diff --git a/.agents/skills/webjs/references/routing-and-pages.md b/.agents/skills/webjs/references/routing-and-pages.md
index 81e0e5431..4d020ccc3 100644
--- a/.agents/skills/webjs/references/routing-and-pages.md
+++ b/.agents/skills/webjs/references/routing-and-pages.md
@@ -211,8 +211,18 @@ Refusals worth knowing: `formaction=${fn}` is supported on a `<button>` anywhere
 
 - `error.ts` default-exports `({ error, ...ctx }) => TemplateResult`; catches sibling-page and deeper render errors, innermost wins (prod sends only `error.message`).
 - `loading.ts` wraps the sibling page in `Suspense` with an immediately-flushed fallback.
-- `not-found.ts` / `forbidden.ts` / `unauthorized.ts` render the nearest matching boundary for the thrown control-flow signal.
-- Root-only (in `app/` exactly): `global-error.ts` is the app-wide catch-all after nested `error` boundaries are exhausted and renders its OWN `<!doctype><html><body>` (returned verbatim, so keep it static HTML with no components or hydration). `global-not-found.ts` renders for an unmatched-anywhere URL when no `not-found` matches.
+- `not-found.ts` / `forbidden.ts` / `unauthorized.ts` render the nearest matching boundary for the thrown control-flow signal, and receive the same ctx a page does (`params`, `searchParams`, `url`).
+- **Every one of those boundaries renders INSIDE the layouts at and above its own segment** (#1298), so it carries the keyed `wj:children` pairs and a client-router navigation into a failing page stays a SOFT navigation with the surrounding chrome and its hydrated state intact. A layout deeper than the boundary is not rendered (it never rendered on the way in), and its module is not in the boundary's boot script; the boundary's own module IS. Since a boundary sits inside its own segment's layout, it cannot catch that layout, matching Next's `layout -> error -> page` hierarchy. What happens next differs by path, and the difference is worth knowing:
+
+- On the **500 path**, a throwing layout is handled by the next `error.{js,ts}` OUT: the walk tries each boundary in the chain, innermost first, and a layout that throws fails every attempt whose wrapped set contains it, so control ends at `global-error` (or the default 500 page) when they are exhausted.
+- On the **404 / 403 / 401 paths** there is NO outward walk. Each renders the one nearest boundary, so a throwing layout degrades that response to a chrome-less standalone render of the boundary with no boot script, keeping its status. A control-flow throw from a wrapped layout there (an auth-gate layout calling `redirect('/login')`) is discarded rather than honoured, deliberately: the status is already decided and the boundary page is the answer to that request.
+
+A genuine layout crash is reported to `onError` (and to the dev overlay on the 404 / 403 / 401 paths, where nothing else claimed the frame) rather than being swallowed. Repeats of the SAME cause within one request collapse to a single report, because one shared layout can fail every boundary attempt (and, when the layout is what threw, arrives again as the error that produced the 500). The key is the STAGE plus the error's name, message and construction site: the stack below that site records how the throw was reached and differs on every re-render, so it cannot be part of the key, and the stage is what keeps `global-error`'s own crash from being swallowed by a boundary that failed through the same helper. Two DIFFERENT failures are both reported, and anything whose key cannot be derived safely (a non-Error throw) is always reported rather than risking a drop. A control-flow sentinel never is, since it is routing rather than a crash.
+
+The BOUNDARY FILE's own crash (it throws, or fails to import at all) is reported the same way, and its response body follows the framework's standard rule for a thrown error: shown in dev, withheld in prod, where the page carries only its status. A thrown message is not author-controlled and may name a driver, a path or a connection string, so it does not reach the client; sanitizing the response never means losing the failure.
+
+Two further consequences: a layout that fetches runs its fetch again on a boundary response, and a `<webjs-suspense>` inside a wrapped layout shows its fallback, because a boundary response is buffered so its status is final before the first byte. A 404 for a URL that matched NO route has no chain to wrap in and stays a bare document.
+- Root-only (in `app/` exactly): `global-error.ts` is the app-wide catch-all after nested `error` boundaries are exhausted and renders its OWN `<!doctype><html><body>` (returned verbatim, so keep it static HTML with no components or hydration). That verbatim document is exactly why it is the one boundary left UNWRAPPED: a second shell would nest inside the root layout's, wrapping it would re-run the code that just threw, and with no boot script it could not soft-swap anyway. `global-not-found.ts` renders for an unmatched-anywhere URL when no `not-found` matches.
 
 Metadata routes (`sitemap.ts`, `robots.ts`, `manifest.ts`, `icon.ts`, `apple-icon.ts`, `opengraph-image.ts`, `twitter-image.ts`) live at app root or static segments and default-export a possibly-async function; `sitemap()` / `sitemapIndex()` from `@webjsdev/server` serialize spec-valid XML.
 
diff --git a/AGENTS.md b/AGENTS.md
index 4e05bb76f..0457037b3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -340,7 +340,7 @@ Default export receives `{ children, params, searchParams, url }`, must embed `c
 
 ### Error / loading / metadata routes
 
-`error.{js,ts}` default-exports `({ error, ...ctx }) => TemplateResult` (catches sibling-page / deeper render errors, innermost wins, prod sends only `error.message`). `loading.{js,ts}` wraps the sibling page in `Suspense` with an immediately-flushed fallback. `forbidden.{js,ts}` / `unauthorized.{js,ts}` render the nearest 403 / 401 boundary for a thrown `forbidden()` / `unauthorized()` (#848). Two **root-only** boundaries (`app/` root exactly): `global-error.{js,ts}` is the app-wide catch-all tried after the nested `error` boundaries are exhausted, and it renders its **own** `<!doctype><html><body>` document (returned verbatim, since a root-layout failure is when it fires). Because it is returned verbatim (no framework `<head>` splice), it ships **no importmap or boot script**, so keep it **static HTML with no components/hydration** (a last-resort page must not depend on the module system that may have just failed); under an opt-in CSP, an inline `<script>` in it must carry the nonce via `cspNonce()` (an inline `<style>` needs one only if you tighten `style-src`, since the default allows inline style outright). `global-not-found.{js,ts}` renders for an unmatched-anywhere URL when no `not-found` matches. `not-found` is nearest-wins from the throwing page's chain (#848 fixed the prior root-only behavior). Metadata routes (`sitemap`, `robots`, `manifest`, `icon`, `apple-icon`, `opengraph-image`, `twitter-image`) live at app root or static segments only and default-export a possibly-async function; `sitemap(entries)` / `sitemapIndex(sitemaps)` from `@webjsdev/server` serialize spec-valid XML. **`icon` / `apple-icon` are auto-LINKED** into the head (`<link rel="icon" href="/icon">`, `<link rel="apple-touch-icon" href="/apple-icon">`, base-path prefixed, no asserted `type` / `sizes` since the route picks its content type at request time), so writing the file is the whole wiring. A declared `metadata.icons` **suppresses** them rather than merging, matching Next's precedence for its static icon files, so an app that outgrows a placeholder route names its real icons instead of deleting it. `opengraph-image` / `twitter-image` are NOT auto-linked (a preview image is a per-page editorial choice): point `metadata.openGraph.images` / `metadata.twitter.images` at them. Declare a favicon through `metadata.icons` or a metadata route, never a hand-written `<link rel="icon">`, since only the root layout may write a shell at all (invariant 8). See `references/routing-and-pages.md`.
+`error.{js,ts}` default-exports `({ error, ...ctx }) => TemplateResult` (catches sibling-page / deeper render errors, innermost wins, prod sends only `error.message`). **A boundary renders INSIDE the layouts at and above its own segment** (#1298), so it carries the keyed `wj:children` pairs and navigating into a failing page is a SOFT navigation with the site chrome and its hydrated state intact; the same holds for `not-found` / `forbidden` / `unauthorized`, which now receive a page-shaped ctx too. A layout deeper than the boundary is not rendered and is not in the boot script, which ships the boundary module instead of the page's. A boundary cannot catch its OWN segment's layout (it renders inside it, Next's `layout -> error -> page` order). On the 500 path a throwing layout falls through to the next `error` boundary OUT, and to `global-error` when the chain is exhausted; the 404 / 403 / 401 paths have no outward walk, so there a throwing layout degrades that one response to a chrome-less standalone render of the boundary (status preserved, no boot script) and a control-flow throw from a wrapped layout is discarded rather than honoured, since the status is already decided. A real layout crash is reported to `onError` instead of vanishing (repeats of the SAME cause within one request collapse to one report, since a shared layout can fail several boundary attempts); a sentinel never is. A crash in the BOUNDARY FILE itself is reported too, and its body follows the standard thrown-error rule: shown in dev, withheld in prod (the page carries only its status). `loading.{js,ts}` wraps the sibling page in `Suspense` with an immediately-flushed fallback. `forbidden.{js,ts}` / `unauthorized.{js,ts}` render the nearest 403 / 401 boundary for a thrown `forbidden()` / `unauthorized()` (#848). Two **root-only** boundaries (`app/` root exactly): `global-error.{js,ts}` is the app-wide catch-all tried after the nested `error` boundaries are exhausted, and it renders its **own** `<!doctype><html><body>` document (returned verbatim, since a root-layout failure is when it fires). It is the sole boundary that is NOT wrapped in layouts: a second shell cannot nest inside the root layout's (invariant 8), wrapping it would re-run the code that just threw, and it ships no boot script anyway. Because it is returned verbatim (no framework `<head>` splice), it ships **no importmap or boot script**, so keep it **static HTML with no components/hydration** (a last-resort page must not depend on the module system that may have just failed); under an opt-in CSP, an inline `<script>` in it must carry the nonce via `cspNonce()` (an inline `<style>` needs one only if you tighten `style-src`, since the default allows inline style outright). `global-not-found.{js,ts}` renders for an unmatched-anywhere URL when no `not-found` matches. `not-found` is nearest-wins from the throwing page's chain (#848 fixed the prior root-only behavior). Metadata routes (`sitemap`, `robots`, `manifest`, `icon`, `apple-icon`, `opengraph-image`, `twitter-image`) live at app root or static segments only and default-export a possibly-async function; `sitemap(entries)` / `sitemapIndex(sitemaps)` from `@webjsdev/server` serialize spec-valid XML. **`icon` / `apple-icon` are auto-LINKED** into the head (`<link rel="icon" href="/icon">`, `<link rel="apple-touch-icon" href="/apple-icon">`, base-path prefixed, no asserted `type` / `sizes` since the route picks its content type at request time), so writing the file is the whole wiring. A declared `metadata.icons` **suppresses** them rather than merging, matching Next's precedence for its static icon files, so an app that outgrows a placeholder route names its real icons instead of deleting it. `opengraph-image` / `twitter-image` are NOT auto-linked (a preview image is a per-page editorial choice): point `metadata.openGraph.images` / `metadata.twitter.images` at them. Declare a favicon through `metadata.icons` or a metadata route, never a hand-written `<link rel="icon">`, since only the root layout may write a shell at all (invariant 8). See `references/routing-and-pages.md`.
 
 ### Route handlers (`app/**/route.{js,ts}`)
 
diff --git a/gallery/app/features/boundaries/page.ts b/gallery/app/features/boundaries/page.ts
index 720bf25cc..88852486e 100644
--- a/gallery/app/features/boundaries/page.ts
+++ b/gallery/app/features/boundaries/page.ts
@@ -51,6 +51,17 @@ export default function BoundariesExample() {
         <code class="font-mono">not-found.ts</code> (404).
       </li>
     </ul>
+    <p class="text-muted-foreground text-sm">
+      Follow the first three links and notice what does NOT happen: the page
+      does not reload. A boundary renders inside the layouts at and above its
+      own segment, so the surrounding chrome survives and the navigation stays
+      a soft one. Two cases still reload, both for the same reason (there is no
+      shared shell to swap into): the fourth link, whose URL matches no route
+      at all, so there is no layout chain to render the
+      <code class="font-mono">not-found.ts</code> inside; and
+      <code class="font-mono">global-error.ts</code>, which owns its whole
+      document.
+    </p>
     <p class="text-muted-foreground text-sm">
       <code class="font-mono">forbidden()</code> is for an authenticated user who
       lacks permission (403); <code class="font-mono">unauthorized()</code> is for
diff --git a/packages/server/src/check/runner-support.js b/packages/server/src/check/runner-support.js
index f10fc57ee..ddaeb7922 100644
--- a/packages/server/src/check/runner-support.js
+++ b/packages/server/src/check/runner-support.js
@@ -159,6 +159,15 @@ export async function checkServerImportInBrowserModule(appDir, violations) {
   for (const page of routeTable.pages || []) {
     for (const f of page.errors || []) alwaysShipRouteModules.set(f, 'error boundary');
     for (const f of page.loadings || []) alwaysShipRouteModules.set(f, 'loading boundary');
+    // forbidden / unauthorized joined this set with #1298. They used to render
+    // with an empty boot set, so their modules never reached the browser and
+    // omitting them here was harmless. They now render inside their layout
+    // chain AND ship, so a `forbidden.ts` doing `import { auth } from
+    // '#lib/auth.server.ts'` (a natural thing on a 403: "signed in as X, but
+    // not permitted") is a real throw-at-load crash that takes every sibling
+    // registration in the same module script with it.
+    for (const f of page.forbiddens || []) alwaysShipRouteModules.set(f, 'forbidden boundary');
+    for (const f of page.unauthorizeds || []) alwaysShipRouteModules.set(f, 'unauthorized boundary');
   }
   if (routeTable.notFound) alwaysShipRouteModules.set(routeTable.notFound, 'not-found page');
   if (routeTable.notFounds) {
@@ -166,6 +175,14 @@ export async function checkServerImportInBrowserModule(appDir, violations) {
       alwaysShipRouteModules.set(f, 'not-found page');
     }
   }
+  // global-not-found ships for the same reason: a thrown notFound() with no
+  // nearer boundary renders it against the matched route, so it wraps and
+  // boots. global-ERROR is deliberately absent: it returns its own document
+  // verbatim with no importmap and no boot script, so nothing of it ever
+  // reaches the browser.
+  if (routeTable.globalNotFound) {
+    alwaysShipRouteModules.set(routeTable.globalNotFound, 'global-not-found page');
+  }
 
   // The elision flag mirrors `dev.js`: respect `webjs.elide === false` and the
   // WEBJS_ELIDE override. When elision is OFF, the build ships EVERY component
diff --git a/packages/server/src/dev/serve.js b/packages/server/src/dev/serve.js
index 4c9aa1227..e9ab32573 100644
--- a/packages/server/src/dev/serve.js
+++ b/packages/server/src/dev/serve.js
@@ -495,7 +495,59 @@ export async function handleCore(req, ctx) {
   }
   // Unmatched anywhere: prefer the root not-found.{js,ts}, then a
   // global-not-found.{js,ts} (#848), else the default 404 page.
-  return ssrNotFound(state.routeTable.notFound || state.routeTable.globalNotFound, { dev, appDir, req, url });
+  // The APM / overlay sinks ride along here too: a root not-found that throws
+  // or fails to load must reach them, not only the console (#1298). Built
+  // inline rather than reused, because the ssrOpts above is scoped to the
+  // matched-page branch, which this path did not take.
+  //
+  // No `route` is passed on purpose: nothing matched, so there is no layout
+  // chain to render the boundary inside, and the response stays a bare
+  // document with no boot script.
+  // Same supersede rule the matched-page branch follows (#1047 / #893): a
+  // LATER successful render of this same url clears the frame it retained, so
+  // an intermittently-failing not-found (a query behind it, not a source edit,
+  // which the rebuild already clears) cannot leave a frame that paints over a
+  // page that has since recovered. Scoped to this url, so a good render here
+  // never erases an error still current for a page the user is looking at.
+  const devErrorUrl = withBasePath(url.pathname, basePath()) + url.search;
+  // Gated on !isPrefetch as well as dev, exactly as the matched-page branch
+  // gates its whole supersede closure. The clear below infers "this render
+  // succeeded" from "the retained frame is still the one I captured", and that
+  // inference is only valid when a sink was installed to write a new one. A
+  // prefetch installs none, so a prefetch of a url that throws AGAIN would
+  // look like a recovery and wipe a frame that is still current, which is the
+  // #893 gap the retention exists to close.
+  const isPrefetch = req.headers.get('x-webjs-prefetch') === '1';
+  const before = dev && !isPrefetch ? state.lastDevError : null;
+  const resp = await ssrNotFound(state.routeTable.notFound || state.routeTable.globalNotFound, {
+    dev,
+    appDir,
+    req,
+    url,
+    onError: reportError ? (e) => reportError(e, req, 'ssr') : undefined,
+    // The frame's url must be stamped exactly as the matched-page branch
+    // stamps it, or the overlay's scope gate refuses it: the browser compares
+    // against `location.pathname + location.search`, so dropping the query
+    // suppresses the overlay on any unrouted url that carries one, and
+    // dropping the base path suppresses it on EVERY url of a sub-path deploy
+    // (the ingress strip already removed the prefix from `url`, while the
+    // browser's location still has it). A refused frame goes to the pending
+    // slot and is then discarded, so the overlay simply never paints.
+    //
+    // Dropped for a speculative prefetch, on the same #1047 rule the
+    // matched-page branch follows: hovering a link to a broken page must not
+    // raise an overlay on the page you are actually on, nor become
+    // `state.lastDevError` for the SSE to replay into a fresh tab. Prefetch is
+    // on by default and fetches unrouted hrefs too, so this is reachable.
+    onDevError: dev && !isPrefetch
+      ? (e) => reportDevError(e, { kind: 'render', url: devErrorUrl })
+      : undefined,
+  });
+  if (
+    before && state.lastDevError === before
+    && before.kind === 'render' && before.url === devErrorUrl
+  ) state.lastDevError = null;
+  return resp;
 }
 
