Add an explicit runtime guard for root-scoped DOM walks and against selector APIs, preserving the no selector/no hidden client framework boundary.
req: pitch/002
req: runtime/001
req: target_policy/001
Report malformed data-slhx-st with slhx:state-error and continue binding the root with an empty atom store instead of letting state decode failures stop handlers, navigation, or push.
req: state/004
req: state/006
req: runtime/001
Require non-empty data-slhx-sse values at build time and have the standard runtime reject cross-origin EventSource URLs with slhx:sse-error instead of opening an implicit external stream.
req: push/006
req: diagnostics/002
Keep data-slhx-every timers separate from debounce/throttle timers and delete the interval handle when a polling element leaves the document, so reinserted elements can start polling again without leaking stale timer state.
req: convention/005
When data-slhx-policy=parallel runs overlapping requests against one target, release pending UI bookkeeping for each completed request instead of only the last pending handle.
req: convention/006
req: convention/007
req: convention/008
When data-slhx-policy=latest aborts an in-flight request, release that request's pending UI bookkeeping before starting the replacement request so pending classes, indicators, and disabled controls do not leak.
req: convention/006
req: convention/007
Track pending class and indicator state with small reference counts so overlapping requests do not hide indicators early or strip a class that existed before the request.
req: convention/007
req: convention/008
Remember each control's pre-request disabled state and keep a small pending count so data-slhx-disable-while-pending does not accidentally enable controls that were disabled before the request.
req: convention/007
When back/forward navigation receives an incompatible or unusable partial response, reload the current URL instead of leaving the previous UI stale.
req: page_swap/005
req: page_swap/006
req: runtime/004
Resolve controls with a form= attribute inside the current slhx root instead of using document-global id lookup, preserving multi-root isolation for direct handle dispatch.
req: runtime/001
req: convention/004
Cover that runtime updates use generated slot/resource ids and do not expose response-side retargeting or CSS fragment selection conventions.
req: target_policy/001
req: target_policy/002
Cover multipart runtime request construction so file-upload forms keep FormData, omit File values from URL encoding, and only mark URLSearchParams bodies as urlencoded.
req: multipart/003
Cover data-slhx-every runtime behavior: root scanning, duplicate timer avoidance, interval dispatch, and cleanup when elements leave the document.
req: convention/005
Send interaction and page-swap fetches with same-origin credentials so cookies/session/CSRF context stay available to integration-layer policy without broad CORS behavior.
req: auth/005
Assert the browser runtime refuses stale partial/effect updates when deployment fingerprints mismatch and falls back to reload instead of applying stale ids.
req: abi/003
req: abi/004
req: runtime/004
slhx agent