@nifrajs/core 2.13.0 → 3.1.0

package/src/server/server.ts

@@ -41,6 +41,7 @@ import {
   type RouteEntry,
 } from "../internal/route-execution.ts"
 import { isSameOriginRequest } from "../internal/same-origin.ts"
+import type { ResponseObserverPlugin } from "../response-observer.ts"
 import { compileRoutePattern, decodeRouteParams } from "../router/pattern.ts"
 import { EMPTY_PARAMS, type Method, Router } from "../router/router.ts"
 import type {
@@ -49,11 +50,13 @@ import type {
   StandardResult,
   StandardSchemaV1,
 } from "../schema/standard.ts"
+import { emitRequestErrorLog, renderBareError } from "./bare-error-lane.ts"
 import {
   assertByteLimit,
   markTransportCap,
   markTrustedBodyFraming,
   type RawBodyReaders,
+  UNLIMITED_BODY_BYTES,
 } from "./body.ts"
 import { type ClientIpTrust, resolveClientIp } from "./client-ip.ts"
 import type { Context, Platform, ResponseControls, RouteSchema } from "./context.ts"
@@ -63,19 +66,18 @@ import {
   markLowercaseHeaderKeys,
 } from "./header-case.ts"
 import { headerObjectOf } from "./headers.ts"
-import { jsonError, pathnameOf, type UrlParts, urlPartsOf } from "./http.ts"
+import { jsonError, pathnameOf, plainError, type UrlParts, urlPartsOf } from "./http.ts"
 import { type NodeServeOutcome, withStaticNodeHeaders } from "./node-outcome.ts"
-import {
-  type NodeOutcomeRuntime,
-  type NodeRequestContext,
-  type NodeRequestHook,
-  type NodeResponseContext,
-  type NodeResponseHook,
-  type ResponseBodyHook,
-  type ResponseBodyReplacement,
-  type ResponseHeadersHook,
-  type ResponseHeadersView,
-  recordHeadersView,
+import type {
+  NodeOutcomeRuntime,
+  NodeRequestContext,
+  NodeRequestHook,
+  NodeResponseContext,
+  NodeResponseHook,
+  ResponseBodyHook,
+  ResponseBodyReplacement,
+  ResponseHeadersHook,
+  ResponseHeadersView,
 } from "./node-outcome-hook.ts"
 import {
   isUrlEncodedForm,
@@ -84,21 +86,21 @@ import {
   readBoundedForm,
   searchOf,
 } from "./query.ts"
-import { RequestContext, readBoundedJsonSource } from "./request-context.ts"
+import { RequestContext, readBodyFramed, readBoundedJsonSource } from "./request-context.ts"
 import {
   applyStaticResponseHeaders,
   buildStaticResponseHeaders,
   fusedRespond,
   fusedRespondNoSet,
-  knownMutableHeaders,
-  rememberMutableHeaders,
-  taggedResponseBody,
   toResponse,
 } from "./respond.ts"
 // Type-only: erased, so the kernel never pulls the lane's implementation into a bundle that does not
 // install the plugin. The value side arrives through the symbol-keyed install seam.
 import type { ResponseContractRuntime } from "./response-contract-lane.ts"
-import { applyBodyReplacement, withReplacedBody } from "./response-hooks.ts"
+import type {
+  ResponseObserverMethods,
+  ResponseObserverRuntime,
+} from "./response-observer-runtime.ts"
 import {
   CONTEXT_SEARCH,
   CONTEXT_SET,
@@ -107,7 +109,10 @@ import {
   getUnboundedRequestBudget,
   type HandlerResult,
   headerOf,
+  isResponseResult,
+  type ResponseResult,
   requestOf,
+  status,
 } from "./runtime-core.ts"
 import { normalizeStaticResponseHeaders, type StaticResponseHeaders } from "./static-headers.ts"
 
@@ -125,96 +130,6 @@ export type {
   ResponseHeadersView,
 }
 
-const HEADER_MUTABILITY_PROBE = "x-nifra-header-probe"
-const GUARDED_RESPONSE_HEADERS = new WeakSet<Headers>()
-
-/**
- * Detect a guarded Web Headers object before invoking user code. Retrying after catching any
- * TypeError is observably wrong: user hooks are allowed to throw TypeError themselves, and a retry
- * runs those hooks twice. The hot path never reaches the probe: every framework-constructed
- * Response stamps its headers as known-mutable at construction (see respond.ts), so only a
- * handler-returned foreign `Response` - the case that can actually be guarded - pays it, once per
- * headers object. The probe uses a valid private header name and restores a pre-existing value, so
- * the fallback is limited to the actual immutable/guarded-header case.
- */
-function hasMutableResponseHeaders(headers: Headers): boolean {
-  if (knownMutableHeaders(headers)) return true
-  if (GUARDED_RESPONSE_HEADERS.has(headers)) return false
-  let previous: string | null = null
-  try {
-    previous = headers.get(HEADER_MUTABILITY_PROBE)
-    headers.set(HEADER_MUTABILITY_PROBE, "1")
-    if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
-    else headers.set(HEADER_MUTABILITY_PROBE, previous)
-    rememberMutableHeaders(headers)
-    return true
-  } catch {
-    try {
-      if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
-      else headers.set(HEADER_MUTABILITY_PROBE, previous)
-    } catch {
-      // The guarded object rejected the cleanup too; the clone below is authoritative.
-    }
-    GUARDED_RESPONSE_HEADERS.add(headers)
-    return false
-  }
-}
-
-/** Adapt a portable {@link ResponseBodyHook} into the Web `onResponse` walk. Only a Response
- * carrying the framework-buffered body tag participates - a raw or streamed Response is skipped by
- * contract, never drained. */
-function webResponseBodyHook(
-  fn: ResponseBodyHook,
-  owners: ReadonlySet<object>,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    const body = taggedResponseBody(response, owners)
-    if (body === undefined) return response
-    const out = fn(body, response.headers, webRequestView(req), response.status)
-    if (out instanceof Promise) return out.then((replaced) => withReplacedBody(response, replaced))
-    return withReplacedBody(response, out)
-  }
-}
-
-/** Minimal request view over a Web `Request` for portable header hooks on the Web serving paths. */
-function webRequestView(req: Request): NodeRequestContext {
-  return { method: req.method, url: req.url, header: (name) => req.headers.get(name) }
-}
-
-/**
- * Adapt a portable {@link ResponseHeadersHook} into the Web `onResponse` walk: run it against the
- * response's own `Headers` in place (no clone). A response whose headers are GUARDED (a raw
- * `fetch()`ed Response returned by a handler) throws on the FIRST mutation, so nothing was applied
- * yet - rerun once against a mutable copy. Async hooks should perform their mutations before their
- * first await for the guard fallback to cover them.
- */
-function webResponseHeadersHook(
-  fn: ResponseHeadersHook,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    const view = webRequestView(req)
-    if (!hasMutableResponseHeaders(response.headers)) {
-      const clone = new Response(response.body, response)
-      const out = fn(clone.headers, view, clone.status)
-      return out instanceof Promise ? out.then(() => clone) : clone
-    }
-    const out = fn(response.headers, view, response.status)
-    return out instanceof Promise ? out.then(() => response) : response
-  }
-}
-
-/** Adapt a raw-response fallback hook. Tagged framework payloads already ran through the body tier,
- * while untagged Responses include streams, proxied fetches, and framework-generated error responses. */
-function webResponseRawHook(
-  fn: (response: Response, req: Request) => MaybePromise<Response>,
-  owners: ReadonlySet<object>,
-): (response: Response, req: Request) => MaybePromise<Response> {
-  return (response, req) => {
-    if (taggedResponseBody(response, owners) !== undefined) return response
-    return fn(response, req)
-  }
-}
-
 import type { IdempotencyRuntime } from "./idempotency-lane.ts"
 import {
   INSTALL_EFFECT_LEDGER,
@@ -222,13 +137,21 @@ import {
   INSTALL_MCP,
   INSTALL_NODE_DIRECT,
   INSTALL_RESPONSE_CONTRACT,
+  INSTALL_RESPONSE_OBSERVER,
   INSTALL_SSE,
   INSTALL_WS,
+  NODE_NATIVE_MOUNT,
+  RESOLVE_NODE_MOUNT,
 } from "./install.ts"
 import type { EffectLedgerRuntime, ResolvedEffectLedger } from "./ledger-lane.ts"
 import { jsonLogger, type Logger } from "./logger.ts"
 import type { McpRuntime } from "./mcp-hook.ts"
-import type { ContextPlugin, IdentityPlugin } from "./plugin.ts"
+import type {
+  ContextPlugin,
+  IdentityPlugin,
+  PluginTypeCollapsed,
+  ServerTypeUnpinned,
+} from "./plugin.ts"
 import type {
   AddRoute,
   EmptyRegistry,
@@ -358,6 +281,22 @@ interface BunUpgradeServer {
 
 type MountedFetchHandler = (request: Request, platform?: Platform) => MaybePromise<Response>
 
