(element, positions, values);
+        for (const [start, v, key] of texts) writeText(start, v, key);
       }
       for (const element of bound) if (!next.has(element)) release(element);
       bound = next;
@@ -458,14 +444,17 @@ function bindDataOccurrence(
     for (const element of bound) release(element);
   });
   // Value positions are READ in the compute phase: a getter read here
-  // tracks, so the occurrence re-writes when its sources move.
-  function valuesFor(positions: any[]) {
+  // tracks, so the occurrence re-writes when its sources move. Text
+  // positions are values too, collected apart: they are nodes, not props.
+  function valuesFor({ element, positions }: { element: Element; positions: any[] }) {
     const props: Record<string, any> = {};
+    const texts: [Comment, unknown, string][] = [];
     let classNames: Record<string, boolean> | null = null;
     let styleProps: Record<string, any> | null = null;
-    for (const { pos, key, name } of positions) {
+    for (const { pos, key, name, start } of positions) {
       if (pos === "ref" || pos.startsWith("on:")) continue;
-      if (pos === "class" || pos === "style") {
+      if (pos === "text") texts.push([start, out[key], key]);
+      else if (pos === "class" || pos === "style") {
         if (name === undefined) props[pos] = out[key];
         else if (pos === "class") (classNames || (classNames = {}))[name] = !!out[key];
         else (styleProps || (styleProps = {}))[name] = out[key];
@@ -473,7 +462,7 @@ function bindDataOccurrence(
     }
     if (classNames !== null && !("class" in props)) props.class = classNames;
     if (styleProps !== null && !("style" in props)) props.style = styleProps;
-    return props;
+    return { element, positions, values: props, texts };
   }
   function write(element: Element, positions: any[], props: Record<string, any>) {
     let st = state.get(element);
@@ -539,24 +528,52 @@ function bindDataOccurrence(
     write(element, [], {});
     state.delete(element);
   }
+  // A text position renders as a client insert renders a primitive: a
+  // string or number as text, nullish and booleans as nothing. Anything
+  // else is content, which belongs in a template slot.
+  function writeText(start: Comment, v: unknown, key: string) {
+    let s = "";
+    if (typeof v === "string" || typeof v === "number") s = "" + v;
+    else if (IS_DEV && v != null && typeof v !== "boolean") {
+      const shape = shapeOf(v);
+      slotShapeFinding(
+        { reason: "text-shape", occurrence: ctx.key, key, shape },
+        `[BINDING_SLOT_POSITION] \`${key}\` of \`${ctx.key}\` is placed as text, but the fill ` +
+          `returned ${shape} for it. A text position renders a string or number; markup belongs ` +
+          `in a template slot. The text is cleared.`
+      );
+    }
+    const n = start.nextSibling;
+    if (n && n.nodeType === 3) {
+      if ((n as Text).data !== s) (n as Text).data = s;
+    } else if (s) start.after(s);
+  }
+}
+
+/** A value's shape, as the binding-slot shape findings name it. */
+function shapeOf(v: unknown): string {
+  return v === null
+    ? "null"
+    : typeof Node === "function" && v instanceof Node
+      ? "a DOM node"
+      : Array.isArray(v)
+        ? "an array"
+        : isAsyncValue(v)
+          ? "an async value"
+          : typeof v;
 }
 
 /**
- * Dev finding (`BINDING_SLOT_POSITION`, reason `fill-shape`): the client
- * side of a binding slot has the wrong shape — the fill's return is not
- * an object, or the prop is not a function. Through the diagnostics
- * channel, so an observer captures it beside the server's findings.
+ * Dev finding (`BINDING_SLOT_POSITION`): the client side of a binding slot
+ * has the wrong shape — the fill's return is not an object or the prop is
+ * not a function (`fill-shape`), or a text position's value is not a
+ * primitive (`text-shape`). Through the diagnostics channel, so an
+ * observer captures it beside the server's findings.
  */
-function slotShapeFinding(occurrence: string, shape: string, message: string) {
+function slotShapeFinding(data: Record<string, string>, message: string) {
   DEV!.report(
     OBSERVE!.diagnostics.emit(
-      {
-        code: "BINDING_SLOT_POSITION",
-        kind: "render",
-        severity: "warn",
-        message,
-        data: { reason: "fill-shape", occurrence, shape }
-      },
+      { code: "BINDING_SLOT_POSITION", kind: "render", severity: "warn", message, data },
       null
     )
   );
@@ -616,8 +633,7 @@ function slotsFor(props: Record<string, any>) {
             if (typeof fill !== "function") {
               if (IS_DEV) {
                 slotShapeFinding(
-                  key,
-                  typeof fill,
+                  { reason: "fill-shape", occurrence: key, shape: typeof fill },
                   `[BINDING_SLOT_POSITION] Server markup reads slot \`${prop}\` as data (\`${key}\`), ` +
                     `but the client prop is ${typeof fill === "object" ? "an object" : `a ${typeof fill}`}, ` +
                     `not a function. The fill is a function of the occurrence's args returning the object ` +
diff --git a/packages/web/frames/src/frame-client.ts b/packages/web/frames/src/frame-client.ts
index 791063cce..7413e2ccb 100644
--- a/packages/web/frames/src/frame-client.ts
+++ b/packages/web/frames/src/frame-client.ts
@@ -429,15 +429,69 @@ const slotEnd = id => `slot:${id}:end`;
 // occurrences. The elements stay server-owned: the morph keeps them (keyed
 // or positional), and reads the markers off INCOMING markup to know which
 // positions are the client's (see `morphAttributes`) — no ownership table.
+//
+// A TEXT position is a comment pair around the value,
+// `<!--_s:t=<occurrence>:<key>-->…<!--/_s:t-->`, registered on its parent
+// element beside that element's attribute positions (`{ pos: "text", key,
+// start }`); the fill writes the one text node between the markers, and the
+// morph keeps a pair it meets again (see `reconcileChildren`).
 const SLOT_MARKER = "_s:";
+const SLOT_TEXT = SLOT_MARKER + "t=";
+const SLOT_TEXT_END = "/" + SLOT_MARKER + "t";
+
+const isTextStart = n => n.nodeType === COMMENT_NODE && n.data.startsWith(SLOT_TEXT);
+
+/**
+ * One marker entry, `<occurrence>:<key>[=<name>]`, as `[occurrence,
+ * { pos, key, name }]`, or null. Keys and names are percent-encoded on the
+ * wire (they are client-controlled strings landing in a `,`/`:`/`=`-delimited
+ * grammar) and decoded here.
+ */
+function slotEntry(entry, pos) {
+  const colon = entry.indexOf(":");
+  if (colon < 1) return null;
+  const eq = entry.indexOf("=", colon);
+  return [
+    entry.slice(0, colon),
+    {
+      pos,
+      key: decodeURIComponent(eq === -1 ? entry.slice(colon + 1) : entry.slice(colon + 1, eq)),
+      name: eq === -1 ? undefined : decodeURIComponent(entry.slice(eq + 1))
+    }
+  ];
+}
+
+/**
+ * Register a text start marker's position on its parent element's consumer
+ * entry for the occurrence — the one its attribute markers opened, if any,
+ * so an element is one consumer however its positions are spelled.
+ */
+function textPosition(start, elements) {
+  const parsed = slotEntry(start.data.slice(SLOT_TEXT.length), "text");
+  const consumers = parsed && consumersOf(elements, parsed[0]);
+  if (!consumers) return;
+  const element = start.parentNode;
+  let consumer;
+  for (let i = consumers.length; i-- && !consumer; )
+    if (consumers[i].element === element) consumer = consumers[i];
+  consumer || consumers.push((consumer = { element, positions: [] }));
+  parsed[1].start = start;
+  consumer.positions.push(parsed[1]);
+}
+
+/** An occurrence's consumer list, created on first use; null when a slot
+ *  range claimed the id (the dev range check reports it). */
+function consumersOf(elements, occurrence) {
+  let consumers = elements.get(occurrence);
+  if (consumers === undefined) elements.set(occurrence, (consumers = []));
+  return Array.isArray(consumers) ? consumers : null;
+}
 