 /** @param {Request} req @param {string} path */
diff --git a/packages/server/src/form-dispatch.js b/packages/server/src/form-dispatch.js
index 2e1c7f17e..030db64d1 100644
--- a/packages/server/src/form-dispatch.js
+++ b/packages/server/src/form-dispatch.js
@@ -561,13 +561,22 @@ export async function runFormAction(route, params, url, req, ssrOpts, deps) {
       // the SUCCESS-result path below.
       return new Response(null, { status: e.status || 307, headers: { location: e.url } });
     }
+    // `route` and `params` ride along so the boundary renders inside its
+    // layouts, exactly as it does on the page-render path (#1298).
     if (isNotFound(err)) {
-      return ssrNotFound(ssrOpts.notFoundFile ?? null, { ...ssrOpts, req, url });
+      // NEAREST-wins, like the page-render path (#848). `ssrOpts.notFoundFile`
+      // is the ROOT one only, so a nested form action throwing notFound()
+      // rendered the root boundary while the same throw from the page render
+      // rendered the nested one. Two paths, one url, different 404s.
+      const nearestNotFound = route.notFounds && route.notFounds.length
+        ? route.notFounds[route.notFounds.length - 1]
+        : (ssrOpts.notFoundFile ?? null);
+      return ssrNotFound(nearestNotFound, { ...ssrOpts, req, url, route, params });
     }
     // forbidden()/unauthorized() from a form action render the same 403/401
     // boundary as the page-render path (#848), not a generic 500.
-    if (isForbidden(err)) return ssrForbidden(route, { ...ssrOpts, req, url });
-    if (isUnauthorized(err)) return ssrUnauthorized(route, { ...ssrOpts, req, url });
+    if (isForbidden(err)) return ssrForbidden(route, { ...ssrOpts, req, url, route, params });
+    if (isUnauthorized(err)) return ssrUnauthorized(route, { ...ssrOpts, req, url, route, params });
     if (typeof onError === 'function') onError(err);
     return await formActionErrorResponse(err, ssrOpts.dev);
   }
diff --git a/packages/server/src/ssr.js b/packages/server/src/ssr.js
index 45c5932b0..1066cb0cc 100644
--- a/packages/server/src/ssr.js
+++ b/packages/server/src/ssr.js
@@ -18,6 +18,8 @@ export { publicEnvShim } from './ssr/env-shim.js';
 export {
   _layoutSegmentPath,
   _pageSegmentPath,
+  _boundarySegmentPath,
+  _layoutsForBoundary,
   _regionRouteKey,
   _wrapWithChildrenMarker,
   _extractUserShell,
diff --git a/packages/server/src/ssr/document.js b/packages/server/src/ssr/document.js
index f66110cd5..073e765bd 100644
--- a/packages/server/src/ssr/document.js
+++ b/packages/server/src/ssr/document.js
@@ -48,6 +48,63 @@ export function pageSegmentPath(pageFile) {
   return p === '' ? '/' : '/' + p;
 }
 
+/**
+ * Like layoutSegmentPath but for a BOUNDARY file (error / not-found /
+ * forbidden / unauthorized). Strips the boundary filename, yielding the
+ * segment the boundary sits at:
+ *
+ *   app/error.ts                        -> '/'
+ *   app/docs/error.ts                   -> '/docs'
+ *   app/(marketing)/about/not-found.ts  -> '/(marketing)/about'
+ *   app/global-not-found.ts             -> '/'   (root-only by definition)
+ *
+ * Route groups are KEPT, for the reason stated on layoutSegmentPath: two
+ * routes at one URL prefix served by different `(group)` layouts must not
+ * look like a shared layout.
+ *
+ * The filename match is anchored to a separator or the start of the path, and
+ * the `global-` forms are matched FIRST. Without the anchor, `not-found` also
+ * matches INSIDE `global-not-found.ts`, which yielded the nonsense segment
+ * `/global-` for a boundary that is root-only and must derive `/`.
+ *
+ * @param {string} boundaryFile  Absolute path to the boundary source file.
+ * @returns {string}
+ */
+export function boundarySegmentPath(boundaryFile) {
+  const p = boundaryFile
+    .replace(/^.*\/app\//, '')
+    .replace(
+      /(?:^|\/)(?:global-error|global-not-found|error|not-found|forbidden|unauthorized)\.[jt]sx?$/,
+      '',
+    );
+  return p === '' ? '/' : '/' + p;
+}
+
+/**
+ * The layouts that wrap a boundary at `boundarySeg`: every layout whose own
+ * segment is that segment or an ancestor of it, in the chain's original
+ * outermost-first order (#1298).
+ *
+ * A layout DEEPER than the boundary never rendered, so it is excluded. The
+ * boundary's OWN segment layout is INCLUDED, which is Next's hierarchy
+ * (`layout.js` then `error.js` then `page.js`, so the boundary sits INSIDE its
+ * segment's layout). That is also why an error thrown by a layout is not
+ * caught by the boundary at its own segment: the boundary is nested inside the
+ * thing that threw, so the next boundary OUT handles it.
+ *
+ * The prefix test breaks on a segment, so '/doc' never matches '/docs'.
+ *
+ * @param {string[]} layouts  route.layouts, outermost first.
+ * @param {string} boundarySeg
+ * @returns {string[]}
+ */
+export function layoutsForBoundary(layouts, boundarySeg) {
+  return (layouts || []).filter((f) => {
+    const seg = layoutSegmentPath(f);
+    return seg === boundarySeg || boundarySeg.startsWith(seg === '/' ? '/' : seg + '/');
+  });
+}
+
 /**
  * Derive a region's ROUTE-KEY from its segment path pattern and the render's
  * resolved params. The route-key is the CONCRETE resolved URL path for the
@@ -169,6 +226,8 @@ export function wrapWithChildrenMarker(tree, segmentPath, params) {
 /** Internal helpers re-exported for unit testing. */
 export const _layoutSegmentPath = layoutSegmentPath;
 export const _pageSegmentPath = pageSegmentPath;
+export const _boundarySegmentPath = boundarySegmentPath;
+export const _layoutsForBoundary = layoutsForBoundary;
 export const _regionRouteKey = regionRouteKey;
 export const _wrapWithChildrenMarker = wrapWithChildrenMarker;
 
diff --git a/packages/server/src/ssr/render.js b/packages/server/src/ssr/render.js
index 56d77a6b9..d6fe3478e 100644
--- a/packages/server/src/ssr/render.js
+++ b/packages/server/src/ssr/render.js
@@ -13,7 +13,7 @@ import {
 } from '../html-cache.js';
 import { requestedFrameId, extractFrameSubtree } from '../frame-render.js';
 import { makeThenable } from '../thenable-params.js';
-import { buildDocumentParts, wrapInDocument, layoutSegmentPath, pageSegmentPath, regionRouteKey, wrapWithChildrenMarker } from './document.js';
+import { buildDocumentParts, wrapInDocument, layoutSegmentPath, pageSegmentPath, boundarySegmentPath, layoutsForBoundary, regionRouteKey, wrapWithChildrenMarker } from './document.js';
 import { escapeHtml } from './escape.js';
 import {
   cachedHtmlResponse, getNonce, htmlResponse, streamingHtmlResponse,
@@ -245,6 +245,115 @@ async function loadingTemplates(route, ctx, dev) {
   return parts.join('');
 }
 
+/**
+ * Wrap a tree in a layout chain, emitting the KEYED boundary comment pair
+ * (#1015) around each layout's `${children}`.
+ *
+ * This is the ONE emitter: the happy path and every boundary render call it, so
+ * the segment ids and route-keys they produce cannot drift apart (#1298). Drift
+ * there is the worst available outcome, because the client router's scan then
+ * finds a mismatched pair and hard-loads anyway, which looks fixed in a diff.
+ *
+ * `have` is the X-Webjs-Have short-circuit. It is null on every boundary path,
+ * so a boundary response is structurally incapable of being reduced.
+ *
+ * @param {unknown} tree  The inner tree (the page, or a boundary in its place).
+ * @param {string[]} layouts  Layout files, outermost first.
+ * @param {Record<string, unknown>} ctx
+ * @param {boolean} dev
+ * @param {Record<string, string>} params  Resolved route params for the keys.
+ * @param {Map<string, string> | null} have
+ * @returns {Promise<{ tree: unknown, reduced: boolean }>}
+ */
+async function wrapLayoutChain(tree, layouts, ctx, dev, params, have) {
+  for (let i = layouts.length - 1; i >= 0; i--) {
+    const segmentPath = layoutSegmentPath(layouts[i]);
+    // Short-circuit ONLY when the client's copy of this layout was rendered
+    // for the SAME route-key: a param change at a dynamic layout must
+    // re-render the layout's own markup (#1015).
+    if (have && have.get(segmentPath) === regionRouteKey(segmentPath, params)) {
+      // REDUCED response (#1009): the outer layouts were skipped, so these
+      // bytes are only valid for a client that already HAS them. The caller
+      // marks the response `private` so no shared cache can store it, and
+      // additionally `Vary: X-Webjs-Have` for caches that honour it. The
+      // `private` is the guarantee, not the Vary: Cloudflare and others honour
+      // only `Accept-Encoding` (#1140).
+      return { tree: wrapWithChildrenMarker(tree, segmentPath, params), reduced: true };
+    }
+    const mod = await loadModule(layouts[i], dev);
+    if (!mod.default) continue;
+    tree = await mod.default({
+      ...ctx,
+      children: wrapWithChildrenMarker(tree, segmentPath, params),
+    });
+  }
+  return { tree, reduced: false };
+}
+
+/**
+ * Render a boundary tree in the PAGE's position, wrapped in the layouts that
+ * wrap that boundary, so the response carries the same keyed boundary comments
+ * a successful render of this URL would and the client router can soft-swap it
+ * (#1298). Before this, a boundary went straight to `wrapInDocument` with no
+ * layouts, so it carried no markers at all, the router's scan found no shared
+ * boundary, and every navigation into a failing page was a full document load.
+ *
+ * Buffered on purpose: no `suspenseCtx`, so a `<webjs-suspense>` inside a
+ * wrapped layout emits its fallback and never resolves (render-server/stream.js).
+ * That is the trade for a boundary response whose status and headers are final
+ * before the first byte, which matters more on a 500 than streaming does.
+ *
+ * A throw from a wrapped layout propagates to the CALLER. That is what makes a
+ * throwing layout fall through to the next boundary OUT instead of looping:
+ * each step outward wraps a strictly smaller set, so the walk converges.
+ *
+ * @param {unknown} tree  The boundary module's rendered tree.
+ * @param {{ file: string, layouts: string[] }} route
+ * @param {string} boundaryFile
+ * @param {Record<string, unknown>} ctx
+ * @param {boolean} dev
+ * @returns {Promise<string>}
+ */
+async function renderBoundaryInChain(tree, route, boundaryFile, ctx, dev) {
+  const params = { ...(/** @type {Record<string,string>} */ (ctx.params) || {}) };
+  const wrapLayouts = layoutsForBoundary(route.layouts, boundarySegmentPath(boundaryFile));
+  // The boundary occupies the PAGE's region, so it gets the page's own keyed
+  // pair, EXCEPT when the page's segment is also a LAYOUT's segment. Then the
+  // id is that layout's and emitting it here would be a lie in one of two ways.
+  //
+  // If that layout is the innermost wrapped one, its children slot already
+  // delimits this exact range and two boundaries under one id break keyed
+  // pairing: the happy path skips for the same reason.
+  //
+  // If that layout was EXCLUDED (the boundary sits above it, so it never
+  // rendered), the id is worse than redundant. The response would advertise a
+  // region under the excluded layout's id with none of its markup inside, the
+  // client would then send that id in `X-Webjs-Have`, and the next navigation
+  // into that layout's subtree would short-circuit on it and return a fragment
+  // that assumes chrome the page never had. The user lands on the next page
+  // with that layout missing entirely.
+  //
+  // So the SET of emitted ids is a subset of the happy path's, never a
+  // different set: an id only ever appears here if a layout at that segment
+  // rendered, or no layout owns that segment at all.
+  const pageSeg = pageSegmentPath(route.file);
+  const layoutSegs = new Set((route.layouts || []).map(layoutSegmentPath));
+  if (!layoutSegs.has(pageSeg)) tree = wrapWithChildrenMarker(tree, pageSeg, params);
+  // MARK a layout-phase failure. The caller has to tell "a wrapped layout
+  // threw" apart from "the boundary's own tree is broken", and it cannot infer
+  // it by re-rendering: when BOTH are broken the standalone attempt throws too,
+  // and an inference would report the layout error under the boundary's label
+  // and lose the tree's entirely. The phase is known exactly here, so it is
+  // recorded rather than guessed.
+  let chain;
+  try {
+    chain = await wrapLayoutChain(tree, wrapLayouts, ctx, dev, params, null);
+  } catch (e) {
+    throw markLayoutPhase(e);
+  }
+  return renderToString(chain.tree, { ssr: true, dev });
+}
+
 async function renderChain(route, ctx, dev, suspenseCtx, have, pageModule) {
   // Reuse a caller-supplied page module when present. The only producer is the
   // HTML-cache path above, which loads the module to read `export const
@@ -309,75 +418,489 @@ async function renderChain(route, ctx, dev, suspenseCtx, have, pageModule) {
   // layout's boundary pair (so the client can identify the splice
   // target) and return: outer layouts are not rendered at all,
   // saving CPU and wire bytes.
-  for (let i = route.layouts.length - 1; i >= 0; i--) {
-    const segmentPath = layoutSegmentPath(route.layouts[i]);
-    // Short-circuit ONLY when the client's copy of this layout was rendered
-    // for the SAME route-key: a param change at a dynamic layout must
-    // re-render the layout's own markup (#1015).
-    if (have && have.get(segmentPath) === regionRouteKey(segmentPath, params)) {
-      tree = wrapWithChildrenMarker(tree, segmentPath, params);
-      const body = await renderToString(tree, { ssr: true, suspenseCtx });
-      // REDUCED response (#1009): the outer layouts were skipped, so these
-      // bytes are only valid for a client that already HAS them. The caller
-      // marks the response `private` so no shared cache can store it, and
-      // additionally `Vary: X-Webjs-Have` for caches that honour it. The
-      // `private` is the guarantee, not the Vary: Cloudflare and others honour
-      // only `Accept-Encoding` (#1140).
-      return { html: body + (await loadingTemplates(route, ctx, dev)), reduced: true };
+  // The loop itself lives in wrapLayoutChain, shared with the boundary render
+  // path (#1298) so both emit identical segment ids and route-keys.
+  const chain = await wrapLayoutChain(tree, route.layouts, ctx, dev, params, have);
+  const body = await renderToString(chain.tree, { ssr: true, suspenseCtx });
+  return { html: body + (await loadingTemplates(route, ctx, dev)), reduced: chain.reduced };
+}
+
+/**
+ * Render the framework's DEFAULT boundary body inside the matched route's
+ * layout chain (#1298), so a route with no boundary file of its own still
+ * keeps its chrome and still soft-navigates.
+ *
+ * Returns null when the chain cannot render, which degrades to the bare
+ * default the caller already holds: this is the last-resort page, so it must
+ * never be the thing that fails. A layout crash here is reported like any
+ * other rather than being swallowed.
+ *
+ * @param {string} raw  The default body markup.
+ * @param {{ dev: boolean, appDir: string, route?: { file: string, layouts: string[] },
+ *   ctx?: Record<string, unknown>, params?: Record<string, string>, url?: URL }} opts
+ * @returns {Promise<{ body: string, moduleUrls: string[] } | null>}
+ */
+async function defaultBoundaryInChain(raw, opts) {
+  const route = opts.route;
+  if (!route || !route.layouts || route.layouts.length === 0) return null;
+  const ctx = opts.ctx || boundaryCtx(opts.params, opts.url, undefined);
+  try {
+    const params = { ...(/** @type {Record<string,string>} */ (ctx.params) || {}) };
+    const chain = await wrapLayoutChain(rawTemplate(raw), route.layouts, ctx, opts.dev, params, null);
+    return {
+      body: await renderToString(chain.tree, { ssr: true, dev: opts.dev }),
+      moduleUrls: boundaryModuleUrls(null, route.layouts, opts),
+    };
+  } catch (e) {
+    reportBoundaryLayoutError(e, opts, { overlay: true });
+    return null;
+  }
+}
+
+/**
+ * Wrap a raw HTML string as a synthetic TemplateResult so it can go through
+ * the layout chain. The string lives in `strings` (static template parts), not
+ * `values`, because a hole is HTML-escaped on render and this markup is the
+ * framework's own.
+ *
+ * @param {string} raw
+ * @returns {{ _$webjs: 'template', strings: string[], values: unknown[] }}
+ */
+function rawTemplate(raw) {
+  return { _$webjs: 'template', strings: [raw], values: [] };
+}
+
+/**
+ * The layouts that will wrap a boundary FILE on this route (#1298). One place,
+ * so the render path and the boot set cannot disagree about what wrapped, and
+ * so the catch can ask whether anything wrapped at all.
+ *
+ * @param {{ layouts: string[] }} route
+ * @param {string} boundaryFile
+ * @returns {string[]}
+ */
+function wrapLayoutsFor(route, boundaryFile) {
+  return layoutsForBoundary(route.layouts, boundarySegmentPath(boundaryFile));
+}
+
+/**
+ * Marker for a throw that came from the LAYOUT-wrapping phase of a boundary
+ * render, as opposed to the boundary's own tree (#1298). Non-enumerable, so it
+ * never shows up in a serialized error, and best-effort: a frozen or primitive
+ * throw simply goes unmarked and is treated as a tree failure, which reports it
+ * once under the boundary label rather than dropping it.
+ */
+const LAYOUT_PHASE = Symbol('webjs.boundaryLayoutPhase');
+
+/** @param {unknown} err @returns {unknown} */
+function markLayoutPhase(err) {
+  if (err && typeof err === 'object') {
+    try { Object.defineProperty(err, LAYOUT_PHASE, { value: true, enumerable: false }); } catch { /* frozen */ }
+  }
+  return err;
+}
+
+/** @param {unknown} err @returns {boolean} */
+function isLayoutPhase(err) {
+  return !!(err && typeof err === 'object' && /** @type {any} */ (err)[LAYOUT_PHASE]);
+}
+
+/**
+ * Render a thrown value as text for a DEV error page, safely.
+ *
+ * `String(err)` is not total: `String(Object.create(null))` throws on both
+ * runtimes, and a getter on a subclass can throw too. Every caller here is
+ * already inside a catch whose job is to keep the response alive, so an
+ * uncaught throw while FORMATTING the failure escapes the handler and takes
+ * the error page down with it, turning a handled 500 into an unhandled one.
+ *
+ * @param {unknown} err
+ * @returns {string}
+ */
+function safeErrorText(err) {
+  try {
+    if (err instanceof Error) return String(err.stack || err.message);
+    return String(err);
+  } catch {
+    return '[unprintable value]';
+  }
+}
+
+/**
+ * A per-request dedup key for a secondary boundary failure: the STAGE it came
+ * from plus the error's name, message and construction site. Identity cannot
+ * be used, because a layout that
+ * constructs its error yields a fresh object each time it is re-run, and the
+ * whole point is to collapse exactly those repeats while letting a genuinely
+ * different failure through.
+ *
+ * The CONSTRUCTION SITE (the first stack frame), not the whole stack. The
+ * frames below it record how the throw was reached, and the same layout
+ * re-rendered around a different boundary is reached differently every time,
+ * so a full-stack key would never collapse the repeats it exists for.
+ *
+ * That leaves the construction site shared by two genuinely different
+ * failures that go through one helper, which is why the caller's STAGE is part
+ * of the key rather than the error alone: the boundary walk and the
+ * `global-error` attempt are different stages, so a shared helper failing in
+ * both is reported twice, while one layout failing repeatedly INSIDE the walk
+ * is reported once. The stage is what distinguishes them; the stack cannot.
+ *
+ * Returns null when no safe key can be derived, which means DO NOT DEDUPE.
+ * Failing open is the only acceptable direction here: a duplicate report is
+ * noise, a dropped one is a crash nobody hears about. That covers a non-Error
+ * throw (two unrelated plain objects would otherwise share `[object Object]`)
+ * and anything whose property access or stringification throws, which is a
+ * real shape: `String(Object.create(null))` throws, and this runs INSIDE the
+ * catch that is supposed to keep the response alive, so a throw here would
+ * escape `ssrPage` and take the 500 page with it.
+ *
+ * @param {unknown} err
+ * @param {string} stage  Which attempt produced this throw. Part of the key.
+ * @returns {string | null}
+ */
+function boundaryErrorKey(err, stage) {
+  if (!(err instanceof Error)) return null;
+  try {
+    const site = String(err.stack || '').split('\n')[1] || '';
+    return `${stage}\u0000${String(err.name)}:${String(err.message)}:${site.trim()}`;
+  } catch {
+    return null;
+  }
+}
+
+/** Stage labels, which are part of the dedup key (see boundaryErrorKey). */
+const STAGE_WALK = 'an error boundary or its layout threw while handling a render error';
+const STAGE_GLOBAL_ERROR = 'global-error threw while handling a render error';
+const STAGE_BOUNDARY = 'a boundary module threw or failed to load';
+
+/**
+ * Report a throw from a layout wrapped around a boundary page (#1298) to the
+ * same sinks a page-render error reaches, then let the caller degrade to the
+ * standalone render. Best-effort on both sinks: a throwing sink must never
+ * affect the response.
+ *
+ * A CONTROL-FLOW sentinel is not an error and is never reported. This is the
+ * same classification the page path makes before it calls `onError` (a
+ * `redirect()` / `notFound()` / `forbidden()` / `unauthorized()` is a routing
+ * decision, not a crash), and it matters more here: reporting one would fire
+ * the app's APM sink and paint a false dev error overlay OVER the 403 the user
+ * is looking at.
+ *
+ * The sentinel is not HONOURED either, and that is deliberate. The status is
+ * already decided by the time a boundary renders, and the boundary page IS the
+ * answer to this request; letting a layout redirect out of it would replace a
+ * 403 the app asked for with a bounce the app did not, on a path where the
+ * redirect target could itself be forbidden. So the render degrades to the
+ * standalone boundary body, exactly as it does for a real layout crash, and
+ * the status the boundary carries is preserved.
+ *
+ * Deduplicated per request by CAUSE, via the caller's `seen` set. The 500 path
+ * tries each boundary in the chain, and a throwing layout that is an ancestor
+ * of several of them fails EVERY attempt: `layoutsForBoundary` selects by
+ * segment ancestry rather than by boundary depth, so two boundaries at
+ * different segments can resolve to the same layout set. Without dedup a root
+ * layout that throws is reported once per boundary in the chain.
+ *
+ * The key is the error's name, message and throw site rather than its identity,
+ * because a layout that constructs its error (`throw new Error(...)`) yields a
+ * fresh object per attempt. Deduplicating on "any secondary failure already
+ * reported" instead would be wrong in the other direction: an inner boundary
+ * throwing a TypeError would silence a LATER, unrelated root-layout crash, and
+ * would make the `global-error` report below unreachable on every route whose
+ * chain contains a real `error.{js,ts}`, since reaching that block at all means
+ * an earlier attempt already threw. Distinct causes are each reported once.
+ *
+ * `overlay` says whether this failure may claim the DEV OVERLAY. The overlay
+ * holds one retained frame per URL and the dev handler's slot is last-write
+ * wins, so a secondary failure pushed after the original page error would
+ * replace the root cause with a symptom, and the replacement would survive a
+ * reconnect. So the 500 path passes false (the page error already claimed the
+ * slot and is what the developer needs to see), while the 403 / 401 / 404
+ * paths pass true, since nothing else claimed it there: their trigger is a
+ * control-flow sentinel, which is never reported.
+ *
+ * @param {unknown} err
+ * @param {{ onError?: (e: unknown) => void, onDevError?: (e: unknown) => void }} opts
+ * @param {{ what?: string, seen?: Set<string>, overlay?: boolean }} [cfg]
+ */
+function reportBoundaryLayoutError(err, opts, cfg = {}) {
+  if (isRedirect(err) || isNotFound(err) || isForbidden(err) || isUnauthorized(err)) return;
+  if (cfg.seen) {
+    const key = boundaryErrorKey(err, cfg.what || '');
+    // A null key means no safe key could be derived, so report rather than
+    // risk dropping. See boundaryErrorKey.
+    if (key !== null) {
+      if (cfg.seen.has(key)) return;
+      cfg.seen.add(key);
     }
-    const mod = await loadModule(route.layouts[i], dev);
-    if (!mod.default) continue;
-    tree = await mod.default({
-      ...ctx,
-      children: wrapWithChildrenMarker(tree, segmentPath, params),
-    });
   }
-  const body = await renderToString(tree, { ssr: true, suspenseCtx });
-  return { html: body + (await loadingTemplates(route, ctx, dev)), reduced: false };
+  const what = cfg.what || 'a layout threw while wrapping a boundary page';
+  if (typeof opts.onError === 'function') {
+    try { opts.onError(err); } catch { /* a throwing sink must not affect the response */ }
+  }
+  if (cfg.overlay !== false && typeof opts.onDevError === 'function') {
+    try { opts.onDevError(err); } catch { /* a throwing sink must not affect the response */ }
+  }
+  console.error(`[webjs] ${what}:`, err);
+}
+
+/**
+ * The boot module set for a boundary response: what actually RENDERED, the
+ * boundary module plus the layouts wrapping it (#1298).
+ *
+ * Applies the SAME inert / import-only substitution as the happy-path boot
+ * (#963), so a boundary never ships a route module the normal render drops.
+ * Pre-substitution, an import-only layout with a bare `.server.*` import
+ * (legal, it never loads client-side) would load here whole and crash the
+ * boundary page's boot on the throw-at-load stub, killing the sibling
+ * component registrations in the same module script.
+ *
+ * The substitution applies to the boundary file harmlessly: only page and
+ * layout files are fed to the elision analysis, so a boundary is never inert
+ * and never import-only, gets no verdict, and is pushed as-is. Every boundary
+ * kind is a `browserEntryFiles` entry (browser-entries.js), so each of these
+ * URLs is servable through the auth gate.
+ *
+ * @param {string | null} boundaryFile  Null for the framework's default body,
+ *   which has no module of its own; only the layouts boot then.
+ * @param {string[]} wrapLayouts
+ * @param {{ appDir: string, inertRouteModules?: Set<string>,
+ *   importOnlyRouteModules?: Map<string, string[]>,
+ *   instrumentationClient?: string }} opts
+ * @returns {string[]}
+ */
+function boundaryModuleUrls(boundaryFile, wrapLayouts, opts) {
+  /** @type {string[]} */
+  const urls = [];
+  const seen = new Set();
+  const push = (abs) => {
+    const u = toUrlPath(abs, opts.appDir);
+    if (!seen.has(u)) { seen.add(u); urls.push(u); }
+  };
+  for (const f of (boundaryFile ? [boundaryFile, ...wrapLayouts] : [...wrapLayouts])) {
+    if (opts.inertRouteModules && opts.inertRouteModules.has(f)) continue;
+    const emit = opts.importOnlyRouteModules && opts.importOnlyRouteModules.get(f);
+    if (emit) emit.forEach(push);
+    else push(f);
+  }
+  // instrumentation-client.{js,ts} (#848) rides the SAME first-import contract
+  // it has on the happy path: it runs before app modules so the app's client
+  // error reporting is installed before anything can throw. A boundary page is
+  // where that matters most, so it must not be the one place it is missing.
+  // The set is never empty by the time we get here (the boundary file is
+  // always pushed above, since only pages and layouts are fed to the elision
+  // analysis, so a boundary is never inert and never import-only), which is
+  // why this needs no non-empty guard.
+  if (opts.instrumentationClient) {
+    const u = toUrlPath(opts.instrumentationClient, opts.appDir);
+    const i = urls.indexOf(u);
+    if (i !== -1) urls.splice(i, 1);
+    urls.unshift(u);
+  }
+  return urls;
+}
+
+/**
+ * The ctx a boundary module and its wrapped layouts receive (#1298). Same shape
+ * as the page render's, so a layout cannot tell a boundary render from a normal
+ * one. Boundary modules used to be called with an empty object, which left a
+ * wrapped layout with no `params` to build its own links from.
+ * @param {Record<string, string> | undefined} params
+ * @param {URL | undefined} url
+ * @param {unknown} actionData
+ */
+function boundaryCtx(params, url, actionData) {
+  return {
+    params: makeThenable(params || {}),
+    searchParams: makeThenable(url ? Object.fromEntries(url.searchParams.entries()) : {}),
+    url: url ? url.toString() : '',
+    actionData,
+  };
 }
 