+/** Structural native mount contract. The serving adapter owns the concrete Node request/response
+ * types; the kernel only selects a handler after proving that taking this lane cannot skip its
+ * global lifecycle. `false` means the capability was unavailable at runtime, so the adapter must
+ * retry the ordinary Web mount with the same untouched source. */
+type NativeMountHandler = (
+  request: unknown,
+  response: unknown,
+  platform?: Platform,
+) => MaybePromise<undefined | false>
+
+interface NativeMountSelection {
+  readonly handler: NativeMountHandler
+  readonly path: string
+  readonly stripPrefix: boolean
+}
+
 interface FetchMount {
   readonly path: string
   readonly handler: MountedFetchHandler
@@ -427,10 +366,11 @@ function requireMcpRuntime(runtime: McpRuntime | undefined): McpRuntime {
 }
 
 /** The handler's permitted return type. When the route declares a `response` schema, the return is
- * constrained to the contract's type (or a raw `Response`) - so the implementation can't drift from the
- * declared contract. Without a `response` schema it's unconstrained (`HandlerResult`), exactly as before. */
+ * constrained to the contract's type (a raw `Response`, or a `status(...)` early exit - both are
+ * control flow, not the declared payload) - so the implementation can't drift from the declared
+ * contract. Without a `response` schema it's unconstrained (`HandlerResult`), exactly as before. */
 type ResponseOf<S extends RouteSchema> = S extends { response: infer R extends StandardSchemaV1 }
-  ? InferOutput<R> | Response
+  ? InferOutput<R> | Response | ResponseResult
   : HandlerResult
 
 /**
@@ -492,12 +432,23 @@ const STOP_HOOK_TIMEOUT_MS = 5_000
  * for the same request, so a browser that could open a socket was told its POST was cross-origin. */
 const wsSameOrigin = isSameOriginRequest
 
-function validationError(issues: ReadonlyArray<StandardIssue>): Response {
+function validationIssues(issues: ReadonlyArray<StandardIssue>): {
+  ok: false
+  error: string
+  issues: unknown[]
+} {
   const serialized = issues.map((issue) => {
     const path = issue.path?.map((seg) => String(typeof seg === "object" ? seg.key : seg))
     return path !== undefined ? { message: issue.message, path } : { message: issue.message }
   })
-  return Response.json({ ok: false, error: "validation", issues: serialized }, { status: 422 })
+  return { ok: false, error: "validation", issues: serialized }
+}
+
+/** The 422 as plain data - the shape every lane's response wrapper takes, so a rejected body costs
+ * what an accepted one costs: on Node it is written straight to the socket with a `content-length`
+ * instead of being built as a `Response` and drained back out. */
+export function plainValidationError(issues: ReadonlyArray<StandardIssue>): ResponseResult {
+  return status(422, validationIssues(issues))
 }
 
 // `jsonError`, `urlPartsOf`, `pathnameOf` moved to `./http.ts` (a dependency-free leaf shared with the
@@ -552,6 +503,21 @@ function responseSet(ctx: RawContext): CtxSet {
   return ctx[CONTEXT_SET]() ?? EMPTY_RESPONSE_CONTROLS
 }
 
+/**
+ * A `derive` that answered with a response rather than a context extension - `status(...)`, or a bare
+ * `Response`. The request ends there, on the same lane a `beforeHandle`'s early return takes.
+ *
+ * `derive` is the one stage that could not exit early: `beforeHandle` says "done" by returning a
+ * value, but a derive's return value IS the extension, so the only way out was `throw`ing a
+ * `Response` - which measured as the single most expensive way to answer (the `Response` object
+ * costs ~40% of the rejection lane; see `PlainRender`). Neither shape had a meaning here before:
+ * `Object.assign(ctx, response)` copies nothing (a `Response`'s properties live on its prototype),
+ * so a derive that returned one silently fell through to the handler it meant to prevent.
+ */
+function isDeriveEarlyExit(extension: unknown): boolean {
+  return isResponseResult(extension) || extension instanceof Response
+}
+
 function isContextlessNoArgArrow(handler: (context: never) => unknown): boolean {
   if (handler.length !== 0) return false
   try {
@@ -572,10 +538,117 @@ type FeatureVersionOf<V extends string> = V extends `${infer Major}.${infer Mino
  */
 export type NifraFeatureVersion = FeatureVersionOf<Version>
 
+/**
+ * The Web lanes' `wrapResponse` input, as a `Response`. A plain-data carrier ({@link plainError},
+ * `status(...)`) is rendered on the ordinary JSON lane rather than through its own `toResponse`, so
+ * it picks up the same prebuilt init a handler's plain return uses. `EMPTY_RESPONSE_CONTROLS` because
+ * these renders happen where no request context exists - before routing, or after it was abandoned.
+ */
+const webResponseOf = (result: Response | ResponseResult): Response =>
+  result instanceof Response ? result : toResponse(result, EMPTY_RESPONSE_CONTROLS)
+
 // Stable module-level finalizers so `fetch`/`resolveNode` allocate no per-request closures.
-const IDENTITY_RESPONSE = (response: Response): Response => response
+const IDENTITY_RESPONSE = (response: Response | ResponseResult): Response => webResponseOf(response)
 const RESPONSE_TIMEOUT = (): Response => jsonError(503, "request_timeout")
 
+// The unused-order-scoped-hook audit (recorder, seal check, stack capture, message) is a dev-time
+// diagnostic. Every guard below keeps the INLINE literal `process.env.NODE_ENV !== "production"` at the
+// branch - never a shared const holding the folded boolean - because a bundler's `process.env.NODE_ENV`
+// define only dead-code-eliminates the audit when the literal appears at the `if`; Bun does not
+// propagate a module const's value into the branch. Every real production bundler (vite/esbuild/webpack/
+// next, `bun build --production`) injects that define, turning each guard into `hookAuditRuntime &&
+// false`, which folds away - dropping the whole audit and restoring the bare kernel size.
+//
+// `hookAuditRuntime` is the one shared flag: `typeof globalThis.Deno === "undefined"`. Deno ships a
+// node-compat `process`, so `typeof process` does NOT gate it out there, yet reading `process.env`
+// throws `NotCapable` without `--allow-env`. The flag short-circuits before the env read on Deno (audit
+// off) while a production define still folds `<flag> && false` to `false` on every other runtime.
+const hookAuditRuntime = typeof (globalThis as { Deno?: unknown }).Deno === "undefined"
+
+// This module's own path, captured once from a sentinel stack. Every internal frame of an
+// order-scoped hook push (the public method, its `use()`-bundle dispatcher, the recorder) lives here,
+// so `captureCallerSite` skips anything starting with it and lands on the user's calling frame.
+const SERVER_MODULE_PATH = /* @__PURE__ */ ((): string | undefined => {
+  const frame = new Error().stack?.split("\n")[1]
+  return frame?.match(/\(?([^()\s]+):\d+:\d+\)?\s*$/)?.[1]
+})()
+
+/** One `file:line:col` frame for the caller of an order-scoped hook method, for the unused-hook
+ * report. Only ever called behind the `unusedScopedHooks !== "off"` guard, so the `Error` (the sole
+ * non-trivial cost) is never constructed when the check is disabled. */
+const captureCallerSite = (): string | undefined => {
+  const stack = new Error().stack
+  if (stack === undefined) return undefined
+  for (const line of stack.split("\n").slice(1)) {
+    const frame = line.match(/\(?([^()\s]+:\d+:\d+)\)?\s*$/)?.[1]
+    if (frame === undefined) continue
+    if (SERVER_MODULE_PATH !== undefined && frame.startsWith(`${SERVER_MODULE_PATH}:`)) continue
+    return frame
+  }
+  return undefined
+}
+
+/** Per-server bookkeeping for the unused-order-scoped-hook audit. Deliberately NOT `Server` fields or
+ * methods: those emit class members (a field declaration, a method shell) that a bundler cannot remove
+ * even after their bodies fold away. Held here in a module WeakMap and reached only through the
+ * functions below, every call guarded by `process.env.NODE_ENV !== "production"`, so a production define
+ * folds the guards away, leaves this map and these functions unreferenced, and the bundler eliminates
+ * the whole audit - restoring the bare kernel size. */
+interface HookAuditState {
+  readonly policy: "warn" | "error" | "off"
+  readonly hasCustomLogger: boolean
+  readonly sites: {
+    readonly kind: string
+    readonly routesAtPush: number
+    readonly site: string | undefined
+  }[]
+  checked: boolean
+}
+const hookAudit = /* @__PURE__ */ new WeakMap<object, HookAuditState>()
+
+/** Start tracking one server's order-scoped hook pushes (once, from the constructor). */
+const beginHookAudit = (
+  key: object,
+  policy: "warn" | "error" | "off",
+  hasCustomLogger: boolean,
+): void => {
+  hookAudit.set(key, { policy, hasCustomLogger, sites: [], checked: false })
+}
+
+/** Record one order-scoped hook push: the route count at that moment (so `routesAtPush === total` at
+ * seal means no route was declared after it) and the caller's frame. */
+const recordScopedHook = (key: object, routesAtPush: number, kind: string): void => {
+  const state = hookAudit.get(key)
+  if (state === undefined || state.policy === "off") return
+  state.sites.push({ kind, routesAtPush, site: captureCallerSite() })
+}
+
+/** Run the deadness check exactly once. A hook whose recorded route count equals the final route count
+ * had no route declared after it - unambiguously dead, since the scoping feature (a hook that covers
+ * only later routes) always leaves at least one such route. Zero-route apps are exempt (different
+ * mistake, and the warning would be noise). */
+const sealHookAudit = (
+  key: object,
+  total: number,
+  logger: { warn(message: string): void },
+): void => {
+  const state = hookAudit.get(key)
+  if (state === undefined || state.checked) return
+  state.checked = true
+  if (state.policy === "off" || total === 0) return
+  const dead = state.sites.filter((hook) => hook.routesAtPush === total)
+  if (dead.length === 0) return
+  const detail = dead.map((hook) => `  ${hook.kind}()  at ${hook.site ?? "<unknown>"}`).join("\n")
+  const message =
+    `[nifra] ${dead.length} order-scoped hook(s) apply to no route - they were added after the ` +
+    `last route was registered, and register() snapshots the chain into each route as it is ` +
+    `declared:\n${detail}\nMove them before the routes they should cover. App-global hooks ` +
+    `(onRequest/onResponse) are not order-scoped and can be added at any time.`
+  if (state.policy === "error") throw new FrameworkError("UNUSED_SCOPED_HOOKS", message)
+  if (state.hasCustomLogger) logger.warn(message)
+  else console.warn(message)
+}
+
 /**
  * The inline server. Routes are chainable and fully type-inferred. `derive`/
  * `decorate` extend the handler context (`Ctx`) for routes defined *after* them,
@@ -677,7 +750,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   private staticResponseHeaders: StaticResponseHeaders | undefined
   /** `wrapResponse` for the Web lanes: identity until static headers exist to fold into the
    * framework's own error/404/timeout renders, which are built outside the header init. */
-  private wrapWebResponse: (response: Response) => Response
+  private wrapWebResponse: (response: Response | ResponseResult) => Response
   private webResponseTimeout: () => Response
   /** Body/raw response hooks need a framework-payload marker; keep that decision per app. */
   private responseBodyTag: object | undefined
@@ -744,6 +817,11 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.defaultOnValidationError = options.onValidationError
     this.bunServer = undefined
     this.sealed = false
+    // Guarded so a production define strips the call, leaving `beginHookAudit`/`hookAudit` unreferenced
+    // for the bundler to eliminate; a non-bundled production run skips it the same way.
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production") {
+      beginHookAudit(this, options.unusedScopedHooks ?? "warn", options.logger !== undefined)
+    }
     this.derives = []
     this.decorations = {}
     this.beforeHandleHooks = []
@@ -812,17 +890,37 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this
   }
 
