Error thrown by a $derived re-executing during teardown escapes <svelte:boundary> (and can mask the real error via null effect.b)

Describe the bug

When a $derived re-executes while a component is being torn down and throws, the error is mishandled:

1. Minimal case: the error escapes the enclosing <svelte:boundary onerror> completely (uncaught), thrown out of execute_effect_teardown → destroy_effect.

2. Real-world case (bits-ui + SvelteKit): when the same teardown-time read comes from a $props proxy that is read by a still-live reaction, active_effect is not flagged DESTROYED, so the DESTROYED guard added in 5.56.3 doesn't fire. invoke_error_boundary then walks up to an ancestor boundary effect whose effect.b is already null (it is mid-teardown) and throws:

   TypeError: Cannot read properties of null (reading 'error')
       at invoke_error_boundary (.../svelte/src/internal/client/error-handling.js)
   

   This masks the original error, making it very hard to debug (the real error was Cannot read properties of undefined (reading 'id') from a $derived reading page data that had gone stale during a cross-layout navigation).

The 5.56.3 fix (fix: ignore errors that occur in destroyed effects) only guards the entry effect:

// invoke_error_boundary
if (effect !== null && (effect.f & DESTROYED) !== 0) {
  return;
}
while (effect !== null) {
  if ((effect.f & BOUNDARY_EFFECT) !== 0) {
    ...
    try {
      /** @type {Boundary} */ (effect.b).error(error); // <-- effect.b can be null here

The boundary effects reached via effect = effect.parent inside the loop are not checked for DESTROYED, and effect.b is not null-checked.

Reproduction

Minimal REPL (Svelte 5.56.4): https://svelte.dev/playground#H4sIAAAAAAAAA3VU0Y7bNhD8lYF6wMmALaHtm2K7uCavvQDtNUBRFQglrmXWFEmQK_sMQUA_ol-YLykoS_Zd0nuytVzO7s7ssE-MaCkpkl9EOJAEk_DSngzIe-uRmk5r0G5HNWfVAscfwSe7CkwuWSYslD4pI5NiJ3SgZbJTmkJS_NknfHYRNQaS5VzjwbksHElzjFUi0P_Fa2uYDIekSNah9srxtjSAap31jCevmoY8dt62uM_y6Xu6fv-uNDFZE6O1nWGS2OAusGBK2Xe0eDcfV94eyNxOxwkW0_08x9Pe25MyDSR5dSS5hD0ZkqjOeHAOaWBxDhBaHWmR4dHyPiYrA94TYhRMrdOCaQL0JGTAZ-Hc-zjhM39eIlgocxRaScHjdYa0FPD48QkcG4BqW5JKMOkzvvzzb8z4uws8YVZU25YCpPJ8XgkjV52JdZagZ1GzPkOrA8GJhiAFCzQ2lgksNKFVcmXEUTWClTXZTMyYt8HdNHc6EfUTxlUo0MP65sG5-E_JAmXyXCYYMNy4vc34EigCZ5e7mZIxe51fBS7NuuqYrYE1tVb1YdOnC2y2SK9CjfoN2-8zVJ7EAemVOppFWqzzC8r2bbzbXlwkH7Y_ZOjMGEY67_9LpNL036ndvFBDnHJ92beisp2Rwp9hzWiYTZ_SWKa2JlhNmbZNWiY_f_z98cPDr3_MaahF1-y5KJMlYgcREljPy90QfxK6o7nnG58D8jF5nX_VwLY0fa52Q2miL-mZkyLyNSzfsOJr37y24zdnb1gySt1fm8UQxXbeupC-8NFvqu2iCwIEtKp8JCulrMlQKQ6rTsFZZ4_kc7ZWs3IL8F7wZBdPomZ1nD3EE0GjZSE7fzFNiN68Pl3jJt9d3qz0QmB_IdgTd97gVQyvpLq_vn-xPlbb--V1wHRx2XBgGH-Hb1c4OGG2U5PrfPz6WpC_hv8AqBhtJnMFAAA

Steps:

1. Click "1. break (invalidate derived)" — this makes appContext dirty. Nothing in the live template reads it, so it does not throw yet (mirrors page data going stale mid-navigation).
2. Click "2. unmount (teardown)" — during teardown a child reads the now-dirty $derived, which re-executes and throws.

Components:

<!-- App.svelte -->
<script>
  import Trigger from './Trigger.svelte';

  let mounted = $state(true);
  let broken = $state(false);

  // Throwing derived, owned by App (stays alive). Nothing in the live template
  // reads `appContext`, so invalidating it does NOT throw immediately — it just
  // becomes dirty-and-unread, like page data going stale mid-navigation.
  let data = $derived(broken ? null : { orgApp: { id: "x" } });
  let appContext = $derived(data.orgApp.id);
</script>

<button onclick={() => (broken = true)}>1. break (invalidate derived)</button>
<button onclick={() => (mounted = false)}>2. unmount (teardown)</button>

{#if mounted}
  <svelte:boundary onerror={(e) => console.log("BOUNDARY onerror caught:", e)}>
    <Trigger getValue={() => appContext} />
  </svelte:boundary>
{/if}

<!-- Trigger.svelte -->
<script>
  let { getValue } = $props();

  // Simulates a library (e.g. bits-ui popover/tooltip) that reads reactive
  // trigger state during its own teardown.
  $effect(() => {
    return () => {
      console.log('teardown read ->', getValue());
    };
  });
</script>

<span>trigger</span>

Logs

Console after step 2:

TypeError: Cannot read properties of null (reading 'orgApp')
    at execute_derived
    at get
    at Object.getValue
    at execute_effect_teardown
    at destroy_effect
    at destroy_effect_children
    at destroy_effect

Note: BOUNDARY onerror caught: is never logged — the <svelte:boundary> does not contain the teardown-phase error.

Severity

annoyance

Expected

A $derived that throws while being read during teardown should either be contained by the enclosing <svelte:boundary>, or at minimum surface the real error — not a masked Cannot read properties of null (reading 'error') originating inside invoke_error_boundary due to an unchecked null effect.b on a boundary effect that is itself being destroyed.

System Info

• Svelte 5.56.4 (reproduced directly in the official playground)