 /**
  * Render a simple boundary page (forbidden / unauthorized, #848) at the given
- * default heading. Loads the nearest boundary module when one exists (its
- * default export receives no props, like not-found), else emits the default
- * heading. Mirrors ssrNotFoundHtml.
+ * default heading. Loads the nearest boundary module when one exists, else
+ * emits the default heading. Mirrors ssrNotFoundHtml.
+ *
+ * When the caller supplies the matched `route` (#1298), the boundary renders
+ * inside the layouts wrapping it, so a 403 / 401 soft-swaps like any other
+ * response. Two bounded attempts, never a loop: a throwing layout degrades to
+ * the standalone render this has always produced.
+ *
  * @param {string | null} file
  * @param {string} heading  e.g. '403: Forbidden'
- * @param {{ dev: boolean, appDir: string, req?: Request }} opts
+ * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL,
+ *   route?: { file: string, layouts: string[] },
+ *   ctx?: Record<string, unknown>, params?: Record<string, string> }} opts
  */
 async function ssrBoundaryHtml(file, heading, opts) {
   let body = `<h1>${heading}</h1>`;
+  /** @type {string[]} */
+  let moduleUrls = [];
+  // No boundary FILE, but a route matched: the framework's own default page is
+  // what renders, and it belongs inside the layouts just as a custom one does.
+  // This is the COMMON case for 403 / 401, since most apps ship no
+  // forbidden.ts, and leaving it bare would mean the headline fix does not
+  // apply to them at all. Wrapped in the route's full chain, because the
+  // default boundary has no segment of its own and stands in for the page.
+  if (!file && opts.route) {
+    const wrapped = await defaultBoundaryInChain(`<h1>${heading}</h1>`, opts);
+    if (wrapped) { body = wrapped.body; moduleUrls = wrapped.moduleUrls; }
+  }
   if (file) {
+    const ctx = opts.ctx || boundaryCtx(opts.params, opts.url, undefined);
     try {
       const mod = await loadModule(file, opts.dev);
-      if (mod.default) body = await renderToString(await mod.default({}), { ssr: true, dev: opts.dev });
+      if (mod.default) {
+        const tree = await mod.default(ctx);
+        try {
+          if (opts.route) {
+            body = await renderBoundaryInChain(tree, opts.route, file, ctx, opts.dev);
+            // The chain rendered, so its modules have to boot: chrome that
+            // paints but never hydrates is worse than no chrome, because its
+            // controls look live and are not (#1298).
+            moduleUrls = boundaryModuleUrls(file, wrapLayoutsFor(opts.route, file), opts);
+          } else {
+            body = await renderToString(tree, { ssr: true, dev: opts.dev });
+          }
+        } catch (layoutErr) {
+          // When NO LAYOUT actually wrapped this boundary, the try body already
+          // ran this exact `renderToString(tree)`: with no route there is no
+          // chain at all, and with a route whose wrap set is empty (a legal
+          // app with no root layout, since the framework emits the shell)
+          // renderBoundaryInChain reduces to the same call. Re-running it would
+          // execute the boundary tree a second time to learn nothing, and a
+          // tree that is not idempotent under re-render could even SUCCEED on
+          // the retry and be reported as a layout crash that never happened.
+          // Rethrow: the outer catch reports it once, under the boundary label.
+          if (!opts.route || wrapLayoutsFor(opts.route, file).length === 0) throw layoutErr;
+          // Always attempt the standalone render, which is the degradation
+          // this path has always produced. Its OUTCOME is half the diagnosis
+          // and the phase marker is the other half; neither alone is enough.
+          //
+          // The marker records a layout that threw when it was CALLED. It
+          // cannot record a layout that fails while being SERIALIZED (the
+          // idiomatic `html`<nav>${getNav()}</nav>${children}`` with a
+          // rejecting hole), because by then its output is fused into one tree
+          // with the boundary's and `renderToString` cannot say which half
+          // threw. That is what the fallback answers: if the boundary renders
+          // alone, the fault was layout-side whether or not it was marked.
+          let treeErr = null;
+          try {
+            body = await renderToString(tree, { ssr: true, dev: opts.dev });
+            moduleUrls = [];
+          } catch (e) {
+            treeErr = e;
+          }
+          if (treeErr === null) {
+            // The boundary is fine on its own, so the chain is what failed.
+            reportBoundaryLayoutError(layoutErr, opts, { overlay: true });
+          } else {
+            // The boundary's own tree is broken too. Report a MARKED layout
+            // failure as the separate thing it is, then hand the outer catch
+            // the tree error: it is what defeated the fallback and what the
+            // dev body should show. An UNMARKED one is not reported here,
+            // because it may be this same tree error arriving twice.
+            if (isLayoutPhase(layoutErr)) {
+              reportBoundaryLayoutError(layoutErr, opts, { overlay: false });
+            }
+            throw treeErr;
+          }
+        }
+      }
     } catch (e) {
-      body = `<h1>${heading}</h1><pre>${escapeHtml(String(e))}</pre>`;
+      // The boundary module itself threw or failed to load. REPORT it: with
+      // the body sanitized below, this is otherwise completely silent in
+      // production, on a request that already returned a 4xx to a real user.
+      // Sanitizing without reporting moves a failure out of sight rather than
+      // out of the response, which is the opposite of the intent.
+      reportBoundaryLayoutError(e, opts, { what: STAGE_BOUNDARY, overlay: true });
+      // Dev shows the failure; prod shows only the heading. The 500 path has
+      // always drawn that line (a thrown error's message is not
+      // author-controlled and must not reach the client), and these pages were
+      // rendering it in production.
+      body = opts.dev
+        ? `<h1>${heading}</h1><pre>${escapeHtml(safeErrorText(e))}</pre>`
+        : `<h1>${heading}</h1>`;
+      moduleUrls = [];
     }
   }
   const nonce = opts.req ? getNonce(opts.req) : undefined;
   return wrapInDocument(body, {
     metadata: { title: heading.replace(/^\d+:\s*/, '') },
-    moduleUrls: [],
+    moduleUrls,
     dev: opts.dev,
     nonce,
   });
 }
 