-  /** Add a per-request, computed context extension for subsequent routes. */
-  derive<D extends object>(fn: (context: Context & Ctx) => MaybePromise<D>): Server<R, Ctx & D> {
+  /**
+   * Add a per-request, computed context extension. Order-scoped: it is snapshotted into every route
+   * declared *after* this call, and reaches none declared before. One added after the last route
+   * (e.g. on the app returned by a route-registering factory) covers nothing - see
+   * {@link ServerOptions.unusedScopedHooks}.
+   *
+   * Returning a `status(...)` (or a `Response`) instead of an extension ends the request there - the
+   * guard shape, and the cheap one: it renders as plain data on the same lane a handler's return
+   * takes, where `throw new Response(...)` pays ~40% of the rejection lane to build the object. That
+   * branch is control flow, so it does not widen the derived context type.
+   */
+  derive<D extends object>(
+    fn: (context: Context & Ctx) => MaybePromise<D | ResponseResult | Response>,
+  ): Server<R, Ctx & D> {
     this.assertConfigurable("derive()")
     this.derives.push(fn as unknown as RawDerive)
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "derive")
     return this as unknown as Server<R, Ctx & D>
   }
 
-  /** Add a static context value for subsequent routes. */
+  /**
+   * Add a static context value. Order-scoped: captured by every route declared *after* this call, and
+   * by none before; one added after the last route reaches nothing
+   * (see {@link ServerOptions.unusedScopedHooks}).
+   */
   decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>> {
     this.assertConfigurable("decorate()")
     this.decorations[key] = value
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "decorate")
     return this as unknown as Server<R, Ctx & Record<K, V>>
   }
 
@@ -840,10 +938,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this
   }
 
-  /** Run after validation, before the handler; a non-`undefined` return short-circuits. Order-scoped. */
+  /**
+   * Run after validation, before the handler; a non-`undefined` return short-circuits. Order-scoped:
+   * it is snapshotted into every route declared *after* this call and covers none declared before, so
+   * one added after the last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
+   */
   beforeHandle(fn: (context: Context & Ctx) => MaybePromise<unknown>): this {
     this.assertConfigurable("beforeHandle()")
     this.beforeHandleHooks.push(fn as unknown as RawBeforeHandle)
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "beforeHandle")
     return this
   }
 
@@ -851,10 +955,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * Wrap the matched route lifecycle for subsequent routes. This is intentionally generic over the
    * route output, so wrappers like async context storage do not force Node's direct JSON path through
    * a Web `Response`. The first registered wrapper is outermost.
+   *
+   * Order-scoped: captured by every route declared *after* this call, none before; one added after the
+   * last route reaches nothing (see {@link ServerOptions.unusedScopedHooks}).
    */
   around(fn: <T>(context: Context & Ctx, next: () => MaybePromise<T>) => MaybePromise<T>): this {
     this.assertConfigurable("around()")
     this.aroundHooks.push(fn as unknown as RawAround)
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "around")
     return this
   }
 
@@ -879,6 +988,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.capabilityInterceptors.push(
       Object.freeze({ interceptor, timeoutMs: Math.min(timeoutMs, 2_147_483_647) }),
     )
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "aroundCapability")
     return this
   }
 
@@ -892,17 +1003,25 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this
   }
 
-  /** Transform the handler's result before it is serialized. Order-scoped. */
+  /** Transform the handler's result before it is serialized. Order-scoped: captured by routes declared
+   * *after* this call, none before; one added after the last route reaches nothing (see
+   * {@link ServerOptions.unusedScopedHooks}). */
   afterHandle(fn: (result: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
     this.assertConfigurable("afterHandle()")
     this.afterHandleHooks.push(fn as unknown as RawAfterHandle)
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "afterHandle")
     return this
   }
 
-  /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500). Order-scoped. */
+  /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500).
+   * Order-scoped: captured by routes declared *after* this call, none before; one added after the last
+   * route reaches nothing (see {@link ServerOptions.unusedScopedHooks}). */
   onError(fn: (error: unknown, context: Context & Ctx) => MaybePromise<unknown>): this {
     this.assertConfigurable("onError()")
     this.onErrorHooks.push(fn as unknown as RawErrorHandler)
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      recordScopedHook(this, this.catalog.size, "onError")
     return this
   }
 
@@ -947,11 +1066,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * hook owns part of the header state - into a hook that runs in the right order. */
   private addStaticResponseHeaders(record: Record<string, string>): this {
     if (this.onResponseHooks.length > 0) {
-      return this.onResponseHeaders((headers) => {
-        for (const name of Object.keys(record)) {
-          if (!headers.has(name)) headers.set(name, record[name] as string)
-        }
-      })
+      const observerHeaders = (
+        this as unknown as Pick<ResponseObserverMethods, "onResponseHeaders">
+      ).onResponseHeaders
+      if (observerHeaders !== undefined) {
+        observerHeaders.call(this, (headers) => {
+          for (const name of Object.keys(record)) {
+            if (!headers.has(name)) headers.set(name, record[name] as string)
+          }
+        })
+        return this
+      }
+      // Route the hook through the same seam the static tier uses. On a framework response (headers
+      // stamped mutable) it applies the defaults in place and returns the SAME object, so the
+      // serialized-body marker survives for later `onResponseBody`/`onResponseRaw` observers and the
+      // Node writer; reconstructing a `Response` here would strip that marker and reclassify the Node
+      // outcome from `json` to a generic `response`. A guarded foreign response takes its clone path.
+      const statics = buildStaticResponseHeaders(record)
+      this.onResponseHooks.push((response) => applyStaticResponseHeaders(response, statics))
+      this.onNodeResponseHooks.push(undefined)
+      this.nodeResponseHooksComplete = false
+      return this
     }
     const merged =
       this.staticResponseHeaders === undefined
@@ -959,7 +1094,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         : { ...this.staticResponseHeaders.record, ...record }
     this.staticResponseHeaders = buildStaticResponseHeaders(merged)
     const statics = this.staticResponseHeaders
-    this.wrapWebResponse = (response) => applyStaticResponseHeaders(response, statics)
+    this.wrapWebResponse = (response) =>
+      applyStaticResponseHeaders(webResponseOf(response), statics)
     this.webResponseTimeout = () => applyStaticResponseHeaders(RESPONSE_TIMEOUT(), statics)
     return this
   }
@@ -972,61 +1108,18 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this.responseBodyTag
   }
 
