hx-boost is the footgun people skip past. It turns every link and form into AJAX, so CSRF tokens, flash messages, and full-page redirects the server still emits need an explicit plan — otherwise you get a fragment where a full document was expected.
Fine for pockets of dynamic behaviour. Collaborative editors and offline-first UIs still want local state.