+/**
+ * Render the 404 page. Same two-attempt wrapping contract as ssrBoundaryHtml
+ * (#1298). `opts.route` is absent when no route matched at all (an unrouted
+ * URL), and then there is no chain to wrap in, so the response stays the bare
+ * document it has always been.
+ * @param {string | null} notFoundFile
+ * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL,
+ *   route?: { file: string, layouts: string[] },
+ *   ctx?: Record<string, unknown>, params?: Record<string, string> }} opts
+ */
 async function ssrNotFoundHtml(notFoundFile, opts) {
   let body = '<h1>404: Not found</h1>';
+  /** @type {string[]} */
+  let moduleUrls = [];
+  if (!notFoundFile && opts.route) {
+    const wrapped = await defaultBoundaryInChain('<h1>404: Not found</h1>', opts);
+    if (wrapped) { body = wrapped.body; moduleUrls = wrapped.moduleUrls; }
+  }
   if (notFoundFile) {
+    const ctx = opts.ctx || boundaryCtx(opts.params, opts.url, undefined);
     try {
       const mod = await loadModule(notFoundFile, opts.dev);
-      if (mod.default) body = await renderToString(await mod.default({}), { ssr: true, dev: opts.dev });
+      if (mod.default) {
+        const tree = await mod.default(ctx);
+        try {
+          if (opts.route) {
+            body = await renderBoundaryInChain(tree, opts.route, notFoundFile, ctx, opts.dev);
+            moduleUrls = boundaryModuleUrls(notFoundFile, wrapLayoutsFor(opts.route, notFoundFile), opts);
+          } else {
+            body = await renderToString(tree, { ssr: true, dev: opts.dev });
+          }
+        } catch (layoutErr) {
+          // Same diagnosis rule as ssrBoundaryHtml above, including the
+          // no-layout-wrapped short-circuit.
+          if (!opts.route || wrapLayoutsFor(opts.route, notFoundFile).length === 0) throw layoutErr;
+          let treeErr = null;
+          try {
+            body = await renderToString(tree, { ssr: true, dev: opts.dev });
+            moduleUrls = [];
+          } catch (e) {
+            treeErr = e;
+          }
+          if (treeErr === null) {
+            reportBoundaryLayoutError(layoutErr, opts, { overlay: true });
+          } else {
+            if (isLayoutPhase(layoutErr)) {
+              reportBoundaryLayoutError(layoutErr, opts, { overlay: false });
+            }
+            throw treeErr;
+          }
+        }
+      }
     } catch (e) {
-      body = `<h1>404: Not found</h1><pre>${escapeHtml(String(e))}</pre>`;
+      // Reported for the same reason as in ssrBoundaryHtml above.
+      reportBoundaryLayoutError(e, opts, { what: STAGE_BOUNDARY, overlay: true });
+      body = opts.dev
+        ? `<h1>404: Not found</h1><pre>${escapeHtml(safeErrorText(e))}</pre>`
+        : '<h1>404: Not found</h1>';
+      moduleUrls = [];
     }
   }
   const nonce = opts.req ? getNonce(opts.req) : undefined;
   return wrapInDocument(body, {
     metadata: { title: 'Not found' },
-    moduleUrls: [],
+    moduleUrls,
     dev: opts.dev,
     nonce,
   });
@@ -757,14 +1280,20 @@ export async function ssrPage(route, params, url, opts) {
       // Nearest not-found.{js,ts} in the page's chain wins (#848 fix: previously
       // this always rendered the bare default, ignoring even a root not-found);
       // fall back to a root global-not-found.{js,ts}, else the default page.
-      const html = await ssrNotFoundHtml(nearest(route.notFounds) || opts.globalNotFound || null, opts);
+      // Pass the matched route and this render's ctx so the boundary renders
+      // inside its layouts (#1298). A root-only global-not-found sits at '/',
+      // so it wraps in the root layout only, which is right.
+      const html = await ssrNotFoundHtml(
+        nearest(route.notFounds) || opts.globalNotFound || null,
+        { ...opts, url, route, ctx }
+      );
       return htmlResponse(html, 404, opts.req, url);
     }
     // forbidden() / unauthorized() sentinels (#848, Next 15/16 parity): render
     // the nearest forbidden.{js,ts} / unauthorized.{js,ts} boundary (innermost
     // wins), else a default page, at 403 / 401.
-    if (isForbidden(err)) return ssrForbidden(route, { ...opts, url });
-    if (isUnauthorized(err)) return ssrUnauthorized(route, { ...opts, url });
+    if (isForbidden(err)) return ssrForbidden(route, { ...opts, url, route, ctx });
+    if (isUnauthorized(err)) return ssrUnauthorized(route, { ...opts, url, route, ctx });
     // APM / Sentry sink (issue #239): a page render error that becomes a 500
     // (an error.js boundary OR the default 500 page) is an unhandled error the
     // app should see in its error tracker. Report it best-effort BEFORE
@@ -783,13 +1312,39 @@ export async function ssrPage(route, params, url, opts) {
     // error page's boot scripts (when moduleUrls is non-empty) and
     // the meta csp-nonce tag both pass strict-CSP enforcement.
     const errNonce = opts.req ? getNonce(opts.req) : undefined;
+    // One dedup set for the whole 500 path: the walk below and the
+    // global-error attempt after it collapse REPEATS of the same cause (a
+    // shared layout that fails every attempt) while still reporting a
+    // genuinely different failure, including global-error's own.
+    //
+    // SEEDED with the original error, which was just reported above. When a
+    // LAYOUT is what threw, the walk re-runs that same layout around each
+    // boundary it wraps (the root layout wraps every boundary), so the cause
+    // that produced this 500 is about to arrive again as a secondary failure.
+    // Without the seed the commonest layout crash of all is reported twice.
+    const secondary = new Set();
+    {
+      const originalKey = boundaryErrorKey(err, STAGE_WALK);
+      if (originalKey !== null) secondary.add(originalKey);
+    }
     // Try nearest error.js (innermost → outermost).
     for (let i = route.errors.length - 1; i >= 0; i--) {
       try {
         const mod = await loadModule(route.errors[i], opts.dev);
         if (!mod.default) continue;
         const tree = await mod.default({ ...ctx, error: err });
-        const body = await renderToString(tree, { ssr: true, dev: opts.dev });
+        // The layouts that wrap THIS boundary: its own segment and every
+        // ancestor (#1298). A layout deeper than the boundary never rendered.
+        const wrapLayouts = layoutsForBoundary(route.layouts, boundarySegmentPath(route.errors[i]));
+        // Render inside them, so the response carries the keyed wj:children
+        // pairs and a client-router navigation into this page stays SOFT.
+        // Inside the existing try on purpose: a layout that throws here is
+        // caught by the `catch (nested)` below and the loop moves one boundary
+        // OUT, whose wrapped set is strictly smaller. That bounded walk is how
+        // a throwing layout resolves, and why no failure-point tracking is
+        // needed (a throw out of renderToString is not attributable to one
+        // layout anyway, so tracking would be absent exactly when it mattered).
+        const body = await renderBoundaryInChain(tree, route, route.errors[i], ctx, opts.dev);
         // Apply the SAME inert / import-only substitution as the happy-path
         // boot (#963): the error page must not ship a page/layout module the
         // normal render drops. Pre-substitution, an import-only page with a
@@ -797,24 +1352,36 @@ export async function ssrPage(route, params, url, opts) {
         // load here whole and crash the error page's boot on the throw-at-load
         // stub, killing the sibling component registrations in the same
         // module script.
-        const errModuleUrls = [];
-        {
-          const seen = new Set();
-          const push = (abs) => {
-            const u = toUrlPath(abs, opts.appDir);
-            if (!seen.has(u)) { seen.add(u); errModuleUrls.push(u); }
-          };
-          for (const f of [route.file, ...route.layouts]) {
-            if (opts.inertRouteModules && opts.inertRouteModules.has(f)) continue;
-            const emit = opts.importOnlyRouteModules && opts.importOnlyRouteModules.get(f);
-            if (emit) emit.forEach(push);
-            else push(f);
-          }
-        }
+        //
+        // The set is what actually RENDERED (#1298): the boundary module and
+        // the layouts wrapping it. It used to be the page module plus every
+        // layout, so a boundary shipped the page (which never ran) and any
+        // deeper layout (which never ran either), while omitting the boundary
+        // itself, and a component the boundary rendered never upgraded. The
+        // substitution applies to the boundary file harmlessly: only page and
+        // layout files are fed to the elision analysis, so a boundary is never
+        // inert and never import-only, gets no verdict, and is pushed as-is.
+        const errModuleUrls = boundaryModuleUrls(route.errors[i], wrapLayouts, opts);
         const html = wrapInDocument(body, { metadata, moduleUrls: errModuleUrls, dev: opts.dev, nonce: errNonce });
         return htmlResponse(html, 500, opts.req, url);
       } catch (nested) {
-        // fall through to next error boundary
+        // Fall through to the next error boundary out. Since #1298 this also
+        // absorbs a throw from a WRAPPED LAYOUT, which is the case that makes a
+        // throwing layout render the boundary outside it (Next parity: a
+        // boundary sits inside its own segment's layout, so it cannot catch it).
+        //
+        // Report it on the way past. The fallthrough is the right BEHAVIOUR,
+        // but it is not a reason to lose the error: whatever this response ends
+        // up being, the sinks only ever hear about the ORIGINAL page error
+        // (reported above), so a boundary or a layout that crashed while
+        // handling it would vanish completely. A control-flow sentinel is
+        // filtered out by the reporter, since a boundary throwing notFound() is
+        // a routing decision rather than a crash.
+        reportBoundaryLayoutError(nested, opts, {
+          what: STAGE_WALK,
+          seen: secondary,
+          overlay: false,
+        });
       }
     }
     // Root global-error.{js,ts} (#848): the app-wide catch-all, tried after the
@@ -822,6 +1389,11 @@ export async function ssrPage(route, params, url, opts) {
     // own <!doctype><html><body>, like the root layout), since a root-layout
     // failure is exactly when it fires, so its rendered output is returned
     // verbatim without wrapInDocument. Status 500.
+    //
+    // Deliberately the one boundary #1298 does NOT wrap in layouts: it writes
+    // its own shell (invariant 8 allows only one), wrapping it in the root
+    // layout would re-run the code that just threw, and it ships no importmap
+    // or boot script by design, so it could not soft-swap even if wrapped.
     if (opts.globalError) {
       try {
         const mod = await loadModule(opts.globalError, opts.dev);
@@ -831,15 +1403,22 @@ export async function ssrPage(route, params, url, opts) {
           return htmlResponse(body, 500, opts.req, url);
         }
       } catch (nested) {
-        // fall through to the default 500 page
+        // Fall through to the default 500 page, but do not lose this. A broken
+        // global-error.{js,ts} is the app's LAST-RESORT boundary failing, and
+        // the developer would otherwise see only the generic default page and
+        // the original error, with nothing naming the boundary as the thing
+        // that failed.
+        reportBoundaryLayoutError(nested, opts, {
+          what: STAGE_GLOBAL_ERROR,
+          seen: secondary,
+          overlay: false,
+        });
       }
     }
     // Default: dev shows stack, prod shows a terse message (no stack trace leaks).
     console.error('[webjs] unhandled render error:', err);
     const body = opts.dev
-      ? `<h1>Server error</h1><pre style="white-space:pre-wrap">${escapeHtml(
-          err instanceof Error ? err.stack || err.message : String(err)
-        )}</pre>`
+      ? `<h1>Server error</h1><pre style="white-space:pre-wrap">${escapeHtml(safeErrorText(err))}</pre>`
       : `<h1>Server error</h1><p>Something went wrong. Please try again.</p>`;
     return htmlResponse(
       wrapInDocument(body, { metadata, moduleUrls: [], dev: opts.dev, nonce: errNonce }),
@@ -853,7 +1432,9 @@ export async function ssrPage(route, params, url, opts) {
 /**
  * 404 response for unmatched routes.
  * @param {string | null} notFoundFile
- * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL }} opts
+ * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL,
+ *   route?: import('../router.js').PageRoute,
+ *   ctx?: Record<string, unknown>, params?: Record<string, string> }} opts
  */
 export async function ssrNotFound(notFoundFile, opts) {
   const html = await ssrNotFoundHtml(notFoundFile, opts);
@@ -866,7 +1447,9 @@ export async function ssrNotFound(notFoundFile, opts) {
  * page-render catch (ssr.js) and the form-action write path (form-dispatch.js) so
  * both behave identically.
  * @param {{ forbiddens?: string[] }} route
- * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL }} opts
+ * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL,
+ *   route?: import('../router.js').PageRoute,
+ *   ctx?: Record<string, unknown>, params?: Record<string, string> }} opts
  */
 export async function ssrForbidden(route, opts) {
   const html = await ssrBoundaryHtml(nearest(route.forbiddens), '403: Forbidden', opts);
@@ -877,7 +1460,9 @@ export async function ssrForbidden(route, opts) {
  * 401 response for a thrown unauthorized() (#848). Renders the nearest
  * unauthorized.{js,ts} in the page's chain, else a default 401 page.
  * @param {{ unauthorizeds?: string[] }} route
- * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL }} opts
+ * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL,
+ *   route?: import('../router.js').PageRoute,
+ *   ctx?: Record<string, unknown>, params?: Record<string, string> }} opts
  */
 export async function ssrUnauthorized(route, opts) {
   const html = await ssrBoundaryHtml(nearest(route.unauthorizeds), '401: Unauthorized', opts);
diff --git a/packages/server/test/check/no-server-import-in-browser-module.test.js b/packages/server/test/check/no-server-import-in-browser-module.test.js
index 5ae27bc27..56f934d23 100644
--- a/packages/server/test/check/no-server-import-in-browser-module.test.js
+++ b/packages/server/test/check/no-server-import-in-browser-module.test.js
@@ -378,6 +378,76 @@ export default async function NotFound() {
   }
 });
 
+// forbidden.ts / unauthorized.ts / global-not-found.ts joined the shipping set
+// with #1298: they render inside their layout chain now, and ship with it. The
+// rule has to see them, or the exact #963 crash it exists to catch (a
+// throw-at-load stub taking every sibling registration with it) passes a green
+// `webjs check`. A 403 that greets the signed-in user by name is the natural
+// shape, so this is not a hypothetical import.
+test('a forbidden boundary importing a server module IS flagged (#1298)', async () => {
+  const appDir = await makeApp({
+    'lib/auth.server.ts': AUTH_SERVER,
+    'app/admin/page.ts': `export default function Admin() { return '<h1>admin</h1>'; }\n`,
+    'app/admin/forbidden.ts': `import { auth } from '../../lib/auth.server.ts';
+export default async function Forbidden() {
+  const session = await auth();
+  return \`<h1>No access for \${session.user ?? 'guest'}</h1>\`;
+}
+`,
+  });
+  try {
+    const violations = await checkConventions(appDir);
+    const hits = find(violations, 'forbidden.ts');
+    assert.equal(hits.length, 1, 'a forbidden boundary that ships and imports a server module must be flagged');
+    assert.ok(hits[0].message.includes('auth.server.ts'), 'names the offending server import');
+    assert.ok(/forbidden boundary/.test(hits[0].message), 'identifies it as a forbidden boundary');
+  } finally {
+    await rm(appDir, { recursive: true, force: true });
+  }
+});
+
+test('an unauthorized boundary importing a server module IS flagged (#1298)', async () => {
+  const appDir = await makeApp({
+    'lib/auth.server.ts': AUTH_SERVER,
+    'app/private/page.ts': `export default function P() { return '<h1>private</h1>'; }\n`,
+    'app/private/unauthorized.ts': `import { auth } from '../../lib/auth.server.ts';
+export default async function Unauthorized() {
+  const session = await auth();
+  return \`<h1>Sign in (\${session.user ?? 'guest'})</h1>\`;
+}
+`,
+  });
+  try {
+    const violations = await checkConventions(appDir);
+    const hits = find(violations, 'unauthorized.ts');
+    assert.equal(hits.length, 1, 'an unauthorized boundary that ships and imports a server module must be flagged');
+    assert.ok(/unauthorized boundary/.test(hits[0].message), 'identifies it as an unauthorized boundary');
+  } finally {
+    await rm(appDir, { recursive: true, force: true });
+  }
+});
+
+test('a global-not-found page importing a server module IS flagged (#1298)', async () => {
+  const appDir = await makeApp({
+    'lib/auth.server.ts': AUTH_SERVER,
+    'app/page.ts': `export default function Home() { return '<h1>home</h1>'; }\n`,
+    'app/global-not-found.ts': `import { auth } from '../lib/auth.server.ts';
+export default async function GlobalNotFound() {
+  const session = await auth();
+  return \`<h1>404 for \${session.user ?? 'guest'}</h1>\`;
+}
+`,
+  });
+  try {
+    const violations = await checkConventions(appDir);
+    const hits = find(violations, 'global-not-found.ts');
+    assert.equal(hits.length, 1, 'a global-not-found page that ships and imports a server module must be flagged');
+    assert.ok(/global-not-found page/.test(hits[0].message), 'identifies it as a global-not-found page');
+  } finally {
+    await rm(appDir, { recursive: true, force: true });
+  }
+});
+
 test('a loading boundary importing a server module IS flagged', async () => {
   const appDir = await makeApp({
     'lib/auth.server.ts': AUTH_SERVER,
diff --git a/packages/server/test/elision/import-only-serve.test.js b/packages/server/test/elision/import-only-serve.test.js
index e8e18ffaf..69b6dd73c 100644
--- a/packages/server/test/elision/import-only-serve.test.js
+++ b/packages/server/test/elision/import-only-serve.test.js
@@ -297,7 +297,18 @@ Inner.register('x-inner');`,
 // The error-boundary render applies the SAME substitution (#963): an
 // import-only page with a bare server import is dropped from the ERROR
 // page's boot too, so the throw-at-load stub never crashes the error page.
-test('an error-boundary render drops the import-only page from its boot (#963)', async () => {
+//
+// Since #1298 the boundary's boot set is what actually RENDERED, the boundary
+// module plus the layouts wrapping it, so the page is not in the set to be
+// substituted for at all. The #963 property this locks is unchanged and in
+// fact stronger: the import-only page's module cannot reach the error page's
+// boot by any route. What is no longer emitted is the page's frontier
+// COMPONENT, and that is the point: the page threw, so its `<x-counter>` is
+// not in the boundary's DOM and booting the module that upgrades it registered
+// a custom element for nothing. The substitution itself still runs, on the
+// wrapping layouts, asserted in the sibling case below and in
+// `test/ssr/ssr.test.js`.
+test('an error-boundary render drops the import-only page from its boot (#963, #1298)', async () => {
   const dir = makeApp({
     'lib/auth.server.ts': `export async function auth() { throw new Error('boom'); }`,
     'app/error.ts': `import { html } from '@webjsdev/core';
@@ -317,7 +328,8 @@ export default async () => { await auth(); return html\`<x-counter></x-counter>\
     assert.match(html, /class="err"/, 'the error boundary rendered');
     const boot = bootOf(html);
     assert.doesNotMatch(boot, /\/app\/page\.ts/, 'the import-only page module stays dropped on the error path');
-    assert.match(boot, /\/components\/counter\.ts/, 'the frontier component is emitted instead');
+    assert.doesNotMatch(boot, /\/components\/counter\.ts/, 'nor its frontier component, whose element the boundary never rendered');
+    assert.match(boot, /\/app\/error\.ts/, 'the boundary module, which DID render, is what boots');
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
diff --git a/packages/server/test/routing/form-dispatch.test.js b/packages/server/test/routing/form-dispatch.test.js
index c68f87c4d..1dd960194 100644
--- a/packages/server/test/routing/form-dispatch.test.js
+++ b/packages/server/test/routing/form-dispatch.test.js
@@ -628,6 +628,33 @@ export default () => html\`<form action=\${nf}></form>\`;
   assert.equal((await submit(app, '/missing', {})).status, 404);
 });
 