-  /**
-   * Register a response transform for raw/streamed Responses. Framework-serialized payloads stay on
-   * the body tier; this hook is only entered for untagged Responses (streams, proxied fetches, and
-   * framework-generated error responses). A no-op native twin keeps buffered JSON on the direct lane.
-   */
-  onResponseRaw(fn: (response: Response, req: Request) => MaybePromise<Response>): this {
-    this.assertConfigurable("onResponseRaw()")
-    this.enableResponseBodyTagging()
-    this.onResponseHooks.push(webResponseRawHook(fn, this.responseBodyOwners))
-    this.onNodeResponseHooks.push(() => undefined)
-    return this
-  }
-
-  /**
-   * Register a PORTABLE header-only response hook - one implementation, fast on every runtime.
-   *
-   * The hook receives a mutable case-insensitive header view, a minimal request view, and the
-   * status. On the Web serving paths it runs inside the normal `onResponse` walk against the
-   * response's own `Headers` (mutating in place - no clone). On Node it self-pairs as a native
-   * response hook against the outcome's plain header record, so registering one NEVER forces the
-   * Node adapter off its direct socket writer the way a full `onResponse(res: Response)` hook does.
-   * Prefer this over `onResponse` whenever the middleware only reads/writes headers.
-   */
-  onResponseHeaders(fn: ResponseHeadersHook): this {
-    this.assertConfigurable("onResponseHeaders()")
-    this.onResponseHooks.push(webResponseHeadersHook(fn))
-    this.onNodeResponseHooks.push((response, req) =>
-      fn(recordHeadersView(response), req, response.status),
-    )
-    return this
-  }
-
-  /**
-   * Register a PORTABLE post-serialization body hook - the payload tier. The hook receives the
-   * FINAL framework-serialized bytes (plus the mutable header view and status) and may return
-   * replacement bytes; `undefined` keeps the body. On the Node direct writer the bytes come
-   * straight off the outcome record; on the Web serving paths they ride the framework-built
-   * Response as a tag, so no body stream is ever drained on any runtime. A handler-returned raw
-   * `Response` (proxied fetch, SSE, streamed SSR) is skipped by contract - transforming those is
-   * what the full `onResponse` hook is for.
-   */
-  onResponseBody(fn: ResponseBodyHook): this {
-    this.assertConfigurable("onResponseBody()")
-    this.enableResponseBodyTagging()
-    this.onResponseHooks.push(webResponseBodyHook(fn, this.responseBodyOwners))
-    this.onNodeResponseHooks.push((response, req) => {
-      const body = response.body
-      if (body === null) return undefined
-      const out = fn(body, recordHeadersView(response), req, response.status)
-      if (out instanceof Promise)
-        return out.then((replaced) => applyBodyReplacement(response, replaced))
-      applyBodyReplacement(response, out)
-      return undefined
-    })
-    return this
+  private responseObserverMethods(): ResponseObserverMethods {
+    const methods = this as unknown as Partial<ResponseObserverMethods>
+    if (
+      typeof methods.onResponseHeaders !== "function" ||
+      typeof methods.onResponseBody !== "function" ||
+      typeof methods.onResponseRaw !== "function"
+    ) {
+      throw new TypeError(
+        "response observation requires `.use(responseObserver())` or an observer-enabled middleware",
+      )
+    }
+    return methods as ResponseObserverMethods
   }
 
   /** Observe the terminal response after all transformations. Observers are ordered and fail-open. */
@@ -1038,10 +1131,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return this
   }
 
+  /** Enable the opt-in portable response observer methods. */
+  use(plugin: ResponseObserverPlugin): this & ResponseObserverMethods
   /**
    * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) - it
    * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry
-   * and context fully intact. This overload exists specifically so a *named* identity plugin (e.g.
+   * and context fully intact. This overload exists specifically so a named identity plugin (e.g.
    * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise
    * defeat the generic inference of the transforming overload below and collapse the result to `any`.
    */
@@ -1059,13 +1154,23 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread
    * the added context to handlers defined after `use` (the overload is generic over the concrete
    * `this`). A named plugin already applied is skipped (idempotent dedupe).
+   *
+   * If the plugin's return type is unpinned - `Server<any, any>`, as a hand-rolled `(app) => app` or a
+   * `NifraPlugin<AnyServer, AnyServer>` infers (e.g. an auth plugin whose own types collapsed) - this
+   * returns the non-callable {@link PluginTypeCollapsed} instead of silently widening the whole typed
+   * client to `any`. `.get()`/`.post()` then fail right here rather than surfacing as `any` hundreds of
+   * lines away. Fix at the plugin: build it with {@link defineIdentityPlugin}/{@link defineContextPlugin},
+   * or pin its input server type. This mirrors the guard {@link definePlugin} already applies.
    */
-  use<Out extends AnyServer>(plugin: (app: this) => Out): Out
+  use<Out extends AnyServer>(
+    plugin: (app: this) => Out,
+  ): [ServerTypeUnpinned<Out>] extends [true] ? PluginTypeCollapsed : Out
   /**
    * Apply a {@link Middleware} bundle - wire each hook it provides to its lifecycle point. Returns
    * `this` (no context-type merging); call it before the routes its `beforeHandle`/`afterHandle`
-   * should cover (those are order-scoped; `onRequest`/`onResponse` are global). A named bundle already
-   * applied is skipped (idempotent).
+   * should cover (those are order-scoped; `onRequest`/`onResponse` are global). A bundle applied after
+   * the last route reaches nothing - {@link ServerOptions.unusedScopedHooks} logs that at seal. A named
+   * bundle already applied is skipped (idempotent).
    */
   use(mw: Middleware): this
   use(arg: Middleware | ((app: this) => AnyServer)): AnyServer {
@@ -1102,6 +1207,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     }
     this.globalAssurance.push(...evidence.filter((item) => item.scope === "global"))
     this.activeAssurance.push(...evidence.filter((item) => item.scope === "subsequent"))
+    const responseObserver = (arg as unknown as Record<symbol, unknown>)[INSTALL_RESPONSE_OBSERVER]
+    if (responseObserver !== undefined) {
+      if (
+        typeof responseObserver !== "object" ||
+        responseObserver === null ||
+        typeof (responseObserver as { install?: unknown }).install !== "function"
+      ) {
+        throw new TypeError("response observer middleware has an invalid runtime")
+      }
+      this[INSTALL_RESPONSE_OBSERVER](responseObserver as ResponseObserverRuntime)
+    }
     if (arg.onRequest !== undefined) {
       this.assertConfigurable("onRequest()")
       this.onRequestHooks.push(arg.onRequest as RawOnRequest)
@@ -1125,9 +1241,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     // Before the bundle's own hooks: a bundle declaring both means its static values are the
     // defaults its hook may then override, which is the order a single bundle reads in.
     if (arg.responseHeaders !== undefined) this.responseHeaders(arg.responseHeaders)
-    if (arg.onResponseHeaders !== undefined) this.onResponseHeaders(arg.onResponseHeaders)
-    if (arg.onResponseBody !== undefined) this.onResponseBody(arg.onResponseBody)
-    if (arg.onResponseRaw !== undefined) this.onResponseRaw(arg.onResponseRaw)
+    if (arg.onResponseHeaders !== undefined)
+      this.responseObserverMethods().onResponseHeaders(arg.onResponseHeaders)
+    if (arg.onResponseBody !== undefined)
+      this.responseObserverMethods().onResponseBody(arg.onResponseBody)
+    if (arg.onResponseRaw !== undefined)
+      this.responseObserverMethods().onResponseRaw(arg.onResponseRaw)
     if (arg.onResponseFinalized !== undefined) this.onResponseFinalized(arg.onResponseFinalized)
     if (arg.onError !== undefined) this.onError(arg.onError)
     return this
@@ -1395,6 +1514,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     // Boot-time guard: the WS runtime is a subpath (`@nifrajs/core/ws`) so no-WebSocket apps don't
     // bundle it. Registration is the loud, early failure point - never the first connection.
     const runtime = requireWsRuntime(this.wsRuntime)
+    if (handler.validateSend === true && handler.sendSchema === undefined) {
+      throw new RouteConfigError(
+        "INVALID_WS_SEND_VALIDATION",
+        `route WS ${path}: validateSend requires sendSchema`,
+      )
+    }
     this.topics ??= runtime.createTopics()
     // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
     // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
@@ -1475,6 +1600,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     handler: (context: never) => unknown,
   ): CatalogRoute {
     const pattern = compileRoutePattern(path)
+    // Resolved here, once: `undefined` past this point means the route declared `"unlimited"`, NOT
+    // "nothing declared". Readers fall back to UNLIMITED_BODY_BYTES accordingly.
     let bodyLimit: number | undefined = this.maxBodyBytes
     const invalidBodyLimit = (message: string): never => {
       throw new RouteConfigError("INVALID_BODY_LIMIT", `route ${method} ${path}: ${message}`)
@@ -1489,6 +1616,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       ) {
         invalidBodyLimit('bodyLimit: "unlimited" requires a non-empty bodyLimitReason')
       }
+      if (schema.body !== undefined) {
+        invalidBodyLimit(
+          'bodyLimit: "unlimited" cannot be used with a body schema; use a finite cap',
+        )
+      }
+      if (schema.idempotency !== undefined) {
+        invalidBodyLimit('bodyLimit: "unlimited" cannot be used with idempotency')
+      }
       bodyLimit = undefined
     } else if (schema?.bodyLimit !== undefined) {
       try {
@@ -1617,7 +1752,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           handler as unknown as InternalHandler,
           schema.body as StandardSchemaV1,
           hasDecorations ? routeDecorations : undefined,
-          bodyLimit ?? this.maxBodyBytes,
+          bodyLimit ?? UNLIMITED_BODY_BYTES,
         )
       : undefined
     const fusedWeb =
@@ -1626,14 +1761,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             handler as unknown as InternalHandler,
             hasDecorations ? routeDecorations : undefined,
             isContextlessNoArgArrow(handler),
-            bodyLimit ?? this.maxBodyBytes,
+            bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
         : fusedQuery
           ? this.buildFusedQueryWeb(
               handler as unknown as InternalHandler,
               hasDecorations ? routeDecorations : undefined,
               schema.query as StandardSchemaV1,
-              bodyLimit ?? this.maxBodyBytes,
+              bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
           : fusedBody
             ? this.buildFusedBodyWeb(fusedBodyRunner as FusedBodyRunner)
@@ -1749,7 +1884,18 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       })
       routeAssurance.push(Object.freeze(declared))
     }
-    if (schema?.body !== undefined) {
+    // Two ways a route proves its body is bounded, both enforced by the core at read time:
+    // `schema.body` (the validated read is bounded) and an explicit finite `schema.bodyLimit` (the
+    // transport cap shadows every reader, including a raw `c.req.body` stream that a Content-Length
+    // middleware cannot bound).
+    // `bodyLimit: "unlimited"` is rejected above for schema and idempotency routes. The remaining
+    // exemption is schema-less streaming/upload work, so it publishes NOTHING: there is no finite
+    // framework byte ceiling for assurance to attest and the application protocol owns that bound.
+    // The server-wide `maxBodyBytes` default is not evidence either. It applies to every route
+    // whether or not anyone thought about it, so publishing it would make the id pass everywhere and
+    // prove nothing; this evidence marks a bound the route chose.
+    const unlimitedBody = schema?.bodyLimit === "unlimited"
+    if (!unlimitedBody && (schema?.body !== undefined || typeof schema?.bodyLimit === "number")) {
       routeAssurance.push(
         Object.freeze({
           id: NIFRA_ASSURANCE_IDS.BODY_BOUNDED,
@@ -1809,6 +1955,29 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     this.responseContractRuntime = runtime
   }
 