 /**
  * Parse one element's `_s:*` markers into positions grouped by occurrence:
  * `{ [occurrence]: [{ pos, key, name }] }`, or null. `pos` is the marker's
  * position as written (`class`, `hidden`, `on:click`, `ref`), `name` the
- * class name / style property for a member position. Keys and names are
- * percent-encoded on the wire (they are client-controlled strings landing
- * in a `,`/`:`/`=`-delimited grammar) and decoded here.
+ * class name / style property for a member position.
  */
 function slotPositions(el) {
   const attrs = el.attributes;
@@ -447,16 +501,10 @@ function slotPositions(el) {
     if (!attr.name.startsWith(SLOT_MARKER)) continue;
     const pos = attr.name.slice(SLOT_MARKER.length);
     for (const entry of attr.value.split(",")) {
-      const colon = entry.indexOf(":");
-      if (colon < 1) continue;
-      const occurrence = entry.slice(0, colon);
-      const eq = entry.indexOf("=", colon);
-      const key = decodeURIComponent(
-        eq === -1 ? entry.slice(colon + 1) : entry.slice(colon + 1, eq)
-      );
-      const name = eq === -1 ? undefined : decodeURIComponent(entry.slice(eq + 1));
+      const parsed = slotEntry(entry, pos);
+      if (!parsed) continue;
       out || (out = Object.create(null));
-      (out[occurrence] || (out[occurrence] = [])).push({ pos, key, name });
+      (out[parsed[0]] || (out[parsed[0]] = [])).push(parsed[1]);
     }
   }
   return out;
@@ -472,7 +520,8 @@ function consumersEqual(a, b) {
     for (let j = 0; j < x.positions.length; j++) {
       const p = x.positions[j];
       const q = y.positions[j];
-      if (p.pos !== q.pos || p.key !== q.key || p.name !== q.name) return false;
+      if (p.pos !== q.pos || p.key !== q.key || p.name !== q.name || p.start !== q.start)
+        return false;
     }
   }
   return true;
@@ -2355,6 +2404,11 @@ function collectSlots(n, end, out, elements) {
       n = afterRange(n, id);
       continue;
     }
+    if (elements !== undefined && isTextStart(n)) {
+      textPosition(n, elements);
+      n = afterText(n);
+      continue;
+    }
     if (n.nodeType === ELEMENT_NODE && !isFrameElement(n)) {
       // Data occurrences (`_s:*` markers), when the caller wants them — the
       // slot sync does; the morph's range index does not (an element is
@@ -2366,10 +2420,8 @@ function collectSlots(n, end, out, elements) {
         const byOccurrence = slotPositions(n);
         if (byOccurrence !== null) {
           for (const occurrence in byOccurrence) {
-            let consumers = elements.get(occurrence);
-            if (consumers === undefined) elements.set(occurrence, (consumers = []));
-            else if (!Array.isArray(consumers)) continue; // a range claimed the id (dev range check)
-            consumers.push({ element: n, positions: byOccurrence[occurrence] });
+            const consumers = consumersOf(elements, occurrence);
+            if (consumers) consumers.push({ element: n, positions: byOccurrence[occurrence] });
           }
         }
       }
@@ -2688,8 +2740,13 @@ function morphNode(oldNode, newNode, claim, ranges, grafts) {
 }
 
 /** The sibling immediately after the `slot:<id>:end` marker for `start`. */
-function afterRange(start, id) {
-  const end = slotEnd(id);
+const afterRange = (start, id) => afterMarker(start, slotEnd(id));
+/** The sibling after a text position's end marker. */
+const afterText = start => afterMarker(start, SLOT_TEXT_END);
+
+/** The sibling immediately after the first `end` comment following `start`
+ *  (null if the range is truncated). */
+function afterMarker(start, end) {
   let n = start.nextSibling;
   while (n) {
     if (n.nodeType === COMMENT_NODE && n.data === end) return n.nextSibling;
@@ -2878,6 +2935,20 @@ function reconcileChildren(
     // Treat reaching the upper bound as "no more old nodes".
     const old = oldChild === boundEnd ? null : oldChild;
 
+    if (
+      old &&
+      isTextStart(newChild) &&
+      old.nodeType === COMMENT_NODE &&
+      old.data === newChild.data
+    ) {
+      // The same text position: its interior is the client's (the incoming
+      // one is empty on the stream face) — keep it and skip both ranges.
+      // Any other case reconciles as ordinary nodes; the consumer change
+      // that follows rebinds the owner, which writes the new range.
+      oldChild = afterText(old);
+      newChild = afterText(newChild);
+      continue;
+    }
     if (pid !== null) {
       if (old && slotStartId(old) === pid) {
         // Same slot already here: preserve its live interior untouched
diff --git a/packages/web/frames/src/server.ts b/packages/web/frames/src/server.ts
index 77b7caa23..5d24b1879 100644
--- a/packages/web/frames/src/server.ts
+++ b/packages/web/frames/src/server.ts
@@ -86,7 +86,8 @@ export type SlotOutput<J> = J extends readonly unknown[]
  * onInput={row.toggle} /></li>`. One call is one data context: any element
  * in the template may read from it, and the client owns exactly the values
  * the template read. Keys are the client's names; the position decides what
- * a property IS (attribute, class name, style property, handler, ref). On
+ * a property IS (attribute, class name, style property, handler, ref, or
+ * text — `<strong>{list.remaining}</strong>`, a string or number). On
  * the server a property is a stand-in, never the value: bind it, never
  * branch on it or compute with it.
  *
diff --git a/packages/web/skills/server-components/SKILL.md b/packages/web/skills/server-components/SKILL.md
index 0058cf460..7927de150 100644
--- a/packages/web/skills/server-components/SKILL.md
+++ b/packages/web/skills/server-components/SKILL.md
@@ -82,7 +82,7 @@ an async value is a type error on both sides (`BindingSlot`'s return is
 
 ## The one rule for binding slots
 
-> **A slot property is a JSX attribute value, whole, and nothing else.**
+> **A slot property is a JSX attribute value or a text child, whole, and nothing else.**
 