+test('action that throws notFound() renders the NEAREST not-found, like the page path', async () => {
+  // The form path used the ROOT not-found only, so the same url produced two
+  // different 404s depending on whether the throw came from the page render or
+  // from a form action on it. #848 made the page path nearest-wins; this is the
+  // other half.
+  const app = await createRequestHandler({
+    appDir: makeApp({
+      'app/not-found.ts': `import { html } from ${CORE};\nexport default () => html\`<main id="root-nf">root 404</main>\`;\n`,
+      'app/shop/not-found.ts': `import { html } from ${CORE};\nexport default () => html\`<main id="shop-nf">shop 404</main>\`;\n`,
+      'modules/nf/actions/nf.server.ts': `'use server';\nimport { notFound } from ${CORE};\nexport async function nf() { notFound(); }\n`,
+      'app/shop/page.ts': `
+import { html } from ${CORE};
+import { nf } from '../../modules/nf/actions/nf.server.ts';
+export default () => html\`<form action=\${nf}></form>\`;
+`,
+    }),
+    dev: true,
+  });
+  await app.warmup();
+
+  const resp = await submit(app, '/shop', {});
+  assert.equal(resp.status, 404);
+  const body = await resp.text();
+  assert.match(body, /shop-nf/, 'the nearest not-found rendered');
+  assert.doesNotMatch(body, /root-nf/, 'not the root one');
+});
+
 test('GET render is unchanged: no actionData, status 200', async () => {
   const app = await createRequestHandler({ appDir: makeApp(SIGNUP_APP), dev: true });
   await app.warmup();
diff --git a/packages/server/test/routing/global-boundaries.test.js b/packages/server/test/routing/global-boundaries.test.js
index 4ebfd08af..45dadab23 100644
--- a/packages/server/test/routing/global-boundaries.test.js
+++ b/packages/server/test/routing/global-boundaries.test.js
@@ -110,3 +110,144 @@ test('global-error renders its OWN full document at 500 when a page throws a rea
   // It rendered its own <html>, returned verbatim (not double-wrapped).
   assert.equal((body.match(/<html/g) || []).length, 1, 'exactly one <html> (no double wrap)');
 });
+
+/* ------------ boundary crashes reach the APM sink (#1298) ------------ */
+
+test('an unrouted 404 whose not-found THROWS reaches the onError sink', async () => {
+  // The wiring, not the capability: this goes through the real unmatched-URL
+  // path in dev/serve.js rather than calling ssrNotFound directly. That path
+  // used to build its own options object without the sinks, so a root
+  // not-found that crashed reported to the console and nothing else.
+  const appDir = makeApp({
+    'package.json': pkg,
+    'app/page.js': page('export default function H() { return html`<main>home</main>`; }'),
+    'app/not-found.js':
+      `export default function NF() { throw new Error('ROOT_NF_BOOM'); }\n`,
+  });
+  const captured = [];
+  const app = await createRequestHandler({
+    appDir, dev: true, onError: (e) => captured.push(e),
+  });
+  const prev = console.error;
+  console.error = () => {};
+  let resp;
+  try {
+    resp = await app.handle(new Request('http://x/nothing-here'));
+  } finally { console.error = prev; }
+  assert.equal(resp.status, 404, 'it still answers 404 rather than failing');
+  assert.equal(captured.length, 1, 'the crash reached the APM sink through the real path');
+  assert.match(String(captured[0].message), /ROOT_NF_BOOM/);
+});
+
+test('an unrouted 404 stamps its dev frame the way the overlay gate expects', async () => {
+  // The browser compares the frame url against `location.pathname +
+  // location.search`. A stamp missing the query is refused for any unrouted
+  // url carrying one, and the frame is then dropped, so the overlay never
+  // paints. This asserts the stamp, which is the half a render test cannot see.
+  const appDir = makeApp({
+    'package.json': pkg,
+    'app/page.js': page('export default function H() { return html`<main>home</main>`; }'),
+    'app/not-found.js':
+      `export default function NF() { throw new Error('NF_FRAME_BOOM'); }\n`,
+  });
+  const frames = [];
+  const app = await createRequestHandler({
+    appDir, dev: true, onDevError: (frame) => frames.push(frame),
+  });
+  const prev = console.error;
+  console.error = () => {};
+  try {
+    await app.handle(new Request('http://x/missing?page=2'));
+  } finally { console.error = prev; }
+  assert.equal(frames.length, 1, 'a frame was pushed');
+  assert.equal(frames[0].url, '/missing?page=2', 'and it carries the search, as the gate requires');
+});
+
+test('a PREFETCH of an unrouted url raises no dev overlay frame (#1047)', async () => {
+  // Hovering a link to a broken url must not raise an overlay on the page the
+  // user is actually looking at, nor become the frame the SSE replays.
+  const appDir = makeApp({
+    'package.json': pkg,
+    'app/page.js': page('export default function H() { return html`<main>home</main>`; }'),
+    'app/not-found.js':
+      `export default function NF() { throw new Error('NF_PREFETCH_BOOM'); }\n`,
+  });
+  const frames = [];
+  const errors = [];
+  const app = await createRequestHandler({
+    appDir, dev: true,
+    onDevError: (frame) => frames.push(frame),
+    onError: (e) => errors.push(e),
+  });
+  const prev = console.error;
+  console.error = () => {};
+  try {
+    await app.handle(new Request('http://x/missing', { headers: { 'x-webjs-prefetch': '1' } }));
+  } finally { console.error = prev; }
+  assert.equal(frames.length, 0, 'no overlay frame from a speculative fetch');
+  assert.equal(errors.length, 1, 'but the APM sink still hears about it, since the render really threw');
+});
+
+test('a recovered unrouted 404 clears the frame it retained (#1047 supersede)', async () => {
+  // An intermittently-failing not-found must not leave a frame that paints
+  // over the same url once it renders again. A source edit is cleared by the
+  // rebuild; this is the other route in, and it only became reachable once the
+  // frame stamp was correct enough for the overlay to accept it.
+  const appDir = makeApp({
+    'package.json': pkg,
+    'app/page.js': page('export default function H() { return html`<main>home</main>`; }'),
+    // Fails on the first render of a url, succeeds afterwards.
+    // globalThis, not module scope: dev re-imports the module per request with
+    // a cache-bust query, so module-level state resets every time.
+    'app/not-found.js': `import { html } from ${JSON.stringify(CORE)};
+export default function NF() {
+  if (!globalThis.__flakyNfSeen) { globalThis.__flakyNfSeen = true; throw new Error('FLAKY_NF_BOOM'); }
+  return html\`<main>missing</main>\`;
+}
+`,
+  });
+  const app = await createRequestHandler({ appDir, dev: true });
+  const prev = console.error;
+  console.error = () => {};
+  try {
+    const first = await app.handle(new Request('http://x/gone?q=1'));
+    assert.equal(first.status, 404);
+    const second = await app.handle(new Request('http://x/gone?q=1'));
+    assert.equal(second.status, 404);
+    assert.match(await second.text(), /missing/, 'the second render succeeded');
+  } finally { console.error = prev; }
+  // Observed directly, not through a probe endpoint that might not exist: a
+  // conditional assertion here would pass whether or not the fix works.
+  assert.equal(typeof app.getLastDevError, 'function', 'the handler exposes the retained frame');
+  const held = app.getLastDevError();
+  assert.equal(held, null, 'no stale frame retained for a url that recovered');
+});
+
+test('a PREFETCH that fails again does not wipe a still-current overlay frame', async () => {
+  // The clear infers "this render succeeded" from "the retained frame is still
+  // the one I captured". A prefetch installs no sink, so a prefetch of a url
+  // that throws AGAIN writes no frame and would look exactly like a recovery.
+  // The url is still broken; wiping the frame is the #893 gap the retention
+  // exists to close.
+  const appDir = makeApp({
+    'package.json': pkg,
+    'app/page.js': page('export default function H() { return html`<main>home</main>`; }'),
+    'app/not-found.js':
+      `export default function NF() { throw new Error('STILL_BROKEN_NF'); }\n`,
+  });
+  const app = await createRequestHandler({ appDir, dev: true });
+  const prev = console.error;
+  console.error = () => {};
+  try {
+    await app.handle(new Request('http://x/gone'));
+    const held = app.getLastDevError();
+    assert.ok(held, 'the first, real navigation retained a frame');
+    assert.match(String(held.url), /\/gone$/);
+
+    // Now hover a link to it. Same url, still broken, speculative.
+    await app.handle(new Request('http://x/gone', { headers: { 'x-webjs-prefetch': '1' } }));
+  } finally { console.error = prev; }
+  const after = app.getLastDevError();
+  assert.ok(after, 'the frame survives a prefetch that failed again');
+  assert.match(String(after.url), /\/gone$/);
+});
diff --git a/packages/server/test/ssr/region-route-key.test.js b/packages/server/test/ssr/region-route-key.test.js
index b587e49d7..e7c0be2c4 100644
--- a/packages/server/test/ssr/region-route-key.test.js
+++ b/packages/server/test/ssr/region-route-key.test.js
@@ -11,7 +11,10 @@
  */
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { _pageSegmentPath, _regionRouteKey, _wrapWithChildrenMarker } from '../../src/ssr.js';
+import {
+  _pageSegmentPath, _regionRouteKey, _wrapWithChildrenMarker,
+  _boundarySegmentPath, _layoutsForBoundary,
+} from '../../src/ssr.js';
 
 test('pageSegmentPath derives the page own segment (full route pattern)', () => {
   assert.equal(_pageSegmentPath('/x/app/page.ts'), '/');
@@ -95,3 +98,44 @@ test('wrapWithChildrenMarker: a static segment has a constant route-key', () =>
   assert.equal(r.strings[0], '<!--wj:children:/:/-->');
   assert.equal(r.strings[1], '<!--/wj:children:/-->');
 });
+
+/* ------------ boundary segment derivation (#1298) ------------ */
+
+test('boundarySegmentPath derives a boundary file own segment', () => {
+  assert.equal(_boundarySegmentPath('/x/app/error.ts'), '/');
+  assert.equal(_boundarySegmentPath('/x/app/docs/error.js'), '/docs');
+  assert.equal(_boundarySegmentPath('/x/app/docs/not-found.tsx'), '/docs');
+  assert.equal(_boundarySegmentPath('/x/app/admin/forbidden.ts'), '/admin');
+  assert.equal(_boundarySegmentPath('/x/app/admin/unauthorized.ts'), '/admin');
+  // Route groups are KEPT, for the same reason layoutSegmentPath keeps them:
+  // two routes at one URL prefix under different (group) layouts must not look
+  // like a shared layout.
+  assert.equal(_boundarySegmentPath('/x/app/(marketing)/about/not-found.ts'), '/(marketing)/about');
+  // The root-only global forms derive '/'. The filename match must be anchored
+  // to a separator or the path start, or `not-found` also matches INSIDE
+  // `global-not-found.ts` and yields the nonsense segment '/global-'. Reachable:
+  // a thrown notFound() with no nearer boundary renders globalNotFound.
+  assert.equal(_boundarySegmentPath('/x/app/global-not-found.ts'), '/');
+  assert.equal(_boundarySegmentPath('/x/app/global-error.js'), '/');
+  // A segment whose folder merely ENDS in a boundary word keeps its name.
+  assert.equal(_boundarySegmentPath('/x/app/my-error/not-found.ts'), '/my-error');
+});
+
+test('layoutsForBoundary keeps the boundary own segment and every ancestor', () => {
+  // Next hierarchy: layout -> error -> page, so error.js sits INSIDE its
+  // segment layout and that layout DOES wrap it. A deeper layout never
+  // rendered, so it is excluded.
+  const layouts = ['/x/app/layout.ts', '/x/app/docs/layout.ts', '/x/app/docs/deep/layout.ts'];
+  assert.deepEqual(_layoutsForBoundary(layouts, '/docs'), ['/x/app/layout.ts', '/x/app/docs/layout.ts']);
+  assert.deepEqual(_layoutsForBoundary(layouts, '/'), ['/x/app/layout.ts']);
+  assert.deepEqual(_layoutsForBoundary(layouts, '/docs/deep'), layouts);
+  assert.deepEqual(_layoutsForBoundary([], '/docs'), []);
+  assert.deepEqual(_layoutsForBoundary(undefined, '/docs'), []);
+});
+
+test('layoutsForBoundary breaks the prefix test on a segment', () => {
+  // '/doc' must never match '/docs': a plain startsWith would wrap a boundary
+  // in a layout from an unrelated sibling route.
+  assert.deepEqual(_layoutsForBoundary(['/x/app/doc/layout.ts'], '/docs'), []);
+  assert.deepEqual(_layoutsForBoundary(['/x/app/docs/layout.ts'], '/docs-archive'), []);
+});
diff --git a/test/architecture/barrel-surface.test.mjs b/test/architecture/barrel-surface.test.mjs
index 0fdf498fe..207464ae2 100644
--- a/test/architecture/barrel-surface.test.mjs
+++ b/test/architecture/barrel-surface.test.mjs
@@ -5,7 +5,7 @@ const BARREL_FLOORS = [
   { path: '../../packages/core/src/router-client.js', floor: 69 },
   { path: '../../packages/core/src/slot.js', floor: 31 },
   { path: '../../packages/server/src/vendor.js', floor: 26 },
-  { path: '../../packages/server/src/ssr.js', floor: 19 },
+  { path: '../../packages/server/src/ssr.js', floor: 21 },
   { path: '../../packages/server/src/dev.js', floor: 16 },
   { path: '../../packages/cli/lib/doctor.js', floor: 9 },
   { path: '../../packages/core/src/render-server.js', floor: 2 },
diff --git a/test/bun/routing-boundaries.mjs b/test/bun/routing-boundaries.mjs
index b1374eed1..c586407c7 100644
--- a/test/bun/routing-boundaries.mjs
+++ b/test/bun/routing-boundaries.mjs
@@ -14,6 +14,7 @@ import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { buildRouteTable } from '../../packages/server/src/router.js';
+import { _boundarySegmentPath, _layoutsForBoundary } from '../../packages/server/src/ssr.js';
 
 const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
 const dir = mkdtempSync(join(tmpdir(), 'webjs-boundaries-'));
@@ -32,6 +33,11 @@ try {
   write('app/shop/not-found.js', 'export default function NF() {}');
   write('app/global-error.js', 'export default function GE() {}');
   write('app/global-not-found.js', 'export default function GN() {}');
+  write('app/layout.js', 'export default function L() {}');
+  write('app/docs/layout.js', 'export default function L() {}');
+  write('app/docs/error.js', 'export default function E() {}');
+  write('app/docs/deep/layout.js', 'export default function L() {}');
+  write('app/docs/deep/page.js', 'export default function P() {}');
 
   const rt = await buildRouteTable(dir);
   assert.ok(rt.globalError, 'globalError parsed');
@@ -41,6 +47,22 @@ try {
   assert.equal(shop.notFounds.length, 2);
   assert.match(shop.notFounds[shop.notFounds.length - 1], /shop[/\\]not-found/);
 