+  /** @internal Symbol-keyed install seam for the response observer plugin. */
+  [INSTALL_RESPONSE_OBSERVER](runtime: ResponseObserverRuntime): ResponseObserverMethods {
+    this.assertConfigurable("responseObserver()")
+    const methods = runtime.install({
+      assertConfigurable: (operation) => this.assertConfigurable(operation),
+      addResponseHook: (web, node) => {
+        this.onResponseHooks.push(web)
+        this.onNodeResponseHooks.push(node)
+        if (node === undefined) this.nodeResponseHooksComplete = false
+      },
+      enableResponseBodyTagging: () => {
+        if (this.responseBodyTag === undefined) {
+          this.responseBodyTag = Object.freeze({})
+          this.responseBodyOwners.add(this.responseBodyTag)
+        }
+        return this.responseBodyTag
+      },
+      responseBodyOwners: () => this.responseBodyOwners,
+    })
+    Object.assign(this, methods)
+    return methods
+  }
+
   /** @internal Symbol-keyed install seam for the `idempotency()` plugin. Off the public typed surface. */
   [INSTALL_IDEMPOTENCY](runtime: IdempotencyRuntime): void {
     this.assertConfigurable("idempotency()")
@@ -1964,7 +2133,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             entry.handler,
             entry.schema?.body as StandardSchemaV1,
             entry.hasDecorations ? entry.decorations : undefined,
-            entry.bodyLimit ?? this.maxBodyBytes,
+            entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
         : undefined
     const fusedWeb =
@@ -1975,13 +2144,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
               entry.handler,
               entry.hasDecorations ? entry.decorations : undefined,
               entry.schema?.query as StandardSchemaV1,
-              entry.bodyLimit ?? this.maxBodyBytes,
+              entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
           : this.buildFusedWeb(
               entry.handler,
               entry.hasDecorations ? entry.decorations : undefined,
               isContextlessNoArgArrow(entry.handler),
-              entry.bodyLimit ?? this.maxBodyBytes,
+              entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
             )
     return {
       ...route,
@@ -2027,6 +2196,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform?: Platform<EnvOf<Ctx>>,
   ): MaybePromise<Response> {
+    // Seal once on the first request so test servers (no `listen()`) still get the dead-hook check.
+    // After that it is a single boolean read - the per-request cost the option promises to keep at zero.
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      sealHookAudit(this, this.catalog.size, this.logger)
     // Off path (default): straight through - one property check, no closure, no promise.
     if (this.capacityGate === undefined) return this.fetchSourceInner(source, platform)
     return this.admitGated(requestOf(source), () => this.fetchSourceInner(source, platform))
@@ -2134,6 +2307,45 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return outcome
   }
 
+  /**
+   * Select a mounted handler's native Node lane without materializing a Web Request. This is an
+   * adapter seam, not a second lifecycle: any app-wide behavior that the ordinary mount path would
+   * run makes the capability ineligible and the caller falls back to `resolveNodeSource`. Typed
+   * routes keep precedence exactly as `routeAndRun` does, including the existing mount behavior for
+   * a path whose registered route rejects this method.
+   */
+  [RESOLVE_NODE_MOUNT](source: RequestSource): NativeMountSelection | undefined {
+    if (
+      this.onRequestHooks.length > 0 ||
+      this.onResponseHooks.length > 0 ||
+      this.onResponseFinalizedHooks.length > 0 ||
+      this.capacityGate !== undefined ||
+      this.staticResponseHeaders !== undefined ||
+      this.requestTimeoutMs !== 0 ||
+      this.acceptInboundDeadlines ||
+      this.clientIpTrust !== undefined
+    ) {
+      return undefined
+    }
+
+    const parts = source.urlParts ?? urlPartsOf(source.url)
+    const match = this.catalog.find(source.method, parts.pathname)
+    if (match.found) return undefined
+
+    for (const mount of this.fetchMounts) {
+      if (!underMountPrefix(parts.pathname, mount.path)) continue
+      const candidate = (mount.handler as unknown as Record<symbol, unknown>)[NODE_NATIVE_MOUNT]
+      return typeof candidate === "function"
+        ? {
+            handler: candidate as NativeMountHandler,
+            path: mount.path,
+            stripPrefix: mount.stripPrefix,
+          }
+        : undefined
+    }
+    return undefined
+  }
+
   /**
    * Like {@link fetch}, but renders a plain-data result **without** building a Web `Response` - the
    * `@nifrajs/node` adapter serializes the returned primitives straight to the socket, skipping the undici
@@ -2151,6 +2363,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     platform?: Platform<EnvOf<Ctx>>,
     suppliedRuntime?: NodeOutcomeRuntime,
   ): MaybePromise<NodeServeOutcome> {
+    // Seal once on the Node-direct lane too - it can bypass `fetchSource` entirely (hookless outcome).
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      sealHookAudit(this, this.catalog.size, this.logger)
     // A paired header-only native hook can preserve the Node-direct JSON/body outcome for successful
     // responses. Arbitrary onResponse transforms need a real Web Response, but a buffered outcome can
     // be materialized with a direct-write marker and return to the socket path when the hook mutates
@@ -2509,7 +2724,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     // True only from the Web `fetch` path - unlocks each route's fused lane, whose output type IS
     // `Response` (`T = Response` there by construction; the node path always passes false).
@@ -2537,7 +2752,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
   ): MaybePromise<T> {
     const hooks = this.onNodeRequestHooks
@@ -2571,7 +2786,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
   ): Promise<T> {
     if (first !== undefined) return wrapResponse(first)
@@ -2599,7 +2814,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2646,7 +2861,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     sourceAtAwait: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): Promise<T> {
@@ -2740,7 +2955,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2792,17 +3007,19 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       }
       if (match.reason === "method-not-allowed") {
         return wrapResponse(
-          jsonError(405, "method_not_allowed", { Allow: match.allowed.join(", ") }),
+          // Lowercase on purpose: a plain render's headers go into the node outcome record verbatim,
+          // and every other name in that record is lowercase (the Web lane normalizes either way).
+          plainError(405, "method_not_allowed", { allow: match.allowed.join(", ") }),
         )
       }
-      return wrapResponse(jsonError(404, "not_found"))
+      return wrapResponse(plainError(404, "not_found"))
     }
 
     // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
     // already did and made every plain dynamic route pay for unrelated static path bytes.
     const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params)
     if (params === null) {
-      return wrapResponse(jsonError(400, "malformed_path"))
+      return wrapResponse(plainError(400, "malformed_path"))
     }
 
     return this.runMatched(
@@ -2842,7 +3059,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     params: Record<string, string>,
     search: string | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2873,7 +3090,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         search,
         wrapResponse,
         {
-          maxBodyBytes: entry.bodyLimit ?? this.maxBodyBytes,
+          maxBodyBytes: entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           runLanes: (buffered, plat, ent, prm, srch) =>
             this.idempotencyRunLanes(buffered, plat, ent as RouteEntry, prm, srch),
         },
@@ -2900,7 +3117,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     params: Record<string, string>,
     search: string | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
@@ -2922,7 +3139,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         ? undefined
         : admitDeadline(source.headers, this.deadlineAdmissionOptions)
     if (admission !== undefined && !admission.ok) {
-      return wrapResponse(jsonError(admission.status, admission.reason))
+      return wrapResponse(plainError(admission.status, admission.reason))
     }
     const effectiveTimeoutMs = admission?.timeoutMs ?? 0
 