 Legal positions: an attribute (`hidden={row.removed}`, `checked={row.done}`,
 `title={row.error}`), a class name inside object form
@@ -91,8 +91,12 @@ Legal positions: an attribute (`hidden={row.removed}`, `checked={row.done}`,
 an event (`onInput={row.onToggle}`), a ref (`ref={row.ref}`) — on an element
 with a spread too (`<button {...rest} onClick={row.go} />` — the last
 source that has the key wins, `undefined` included, as the client's
-spread reads it). Not a `prop:*`
-property, not a text child, not inside another slot call's args (nested in
+spread reads it) — and a text child (`<strong>{list.remaining}</strong> items
+left`): a string or number renders, nullish and booleans render empty, and
+the client owns the text between a `<!--_s:t=…-->` marker pair. Never the
+content of `<textarea>`, `<title>`, `<style>` or `<script>`, where the
+markers would be literal text — bind `value=` or a style property there.
+Not a `prop:*` property, not inside another slot call's args (nested in
 plain objects and arrays included). Reserved keys the fill must not use:
 keys beginning with `$` or a digit, `length`, `slice`, `t`/`h`/`p`, `then`,
 `constructor`/`toString`/`valueOf`/`toJSON`; anything else (`filter`, `map`
@@ -107,16 +111,18 @@ nothing can be computed from it on the server. Every one of these is wrong:
 | ``class={`todo ${row.done}`}``                                         | stringified: not the whole value                                                      | `class={{ todo: true, completed: row.done }}` or return `rowClass` from the fill                 |
 | `row.count > 3 ? "a" : "b"`                                            | comparison on a stand-in                                                              | decide in the fill; return the decided value                                                     |
 | `if (row.error) …`, `row.error && <button/>`, `<Show when={row.done}>` | truthiness: a stand-in is an object and **always truthy** — the branch always renders | presence → `hidden={…}` or a class; a node that exists because of client state → a template slot |
-| `<strong>{row.count}</strong>`                                         | text is not a bindable position yet                                                   | a template slot for the text                                                                     |
+| `<strong>{row.label}</strong>` where the fill returns JSX for `label`  | a text position renders a string or number                                            | a template slot for markup                                                                       |
+| `<textarea>{row.draft}</textarea>`                                     | raw-text content: the markers land in the text                                        | `value={row.draft}`                                                                              |
 | `format(row.title)` (a server helper)                                  | the helper receives a stand-in                                                        | do the formatting in the fill                                                                    |
 | `<li {...row}>`                                                        | spread: the template must show what the client owns                                   | name each position                                                                               |
 | `onClick={() => …}` on a server element                                | a server function can never run in the browser                                        | bind a slot property or a form `action`                                                          |
 | `onKeyDown={[row.key, 1]}`                                             | a tuple: a marker names keys, never data                                              | return `onKeyDown: [handler, data]` from the fill; bind `onKeyDown={row.onKeyDown}`              |
 
-Every case except truthiness is a dev finding (`BINDING_SLOT_POSITION`)
-and renders **nothing on either face**, so it shows on the first render.
-Truthiness has no runtime hook: if a retry button appears on every row, this
-is why.
+Every case except truthiness and raw-text content is a dev finding
+(`BINDING_SLOT_POSITION`) and renders **nothing on either face**, so it
+shows on the first render. Truthiness has no runtime hook: if a retry button
+appears on every row, this is why. Raw-text content has none either; in
+`<textarea>` and `<title>` the markers show as text.
 
 ## Writing the fill
 
@@ -201,7 +207,6 @@ cannot be marked — the `inline` finding below.
 | `spread`       | error (throws) | a slot's return was spread onto an element                                                                                                      | name each position                                                                                                                                                |
 | `stringified`  | warn           | template literal / concatenation                                                                                                                | whole value at one position                                                                                                                                       |
 | `coerced`      | warn           | comparison, arithmetic, `==`                                                                                                                    | decide in the fill                                                                                                                                                |
-| `text`         | warn           | placed as a text child                                                                                                                          | template slot                                                                                                                                                     |
 | `inline`       | warn           | reached `class`/`style` inside template quotes                                                                                                  | compile with `serverComponents: true`                                                                                                                             |
 | `markup`       | warn           | the fill returned JSX but the template read a property                                                                                          | return an object, or place the slot                                                                                                                               |
 | `server-local` | warn           | a server function at `on*`/`ref`                                                                                                                | bind a slot property                                                                                                                                              |
@@ -210,9 +215,10 @@ cannot be marked — the `inline` finding below.
 | `arg`          | warn           | a slot property passed in another slot call's argument (nested in plain objects/arrays; `data.path`)                                            | pass the server's own value, or read it in the fill from client state                                                                                             |
 | `prop`         | warn           | a slot property at a `prop:*` key of a spread                                                                                                   | bind the attribute form, or set the property in the fill's ref                                                                                                    |
 | `fill-shape`   | warn (client)  | the fill returned a non-object (`null`, array, DOM node, async value, primitive), or the prop read as data is not a function                    | return a plain object from a function prop                                                                                                                        |
+| `text-shape`   | warn (client)  | a text position received a non-primitive (object, array, DOM node, function, async value — `data.key`, `data.shape`)                            | return a string or number; markup goes in a template slot                                                                                                         |
 | `orphan`       | warn (client)  | markers for an occurrence that can never bind: `data.why` `"fill"` — no fill for the prop; `"record"` — a called occurrence with no args record | `fill`: pass the prop / match the name on both sides. `record`: not the fill — rebuild client and server together (stale prebundle, cached asset), else report it |
 
-Every reason but `fill-shape` and `orphan` comes from the server render.
+Every reason but `fill-shape`, `text-shape` and `orphan` comes from the server render.
 `orphan` is the one failure this model cannot otherwise show you: the
 element is inert — a handler that never fires, a class that never updates —
 with no error.
diff --git a/packages/web/src/server.ts b/packages/web/src/server.ts
index e3fa15da6..c2bcaf2ba 100644
--- a/packages/web/src/server.ts
+++ b/packages/web/src/server.ts
@@ -4751,6 +4751,10 @@ export function slotValue(occurrence, key, value, face) {
     value: hint => slotValueString(sv, hint === "string" ? "stringified" : "coerced")
   });
   Object.defineProperty(sv, "toString", { value: () => slotValueString(sv, "stringified") });
+  // The text-position writer rides on the stand-in (`w`) rather than being
+  // called by the resolvers, so a server render with no binding slots does
+  // not retain it.
+  Object.defineProperty(sv, "w", { value: () => slotText(sv) });
   return sv;
 }
 
@@ -4765,11 +4769,11 @@ function slotValueString(sv, reason) {
         ? `[${BINDING_SLOT_POSITION}] \`${prop}\`'s \`${sv.k}\` is a binding-slot value used in an expression ` +
             `(a comparison, arithmetic, or a branch on its result). The server does not have the value — ` +
             `the client owns it — so nothing can be computed from it here. It must be the WHOLE value of ` +
-            `an attribute, class name, style property, handler or ref; a decision that depends on it ` +
+            `an attribute, class name, style property, handler, ref or text child; a decision that depends on it ` +
             `belongs in the client fill (return the decided value) or in a markup slot.`
         : `[${BINDING_SLOT_POSITION}] \`${prop}\`'s \`${sv.k}\` is a binding-slot value ` +
             `and was stringified outside a bindable position — it must be the WHOLE value of an attribute, ` +
-            `class name, style property, handler or ref (\`class={row.${sv.k}}\`, not \`class={\`x \${row.${sv.k}}\`}\`). ` +
+            `class name, style property, handler, ref or text child (\`class={row.${sv.k}}\`, not \`class={\`x \${row.${sv.k}}\`}\`). ` +
             `If it is, the element was compiled without the \`serverComponents\` compiler option. ` +
             `Nothing renders here on either face.`
     );
@@ -4777,18 +4781,21 @@ function slotValueString(sv, reason) {
   return "";
 }
 