+  // The boundary-to-layout derivation (#1298) rides the same fs-walked paths,
+  // so it is proven on the same table rather than on hand-written strings: a
+  // path-separator divergence would break the wrapping on one runtime only.
+  const nested = rt.pages.find((p) => p.routeDir === 'docs/deep');
+  assert.equal(_boundarySegmentPath(nested.errors[nested.errors.length - 1]), '/docs');
+  const wrapped = _layoutsForBoundary(nested.layouts, '/docs');
+  // The boundary's OWN segment layout is included, the deeper one is not.
+  assert.equal(wrapped.length, 2, 'root + /docs layouts wrap a /docs boundary');
+  assert.match(wrapped[wrapped.length - 1], /docs[/\\]layout/);
+  assert.ok(!wrapped.some((f) => /deep[/\\]layout/.test(f)), 'the deeper layout is excluded');
+  // The prefix test breaks on a SEGMENT, so a sibling never leaks in: '/doc'
+  // gets the root layout (which wraps everything) and never '/docs'.
+  const sibling = _layoutsForBoundary(nested.layouts, '/doc');
+  assert.equal(sibling.length, 1, "only the root layout wraps a '/doc' boundary");
+  assert.ok(!sibling.some((f) => /docs/.test(f)), "'/docs' does not leak into '/doc'");
+
   console.log(`OK  route-table boundary parsing identical on ${runtime}`);
 } finally {
   rmSync(dir, { recursive: true, force: true });
diff --git a/test/bun/routing-boundaries.test.mjs b/test/bun/routing-boundaries.test.mjs
new file mode 100644
index 000000000..4f4a5bacf
--- /dev/null
+++ b/test/bun/routing-boundaries.test.mjs
@@ -0,0 +1,17 @@
+/**
+ * Run the cross-runtime route-table boundary proof (#848, #1298) under
+ * WHICHEVER runtime executes the suite. Picked up by the root `node --test`
+ * runner (so `npm test` exercises the Node path); CI reaches the Bun path
+ * through `node scripts/run-bun-tests.js`, which auto-discovers
+ * `test/bun/*.test.mjs` and re-runs them under `bun`. The proof is a plain
+ * assert script (`routing-boundaries.mjs`, not `*.test.mjs`, so the runner does
+ * not double-run it); importing it runs it and throws on any failure.
+ *
+ * Before this wrapper existed the proof ran on Bun in CI and NEVER on Node, so
+ * a Node-only regression in it would have gone unseen.
+ */
+import { test } from 'node:test';
+
+test('route-table boundary parsing and layout derivation on this runtime (#848, #1298)', async () => {
+  await import('./routing-boundaries.mjs');
+});
diff --git a/test/bun/ssr-boundary-chain.mjs b/test/bun/ssr-boundary-chain.mjs
new file mode 100644
index 000000000..efdfcac82
--- /dev/null
+++ b/test/bun/ssr-boundary-chain.mjs
@@ -0,0 +1,122 @@
+/**
+ * Cross-runtime proof that a BOUNDARY response carries the same keyed
+ * children-boundary markers a successful render does (#1298).
+ *
+ * Runs under WHICHEVER runtime executes it (Bun via the CI `bun` job /
+ * `bun test/bun/ssr-boundary-chain.mjs`, Node via the `.test.mjs` wrapper in
+ * `npm test`). Sibling of `keyed-boundaries.mjs`, which proves the same
+ * emission on the HAPPY path.
+ *
+ * This is runtime-sensitive surface for the same reason the happy path is, plus
+ * one of its own: the boundary render is reached through the SSR dispatch
+ * catch, so it rides the throw path (a rejected async render, `isForbidden` /
+ * `isNotFound` sentinel identity across module instances) as well as the string
+ * path. A runtime divergence in either would leave one runtime emitting a
+ * marker-less boundary response, which the client router cannot soft-swap, and
+ * nothing on the happy path would show it.
+ *
+ * Asserts on a real app boot + real GETs:
+ *   - a 500 through error.ts carries matched keyed pairs for the layouts at and
+ *     above the boundary's segment, and the layouts' own markup
+ *   - a 403 through forbidden.ts does the same
+ *   - every open marker has exactly one matching close and no id repeats
+ *   - the boundary's module is booted and the page's is not
+ */
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import assert from 'node:assert/strict';
+import { createRequestHandler } from '@webjsdev/server';
+
+const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
+const here = dirname(fileURLToPath(import.meta.url));
+// The tmp app has no node_modules, so its modules import core by absolute file
+// URL (the same pattern the server unit fixtures and keyed-boundaries.mjs use).
+const HTML_URL = pathToFileURL(resolve(here, '../../packages/core/src/html.js')).toString();
+const CORE_URL = pathToFileURL(resolve(here, '../../packages/core/index.js')).toString();
+
+/** Markers in DOM order: `{ close, segment }`. */
+const markersOf = (html) => [...html.matchAll(/<!--(\/?)wj:children:([^:>]+)(?::([^>]*))?-->/g)]
+  .map((m) => ({ close: m[1] === '/', segment: m[2] }));
+
+/** Every open has one close, no id repeats, and the nesting is well formed. */
+function assertPaired(html, what) {
+  const ms = markersOf(html);
+  const opens = ms.filter((m) => !m.close).map((m) => m.segment);
+  const closes = ms.filter((m) => m.close).map((m) => m.segment);
+  assert.deepEqual([...opens].sort(), [...closes].sort(), `${what}: every open has a close on ${runtime}`);
+  assert.equal(new Set(opens).size, opens.length, `${what}: no duplicate segment id on ${runtime}`);
+  const stack = [];
+  for (const m of ms) {
+    if (!m.close) stack.push(m.segment);
+    else assert.equal(stack.pop(), m.segment, `${what}: markers nest correctly on ${runtime}`);
+  }
+  assert.equal(stack.length, 0, `${what}: no marker left open on ${runtime}`);
+}
+
+const dir = mkdtempSync(join(tmpdir(), 'webjs-bun-boundary-chain-'));
+const prevError = console.error;
+try {
+  const appDir = join(dir, 'app');
+  mkdirSync(join(appDir, 'docs', 'crash'), { recursive: true });
+  mkdirSync(join(appDir, 'docs', 'gated'), { recursive: true });
+  writeFileSync(join(dir, 'package.json'),
+    JSON.stringify({ name: 'fx', type: 'module', imports: { '#*': './*' } }));
+  writeFileSync(join(appDir, 'layout.ts'),
+    `import { html } from ${JSON.stringify(HTML_URL)};\n` +
+    `export default ({ children }: any) => html\`<div id="root-chrome">\${children}</div>\`;\n`);
+  writeFileSync(join(appDir, 'docs', 'layout.ts'),
+    `import { html } from ${JSON.stringify(HTML_URL)};\n` +
+    `export default ({ children }: any) => html\`<div id="docs-chrome">\${children}</div>\`;\n`);
+  writeFileSync(join(appDir, 'docs', 'error.ts'),
+    `import { html } from ${JSON.stringify(HTML_URL)};\n` +
+    `export default ({ error }: any) => html\`<p id="boundary">\${error.message}</p>\`;\n`);
+  writeFileSync(join(appDir, 'docs', 'crash', 'page.ts'),
+    `export default () => { throw new Error('kaboom'); };\n`);
+  writeFileSync(join(appDir, 'docs', 'gated', 'forbidden.ts'),
+    `import { html } from ${JSON.stringify(HTML_URL)};\n` +
+    `export default () => html\`<p id="fb">no</p>\`;\n`);
+  writeFileSync(join(appDir, 'docs', 'gated', 'page.ts'),
+    `import { forbidden } from ${JSON.stringify(CORE_URL)};\n` +
+    `export default () => { forbidden(); };\n`);
+
+  const h = await createRequestHandler({ appDir: dir, dev: false });
+  if (h.warmup) await h.warmup();
+  // The 500 path logs the unhandled render error by design; keep the proof's
+  // output to its own assertions.
+  console.error = () => {};
+
+  // 1. A 500 through the nearest error.ts renders inside its layout chain.
+  {
+    const res = await h.handle(new Request('http://localhost/docs/crash'));
+    assert.equal(res.status, 500, `GET /docs/crash on ${runtime}`);
+    const body = await res.text();
+    assert.ok(body.includes('id="boundary"'), `the boundary rendered on ${runtime}`);
+    assert.ok(body.includes('id="root-chrome"'), `the root layout wraps the boundary on ${runtime}`);
+    assert.ok(body.includes('id="docs-chrome"'), `the /docs layout wraps the boundary on ${runtime}`);
+    assert.ok(body.includes('<!--wj:children:/:/-->'), `root keyed open on ${runtime}`);
+    assert.ok(body.includes('<!--wj:children:/docs:/docs-->'), `/docs keyed open on ${runtime}`);
+    assert.ok(body.includes('<!--wj:children:/docs/crash:/docs/crash-->'), `page-region keyed open on ${runtime}`);
+    assertPaired(body, '500');
+    assert.ok(/import\s+"[^"]*docs\/error\.ts/.test(body), `the boundary module is booted on ${runtime}`);
+    assert.ok(!/import\s+"[^"]*docs\/crash\/page\.ts/.test(body), `the page module is NOT booted on ${runtime}`);
+  }
+
+  // 2. A 403 through forbidden.ts takes the same path.
+  {
+    const res = await h.handle(new Request('http://localhost/docs/gated'));
+    assert.equal(res.status, 403, `GET /docs/gated on ${runtime}`);
+    const body = await res.text();
+    assert.ok(body.includes('id="fb"'), `the 403 boundary rendered on ${runtime}`);
+    assert.ok(body.includes('id="root-chrome"') && body.includes('id="docs-chrome"'),
+      `the 403 renders inside its layout chain on ${runtime}`);
+    assertPaired(body, '403');
+  }
+
+  console.error = prevError;
+  console.log(`[ssr-boundary-chain] OK on ${runtime}`);
+} finally {
+  console.error = prevError;
+  rmSync(dir, { recursive: true, force: true });
+}
diff --git a/test/bun/ssr-boundary-chain.test.mjs b/test/bun/ssr-boundary-chain.test.mjs
new file mode 100644
index 000000000..88c36ce6c
--- /dev/null
+++ b/test/bun/ssr-boundary-chain.test.mjs
@@ -0,0 +1,14 @@
+/**
+ * Run the cross-runtime boundary-chain SSR proof (#1298) under WHICHEVER
+ * runtime executes the suite. Picked up by the root `node --test` runner (so
+ * `npm test` exercises the Node path); CI reaches the Bun path through `node
+ * scripts/run-bun-tests.js`, which auto-discovers `test/bun/*.test.mjs` and
+ * re-runs them under `bun`. The proof is a plain assert script
+ * (`ssr-boundary-chain.mjs`, not `*.test.mjs`, so the runner does not
+ * double-run it); importing it runs it and throws on any failure.
+ */
+import { test } from 'node:test';
+
+test('a boundary response carries its layout chain markers on this runtime (#1298)', async () => {
+  await import('./ssr-boundary-chain.mjs');
+});
diff --git a/test/e2e/dev-overlay-nav.test.mjs b/test/e2e/dev-overlay-nav.test.mjs
index 9a9a6d87d..12feafc3f 100644
--- a/test/e2e/dev-overlay-nav.test.mjs
+++ b/test/e2e/dev-overlay-nav.test.mjs
@@ -214,6 +214,52 @@ describe('E2E: dev error overlay URL scope (#1047)', {
     } finally { await other.close(); }
   });
 
+  test('navigating into a page whose render throws is a SOFT navigation (#1298)', async () => {
+    // Until #1298 this could not be written at all: a boundary was served with
+    // no layout chain, so it carried none of the keyed wj:children markers, the
+    // router's scan found no shared boundary, and the click was a full document
+    // load. That is why every other test in this file reaches /crash with a
+    // plain `page.goto` or only prefetches it, and never clicks through to it.
+    const fallbacks = [];
+    await gotoReady(page, `${base}/good`);
+    await page.evaluate(() => {
+      window.__wjCtx = 'alive';
+      window.__wjFallbacks = [];
+      document.addEventListener('webjs:navigation-fallback', (e) => {
+        window.__wjFallbacks.push(e.detail && e.detail.cause);
+      });
+      // Tag the layout's own DOM so its IDENTITY can be checked after the swap,
+      // not merely its presence: a re-created node would look the same.
+      document.querySelector('main').__wjIdentity = 'same-main';
+      document.querySelector('counter-el').__wjIdentity = 'same-counter';
+    });
+    // Give the counter some hydrated state to lose.
+    await page.click('#bump');
+    await page.waitForFunction(() => /bumped 1/.test(document.querySelector('#bump').textContent));
+
+    await page.evaluate(() => document.querySelector('#to-crash').click());
+    await page.waitForSelector('#crash-boundary', { timeout: 5000 });
+
+    assert.match(page.url(), /\/crash$/);
+    assert.equal(
+      await page.evaluate(() => window.__wjCtx), 'alive',
+      'the document was never reloaded, so it really was a soft navigation',
+    );
+    fallbacks.push(...await page.evaluate(() => window.__wjFallbacks));
+    assert.deepEqual(fallbacks, [], 'the router did not degrade to a full page load');
+
+    const identity = await page.evaluate(() => ({
+      main: document.querySelector('main') && document.querySelector('main').__wjIdentity,
+      counter: document.querySelector('counter-el') && document.querySelector('counter-el').__wjIdentity,
+      bump: document.querySelector('#bump') && document.querySelector('#bump').textContent,
+      boundary: document.querySelector('#crash-boundary').textContent,
+    }));
+    assert.equal(identity.main, 'same-main', 'the layout element itself survived, not a copy of it');
+    assert.equal(identity.counter, 'same-counter', 'and so did the interactive component inside it');
+    assert.match(identity.bump, /bumped 1/, 'its hydrated state survived too');
+    assert.match(identity.boundary, /this page threw during render/, 'the boundary rendered the real error');
+  });
+
   test('merely PREFETCHING a link to a throwing page raises no overlay', async () => {
     // The listener goes on BEFORE the navigation, for two reasons. The prefetch
     // strategy is device-adaptive, and on the `viewport` branch (no hover
diff --git a/test/e2e/fixtures/dev-overlay-app/app/crash/error.ts b/test/e2e/fixtures/dev-overlay-app/app/crash/error.ts
new file mode 100644
index 000000000..6ccbaeda7
--- /dev/null
+++ b/test/e2e/fixtures/dev-overlay-app/app/crash/error.ts
@@ -0,0 +1,10 @@
+import { html } from '@webjsdev/core';
+
+// The boundary for the throwing page next to it. It is nested at `/crash`
+// rather than at the app root deliberately: that is the shape #1298 is about,
+// a boundary that has a layout ABOVE it which must stay on screen. The root
+// layout (with its interactive `counter-el`) wraps this, so a navigation into
+// the throwing page is a SOFT one and the chrome around it survives.
+export default function CrashBoundary({ error }: { error: Error }) {
+  return html`<h1 id="crash-boundary">boundary: ${error.message}</h1>`;
+}
diff --git a/test/ssr/ssr.test.js b/test/ssr/ssr.test.js
index 1b5414b21..1bf5c5277 100644
--- a/test/ssr/ssr.test.js
+++ b/test/ssr/ssr.test.js
@@ -1538,6 +1538,13 @@ test('preloadCrossOriginAttr: adds crossorigin=anonymous for cross-origin URLs o
   assert.equal(preloadCrossOriginAttr('/__webjs/vendor/dayjs@1.11.20.js'), '');
 });
 
+/** Run `fn` with console.error muted: several cases provoke a real crash. */
+const SILENT = async (fn) => {
+  const prev = console.error;
+  console.error = () => {};
+  try { return await fn(); } finally { console.error = prev; }
+};
+
 /* ------------ ssrNotFound + not-found.js rendering ------------ */
 
 test('ssrNotFound: no notFound file → plain 404 fallback', async () => {
@@ -1560,15 +1567,28 @@ test('ssrNotFound: renders the user-supplied not-found.js module', async () => {
 });
 
 test('ssrNotFound: not-found.js that throws falls back to an inline error body', async () => {
+  // The fallback body is DEV-only as of #1298. This used to render the thrown
+  // message in production too, which leaks a value the author does not control
+  // (a driver message, a path, a DSN) to the client. The 500 path has always
+  // drawn that line; these pages now do as well.
   const sub = mkdtempSync(join(tmpDir, 'nf-err-'));
   const notFoundFile = join(sub, 'not-found.js');
   writeFileSync(notFoundFile,
     `export default function NotFound() { throw new Error('boom'); }\n`);
-  const resp = await ssrNotFound(notFoundFile, { dev: false, appDir: sub });
-  assert.equal(resp.status, 404);
-  const body = await resp.text();
-  assert.ok(body.includes('404: Not found'));
-  assert.ok(body.includes('boom'));
+
+  // SILENT: the boundary crash is REPORTED to console.error as of #1298, and
+  // this test provokes it deliberately.
+  const dev = await SILENT(() => ssrNotFound(notFoundFile, { dev: true, appDir: sub }));
+  assert.equal(dev.status, 404);
+  const devBody = await dev.text();
+  assert.ok(devBody.includes('404: Not found'));
+  assert.ok(devBody.includes('boom'), 'dev still shows the failure');
+
+  const prod = await SILENT(() => ssrNotFound(notFoundFile, { dev: false, appDir: sub }));
+  assert.equal(prod.status, 404);
+  const prodBody = await prod.text();
+  assert.ok(prodBody.includes('404: Not found'), 'prod still identifies the status');
+  assert.ok(!prodBody.includes('boom'), 'but never renders the thrown message');
 });
 
 /* ------------ ssrPage: redirect / notFound / error boundaries ------------ */
@@ -1752,6 +1772,890 @@ test('ssrPage: dev=true exposes the error stack, prod hides it', async () => {
   } finally { console.error = prev; }
 });
 