@@ -2981,7 +3198,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     if (controller !== undefined && outcome instanceof Promise) {
       const timedOut =
         admission?.inherited === true
-          ? () => wrapResponse(jsonError(504, "deadline_exceeded"))
+          ? () => wrapResponse(plainError(504, "deadline_exceeded"))
           : onTimeout
       return this.withTimeout(
         outcome,
@@ -3012,7 +3229,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     budget: RequestBudget,
     platform: Platform | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     let result: unknown
     try {
@@ -3056,9 +3273,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     signal: AbortSignal,
     budget: RequestBudget,
     platform: Platform | undefined,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): T {
     if (err instanceof Response) return wrapResponse(err)
+    // Handed over as the plain data it is: `wrapResponse` renders it on the JSON lane (no `Response`
+    // built on Node). There is no context here by construction, so there is no `c.set` to merge.
+    if (isResponseResult(err)) return wrapResponse(err)
     const ctx = new RequestContext(
       source,
       params,
@@ -3070,7 +3290,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       this.protoPoisoning,
     )
     this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
+    return wrapResponse(plainError(500, "internal_error"))
   }
 
   /**
@@ -3087,20 +3307,20 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     let result: unknown
     try {
       if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
       result = entry.handler(ctx)
     } catch (err) {
-      return this.bareError(err, ctx, wrapResponse)
+      return this.bareError(err, ctx, finalize, wrapResponse)
     }
     if (result instanceof Promise) {
       // Async handler on an otherwise-bare route: finish on a microtask, with the same error handling.
       return result.then(
         (value) => finalize(value, responseSet(ctx)),
-        (err) => this.bareError(err, ctx, wrapResponse),
+        (err) => this.bareError(err, ctx, finalize, wrapResponse),
       )
     }
     return finalize(result, responseSet(ctx))
@@ -3121,13 +3341,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     contextless: boolean,
     maxBodyBytes: number,
   ): FusedWebRunner {
-    // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-    // static headers here rather than through the shared `wrapResponse` seam.
-    const logError = (err: unknown, ctx: RawContext): Response => {
-      if (err instanceof Response) return this.wrapWebResponse(err)
-      this.logRequestError(err, ctx)
-      return this.wrapWebResponse(jsonError(500, "internal_error"))
-    }
+    // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+    // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+    // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
     if (contextless && decorations === undefined) {
       // `() => ...` can't observe the context - skip allocating one entirely (errors still build
       // one for the structured log, exactly like runContextlessBare).
@@ -3257,20 +3480,21 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     const logError = <T>(
       err: unknown,
       ctx: RawContext,
-      wrapResponse: (response: Response) => T,
-    ): T => this.bareError(err, ctx, wrapResponse)
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => this.bareError(err, ctx, finalize, wrapResponse)
 
     const runHandler = <T>(
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       if (decorations !== undefined) Object.assign(ctx, decorations)
       let output: MaybePromise<HandlerResult>
       try {
         output = handler(ctx)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
       if (output instanceof Promise) {
         return output.then(
@@ -3278,16 +3502,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             try {
               return finalize(result, responseSet(ctx), ctx)
             } catch (err) {
-              return logError(err, ctx, wrapResponse)
+              return logError(err, ctx, finalize, wrapResponse)
             }
           },
-          (err) => logError(err, ctx, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
         )
       }
       try {
         return finalize(output, responseSet(ctx), ctx)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
     }
 
@@ -3295,9 +3519,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       result: StandardResult<unknown>,
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
-      if (result.issues !== undefined) return wrapResponse(validationError(result.issues))
+      if (result.issues !== undefined) return wrapResponse(plainValidationError(result.issues))
       ctx.body = result.value
       return runHandler(ctx, finalize, wrapResponse)
     }
@@ -3306,13 +3530,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       parsed: unknown,
       ctx: RawContext,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
       try {
         validation = bodySchema["~standard"].validate(parsed)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
       if (validation instanceof Promise) {
         return validation.then(
@@ -3320,16 +3544,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
             try {
               return runValidated(settled, ctx, finalize, wrapResponse)
             } catch (err) {
-              return logError(err, ctx, wrapResponse)
+              return logError(err, ctx, finalize, wrapResponse)
             }
           },
-          (err) => logError(err, ctx, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
         )
       }
       try {
         return runValidated(validation, ctx, finalize, wrapResponse)
       } catch (err) {
-        return logError(err, ctx, wrapResponse)
+        return logError(err, ctx, finalize, wrapResponse)
       }
     }
 
@@ -3342,7 +3566,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       platform: Platform | undefined,
       nativeContext: boolean,
       finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-      wrapResponse: (response: Response) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
     ): MaybePromise<T> => {
       const ctx = nativeContext
         ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
@@ -3358,8 +3582,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           )
       const finish = (value: unknown): MaybePromise<T> =>
         runParsed(value, ctx, finalize, wrapResponse)
-      return this.readBodyInput(source, maxBodyBytes, finish, wrapResponse, (err) =>
-        logError(err, ctx, wrapResponse),
+      return readBodyFramed(
+        source,
+        maxBodyBytes,
+        this.protoPoisoning,
+        finish,
+        wrapResponse,
+        (err) => logError(err, ctx, finalize, wrapResponse),
       )
     }
   }
@@ -3401,13 +3630,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     querySchema: StandardSchemaV1,
     maxBodyBytes: number,
   ): FusedWebRunner {
-    // The fused lanes return to the runtime directly, so the framework's own error renders fold in
-    // static headers here rather than through the shared `wrapResponse` seam.
-    const logError = (err: unknown, ctx: RawContext): Response => {
-      if (err instanceof Response) return this.wrapWebResponse(err)
-      this.logRequestError(err, ctx)
-      return this.wrapWebResponse(jsonError(500, "internal_error"))
-    }
+    // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
+    // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
+    // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
+    const logError = (err: unknown, ctx: RawContext): Response =>
+      this.bareError(
+        err,
+        ctx,
+        (result, set) => this.wrapWebResponse(toResponse(result, set)),
+        this.wrapWebResponse,
+      )
     const runHandler = (ctx: RawContext, value: unknown): MaybePromise<Response> => {
       ctx.query = value
       let result: unknown
@@ -3461,21 +3693,29 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         return validation.then(
           (settled) =>
             settled.issues !== undefined
-              ? this.wrapWebResponse(validationError(settled.issues))
+              ? this.wrapWebResponse(plainValidationError(settled.issues))
               : runHandler(ctx, settled.value),
           (err) => logError(err, ctx),
         )
       }
       if (validation.issues !== undefined)
-        return this.wrapWebResponse(validationError(validation.issues))
+        return this.wrapWebResponse(plainValidationError(validation.issues))
       return runHandler(ctx, validation.value)
     }
   }
 
-  private bareError<T>(err: unknown, ctx: RawContext, wrapResponse: (response: Response) => T): T {
-    if (err instanceof Response) return wrapResponse(err)
-    this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
+  private bareError<T>(
+    err: unknown,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): T {
+    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
+    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
+    // into class state; the closure is allocated only on the throw path, never on the hot lane.
+    return renderBareError(err, ctx, finalize, wrapResponse, responseSet, (e, c) =>
+      this.logRequestError(e, c),
+    )
   }
 
   // @ts-expect-error TS6133 -- invoked structurally by compiled plans (internal/route-execution.ts)
@@ -3485,7 +3725,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     ctx: RawContext,
     run: () => MaybePromise<T>,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     let outcome: MaybePromise<T>
     try {
@@ -3523,52 +3763,18 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): Promise<T> {
-    return this.readBodyInput(
+    return readBodyFramed(
       source,
-      entry.bodyLimit ?? this.maxBodyBytes,
+      entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+      this.protoPoisoning,
       (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
       wrapResponse,
       (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
     )
   }
 