-function slotTextPosition(sv) {
-  if ("_SOLID_DEV_") {
-    slotFinding(
-      sv,
-      "text",
-      undefined,
-      `[${BINDING_SLOT_POSITION}] \`${sv.k}\` of slot \`${propOfOccurrence(sv[SLOT_VALUE])}\` is placed as TEXT. ` +
-        `Text is not a bindable position yet: nothing renders here on either face. ` +
-        `Bind it to an attribute, or render the text in a markup slot.`
-    );
-  }
-  return "";
+/**
+ * A binding-slot value at a TEXT position (`<b>{row.count}</b>`): a marker
+ * pair `<!--_s:t=<occurrence>:<key>-->…<!--/_s:t-->` the client writes
+ * between. The document face writes the escaped t=0 value inside; the
+ * stream face (and a read off markup) leaves it empty. A pair rather than
+ * one marker: an empty value has no text node to find, and a written one
+ * would merge with static text beside it — the end marker bounds the
+ * range on both faces. Only a string or number renders, as a client insert
+ * renders it; the client reports any other shape.
+ */
+function slotText(sv) {
+  slotMarkupRead(sv, "text");
+  const v = sv.f === SLOT_FACE_DATA ? sv.v : undefined;
+  const text = typeof v === "string" || typeof v === "number" ? escape("" + v) : "";
+  return `<!--${SLOT_MARKER}t=${slotEntry(sv)}-->${text}<!--/${SLOT_MARKER}t-->`;
 }
 