+/* ------------ boundaries render inside their layout chain (#1298) ------------ */
+
+/**
+ * Build a nested app on disk and return a route object for its page.
+ *
+ * `files` maps an app-relative path to source. `layouts` and `errors` are
+ * app-relative paths listed OUTERMOST first, matching what the router builds.
+ */
+function makeBoundaryApp({ files, page, layouts = [], errors = [], notFounds = [], forbiddens = [] }) {
+  const sub = mkdtempSync(join(tmpDir, 'boundary-'));
+  const appDir = join(sub, 'app');
+  for (const [rel, src] of Object.entries(files)) {
+    const abs = join(appDir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, src);
+  }
+  const abs = (rel) => join(appDir, rel);
+  return {
+    appDir,
+    route: {
+      file: abs(page),
+      layouts: layouts.map(abs),
+      errors: errors.map(abs),
+      notFounds: notFounds.map(abs),
+      forbiddens: forbiddens.map(abs),
+      metadataFiles: [],
+    },
+  };
+}
+
+/** Every `wj:children` marker in DOM order. */
+const markersOf = (html) => [...html.matchAll(/<!--(\/?)wj:children:([^:>]+)(?::([^>]*))?-->/g)]
+  .map((m) => ({ close: m[1] === '/', segment: m[2], key: m[3] }));
+
+/** The set of segment ids opened, sorted, for set-equality assertions. */
+const openSegments = (html) => markersOf(html).filter((m) => !m.close).map((m) => m.segment).sort();
+
+/** Assert every open has exactly one matching close, and no id repeats (#1015). */
+function assertPaired(html) {
+  const ms = markersOf(html);
+  const opens = ms.filter((m) => !m.close).map((m) => m.segment);
+  const closes = ms.filter((m) => m.close).map((m) => m.segment);
+  assert.deepEqual([...opens].sort(), [...closes].sort(), 'every open has a matching close');
+  assert.equal(new Set(opens).size, opens.length, 'no segment id is duplicated');
+  // Properly nested: walking the list as a stack must never mispair.
+  const stack = [];
+  for (const m of ms) {
+    if (!m.close) stack.push(m.segment);
+    else assert.equal(stack.pop(), m.segment, 'markers are properly nested');
+  }
+  assert.equal(stack.length, 0, 'no marker left open');
+}
+
+const HTML_IMPORT = `import { html } from ${JSON.stringify(HTML_MODULE_URL)};\n`;
+
+/** Root layout + /docs layout + a throwing /docs/crash page + /docs/error.js. */
+function crashApp(extra = {}) {
+  return makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'docs/layout.js': HTML_IMPORT + `export default function Docs({ children }) { return html\`<div id="docs-chrome">\${children}</div>\`; }\n`,
+      'docs/crash/page.js': `export default function Page() { throw new Error('kaboom'); }\n`,
+      'docs/error.js': HTML_IMPORT + `export default function Err({ error }) { return html\`<p id="boundary">\${error.message}</p>\`; }\n`,
+      ...(extra.files || {}),
+    },
+    page: 'docs/crash/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+    errors: ['docs/error.js'],
+    ...(extra.route || {}),
+  });
+}
+
+test('boundary: a 500 renders inside the layouts at and above the boundary segment (#1298)', async () => {
+  // The headline. Before this the catch rendered the boundary standalone and
+  // handed it to wrapInDocument, so the response carried NO keyed markers, the
+  // client router's scan found no shared boundary, and every navigation into a
+  // throwing page degraded to a full document load.
+  const { route, appDir } = crashApp();
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), { dev: false, appDir }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+
+  assert.ok(body.includes('id="boundary"'), 'the boundary rendered');
+  assert.ok(body.includes('id="root-chrome"'), 'the root layout wraps it');
+  assert.ok(body.includes('id="docs-chrome"'), 'the /docs layout wraps it');
+  const segs = openSegments(body);
+  assert.deepEqual(segs, ['/', '/docs', '/docs/crash']);
+  assertPaired(body);
+});
+
+test('boundary: the 500 emits the SAME segment-id set a 200 at that depth does', async () => {
+  // The strongest available assertion: it catches every mistake in the
+  // page-region skip rule at once, which is the part most likely to be got
+  // subtly wrong (a mismatched pair degrades the swap, so it would look fixed
+  // in a diff and still hard-load).
+  const crash = crashApp();
+  const fine = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div>\${children}</div>\`; }\n`,
+      'docs/layout.js': HTML_IMPORT + `export default function Docs({ children }) { return html\`<div>\${children}</div>\`; }\n`,
+      'docs/fine/page.js': HTML_IMPORT + `export default function Page() { return html\`<p>fine</p>\`; }\n`,
+    },
+    page: 'docs/fine/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+  });
+
+  const bad = await SILENT(() => ssrPage(crash.route, {}, new URL('http://localhost/docs/crash'), { dev: false, appDir: crash.appDir }));
+  const ok = await ssrPage(fine.route, {}, new URL('http://localhost/docs/fine'), { dev: false, appDir: fine.appDir });
+  assert.equal(bad.status, 500);
+  assert.equal(ok.status, 200);
+
+  const shape = (segs) => segs.map((s) => s.split('/').length);
+  const badSegs = openSegments(await bad.text());
+  const okSegs = openSegments(await ok.text());
+  assert.deepEqual(shape(badSegs), shape(okSegs));
+  assert.deepEqual(badSegs.slice(0, 2), okSegs.slice(0, 2), 'the shared layout regions are identical');
+});
+
+test('boundary: a layout DEEPER than the boundary is not rendered and not booted', async () => {
+  // The boundary sits at /docs, so the /docs/deep layout never ran on the
+  // happy path either. Wrapping it would render markup the failing page never
+  // produced, and shipping its module would boot a layout that is not on screen.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'docs/error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="boundary">b</p>\`; }\n`,
+      'docs/deep/layout.js': HTML_IMPORT + `export default function Deep({ children }) { return html\`<div id="deep-chrome">\${children}</div>\`; }\n`,
+      'docs/deep/page.js': `export default function Page() { throw new Error('kaboom'); }\n`,
+    },
+    page: 'docs/deep/page.js',
+    layouts: ['layout.js', 'docs/deep/layout.js'],
+    errors: ['docs/error.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/deep'), { dev: false, appDir }));
+  const body = await resp.text();
+  assert.ok(!body.includes('id="deep-chrome"'), 'the deeper layout did not render');
+  assert.ok(!body.includes('"/docs/deep/layout.js"'), 'the deeper layout is not in the boot script');
+  // And its segment id must not be emitted either. The page sits at
+  // /docs/deep, which is the EXCLUDED layout's own segment, so emitting the
+  // page region under that id would advertise a region the excluded layout's
+  // markup was never in. The client would send that id in X-Webjs-Have and the
+  // next navigation into /docs/deep would short-circuit on it, returning a
+  // fragment that assumes chrome this page never had.
+  assert.deepEqual(openSegments(body), ['/']);
+  assertPaired(body);
+});
+
+test('boundary: an excluded layout id is never advertised, so the NEXT nav keeps its chrome', async () => {
+  // The end-to-end consequence of the rule above, asserted through the header
+  // the client would really send. This is the shape that made the defect
+  // expensive: the boundary response looks fine on its own and corrupts the
+  // navigation AFTER it.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'docs/layout.js': HTML_IMPORT + `export default function Docs({ children }) { return html\`<div id="docs-chrome">\${children}</div>\`; }\n`,
+      'docs/page.js': `export default function Page() { throw new Error('boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="root-boundary">err</p>\`; }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+    errors: ['error.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs'), { dev: false, appDir }));
+  const body = await resp.text();
+  assert.ok(!body.includes('id="docs-chrome"'), 'the /docs layout is above the boundary, so it did not render');
+  assert.ok(
+    !openSegments(body).includes('/docs'),
+    'and its id is absent, so the client cannot claim to hold a layout it never received',
+  );
+  assert.deepEqual(openSegments(body), ['/']);
+  assertPaired(body);
+});
+
+test('boundary: the boot script ships the boundary module, not the page module (#1298)', async () => {
+  // The boundary is what rendered, so it is what has to upgrade its custom
+  // elements. The page module never ran, so booting it was always wrong.
+  const { route, appDir } = crashApp();
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), { dev: false, appDir }));
+  const body = await resp.text();
+  assert.ok(body.includes('"/docs/error.js"'), 'the boundary module is booted');
+  assert.ok(!body.includes('"/docs/crash/page.js"'), 'the page module is not booted');
+});
+
+test('boundary: the #963 inert / import-only substitution still applies to the boot set', async () => {
+  // An import-only layout is replaced by the component URLs it would have
+  // emitted, exactly as on the happy path. Without this an import-only module
+  // with a bare `.server.*` import loads whole and crashes the boundary's boot
+  // on the throw-at-load stub, killing every sibling registration with it.
+  const { route, appDir } = crashApp();
+  const importOnly = new Map([[join(appDir, 'docs/layout.js'), [join(appDir, 'components/thing.js')]]]);
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), {
+    dev: false, appDir, importOnlyRouteModules: importOnly,
+  }));
+  const body = await resp.text();
+  assert.ok(body.includes('"/components/thing.js"'), 'the substitute component URL is booted');
+  assert.ok(!body.includes('"/docs/layout.js"'), 'the import-only layout module itself is not');
+
+  const inert = new Set([join(appDir, 'docs/layout.js')]);
+  const resp2 = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), {
+    dev: false, appDir, inertRouteModules: inert,
+  }));
+  const body2 = await resp2.text();
+  assert.ok(!body2.includes('"/docs/layout.js"'), 'an inert layout is dropped from the boot set');
+});
+
+test('boundary: a throwing LAYOUT renders the boundary OUTSIDE it, not the one at its own segment', async () => {
+  // Next's hierarchy is layout -> error -> page, so error.js sits INSIDE its
+  // segment's layout and therefore cannot catch it. Here /docs/layout.js
+  // throws, so /docs/error.js is unusable and the root error.js must handle it.
+  // The walk terminates because each step outward wraps a strictly smaller set.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="root-boundary">outer</p>\`; }\n`,
+      'docs/layout.js': `export default function Docs() { throw new Error('layout boom'); }\n`,
+      'docs/error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="docs-boundary">inner</p>\`; }\n`,
+      'docs/page.js': HTML_IMPORT + `export default function Page() { return html\`<p>ok</p>\`; }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+    errors: ['error.js', 'docs/error.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs'), { dev: false, appDir }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+  assert.ok(body.includes('id="root-boundary"'), 'the next boundary OUT handled it');
+  assert.ok(!body.includes('id="docs-boundary"'), 'the boundary inside the throwing layout was not used');
+  assert.ok(body.includes('id="root-chrome"'), 'the root layout still wraps it');
+  assertPaired(body);
+});
+
+test('boundary: a throwing ROOT layout still reaches global-error, returned verbatim', async () => {
+  // global-error is the one boundary that stays unwrapped: it writes its own
+  // shell (invariant 8), wrapping it would re-run the code that just threw,
+  // and it ships no boot script by design.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('root boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p>never</p>\`; }\n`,
+      'global-error.js': HTML_IMPORT + `export default function GE() { return html\`<html><body><p id="ge">global</p></body></html>\`; }\n`,
+      'page.js': HTML_IMPORT + `export default function Page() { return html\`<p>ok</p>\`; }\n`,
+    },
+    page: 'page.js',
+    layouts: ['layout.js'],
+    errors: ['error.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), {
+    dev: false, appDir, globalError: join(appDir, 'global-error.js'),
+  }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+  assert.ok(body.includes('id="ge"'), 'global-error rendered');
+  assert.equal(markersOf(body).length, 0, 'no boundary markers');
+  assert.ok(!body.includes('<script type="module">'), 'no boot script');
+});
+
+test('boundary: a thrown notFound() renders the nearest not-found inside its layouts', async () => {
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'docs/layout.js': HTML_IMPORT + `export default function Docs({ children }) { return html\`<div id="docs-chrome">\${children}</div>\`; }\n`,
+      'docs/not-found.js': HTML_IMPORT + `export default function NF() { return html\`<p id="nf">missing</p>\`; }\n`,
+      'docs/[slug]/page.js': `import { notFound } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { notFound(); }\n`,
+    },
+    page: 'docs/[slug]/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+    notFounds: ['docs/not-found.js'],
+  });
+  const resp = await ssrPage(route, { slug: 'gone' }, new URL('http://localhost/docs/gone'), { dev: false, appDir });
+  assert.equal(resp.status, 404);
+  const body = await resp.text();
+  assert.ok(body.includes('id="nf"'));
+  assert.ok(body.includes('id="root-chrome"') && body.includes('id="docs-chrome"'));
+  assert.deepEqual(openSegments(body), ['/', '/docs', '/docs/[slug]']);
+  assertPaired(body);
+  // The page region's key carries the RESOLVED param, so a param change
+  // remounts it the same way a 200 would.
+  const pageRegion = markersOf(body).find((m) => !m.close && m.segment === '/docs/[slug]');
+  assert.equal(pageRegion.key, '/docs/gone');
+});
+
+test('boundary: a thrown forbidden() renders inside its layouts and receives a real ctx', async () => {
+  // The boundary modules used to be called with an empty object, so a wrapped
+  // layout had no params to build its own links from.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'admin/[org]/forbidden.js': HTML_IMPORT + `export default function F({ params }) { return html\`<p id="fb">\${params.org}</p>\`; }\n`,
+      'admin/[org]/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/[org]/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/[org]/forbidden.js'],
+  });
+  const resp = await ssrPage(route, { org: 'acme' }, new URL('http://localhost/admin/acme'), { dev: false, appDir });
+  assert.equal(resp.status, 403);
+  const body = await resp.text();
+  assert.ok(body.includes('id="fb"'));
+  assert.ok(body.includes('acme'), 'the boundary received params');
+  assert.ok(body.includes('id="root-chrome"'), 'the root layout wraps it');
+  assert.deepEqual(openSegments(body), ['/', '/admin/[org]']);
+  assertPaired(body);
+  // The chain rendered, so its modules must boot. Chrome that paints and never
+  // hydrates is worse than no chrome: its controls look live and are not.
+  assert.ok(body.includes('"/layout.js"'), 'the wrapping layout module boots');
+  assert.ok(body.includes('"/admin/[org]/forbidden.js"'), 'and so does the boundary that rendered');
+});
+
+test('boundary: a 404 for a URL that matched no route stays a bare document', async () => {
+  // ssrNotFound with no route has no chain to wrap in, so there is no shared
+  // shell to swap into and a hard load is the correct outcome.
+  const sub = mkdtempSync(join(tmpDir, 'unrouted-'));
+  const appDir = join(sub, 'app');
+  mkdirSync(appDir, { recursive: true });
+  const nf = join(appDir, 'not-found.js');
+  writeFileSync(nf, HTML_IMPORT + `export default function NF() { return html\`<p id="nf">nope</p>\`; }\n`);
+  const resp = await ssrNotFound(nf, { dev: false, appDir, url: new URL('http://localhost/nothing') });
+  assert.equal(resp.status, 404);
+  const body = await resp.text();
+  assert.ok(body.includes('id="nf"'));
+  assert.equal(markersOf(body).length, 0, 'no markers, since there is no chain');
+  assert.ok(!body.includes('<script type="module">'), 'and no boot script, since no chain rendered');
+});
+
+test('boundary: instrumentation-client boots FIRST on a boundary page too (#848)', async () => {
+  // The boundary page is where the app's client error reporting matters most,
+  // so it must not be the one page that runs app modules without it.
+  const { route, appDir } = crashApp({
+    files: { 'instrumentation-client.js': `console.log('boot');\n` },
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), {
+    dev: false, appDir, instrumentationClient: join(appDir, 'instrumentation-client.js'),
+  }));
+  const body = await resp.text();
+  const boot = body.match(/<script type="module">([\s\S]*?)<\/script>/);
+  assert.ok(boot, 'the boundary page has a boot script');
+  const imports = [...boot[1].matchAll(/import\s+"([^"]+)"/g)].map((m) => m[1]);
+  assert.equal(imports[0], '/instrumentation-client.js', 'and instrumentation is its FIRST import');
+  assert.ok(imports.includes('/docs/error.js'), 'the boundary module still boots');
+});
+
+test('boundary: a layout that throws while wrapping a 403 is REPORTED, not swallowed', async () => {
+  // These paths execute layout modules for the first time since #1298, so a
+  // genuine layout crash would otherwise vanish: a chrome-less boundary page
+  // with nothing saying why, and an APM sink that never heard about it.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('layout-boom-403'); }\n`,
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() { return html\`<p id="fb">no</p>\`; }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403, 'it still degrades to the standalone 403 rather than failing');
+  const body = await resp.text();
+  assert.ok(body.includes('id="fb"'), 'the boundary itself still rendered');
+  assert.equal(markersOf(body).length, 0, 'with no markers, since the chain could not render');
+  assert.ok(!body.includes('<script type="module">'), 'and no boot set for a chain that did not render');
+  assert.equal(seen.length, 1, 'the layout throw reached the onError sink');
+  assert.match(String(seen[0].message), /layout-boom-403/);
+});
+
+test('boundary: a layout control-flow throw is NOT reported as an error', async () => {
+  // A redirect() from a layout is a routing decision, not a crash. Reporting it
+  // would fire the app's APM sink and paint a false dev error overlay OVER the
+  // 403 the user is looking at. It is not honoured either: the status is
+  // already decided and the boundary page IS the answer to this request.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `import { redirect } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Root() { redirect('/login'); }\n`,
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() { return html\`<p id="fb">no</p>\`; }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const devSeen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: true, appDir, onError: (e) => seen.push(e), onDevError: (e) => devSeen.push(e),
+  }));
+  assert.equal(resp.status, 403, 'the boundary still answers, and its status is preserved');
+  const body = await resp.text();
+  assert.ok(body.includes('id="fb"'), 'the boundary rendered');
+  assert.deepEqual(seen, [], 'a control-flow sentinel never reaches the APM sink');
+  assert.deepEqual(devSeen, [], 'nor the dev error overlay');
+});
+
+test('boundary: a layout that throws on the 500 path is reported, not lost', async () => {
+  // The fallthrough to the next boundary out is the right behaviour, but the
+  // sinks otherwise only ever hear the ORIGINAL page error, so a boundary or
+  // layout that crashed while handling it would vanish completely.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="root-boundary">outer</p>\`; }\n`,
+      'docs/layout.js': `export default function Docs() { throw new Error('layout-boom-500'); }\n`,
+      'docs/error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="docs-boundary">inner</p>\`; }\n`,
+      'docs/page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js', 'docs/layout.js'],
+    errors: ['error.js', 'docs/error.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+  assert.ok(body.includes('id="root-boundary"'), 'it still falls through to the boundary outside the throwing layout');
+  const messages = seen.map((e) => String(e && e.message));
+  assert.ok(messages.includes('page-boom'), 'the original page error is still reported');
+  assert.ok(messages.includes('layout-boom-500'), 'and so is the layout crash that used to vanish');
+});
+
+test('boundary: one throwing layout is reported ONCE, not once per boundary', async () => {
+  // The walk tries each boundary in the chain, and layoutsForBoundary selects
+  // by segment ancestry rather than boundary depth, so a root layout that
+  // throws fails EVERY attempt. Identity dedup would not help: a layout that
+  // constructs its error yields a fresh object per attempt, so the key is the
+  // STAGE plus its name, message and construction site.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('root-layout-boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p>outer</p>\`; }\n`,
+      'docs/error.js': HTML_IMPORT + `export default function Err() { return html\`<p>inner</p>\`; }\n`,
+      'docs/page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js'],
+    // Both boundaries resolve to the SAME wrapped set (the root layout), which
+    // is the shape that produced the duplicate report.
+    errors: ['error.js', 'docs/error.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 500);
+  const layoutHits = seen.filter((e) => /root-layout-boom/.test(String(e && e.message)));
+  assert.equal(layoutHits.length, 1, 'the layout crash is reported exactly once for the request');
+  assert.equal(
+    seen.filter((e) => /page-boom/.test(String(e && e.message))).length, 1,
+    'and the original page error is still reported exactly once',
+  );
+});
+
+test('boundary: a secondary failure never steals the dev overlay from the root cause', async () => {
+  // The overlay holds ONE retained frame per URL and the dev handler's slot is
+  // last-write-wins, so pushing the secondary failure after the page error
+  // would replace the root cause with a symptom, and it would survive a
+  // reconnect (#1047 scopes that slot per URL).
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('layout-boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p>outer</p>\`; }\n`,
+      'page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'page.js',
+    layouts: ['layout.js'],
+    errors: ['error.js'],
+  });
+  const devSeen = [];
+  await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), {
+    dev: true, appDir, onDevError: (e) => devSeen.push(e),
+  }));
+  assert.equal(devSeen.length, 1, 'exactly one frame reached the overlay');
+  assert.match(String(devSeen[0].message), /page-boom/, 'and it is the ROOT CAUSE, not the secondary failure');
+});
+
+test('boundary: a broken global-error is reported, not silently swallowed', async () => {
+  // The app's last-resort boundary failing used to reach no sink, no overlay
+  // and no console line, leaving only the generic default 500 page.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'global-error.js': `export default function GE() { throw new Error('global-error-boom'); }\n`,
+      // A REAL error boundary in the chain, which is the shape that matters:
+      // control only reaches global-error because this one threw first, so a
+      // dedup keyed on "any secondary failure already reported" would swallow
+      // global-error's own crash on every route that has an error.ts at all.
+      'error.js': `export default function Err() { throw new Error('boundary-boom'); }\n`,
+      'page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'page.js',
+    layouts: [],
+    errors: ['error.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), {
+    dev: false, appDir, globalError: join(appDir, 'global-error.js'), onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+  assert.ok(body.includes('Something went wrong'), 'it still degrades to the default 500 page');
+  const messages = seen.map((e) => String(e && e.message));
+  assert.ok(messages.includes('global-error-boom'), 'the global-error crash reached the sink');
+  assert.ok(messages.includes('boundary-boom'), 'and so did the boundary that failed before it');
+  assert.ok(messages.includes('page-boom'), 'alongside the original page error');
+});
+
+test('boundary: dedup collapses REPEATS of one cause, not distinct failures', async () => {
+  // The dedup exists for one layout that fails every attempt. It must not
+  // silence a genuinely different secondary failure: an inner boundary that
+  // throws its own error, then an outer attempt whose layout crashes, are two
+  // causes and both belong in the sink.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('shared-layout-boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p>outer</p>\`; }\n`,
+      'docs/error.js': `export default function Err() { throw new TypeError('inner-boundary-boom'); }\n`,
+      'docs/page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js'],
+    errors: ['error.js', 'docs/error.js'],
+  });
+  const seen = [];
+  await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  const messages = seen.map((e) => String(e && e.message));
+  assert.ok(messages.includes('inner-boundary-boom'), 'the inner boundary crash is reported');
+  assert.ok(messages.includes('shared-layout-boom'), 'and the LATER, unrelated layout crash is not swallowed by it');
+});
+
+test('boundary: a LAYOUT crash that produced the 500 is reported once, not twice', async () => {
+  // The commonest shape of all, and the one the dedup set has to be SEEDED for.
+  // When the layout is what threw, it becomes the original error AND is re-run
+  // around every boundary it wraps, so the same cause arrives twice.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('only-layout-boom'); }\n`,
+      'error.js': HTML_IMPORT + `export default function Err() { return html\`<p id="b">boundary</p>\`; }\n`,
+      // The page renders fine: the LAYOUT is the sole failure.
+      'page.js': HTML_IMPORT + `export default function Page() { return html\`<p>ok</p>\`; }\n`,
+    },
+    page: 'page.js',
+    layouts: ['layout.js'],
+    errors: ['error.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 500);
+  const hits = seen.filter((e) => /only-layout-boom/.test(String(e && e.message)));
+  assert.equal(hits.length, 1, 'reported once, not once as the original and again as a secondary');
+});
+
+test('boundary: a throw whose value cannot be stringified still degrades, never escapes', async () => {
+  // The dedup key runs INSIDE the catch that keeps the response alive, so it
+  // must be total. `String(Object.create(null))` throws, and a key computation
+  // that throws would take ssrPage's 500 page down with it.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'error.js': `export default function Err() { throw Object.create(null); }\n`,
+      'page.js': `export default function Page() { throw Object.create(null); }\n`,
+    },
+    page: 'page.js',
+    layouts: [],
+    errors: ['error.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), { dev: false, appDir }));
+  assert.equal(resp.status, 500, 'it degraded to the default 500 rather than throwing out of ssrPage');
+  assert.ok((await resp.text()).includes('Something went wrong'));
+});
+
+test('boundary: two boundaries failing through ONE shared helper are both reported', async () => {
+  // These two share a construction site, so the error alone cannot separate
+  // them: it is the STAGE in the key (the boundary walk versus the
+  // global-error attempt) that keeps global-error's own crash from being
+  // swallowed by the earlier boundary's.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'boom.js': `export function boom() { throw new Error('shared-helper-boom'); }\n`,
+      'error.js': `import { boom } from './boom.js';\nexport default function Err() { boom(); }\n`,
+      'global-error.js': `import { boom } from './boom.js';\nexport default function GE() { boom(); }\n`,
+      'page.js': `export default function Page() { throw new Error('page-boom'); }\n`,
+    },
+    page: 'page.js',
+    layouts: [],
+    errors: ['error.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), {
+    dev: false, appDir, globalError: join(appDir, 'global-error.js'), onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 500);
+  const hits = seen.filter((e) => /shared-helper-boom/.test(String(e && e.message)));
+  assert.equal(hits.length, 2, 'the boundary and global-error each report, despite one construction site');
+});
+
+test('boundary: an unprintable throw degrades in DEV too, and never escapes', async () => {
+  // The prod path was covered; dev formats the error into the page, and that
+  // formatting is itself inside the catch that keeps the response alive.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'page.js': `export default function Page() { throw Object.create(null); }\n`,
+    },
+    page: 'page.js',
+    layouts: [],
+    errors: [],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/'), { dev: true, appDir }));
+  assert.equal(resp.status, 500, 'dev degrades to the 500 page rather than throwing out of ssrPage');
+  assert.match(await resp.text(), /unprintable value/, 'and says so instead of crashing while formatting');
+});
+
+test('boundary: a crashing 403 boundary does not leak its error to the client in prod', async () => {
+  // The 500 path has always drawn this line; these pages were rendering the
+  // thrown message into the response body in production.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/forbidden.js': `export default function F() { throw new Error('SECRET_DB_DSN_LEAK'); }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const prod = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), { dev: false, appDir }));
+  assert.equal(prod.status, 403);
+  const prodBody = await prod.text();
+  assert.ok(!prodBody.includes('SECRET_DB_DSN_LEAK'), 'prod never renders the thrown message');
+  assert.ok(prodBody.includes('403'), 'but still identifies the status');
+
+  const dev = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), { dev: true, appDir }));
+  assert.match(await dev.text(), /SECRET_DB_DSN_LEAK/, 'dev still shows it, which is the point of dev');
+});
+
+test('boundary: an unprintable throw from a 403 boundary degrades, never escapes', async () => {
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/forbidden.js': `export default function F() { throw Object.create(null); }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), { dev: true, appDir }));
+  assert.equal(resp.status, 403, 'it degrades rather than escaping ssrBoundaryHtml and ssrPage');
+  assert.match(await resp.text(), /unprintable value/);
+});
+
+test('boundary: a crashing boundary module is REPORTED, so prod is not silent', async () => {
+  // Sanitizing the body removed the only production-visible trace of this
+  // failure. Sanitizing without reporting moves a failure out of sight rather
+  // than out of the response, on a request that already returned a 4xx to a
+  // real user.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/forbidden.js': `export default function F() { throw new Error('BOUNDARY_MODULE_BOOM'); }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403);
+  assert.ok(!(await resp.text()).includes('BOUNDARY_MODULE_BOOM'), 'the body stays sanitized');
+  assert.equal(seen.length, 1, 'but the failure reached the sink');
+  assert.match(String(seen[0].message), /BOUNDARY_MODULE_BOOM/);
+});
+
+test('boundary: a 404 boundary that fails to LOAD is reported too', async () => {
+  // The load failure path, not the render one: a syntax error in not-found.ts.
+  const sub = mkdtempSync(join(tmpDir, 'nf-load-'));
+  const appDir = join(sub, 'app');
+  mkdirSync(appDir, { recursive: true });
+  const nf = join(appDir, 'not-found.js');
+  writeFileSync(nf, `export default function NF({ x { return; }\n`);
+  const seen = [];
+  const resp = await SILENT(() => ssrNotFound(nf, {
+    dev: false, appDir, url: new URL('http://localhost/gone'), onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 404);
+  assert.equal(seen.length, 1, 'a boundary that cannot even be imported is not silent either');
+});
+
+test('boundary: a boundary whose own TREE fails is reported ONCE, and not as a layout', async () => {
+  // The standalone fallback re-renders the SAME tree, so a tree-level failure
+  // throws twice: once from the wrapped attempt and once from the fallback.
+  // Reporting before the fallback ran would report it twice and label the
+  // first one a layout crash, when no layout threw at all.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div>\${children}</div>\`; }\n`,
+      // Fails while the tree is RENDERED, not while it is built, so the
+      // wrapped attempt and the standalone fallback fail identically on the
+      // same tree. A rejected promise in a hole is the simplest such shape:
+      // renderToString awaits it.
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() {
+        return html\`<p>\${{ toString() { throw new Error('TREE_RENDER_BOOM'); } }}</p>\`;
+      }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403, 'it still answers with the boundary status');
+  const hits = seen.filter((e) => /TREE_RENDER_BOOM/.test(String(e && e.message)));
+  assert.equal(hits.length, 1, 'reported once, not once per render attempt');
+});
+
+test('boundary: when the layout AND the tree are broken, BOTH are reported', async () => {
+  // The previous shape inferred the phase by re-rendering, so with both broken
+  // the standalone attempt threw too, the tree error was discarded, and the
+  // LAYOUT error was reported under the boundary label. Two failures, one
+  // report, wrong name. The phase is recorded at its source now.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': `export default function Root() { throw new Error('LAYOUT_HALF_BOOM'); }\n`,
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() {
+        return html\`<p>\${{ toString() { throw new Error('TREE_HALF_BOOM'); } }}</p>\`;
+      }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: true, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403, 'it still answers with the boundary status');
+  const messages = seen.map((e) => String(e && e.message));
+  assert.ok(messages.includes('LAYOUT_HALF_BOOM'), 'the layout crash is reported');
+  assert.ok(messages.includes('TREE_HALF_BOOM'), 'and the tree crash is not lost behind it');
+  // The dev body shows the TREE error, since that is the one that defeated the
+  // fallback and left the page with nothing to render.
+  assert.match(await resp.text(), /TREE_HALF_BOOM/);
+});
+
+test('boundary: a layout failing in a TEMPLATE HOLE still degrades to the boundary', async () => {
+  // The idiomatic async layout: it returns fine and fails while being
+  // serialized. The phase marker cannot see this, because by then the layout's
+  // output is fused into one tree with the boundary's, so the FALLBACK is what
+  // diagnoses it: the boundary renders alone, therefore the chain was at fault.
+  // Getting this wrong serves a bare heading instead of the boundary page.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) {
+        return html\`<nav>\${{ toString() { throw new Error('LAYOUT_HOLE_BOOM'); } }}</nav>\${children}\`;
+      }\n`,
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() { return html\`<p id="fb">no access</p>\`; }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403);
+  const body = await resp.text();
+  assert.ok(body.includes('id="fb"'), 'the boundary page is served, not a bare heading');
+  assert.equal(markersOf(body).length, 0, 'chrome-less, since the chain could not render');
+  assert.ok(!body.includes('<script type="module">'), 'and no boot set for a chain that did not render');
+  const hits = seen.filter((e) => /LAYOUT_HOLE_BOOM/.test(String(e && e.message)));
+  assert.equal(hits.length, 1, 'the layout failure is reported exactly once');
+});
+
+test('boundary: a route with NO layouts does not re-render the boundary tree', async () => {
+  // A legal app with no root layout: the framework emits the shell. The wrap
+  // set is empty, so renderBoundaryInChain reduces to the same renderToString
+  // the fallback would repeat. Re-running it executes the tree twice and can
+  // report a layout crash on a route that has no layouts at all.
+  let renders = 0;
+  globalThis.__boundaryRenderCount = () => { renders += 1; };
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/forbidden.js': HTML_IMPORT + `export default function F() {
+        globalThis.__boundaryRenderCount();
+        return html\`<p>\${{ toString() { throw new Error('NO_LAYOUT_BOOM'); } }}</p>\`;
+      }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403);
+  assert.equal(renders, 1, 'the boundary module was rendered once, not retried');
+  const hits = seen.filter((e) => /NO_LAYOUT_BOOM/.test(String(e && e.message)));
+  assert.equal(hits.length, 1, 'and reported once');
+});
+
+test('boundary: the DEFAULT 403 page renders in its layouts too (no forbidden.ts)', async () => {
+  // The common case: most apps ship no forbidden.ts, so the framework's own
+  // page is what renders. Leaving it bare means the headline fix does not
+  // apply to them at all.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: ['layout.js'],
+    forbiddens: [],
+  });
+  const resp = await ssrPage(route, {}, new URL('http://localhost/admin'), { dev: false, appDir });
+  assert.equal(resp.status, 403);
+  const body = await resp.text();
+  assert.ok(body.includes('403: Forbidden'), 'the default body still renders');
+  assert.ok(body.includes('id="root-chrome"'), 'inside the layout chain');
+  assert.ok(openSegments(body).length > 0, 'so it carries markers and can soft-swap');
+  assertPaired(body);
+  assert.ok(body.includes('"/layout.js"'), 'and the layout that rendered boots');
+});
+
+test('boundary: the DEFAULT 404 page renders in its layouts too (no not-found.ts)', async () => {
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'layout.js': HTML_IMPORT + `export default function Root({ children }) { return html\`<div id="root-chrome">\${children}</div>\`; }\n`,
+      'docs/page.js': `import { notFound } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { notFound(); }\n`,
+    },
+    page: 'docs/page.js',
+    layouts: ['layout.js'],
+    notFounds: [],
+  });
+  const resp = await ssrPage(route, {}, new URL('http://localhost/docs'), { dev: false, appDir });
+  assert.equal(resp.status, 404);
+  const body = await resp.text();
+  assert.ok(body.includes('404: Not found') && body.includes('id="root-chrome"'));
+  assert.ok(openSegments(body).length > 0);
+  assertPaired(body);
+});
+
+test('boundary: a route with no layouts keeps the bare default (nothing to wrap in)', async () => {
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: [],
+  });
+  const resp = await ssrPage(route, {}, new URL('http://localhost/admin'), { dev: false, appDir });
+  assert.equal(resp.status, 403);
+  const body = await resp.text();
+  assert.ok(body.includes('403: Forbidden'));
+  assert.equal(markersOf(body).length, 0, 'no chain, so no markers and no pretence of one');
+});
+
+test('boundary: a boundary response is never storable and never reduced', async () => {
+  // Two independent guarantees. The HTML cache refuses a non-200 outright, and
+  // the reduced X-Webjs-Have path is structurally unreachable: the boundary
+  // render passes `have` as null, so there is no short-circuit branch to take.
+  const { route, appDir } = crashApp();
+  const req = new Request('http://localhost/docs/crash', { headers: { 'x-webjs-have': '/:/' } });
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/docs/crash'), { dev: false, appDir, req }));
+  assert.equal(resp.status, 500);
+  const body = await resp.text();
+  assert.ok(body.includes('id="root-chrome"'), 'the root layout is rendered, not short-circuited away');
+  assert.ok(body.includes('<!doctype') || body.includes('<!DOCTYPE'), 'a full document, not a fragment');
+  assert.equal(resp.headers.get('vary'), null, 'not marked Vary: X-Webjs-Have');
+});
+
 /* ------------ metadata: generateMetadata fn, openGraph, preload links ------------ */
 