-  /** Shared bounded body framing/parser. Both body lanes use the same trust-boundary checks; only
-   * the validation + handler continuation differs. */
-  private readBodyInput<T>(
-    source: RequestSource,
-    maxBodyBytes: number,
-    onParsed: (parsed: unknown) => MaybePromise<T>,
-    wrapResponse: (response: Response) => T,
-    onError: (err: unknown) => MaybePromise<T>,
-  ): Promise<T> {
-    const contentType = headerOf(source, "content-type") ?? ""
-    if (contentType !== "application/json" && !contentType.includes("application/json")) {
-      if (isUrlEncodedForm(contentType)) {
-        return readBoundedForm(source, maxBodyBytes).then(
-          (form) => (form instanceof Response ? wrapResponse(form) : onParsed(form)),
-          onError,
-        ) as Promise<T>
-      }
-      return Promise.resolve(wrapResponse(jsonError(415, "unsupported_media_type")))
-    }
-
-    // All JSON bodies go through readBoundedJson - the single enforcement point for the framed
-    // fast path (post-read byte re-check), the streaming cap, and the prototype-poisoning guard.
-    // A separate inlined native-json() fast path here would fork the trust boundary in two.
-    try {
-      return this.readBoundedJson(
-        source,
-        maxBodyBytes,
-        (parsed) => (parsed instanceof Response ? wrapResponse(parsed) : onParsed(parsed)),
-        onError,
-      )
-    } catch (err) {
-      return Promise.resolve(onError(err))
-    }
-  }
-
   /** Validate + run the handler for the bodyOnly path - shared by the inline fast path and the
    * streaming fallback. A method (not per-request closures) so the hot path allocates nothing
    * beyond the one `.then` continuation. */
@@ -3577,7 +3783,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     parsed: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
       const bodySchema = entry.schema!.body!
@@ -3612,7 +3818,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse?: (response: Response) => T,
+    wrapResponse?: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     if (entry.hasDecorations) Object.assign(ctx, entry.decorations)
     const handlerOutput = entry.handler(ctx)
@@ -3635,7 +3841,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     recovery: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     originalIssues: ReadonlyArray<StandardIssue>,
     kind: "body" | "query",
   ): MaybePromise<T> {
@@ -3647,12 +3853,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         const validation = entry.schema.body["~standard"].validate(recovery)
         if (validation instanceof Promise) {
           return validation.then((settled) => {
-            if (settled.issues !== undefined) return wrapResponse(validationError(settled.issues))
+            if (settled.issues !== undefined)
+              return wrapResponse(plainValidationError(settled.issues))
             ctx.body = settled.value
             return this.executeHandler(entry, ctx, finalize)
           })
         }
-        if (validation.issues !== undefined) return wrapResponse(validationError(validation.issues))
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
         ctx.body = validation.value
         return this.executeHandler(entry, ctx, finalize)
       }
@@ -3661,19 +3869,21 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         if (validation instanceof Promise) {
           return validation.then(
             (settled) => {
-              if (settled.issues !== undefined) return wrapResponse(validationError(settled.issues))
+              if (settled.issues !== undefined)
+                return wrapResponse(plainValidationError(settled.issues))
               ctx.query = settled.value
               return this.executeHandler(entry, ctx, finalize, wrapResponse)
             },
             (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
           )
         }
-        if (validation.issues !== undefined) return wrapResponse(validationError(validation.issues))
+        if (validation.issues !== undefined)
+          return wrapResponse(plainValidationError(validation.issues))
         ctx.query = validation.value
         return this.executeHandler(entry, ctx, finalize, wrapResponse)
       }
     }
-    return wrapResponse(validationError(originalIssues))
+    return wrapResponse(plainValidationError(originalIssues))
   }
 
   private applyBodyValidation<T>(
@@ -3681,7 +3891,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     result: StandardResult<unknown>,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     if (result.issues !== undefined) {
       const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
@@ -3710,7 +3920,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           "body",
         )
       }
-      return wrapResponse(validationError(result.issues))
+      return wrapResponse(plainValidationError(result.issues))
     }
     ctx.body = result.value
     return this.executeHandler(entry, ctx, finalize)
@@ -3722,7 +3932,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
       // Call the validator directly for the raw StandardResult (read `.issues`/`.value`) - skip
@@ -3760,7 +3970,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     result: StandardResult<unknown>,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     if (result.issues !== undefined) {
       const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
@@ -3789,7 +3999,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
           "query",
         )
       }
-      return wrapResponse(validationError(result.issues))
+      return wrapResponse(plainValidationError(result.issues))
     }
     ctx.query = result.value
     return this.executeHandler(entry, ctx, finalize, wrapResponse)
@@ -3931,7 +4141,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
       const headersSchema = entry.schema?.headers
@@ -4004,7 +4214,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: StandardResult<unknown>,
   ): MaybePromise<T> {
     try {
@@ -4031,7 +4241,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     const paramsSchema = entry.schema?.params
     if (paramsSchema === undefined) {
@@ -4062,7 +4272,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
       // The execution plan only selects this runner when the route has a query schema. Keeping the
@@ -4096,7 +4306,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     return this.readAndValidateBody(source, entry, ctx).then(
       (bodyError) =>
@@ -4115,7 +4325,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     return this.readAndValidateBody(source, entry, ctx).then(
       (bodyError) =>
@@ -4131,7 +4341,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     const querySchema = entry.schema?.query
     return querySchema === undefined
@@ -4143,7 +4353,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: StandardResult<unknown>,
   ): MaybePromise<T> {
     const queryError = this.applyLifecycleValidation(entry, result, ctx, "query")
@@ -4165,7 +4375,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: StandardResult<unknown>,
   ): MaybePromise<T> {
     try {
@@ -4187,8 +4397,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    paramsError: MaybePromise<Response | undefined>,
+    wrapResponse: (response: Response | ResponseResult) => T,
+    paramsError: MaybePromise<Response | ResponseResult | undefined>,
   ): MaybePromise<T> {
     if (paramsError instanceof Promise) {
       return paramsError.then(
@@ -4212,8 +4422,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     source: RequestSource,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    paramsError: Response | undefined,
+    wrapResponse: (response: Response | ResponseResult) => T,
+    paramsError: Response | ResponseResult | undefined,
   ): MaybePromise<T> {
     if (paramsError !== undefined) return wrapResponse(paramsError)
     if (entry.schema?.body !== undefined) {
@@ -4229,8 +4439,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    bodyError: Response | undefined,
+    wrapResponse: (response: Response | ResponseResult) => T,
+    bodyError: Response | ResponseResult | undefined,
   ): MaybePromise<T> {
     if (bodyError !== undefined) return wrapResponse(bodyError)
     const querySchema = entry.schema?.query
@@ -4249,7 +4459,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: StandardResult<unknown>,
   ): MaybePromise<T> {
     try {
@@ -4270,8 +4480,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-    queryError: Response | undefined,
+    wrapResponse: (response: Response | ResponseResult) => T,
+    queryError: Response | ResponseResult | undefined,
   ): MaybePromise<T> {
     if (queryError !== undefined) return wrapResponse(queryError)
     return this.runLifecycleHooks(entry, ctx, finalize, wrapResponse)
@@ -4281,7 +4491,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     if (entry.lifecycleHookLane === "derive-before") {
       return this.runLifecycleDeriveBefore(entry, ctx, finalize, wrapResponse)
@@ -4293,6 +4503,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         if (extension instanceof Promise) {
           return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, i, extension)
         }
+        if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
         Object.assign(ctx, extension)
       }
       for (let i = 0; i < entry.beforeHandle.length; i++) {
@@ -4320,13 +4531,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     try {
       const extension = entry.derives[0]!(ctx)
       if (extension instanceof Promise) {
         return this.continueLifecycleAfterDerive(entry, ctx, finalize, wrapResponse, 0, extension)
       }
+      if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
       Object.assign(ctx, extension)
 
       const outcome = entry.beforeHandle[0]!(ctx)
@@ -4354,7 +4566,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: unknown,
   ): MaybePromise<T> {
     try {
@@ -4368,15 +4580,19 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     firstIndex: number,
     first: Promise<unknown>,
   ): Promise<T> {
     try {
-      Object.assign(ctx, await first)
+      const settled = await first
+      if (isDeriveEarlyExit(settled)) return finalize(settled, responseSet(ctx))
+      Object.assign(ctx, settled)
       for (let i = firstIndex + 1; i < entry.derives.length; i++) {
-        const extension = entry.derives[i]!(ctx)
-        Object.assign(ctx, extension instanceof Promise ? await extension : extension)
+        const raw = entry.derives[i]!(ctx)
+        const extension = raw instanceof Promise ? await raw : raw
+        if (isDeriveEarlyExit(extension)) return finalize(extension, responseSet(ctx))
+        Object.assign(ctx, extension)
       }
       return await this.runLifecycleHooksAsync(entry, ctx, finalize, wrapResponse)
     } catch (err) {
@@ -4388,7 +4604,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): Promise<T> {
     try {
       // Indexed, not `for...of`. An array iterator declared inside an async function stays live
@@ -4410,7 +4626,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     firstIndex: number,
     first: Promise<unknown>,
   ): Promise<T> {
@@ -4432,7 +4648,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
   ): Promise<T> {
     try {
       const output = entry.handler(ctx)
@@ -4447,7 +4663,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     initial: unknown,
   ): MaybePromise<T> {
     try {
@@ -4476,7 +4692,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     firstIndex: number,
     first: Promise<unknown>,
   ): Promise<T> {
@@ -4496,7 +4712,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     entry: RouteEntry,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     result: unknown,
   ): MaybePromise<T> {
     try {
@@ -4518,7 +4734,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
   private finishContractOutcome<T>(
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
     outcome: {
       readonly kind: "ok" | "warn" | "violation"
       readonly value?: unknown
@@ -4531,7 +4747,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         path: pathnameOf(ctx.req.url),
         detail: outcome.message,
       })
-      return wrapResponse(jsonError(500, "internal_error"))
+      return wrapResponse(plainError(500, "internal_error"))
     }
     if (outcome.kind === "warn") {
       this.logger.warn("response contract", {
@@ -4543,19 +4759,44 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     return finalize(outcome.value, responseSet(ctx))
   }
 