 function slotMarkupRead(sv, position) {
@@ -5935,6 +5942,10 @@ function tryResolveString(node, nested?: boolean) {
       return s;
     }
     if (node.h && node.h.length > 0) return { merge: node };
+    if (node[SLOT_VALUE] !== undefined) {
+      ssrTextTail = false;
+      return node.w();
+    }
     if (node.t === undefined) {
       // Not a template object — mirror the client's dev warn-and-skip
       // instead of crashing downstream on a malformed template shape.
@@ -6011,13 +6022,8 @@ export function resolveSSRNode(
       result.t[result.t.length - 1] += node.t;
       ssrTextTail = false;
     } else if (node[SLOT_VALUE] !== undefined) {
-      // A binding-slot value at a TEXT position (`<b>{row.count}</b>`): not a
-      // bindable position yet (principles §9.2.3, open). Nothing renders on
-      // either face — the document face never shows a t=0 value the stream
-      // face cannot reproduce — and dev says so (slotTextPosition).
-      const text = escape(slotTextPosition(node));
-      result.t[result.t.length - 1] += ssrTextTail ? "<!--!$-->" + text : text;
-      ssrTextTail = true;
+      result.t[result.t.length - 1] += node.w();
+      ssrTextTail = false;
     } else if ("_SOLID_DEV_") unrecognizedInsert(node);
   } else if (t === "function") {
     // Function nodes reaching the tree resolver are content by construction
diff --git a/packages/web/test/frames-binding-slots.spec.tsx b/packages/web/test/frames-binding-slots.spec.tsx
index 2484fb1f6..0fa690878 100644
--- a/packages/web/test/frames-binding-slots.spec.tsx
+++ b/packages/web/test/frames-binding-slots.spec.tsx
@@ -8,8 +8,9 @@
 // data context), so the frame mounts it once — the fill runs once with the
 // occurrence's args (live: re-emitted args flow into the same computation)
 // — and writes every consuming element's positions from the returned
-// object: attributes, class names and style properties by name, handlers
-// as stable dispatchers reading the latest output, refs once per element.
+// object: attributes, class names and style properties by name, text
+// between its `<!--_s:t=…-->` pair, handlers and refs read once when an
+// element binds.
 // The morph keeps the elements (keyed) and reads the same markers off
 // incoming markup to skip the client's positions, so a server re-render
 // can't strip a client-owned value between the morph and the fill's next
@@ -1097,4 +1098,356 @@ describe("binding slots through server-component mounts", () => {
     flush();
     container.remove();
   });
+
+  test("a TEXT position: the fill writes between the markers, apart from the server's static text; a getter rewrites it; a refetch keeps the client's text", async () => {
+    // The stream face: an empty pair per text position, the zero-arg `list`
+    // and the called `row#1` beside the server's own text (` items left`,
+    // ` left` — the second in the compiler's insert range, as a child among
+    // siblings is).
+    let tail = " items left";
+    const [version, setVersion] = createSignal(1);
+    vi.stubGlobal("fetch", async () =>
+      frameResponse(ID, [
+        { type: "start", id: ID, version: version() },
+        { type: "slot", id: ID, version: version(), key: "row#1", args: { id: "1" } },
+        {
+          type: "html",
+          id: ID,
+          version: version(),
+          html:
+            `<footer><strong><!--_s:t=list:remaining--><!--/_s:t--></strong>${tail}` +
+            `<ul><li _key="1"><label><!--_s:t=row#1:title--><!--/_s:t--></label>` +
+            `<span><!--$--><!--_s:t=row#1:count--><!--/_s:t--><!--/--> left</span></li></ul></footer>`
+        },
+        { type: "complete", id: ID, version: version() }
+      ])
+    );
+    const [remaining, setRemaining] = createSignal<unknown>(3);
+    const [count, setCount] = createSignal(2);
+    let builds = 0;
+    const List = dynamic(() => getTodos() as any);
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const dispose = render(
+      () => (
+        <Loading fallback={<span>...</span>}>
+          <List
+            list={() => ({
+              get remaining() {
+                return remaining();
+              }
+            })}
+            row={() => {
+              builds++;
+              return {
+                title: "Hello <b>",
+                get count() {
+                  return count();
+                }
+              };
+            }}
+          />
+        </Loading>
+      ),
+      container
+    );
+    await cycle();
+    const strong = container.querySelector("strong") as HTMLElement;
+    const label = container.querySelector("label") as HTMLElement;
+    const span = container.querySelector("span") as HTMLElement;
+    const footer = container.querySelector("footer") as HTMLElement;
+    // Written between the markers, as text (never parsed as markup).
+    expect(strong.textContent).toBe("3");
+    expect(strong.childNodes).toHaveLength(3);
+    expect(label.textContent).toBe("Hello <b>");
+    expect(label.children).toHaveLength(0);
+    // The value is its own text node; the static text beside it is the server's.
+    expect(span.textContent).toBe("2 left");
+    const countText = span.childNodes[2] as Text;
+    expect(countText.nodeType).toBe(3);
+    expect(countText.data).toBe("2");
+    expect(footer.textContent).toBe("3 items leftHello <b>2 left");
+    const remainingText = strong.childNodes[1] as Text;
+
+    // A getter's sources move: the same text node is rewritten in place.
+    setRemaining(2);
+    setCount(5);
+    flush();
+    expect(strong.childNodes[1]).toBe(remainingText);
+    expect(remainingText.data).toBe("2");
+    expect(countText.data).toBe("5");
+    // Numbers render, zero included; nullish and booleans clear.
+    setRemaining(0);
+    flush();
+    expect(strong.textContent).toBe("0");
+    setRemaining(null);
+    flush();
+    expect(strong.textContent).toBe("");
+    setRemaining(true);
+    flush();
+    expect(strong.textContent).toBe("");
+    setRemaining(4);
+    flush();
+    expect(strong.textContent).toBe("4");
+
+    // A refetch re-sends the empty pairs: the morph keeps the client's text
+    // (and its node) while the server's own text beside it updates.
+    tail = " items to go";
+    setVersion(2);
+    await cycle();
+    expect(container.querySelector("strong")).toBe(strong);
+    expect(strong.childNodes[1]).toBe(remainingText);
+    expect(strong.textContent).toBe("4");
+    expect(span.childNodes[2]).toBe(countText);
+    expect(footer.textContent).toBe("4 items to goHello <b>5 left");
+    expect(builds).toBe(1);
+    setCount(6);
+    flush();
+    expect(span.textContent).toBe("6 left");
+
+    dispose();
+    flush();
+    container.remove();
+  });
+
+  test("another occurrence taking a TEXT position writes its own value; a position the server releases is the server's again and gets no final write", async () => {
+    // Positional ids: v1 renders rows [a, b] as `row#0`, `row#1`; v2 marks
+    // the kept first li for `row#1` (another occurrence at the same
+    // position); v3 keeps `row#1` alive on the li's `hidden` but releases
+    // its text — the server writes the li's content itself.
+    let shape = 1;
+    const [version, setVersion] = createSignal(1);
+    const html = () =>
+      shape === 1
+        ? `<ul><li><!--_s:t=row#0:title--><!--/_s:t--></li><li><!--_s:t=row#1:title--><!--/_s:t--></li></ul>`
+        : shape === 2
+          ? `<ul><li><!--_s:t=row#1:title--><!--/_s:t--></li></ul>`
+          : `<ul><li _s:hidden="row#1:gone">server text</li></ul>`;
+    vi.stubGlobal("fetch", async () => {
+      const v = version();
+      const chunks: any[] = [{ type: "start", id: ID, version: v }];
+      if (shape === 1)
+        chunks.push({ type: "slot", id: ID, version: v, key: "row#0", args: { name: "a" } });
+      chunks.push({ type: "slot", id: ID, version: v, key: "row#1", args: { name: "b" } });
+      chunks.push({ type: "html", id: ID, version: v, html: html() });
+      chunks.push({ type: "complete", id: ID, version: v });
+      return frameResponse(ID, chunks);
+    });
+    const [suffix, setSuffix] = createSignal("");
+    const List = dynamic(() => getTodos() as any);
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const dispose = render(
+      () => (
+        <Loading fallback={<span>...</span>}>
+          <List
+            row={(p: any) => ({
+              get title() {
+                return p.name + suffix();
+              },
+              gone: false
+            })}
+          />
+        </Loading>
+      ),
+      container
+    );
+    await cycle();
+    const [liA, liB] = Array.from(container.querySelectorAll("li"));
+    expect(liA.textContent).toBe("a");
+    expect(liB.textContent).toBe("b");
+
+    shape = 2;
+    setVersion(2);
+    await cycle();
+    const lis = Array.from(container.querySelectorAll("li"));
+    expect(lis).toEqual([liA]);
+    expect(liA.textContent).toBe("b");
+    setSuffix("!");
+    flush();
+    expect(liA.textContent).toBe("b!");
+
+    shape = 3;
+    setVersion(3);
+    await cycle();
+    expect(container.querySelector("li")).toBe(liA);
+    expect(liA.textContent).toBe("server text");
+    expect(liA.hidden).toBe(false);
+    setSuffix("?");
+    flush();
+    expect(liA.textContent).toBe("server text");
+
+    dispose();
+    flush();
+    container.remove();
+  });
+
+  test("an element binding a handler, an attribute and TEXT from one occurrence is one consumer: a counter button keeps all three", async () => {
+    vi.stubGlobal("fetch", async () =>
+      frameResponse(ID, [
+        { type: "start", id: ID, version: 1 },
+        { type: "slot", id: ID, version: 1, key: "row#0", args: {} },
+        {
+          type: "html",
+          id: ID,
+          version: 1,
+          html: `<p><button _s:aria-pressed="row#0:odd" _s:on:click="row#0:bump"><!--_s:t=row#0:count--><!--/_s:t--></button></p>`
+        },
+        { type: "complete", id: ID, version: 1 }
+      ])
+    );
+    const [count, setCount] = createSignal(0);
+    const List = dynamic(() => getTodos() as any);
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const dispose = render(
+      () => (
+        <Loading fallback={<span>...</span>}>
+          <List
+            row={() => ({
+              get count() {
+                return count();
+              },
+              get odd() {
+                return count() % 2 === 1 ? "true" : "false";
+              },
+              bump: () => setCount(c => c + 1)
+            })}
+          />
+        </Loading>
+      ),
+      container
+    );
+    await cycle();
+    const button = container.querySelector("button") as HTMLButtonElement;
+    expect(button.textContent).toBe("0");
+    button.click();
+    flush();
+    expect(button.textContent).toBe("1");
+    expect(button.getAttribute("aria-pressed")).toBe("true");
+    button.click();
+    flush();
+    expect(button.textContent).toBe("2");
+    expect(button.getAttribute("aria-pressed")).toBe("false");
+
+    dispose();
+    flush();
+    container.remove();
+  });
+
+  test("a TEXT range the morph re-creates (same element, same key, new markers) rebinds and is written", async () => {
+    // v2 moves the server's text from before the pair to after it: the
+    // sibling-scoped morph lands the incoming pair as new nodes and removes
+    // the old ones, so the consumer is the same element and key at a new
+    // start marker — which must count as a change, or the empty new range
+    // is never written.
+    let shape = 1;
+    const [version, setVersion] = createSignal(1);
+    vi.stubGlobal("fetch", async () =>
+      frameResponse(ID, [
+        { type: "start", id: ID, version: version() },
+        { type: "slot", id: ID, version: version(), key: "row#0", args: {} },
+        {
+          type: "html",
+          id: ID,
+          version: version(),
+          html:
+            shape === 1
+              ? `<p>by <!--_s:t=row#0:who--><!--/_s:t--></p>`
+              : `<p><!--_s:t=row#0:who--><!--/_s:t--> wrote</p>`
+        },
+        { type: "complete", id: ID, version: version() }
+      ])
+    );
+    const List = dynamic(() => getTodos() as any);
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const dispose = render(
+      () => (
+        <Loading fallback={<span>...</span>}>
+          <List row={() => ({ who: "ada" })} />
+        </Loading>
+      ),
+      container
+    );
+    await cycle();
+    const p = container.querySelector("p") as HTMLElement;
+    expect(p.textContent).toBe("by ada");
+    shape = 2;
+    setVersion(2);
+    await cycle();
+    expect(container.querySelector("p")).toBe(p);
+    expect(p.textContent).toBe("ada wrote");
+
+    dispose();
+    flush();
+    container.remove();
+  });
+
+  test("a non-primitive at a TEXT position is a `text-shape` finding and clears; markup belongs in a template slot", async () => {
+    const capture = OBSERVE!.diagnostics.capture();
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    vi.stubGlobal("fetch", async () =>
+      frameResponse(ID, [
+        { type: "start", id: ID, version: 1 },
+        { type: "slot", id: ID, version: 1, key: "row#0", args: {} },
+        {
+          type: "html",
+          id: ID,
+          version: 1,
+          html:
+            `<p><!--_s:t=row#0:obj--><!--/_s:t-->|<!--_s:t=row#0:list--><!--/_s:t-->|` +
+            `<!--_s:t=row#0:el--><!--/_s:t-->|<!--_s:t=row#0:fn--><!--/_s:t-->|` +
+            `<!--_s:t=row#0:ok--><!--/_s:t--></p>`
+        },
+        { type: "complete", id: ID, version: 1 }
+      ])
+    );
+    const [obj, setObj] = createSignal<unknown>({ a: 1 });
+    const List = dynamic(() => getTodos() as any);
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const dispose = render(
+      () => (
+        <Loading fallback={<span>...</span>}>
+          <List
+            row={() => ({
+              get obj() {
+                return obj();
+              },
+              list: ["x", "y"],
+              el: document.createElement("b"),
+              fn: () => "x",
+              ok: "ok"
+            })}
+          />
+        </Loading>
+      ),
+      container
+    );
+    await cycle();
+    const p = container.querySelector("p") as HTMLElement;
+    expect(p.textContent).toBe("||||ok");
+    expect(p.querySelector("b")).toBeNull();
+    const shapes = () =>
+      capture.events.filter(
+        e => e.code === "BINDING_SLOT_POSITION" && (e.data as any).reason === "text-shape"
+      );
+    expect(shapes().map(e => e.data)).toEqual([
+      { reason: "text-shape", occurrence: "row#0", key: "obj", shape: "object" },
+      { reason: "text-shape", occurrence: "row#0", key: "list", shape: "an array" },
+      { reason: "text-shape", occurrence: "row#0", key: "el", shape: "a DOM node" },
+      { reason: "text-shape", occurrence: "row#0", key: "fn", shape: "function" }
+    ]);
+    expect(shapes()[0].message).toContain("template slot");
+    // Once the value is a primitive it renders.
+    setObj("fine");
+    flush();
+    expect(p.textContent).toBe("fine||||ok");
+    capture.stop();
+    warn.mockRestore();
+    dispose();
+    flush();
+    container.remove();
+  });
 });
diff --git a/packages/web/test/hydration/binding-slot-adoption.spec.tsx b/packages/web/test/hydration/binding-slot-adoption.spec.tsx
index 3a1efb592..7e7cc595f 100644
--- a/packages/web/test/hydration/binding-slot-adoption.spec.tsx
+++ b/packages/web/test/hydration/binding-slot-adoption.spec.tsx
@@ -45,23 +45,37 @@ describe("binding-slot adoption at t=0", () => {
 