 test('ssrPage: metadata.generateMetadata(ctx) is called and merged', async () => {
diff --git a/website/app/docs/error-handling/page.ts b/website/app/docs/error-handling/page.ts
index 46db8ce7e..8965a6e0a 100644
--- a/website/app/docs/error-handling/page.ts
+++ b/website/app/docs/error-handling/page.ts
@@ -29,6 +29,21 @@ export default function ErrorHandling() {
     <h2>Route-level error boundaries</h2>
     <p>Place an <code>error.ts</code> file at any level in the <code>app/</code> directory. When a page or layout at that level (or deeper) throws, the nearest <code>error.ts</code> is rendered instead.</p>
 
+    <p>The boundary renders <strong>inside the layouts at and above its own segment</strong>, so your site chrome stays on screen: the nav, the sidebar and the header are still there, and the user has something to navigate away with. It also means a client-router navigation into a failing page stays a soft navigation rather than reloading the document, so hydrated state elsewhere on the page survives. A layout deeper than the boundary never rendered on the way in, so it is not rendered on the way out either.</p>
+
+    <p>Because the boundary sits inside its own segment's layout, that layout cannot be caught by it. This matches Next's component hierarchy. What happens instead depends on which boundary is rendering:</p>
+
+    <ul>
+      <li>On a <strong>500</strong>, the error walks outward: each <code>error.ts</code> in the chain is tried in turn, innermost first, and a layout that throws fails every attempt whose layouts include it, so control ends at <code>global-error.ts</code> (or the built-in 500 page) once they are exhausted.</li>
+      <li>On a <strong>404, 403 or 401</strong> there is no outward walk. Each renders the single nearest boundary, so a layout that throws degrades that response to the boundary on its own, without the surrounding chrome and without a boot script. The status is preserved. A <code>redirect()</code> thrown by one of those layouts is discarded rather than followed, because the status is already decided and the boundary page is the answer to that request.</li>
+    </ul>
+
+    <p>A layout that genuinely crashes is reported to your <code>onError</code> hook rather than being swallowed, so it reaches your error tracker. Repeats of the same crash within one request are collapsed to a single report, since one shared layout can fail several boundary attempts. A <code>redirect()</code> or <code>notFound()</code> is never reported, being routing rather than a crash.</p>
+
+    <p>The same holds when the <strong>boundary file itself</strong> throws or fails to load. Its response body follows the rule the rest of the framework uses for a thrown error: the failure is shown in development and withheld in production, where the page carries only its status, because a thrown message is not something you control and may name a driver, a path or a connection string. The error still reaches <code>onError</code> and the server log either way, so sanitizing the response never means losing the failure.</p>
+
+    <p>Two consequences worth knowing. A layout that fetches data runs that fetch a second time on a boundary response, since the chain is rendered again around the boundary. And a <code>&lt;webjs-suspense&gt;</code> inside a wrapped layout shows its fallback, because a boundary response is buffered so its status and headers are final before the first byte goes out.</p>
+
     <code-block>// app/error.ts: root error boundary
 import { html } from '@webjsdev/core';
 
@@ -91,6 +106,8 @@ export default async function AdminPage() {
     <h2>global-error.ts and global-not-found.ts</h2>
     <p>Two root-only boundaries (in <code>app/</code> exactly). <code>global-error.ts</code> is the app-wide catch-all, tried after the nested <code>error.ts</code> boundaries are exhausted, and it renders its OWN full document (a root-layout failure is when it fires):</p>
 
+    <p>It is the one boundary that is <strong>not</strong> wrapped in layouts. It writes its own document shell, wrapping it in the root layout would re-run the code that just threw, and it ships no importmap or boot script by design. So a navigation into <code>global-error.ts</code> is a full page load, which is the right outcome for a last-resort page.</p>
+
     <code-block>// app/global-error.ts
 import { html } from '@webjsdev/core';
 
diff --git a/website/app/docs/routing/page.ts b/website/app/docs/routing/page.ts
index 92a3a8606..9410fb02c 100644
--- a/website/app/docs/routing/page.ts
+++ b/website/app/docs/routing/page.ts
@@ -423,6 +423,23 @@ export default function NotFound() {
       means error boundaries are nested. A deeply-placed <code>error.ts</code> catches
       errors for its subtree without affecting the rest of the site.
     </p>
+    <p>
+      The boundary renders <strong>inside the layouts at and above its own segment</strong>,
+      so the surrounding chrome stays on screen and a client-router navigation into a
+      failing page is still a soft navigation. A layout deeper than the boundary is not
+      rendered, since it never rendered on the way in either.
+    </p>
+    <p>
+      A boundary sits inside its own segment's layout, so it cannot catch that layout.
+      This is Next's rule and it exists for a plain reason: re-running the layout that
+      just threw would only throw again. On a 500 the error walks outward to the next
+      <code>error.ts</code>, and on to <code>global-error.ts</code> once the chain is
+      exhausted. The <code>not-found.ts</code>, <code>forbidden.ts</code> and
+      <code>unauthorized.ts</code> boundaries have no outward walk: each renders the
+      single nearest file, so a throwing layout degrades that one response to the
+      boundary without its chrome, keeping the status. See
+      <a href="/docs/error-handling">Error handling</a> for the full rules.
+    </p>
 
     <code-block>// app/error.ts: root error boundary
 import { html } from '@webjsdev/core';
@@ -450,7 +467,9 @@ export default function ErrorBoundary({ error }: { error: unknown }) {
       <code>searchParams</code>, <code>url</code>) along with the <code>error</code>
       property. Errors from <code>notFound()</code> and <code>redirect()</code> are
       <strong>not</strong> caught by error boundaries. Those are handled specially by the
-      framework.
+      framework. A <code>not-found.ts</code>, <code>forbidden.ts</code> or
+      <code>unauthorized.ts</code> boundary receives that same context object and is
+      wrapped in its layouts the same way.
     </p>
 
     <!-- ===== METADATA ===== -->