-  private async handleLifecycleError<T>(
+  /** Synchronous by design, and `MaybePromise` rather than `Promise` for the same reason: control flow
+   * out of a lifecycle stage must not cost a promise. An `async` method allocates one and defers the
+   * result a microtask even when every branch it takes returns immediately, which is the common case
+   * here - a thrown `status(...)`/`Response`, or a route with no `onError` hook at all. Only the hook
+   * loop, which may await, drops into {@link runErrorHooks}. */
+  private handleLifecycleError<T>(
     entry: RouteEntry,
     err: unknown,
     ctx: RawContext,
     finalize: (result: unknown, set: CtxSet) => T,
-    wrapResponse: (response: Response) => T,
-  ): Promise<T> {
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): MaybePromise<T> {
     // A *thrown* Response is deliberate control flow, not an error - a guard throws a redirect/401,
     // an action throws an error page. Return it as-is (Remix/SvelteKit semantics); don't run onError
     // or log it as a 500. This is what makes `throw redirect(...)` / `requireSession(...)` work from
     // any handler or loader.
     if (err instanceof Response) return wrapResponse(err)
-    // onError hooks may return a custom response; otherwise the default 500 stands.
+    // Same rule for a thrown `status(...)`, but through `finalize` rather than `wrapResponse`: the
+    // value is still plain data, so the ordinary JSON lane renders it and no `Response` is built.
+    if (isResponseResult(err)) return finalize(err, responseSet(ctx))
+    if (entry.onError.length === 0) {
+      // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
+      // (redacting) logger. Body-read failures and around-hook failures land here too.
+      this.logRequestError(err, ctx)
+      return wrapResponse(plainError(500, "internal_error"))
+    }
+    return this.runErrorHooks(entry, err, ctx, finalize, wrapResponse)
+  }
+
+  /** The `onError` chain, split off {@link handleLifecycleError} so its `await` costs only the routes
+   * that registered a hook. A hook may return a custom response; otherwise the default 500 stands. */
+  private async runErrorHooks<T>(
+    entry: RouteEntry,
+    err: unknown,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): Promise<T> {
     // Indexed for the same reason as the `beforeHandle` chain above: the iterator would outlive
     // the `await` and stay heap-allocated on both engines.
     for (let i = 0; i < entry.onError.length; i++) {
@@ -4563,51 +4804,35 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       const handled = outcome instanceof Promise ? await outcome : outcome
       if (handled !== undefined) return finalize(handled, responseSet(ctx))
     }
-    // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
-    // (redacting) logger. Body-read failures and around-hook failures land here too.
     this.logRequestError(err, ctx)
-    return wrapResponse(jsonError(500, "internal_error"))
+    return wrapResponse(plainError(500, "internal_error"))
   }
 
   /** Log an unhandled request error to the (redacting) logger - shared by {@link runLifecycle} and the
    * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */
   private logRequestError(err: unknown, ctx: RawContext): void {
-    // An error's own text can quote the input that produced it, so how much of it reaches the sink is
-    // the app's call (`errorLogDetail`). The default keeps it: a 500 with no message and no stack is
-    // an incident nobody can diagnose, and the framework already ships the narrower instrument for
-    // the leak - a redacting logger with `valuePatterns`. `"none"` is there for an untrusted sink.
-    const detail = this.errorLogDetail
-    this.logger.error("unhandled request error", {
-      method: ctx.req.method,
-      path: pathnameOf(ctx.req.url),
-      name: err instanceof Error ? err.name : "Error",
-      // `detail`, not `message`: the logger uses `message` for its own first argument, so a field of
-      // that name is silently overwritten and the thrown error's own text never reaches the sink. It
-      // survived only incidentally inside `stack`, and was lost outright for a non-Error throw.
-      ...(detail === "none" ? {} : { detail: err instanceof Error ? err.message : String(err) }),
-      ...(detail === "full" && err instanceof Error ? { stack: err.stack } : {}),
-    })
+    emitRequestErrorLog(this.logger, this.errorLogDetail, err, ctx)
   }
 
   private async readAndValidateBody(
     req: RequestSource,
     entry: RouteEntry,
     ctx: RawContext,
-  ): Promise<Response | undefined> {
+  ): Promise<Response | ResponseResult | undefined> {
     const contentType = headerOf(req, "content-type") ?? ""
     let parsed: unknown
     if (contentType === "application/json" || contentType.includes("application/json")) {
-      const json = await this.readBoundedJson(req, entry.bodyLimit ?? this.maxBodyBytes)
-      if (json instanceof Response) return json
+      const json = await this.readBoundedJson(req, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+      if (isResponseResult(json)) return json
       parsed = json
     } else if (isUrlEncodedForm(contentType)) {
-      const form = await readBoundedForm(req, entry.bodyLimit ?? this.maxBodyBytes)
-      if (form instanceof Response) return form
+      const form = await readBoundedForm(req, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+      if (isResponseResult(form)) return form
       parsed = form
     } else {
       // multipart/form-data (file uploads) stays 415 on the schema path by design - files don't
       // fit a value schema; use a schema-less route + @nifrajs/uploads helpers for those.
-      return jsonError(415, "unsupported_media_type")
+      return plainError(415, "unsupported_media_type")
     }
     const validation = entry.schema!.body!["~standard"].validate(parsed)
     const result = validation instanceof Promise ? await validation : validation
@@ -4621,7 +4846,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     result: StandardResult<unknown>,
     ctx: RawContext,
     kind: "body" | "query" | "params" | "headers",
-  ): MaybePromise<Response | undefined> {
+  ): MaybePromise<Response | ResponseResult | undefined> {
     const assign = (value: unknown): void => {
       if (kind === "body") ctx.body = value
       else if (kind === "query") ctx.query = value
@@ -4633,7 +4858,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
       return undefined
     }
     const hook = entry.schema?.onValidationError ?? this.defaultOnValidationError
-    if (hook === undefined) return validationError(result.issues)
+    if (hook === undefined) return plainValidationError(result.issues)
     const attempted = hook(result.issues, ctx as unknown as Context, kind)
     if (attempted instanceof Promise) {
       return attempted.then((recovery) =>
@@ -4649,8 +4874,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     issues: ReadonlyArray<StandardIssue>,
     recovery: unknown,
     assign: (value: unknown) => void,
-  ): MaybePromise<Response | undefined> {
-    if (recovery === undefined) return validationError(issues)
+  ): MaybePromise<Response | ResponseResult | undefined> {
+    if (recovery === undefined) return plainValidationError(issues)
     if (recovery instanceof Response) return recovery
     const schema =
       kind === "body"
@@ -4663,12 +4888,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
     const retried = schema!["~standard"].validate(recovery)
     if (retried instanceof Promise) {
       return retried.then((settled) => {
-        if (settled.issues !== undefined) return validationError(settled.issues)
+        if (settled.issues !== undefined) return plainValidationError(settled.issues)
         assign(settled.value)
         return undefined
       })
     }
-    if (retried.issues !== undefined) return validationError(retried.issues)
+    if (retried.issues !== undefined) return plainValidationError(retried.issues)
     assign(retried.value)
     return undefined
   }
@@ -4680,19 +4905,22 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
    * length-less body mid-stream once the running byte count exceeds the cap - so a lying
    * or absent length can't force us to buffer an oversized payload.
    */
-  private readBoundedJson(req: RequestSource, maxBodyBytes?: number): Promise<unknown | Response>
+  private readBoundedJson(
+    req: RequestSource,
+    maxBodyBytes?: number,
+  ): Promise<unknown | ResponseResult>
   private readBoundedJson<T>(
     req: RequestSource,
     maxBodyBytes: number,
-    onResult: (parsed: unknown | Response) => T | Promise<T>,
+    onResult: (parsed: unknown | ResponseResult) => T | Promise<T>,
     onError: (error: unknown) => T | Promise<T>,
   ): Promise<T>
   private readBoundedJson<T>(
     req: RequestSource,
     maxBodyBytes = this.maxBodyBytes,
-    onResult?: (parsed: unknown | Response) => T | Promise<T>,
+    onResult?: (parsed: unknown | ResponseResult) => T | Promise<T>,
     onError?: (error: unknown) => T | Promise<T>,
-  ): Promise<unknown | Response | T> {
+  ): Promise<unknown | ResponseResult | T> {
     // Not `async`: this is a pass-through, and wrapping the lane's own promise in a coroutine
     // frame costs an extra microtask hop on every JSON body.
     return onResult === undefined
@@ -4873,6 +5101,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {
         "listen() uses Bun.serve and runs only on Bun. Serve on Node with @nifrajs/node or on Deno with @nifrajs/deno, or hand app.fetch to any fetch-compatible runtime (Workers, etc.).",
       )
     }
+    // Seal before Bun.serve: in `"error"` mode this throws instead of leaving a bound port behind.
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      sealHookAudit(this, this.catalog.size, this.logger)
     // Bun's `Server` is the concrete handle; we expose the stable `RunningServer`
     // subset so the public types don't depend on the ambient `Bun` global. The cast
     // bridges them - Bun's `.port` is `number | undefined` (undefined only for unix