   test("the fill mounts on the server-written positions and owns them from there on", async () => {
     // The document as the server left it: the fill's t=0 values are already
-    // the attributes (todo 2 completed → `completed` class, `checked`), each
-    // beside its marker.
+    // the attributes (todo 2 completed → `completed` class, `checked`) and
+    // the text (each title inside its marker pair, on the li that carries
+    // the same occurrence's attribute markers; the zero-arg `list` count
+    // beside the server's own text), each beside its marker.
     const container = document.createElement("div");
     container.innerHTML =
       `<solid-frame data-fid="${FID}" style="display:contents"><ul>` +
       `<li _key="1" class="todo" _s:class="row#1:done=completed" _s:hidden="row#1:removed">` +
-      `<input type="checkbox" _s:checked="row#1:done" _s:on:input="row#1:toggle" _s:ref="row#1:box"><label>a</label></li>` +
+      `<input type="checkbox" _s:checked="row#1:done" _s:on:input="row#1:toggle" _s:ref="row#1:box">` +
+      `<!--_s:t=row#1:title-->a &lt;1&gt;<!--/_s:t--></li>` +
       `<li _key="2" class="todo completed" _s:class="row#2:done=completed" _s:hidden="row#2:removed">` +
-      `<input type="checkbox" checked _s:checked="row#2:done" _s:on:input="row#2:toggle" _s:ref="row#2:box"><label>b</label></li>` +
-      `</ul></solid-frame>`;
+      `<input type="checkbox" checked _s:checked="row#2:done" _s:on:input="row#2:toggle" _s:ref="row#2:box">` +
+      `<!--_s:t=row#2:title-->b<!--/_s:t--></li>` +
+      `</ul><strong><!--_s:t=list:left-->1<!--/_s:t--></strong> item left</solid-frame>`;
     document.body.appendChild(container);
+    const textNodes = () =>
+      Array.from(container.querySelectorAll("li, strong")).map(el => {
+        const start = Array.from(el.childNodes).find(n => n.nodeType === 8)!;
+        return start.nextSibling as Text;
+      });
+    const adoptedText = textNodes();
+    const textWrites: string[] = [];
+    new MutationObserver(records => {
+      for (const r of records) textWrites.push(`${r.type}:${r.target.textContent}`);
+    }).observe(container, { characterData: true, childList: true, subtree: true });
     (globalThis as any)._$HY = {
       events: [],
       completed: new WeakSet(),
       r: {
-        [`sc:slot:${FID}:row#1`]: { id: "1", completed: false },
-        [`sc:slot:${FID}:row#2`]: { id: "2", completed: true }
+        [`sc:slot:${FID}:row#1`]: { id: "1", completed: false, title: "a <1>" },
+        [`sc:slot:${FID}:row#2`]: { id: "2", completed: true, title: "b" }
       },
       fe() {}
     };
@@ -88,10 +102,21 @@ describe("binding-slot adoption at t=0", () => {
               get removed() {
                 return removed() === p.id;
               },
+              get title() {
+                return toggled() === p.id ? p.title + " (toggled)" : p.title;
+              },
               toggle: () => events.push(`toggle:${p.id}`),
               box: (el: Element) => refs.push(el)
             };
           }}
+          list={() => {
+            runs.push("list");
+            return {
+              get left() {
+                return toggled() ? 0 : 1;
+              }
+            };
+          }}
         />
       ),
       container
@@ -105,11 +130,15 @@ describe("binding-slot adoption at t=0", () => {
     const li2 = container.querySelector('li[_key="2"]') as HTMLLIElement;
     const input1 = li1.querySelector("input") as HTMLInputElement;
     const input2 = li2.querySelector("input") as HTMLInputElement;
-    expect(runs).toEqual(["row:1", "row:2"]);
+    expect([...runs].sort()).toEqual(["list", "row:1", "row:2"]);
     expect(li2.className).toBe("todo completed");
     expect(input2.checked).toBe(true);
     expect(input1.checked).toBe(false);
     expect(refs).toEqual([input1, input2]);
+    // The text nodes are the server's, and the equal t=0 write left them alone.
+    expect(textNodes()).toEqual(adoptedText);
+    expect(adoptedText.map(t => t.data)).toEqual(["a <1>", "b", "1"]);
+    expect(textWrites).toEqual([]);
 
     // From here the positions are the client's.
     input1.dispatchEvent(new Event("input", { bubbles: true }));
@@ -118,11 +147,16 @@ describe("binding-slot adoption at t=0", () => {
     flush();
     expect(li1.className).toBe("todo completed");
     expect(input1.checked).toBe(true);
+    // Text beside the same occurrence's attributes, and the zero-arg count,
+    // move in place.
+    expect(textNodes()).toEqual(adoptedText);
+    expect(adoptedText.map(t => t.data)).toEqual(["a <1> (toggled)", "b", "0"]);
+    expect(container.textContent).toContain("0 item left");
     setRemoved("2");
     flush();
     expect(li2.hidden).toBe(true);
     // The getters moved the positions; the fill itself never re-ran.
-    expect(runs).toEqual(["row:1", "row:2"]);
+    expect([...runs].sort()).toEqual(["list", "row:1", "row:2"]);
     expect(refs).toEqual([input1, input2]);
 
     dispose();
diff --git a/packages/web/test/server/frame-binding-slots.spec.tsx b/packages/web/test/server/frame-binding-slots.spec.tsx
index f7e089195..a5760faa3 100644
--- a/packages/web/test/server/frame-binding-slots.spec.tsx
+++ b/packages/web/test/server/frame-binding-slots.spec.tsx
@@ -20,7 +20,7 @@
 // server vitest config), which is what routes `ref`/`on*` and a dynamic
 // `class`/`style` through runtime holes where the stand-in is seen.
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { Loading, renderToStream } from "@solidjs/web";
+import { Loading, renderToStream, renderToString } from "@solidjs/web";
 import { createMemo, merge, OBSERVE, type DiagnosticEvent } from "solid-js";
 import { sharedConfig } from "solid-js/internal";
 import {
@@ -706,6 +706,34 @@ describe("binding slots — stream face", () => {
     expect(tuples[0].message).toContain("[handler, data]");
     expect(findings()).toHaveLength(2);
   });
+
+  it("a stand-in placed as a child is a TEXT position: an empty marker pair the client fills, apart from the static text beside it", async () => {
+    // A pair, not one marker: on this face the value is empty, so there is
+    // no text node to find; on the document face the value would merge with
+    // the static text beside it. The end marker bounds the range on both.
+    const ServerComp = (props: any) => {
+      const list = props.list();
+      const row = props.row({ id: 1 });
+      return (
+        <footer>
+          <strong>{list.remaining}</strong> items left
+          <a href="#">{row.label}</a>
+          <span>
+            {row.count} of {list.total}
+          </span>
+        </footer>
+      );
+    };
+    const chunks = await collect(renderServerComponent(ServerComp, { frame: { id: "ds6t" } }));
+    const html = plain(chunks.find(c => c.type === "html").html);
+    expect(html).toContain("<strong><!--_s:t=list:remaining--><!--/_s:t--></strong> items left");
+    expect(html).toContain('<a href="#"><!--_s:t=row#0:label--><!--/_s:t--></a>');
+    expect(html).toContain(
+      "<span><!--$--><!--_s:t=row#0:count--><!--/_s:t--><!--/--> of " +
+        "<!--$--><!--_s:t=list:total--><!--/_s:t--><!--/--></span>"
+    );
+    expect(findings()).toEqual([]);
+  });
 });
 
 describe("binding slots — document face (t=0)", () => {
@@ -983,14 +1011,85 @@ describe("binding slots — document face (t=0)", () => {
     expect(findings("reserved-key").map(e => (e.data as any).key)).toEqual(["t", "$key"]);
   });
 
-  it("a stand-in placed as text, stringified, or coerced renders NOTHING at t=0 too — the faces agree — with a dev finding each", async () => {
+  it("a TEXT position writes the escaped t=0 value inside its marker pair; nullish and booleans render empty, as a client insert renders them", async () => {
+    const ServerComp = (props: any) => {
+      const row = props.row({ id: 1 });
+      return (
+        <ul>
+          <li>{row.title}</li>
+          <li>{row.count} items left</li>
+          <li>
+            {row.none}|{row.no}|{row.yes}|{row.zero}
+          </li>
+        </ul>
+      );
+    };
+    const Inline = frameTransformDirectResult(ServerComp, { id: "dsd6t" }) as any;
+    const html = plain(
+      await document(() =>
+        Inline({
+          row: () => ({ title: "Hello <b>", count: 3, none: null, no: false, yes: true, zero: 0 })
+        })
+      )
+    );
+    expect(html).toContain("<li><!--_s:t=row#0:title-->Hello &lt;b><!--/_s:t--></li>");
+    // The value and the static text beside it stay two text nodes. (A child
+    // among siblings sits in the compiler's own `<!--$-->…<!--/-->` insert
+    // range, as any dynamic child does.)
+    expect(html).toContain(
+      "<li><!--$--><!--_s:t=row#0:count-->3<!--/_s:t--><!--/--> items left</li>"
+    );
+    expect(html).toContain(
+      "<li><!--$--><!--_s:t=row#0:none--><!--/_s:t--><!--/-->|" +
+        "<!--$--><!--_s:t=row#0:no--><!--/_s:t--><!--/-->|" +
+        "<!--$--><!--_s:t=row#0:yes--><!--/_s:t--><!--/-->|" +
+        "<!--$--><!--_s:t=row#0:zero-->0<!--/_s:t--><!--/--></li>"
+    );
+    expect(findings()).toEqual([]);
+  });
+
+  it("a TEXT position is the marker pair however the child arrives — in an array, from a function child, through a component's children — with or without live holes", async () => {
+    const Echo = (props: any) => props.children;
+    const ServerComp = (props: any) => {
+      const row = props.row({ id: 1 });
+      return (
+        <div>
+          <p>{[row.a, " ", row.b]}</p>
+          <p>{(() => row.c) as any}</p>
+          <p>
+            <Echo>{row.d}</Echo>
+          </p>
+        </div>
+      );
+    };
+    const Inline = frameTransformDirectResult(ServerComp, { id: "dsd8t" }) as any;
+    const fill = () => ({ a: "A", b: "B", c: "C", d: "D" });
+    const expected =
+      "<div><p><!--_s:t=row#0:a-->A<!--/_s:t--> <!--_s:t=row#0:b-->B<!--/_s:t--></p>" +
+      "<p><!--_s:t=row#0:c-->C<!--/_s:t--></p><p><!--_s:t=row#0:d-->D<!--/_s:t--></p></div>";
+    expect(plain(renderToString(() => Inline({ row: fill })))).toContain(expected);
+    expect(plain(await document(() => Inline({ row: fill })))).toContain(expected);
+    expect(findings()).toEqual([]);
+  });
+
+  it("a TEXT position read off a fill that returned markup is the `markup` finding and an empty pair", async () => {
+    const ServerComp = (props: any) => {
+      const row = props.row({ id: 1 });
+      return <p>{row.title}</p>;
+    };
+    const Inline = frameTransformDirectResult(ServerComp, { id: "dsd7t" }) as any;
+    const html = plain(await document(() => Inline({ row: () => <b>content</b> })));
+    expect(html).toContain("<p><!--_s:t=row#0:title--><!--/_s:t--></p>");
+    expect(findings("markup").map(e => (e.data as any).position)).toEqual(["text"]);
+  });
+
+  it("a stand-in stringified or coerced renders NOTHING at t=0 too — the faces agree — with a dev finding each", async () => {
     // The document face has the t=0 value and the stream face never does;
     // rendering it at t=0 would make the first refetch change the page.
     const ServerComp = (props: any) => {
       const row = props.row({ id: 1 });
       return (
         <ul>
-          <li>{row.title}</li>
           <li class={`todo ${row.title}`} title={`n=${row.count}`} />
           <li data-more={row.count > 3 ? "yes" : "no"} data-sum={row.count + 1} />
         </ul>
@@ -1000,11 +1099,9 @@ describe("binding slots — document face (t=0)", () => {
     const html = plain(
       await document(() => Inline({ row: () => ({ title: "Hello <b>", count: 5 }) }))
     );
-    expect(html).toContain("<li></li>");
     expect(html).toContain('<li class="todo " title="n="></li>');
     // A comparison on a stand-in is `undefined`-shaped: `"" > 3` is false.
     expect(html).toContain('<li data-more="no" data-sum="1"></li>');
-    expect(findings("text").length).toBe(1);
     expect(findings("stringified").length).toBe(2);
     expect(findings("coerced").map(e => (e.data as any).key)).toEqual(["count"]);
   });
diff --git a/scripts/size/floor-caps.json b/scripts/size/floor-caps.json
index f2601266e..dea5dea79 100644
--- a/scripts/size/floor-caps.json
+++ b/scripts/size/floor-caps.json
@@ -2,8 +2,8 @@
   "signals: core floor (createSignal/Memo/Effect/Root/flush)": "9.51 KB",
   "app: render + one signal (the simple-app floor)": "12.05 KB",
   "app: hydrating (no stores) with Show/For/Loading/Errored/lazy": "19.69 KB",
-  "page: base server components (hydrating + dynamic + frames + sf reference)": "46.04 KB",
-  "page: live server components (base + live/GET + action + isPending/latest)": "50.17 KB",
+  "page: base server components (hydrating + dynamic + frames + sf reference)": "46.20 KB",
+  "page: live server components (base + live/GET + action + isPending/latest)": "50.45 KB",
   "server: floor (getRequestEvent + isServer)": "1.34 KB",
-  "server: renderToString (the server-render floor)": "20.36 KB"
+  "server: renderToString (the server-render floor)": "20.38 KB"
 }
diff --git a/scripts/size/scenarios.js b/scripts/size/scenarios.js
index 9874e8d02..a1b9e8967 100644
--- a/scripts/size/scenarios.js
+++ b/scripts/size/scenarios.js
@@ -2923,7 +2923,22 @@ module.exports = [
     // (12,695 -> 12,708), fb4e637ad moved `sharedConfig` after it (12,708 ->
     // 12,704); both modules are external, so the bytes are brotli layout
     // across the two import statements, as in the #3470 note above.
-    limit: "12.71 KB",
+    // Size-Exception (#3714, 2026-09-29): 12.71 ->
+    // 12.98 KB, measured at 12,963 B against #3713 @ 73640f5cd's 12,694
+    // (+269 B; 253 B over the cap; +760 B minified, 40,194 -> 40,954). A
+    // binding-slot value placed as a child is a position the client owns:
+    // `collectSlots` registers each `<!--_s:t=…-->` pair on its parent
+    // element's consumer entry for the occurrence, `consumersEqual` compares
+    // the start marker, the occurrence's render effect writes the one text
+    // node between the markers (creating it when absent), and
+    // `reconcileChildren` keeps a pair it meets again. Dev-only (the
+    // `text-shape` reporter) is 0 B here. Trimmed before accepting (entry
+    // parsing shared with `slotPositions`, one consumer-list helper, the end
+    // walk shared with `afterRange`); discovering pairs from `slotPositions`
+    // over an element's direct children was weighed and rejected (~100 B
+    // for a new rule: no text position at a component's top level).
+    // Accepted by the maintainer. The cap is frozen again at 12.98 KB.
+    limit: "12.98 KB",
     alias: framesAlias,
     external: framesExternal
   },
@@ -3022,6 +3037,14 @@ module.exports = [
     // (brotli layout moved each by up to ±100 B); this is the smallest
     // minified form. Accepted by the maintainer. The cap is frozen again at
     // 46.04 KB.
+    // Size-Exception (#3714, 2026-09-30): 46.04 ->
+    // 46.20 KB, measured at 46,193 B against `next` @ ecb68a18e's 45,934
+    // (+259 B; 153 B over the cap; +760 B minified). The frames client's
+    // text-position bytes (the frames note, +269 B there); nothing of this
+    // page's own. First measured at 46,204 B against #3713 @ 73640f5cd (a
+    // 45.95 -> 46.21 KB raise); the base moved under the PR (the fake-
+    // `Promise` cap above). Size vetted by the maintainer. The cap is frozen
+    // again at 46.20 KB.
     limit: floorCaps["page: base server components (hydrating + dynamic + frames + sf reference)"],
     alias: pageAlias
   },
@@ -3100,6 +3123,13 @@ module.exports = [
     // (-41 B; -5 B minified), under the fake-`Promise` cap above. The fill
     // runs once through `assign` instead of a memo and an own listener; the
     // code shrinks, and brotli layout moves the page either way.
+    // Size-Exception (#3714, 2026-09-30): 50.17 ->
+    // 50.45 KB, measured at 50,442 B against `next` @ ecb68a18e's 50,125
+    // (+317 B; 272 B over the cap; +760 B minified). The same text-position
+    // bytes as the base page; brotli layout moves them here. First measured
+    // at 50,346 B against #3713 @ 73640f5cd's 50,150 (a 50.15 -> 50.35 KB
+    // raise); the base moved under the PR (the fake-`Promise` cap above).
+    // Size vetted by the maintainer. The cap is frozen again at 50.45 KB.
     limit: floorCaps["page: live server components (base + live/GET + action + isPending/latest)"],
     alias: pageAlias
   },
@@ -3137,6 +3167,13 @@ module.exports = [
     // 5efaf260b, 20,356 B (71,723 B minified) with the floor scenario's
     // shaking fixes (the stub gap-fill set, the heartbeat, `Feature` reads);
     // cap 20.36 KB, measured rounded up to the next 0.01 kB.
+    // Size-Exception (#3714, 2026-09-30): 20.36 ->
+    // 20.38 KB, measured at 20,372 B against #3713 @ 73640f5cd's 20,356
+    // (+16 B; 12 B over the cap; -35 B minified, 71,723 -> 71,688). The
+    // resolvers call a text writer the stand-in carries instead of writing
+    // text positions themselves, so none of that code is retained here; the
+    // code shrinks and brotli layout grows. Accepted by the maintainer. The
+    // cap is frozen again at 20.38 KB.
     path: "../../packages/web/dist/server.js",
     import: "{ renderToString }",
     limit: floorCaps["server: renderToString (the server-render floor)"],